feat/int-base

releaseLock SDK fault after successful casWritePair leaves lock held until expiry

services/metrics/integrations/enphase/src/lib/token-manager.ts:250

If releaseLock throws a non-ConditionalCheckFailedException after casWritePair succeeds, .catch(()=>{}) swallows it and lock stays held for up to 90s. pollForWinner losers correctly adopt the freshly written pair via rowUsable() within 2s. Documented tradeoff.

isInvalidGrantBody: /valid refresh[ _]token/ could match benign verbose error body

services/metrics/integrations/enphase/src/engine/enlighten-client.ts:54

Pattern would match 'client must provide a valid refresh_token along with credentials', classifying a transient bad-request as terminal dead grant. Extremely unlikely given Enphase's narrow vendor surface but stricter anchor (/please enter a valid refresh[ _]token/i) would eliminate residual risk.

APsystems loadCredentialFromArn blanket-catch turns SDK faults into non-retryable MissingSecret

services/metrics/integrations/apsystems/src/engine/ema-client.ts:288

The bare catch block returns null for every exception including throttles, network failures, and AccessDeniedException. The handler maps null -> MissingSecret (400, non-retryable). R12 fixed this in Fronius (catch only ResourceNotFoundException -> null; re-throw everything else). The APsystems equivalent was not updated. Fix: catch (e) { if (e instanceof Error && e.name === 'ResourceNotFoundException') return null; throw e; }

console.warn logs vendor-supplied host without length cap

services/metrics/integrations/fronius/src/engine/solarweb-client.ts:226

When a pagination link is rejected, the off-origin host is logged via JSON.stringify. JSON encoding prevents newline injection but the value is uncapped. Consider capping to 253 chars (max valid hostname).

Enphase credentials.ts blanket-catch turns SDK faults into non-retryable MissingSecret

services/metrics/integrations/enphase/src/lib/credentials.ts:42

The catch block returns { ok: false } for ALL GetSecretValueCommand exceptions. The handler maps !loaded.ok -> MissingSecret (400, non-retryable). Fix: check e.name === 'ResourceNotFoundException' -> return null; re-throw all other SDK errors so the outer handler maps them to UpstreamUnavailable (502, retryable).

R6: isTrustedNextLink subdomain allowance never tested or documented

services/metrics/integrations/fronius/src/__tests__/solarweb-client.test.ts:76

The implementation allows *.api.solarweb.com subdomains via endsWith. No test confirms this is intentional. Add a positive subdomain test if intended, or tighten the check to exact host only.

canRotate closure captures mutable bindings — inline comparison would be clearer

services/metrics/integrations/enphase/src/handlers/metrics.lambda.ts:208

The canRotate() closure closes over two mutable let bindings (rotationsSpent, tokenSource) mutated inside paced. Inline boolean at call site would be clearer by co-locating mutation and guard.

isTrustedNextLink re-parses BASE_URL on every call

services/metrics/integrations/fronius/src/engine/solarweb-client.ts:150

new URL(BASE_URL).hostname is evaluated on every call. Extract as module-level const BASE_HOST = new URL(BASE_URL).hostname.

loadCredentialFromArn code duplication across Fronius, APsystems, Enphase

services/metrics/integrations/apsystems/src/engine/ema-client.ts:275

GetSecretValueCommand + parse + field extract + secretsClient/resetSecretsClientForTests is verbatim duplicated across all three vendors. R12 fix applied only to Fronius because each copy evolved independently. A shared loadSecretJson helper would prevent this class of drift.