@composurecdk/cloudwatch 0.8.3 → 0.8.5

package/dist/commonjs/alarm-name.d.ts

@@ -7,13 +7,15 @@ declare const alarmNameBrand: unique symbol;
 export type AlarmName = string & {
     readonly [alarmNameBrand]: true;
 };
+/** Validates a CloudWatch alarm name against {@link ALARM_NAME}. @throws on invalid input. */
+export declare function validateAlarmName(value: string): void;
 /**
- * Validates and brands a string as an {@link AlarmName}. The string is used
- * verbatim — no sanitisation — so what the caller writes is exactly what
- * appears in CloudWatch.
+ * Validates and brands a string as an {@link AlarmName}. Surrounding whitespace
+ * is trimmed, then the value is used verbatim — so what the caller writes is
+ * exactly what appears in CloudWatch.
  *
  * @throws If the input is empty, exceeds 255 chars, or contains characters
- * outside CloudWatch's allowed set: `[A-Za-z0-9-_./#:()+ =@]`.
+ * outside CloudWatch's allowed set.
  */
 export declare function alarmName(input: string): AlarmName;
 /**

package/dist/commonjs/alarm-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-name.d.ts","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAKrE;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAclD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,SAAM,GAAG,SAAS,CAG/E;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3C"}
+{"version":3,"file":"alarm-name.d.ts","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AAEA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAiBrE,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,SAAM,GAAG,SAAS,CAG/E;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3C"}

package/dist/commonjs/alarm-name.js

@@ -1,29 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAlarmName = validateAlarmName;
 exports.alarmName = alarmName;
 exports.joinAlarmName = joinAlarmName;
 exports.kebab = kebab;
-const VALID_CHARS = /^[A-Za-z0-9\-_./#:()+ =@]+$/;
-const MAX_LEN = 255;
+const cloudformation_1 = require("@composurecdk/cloudformation");
 /**
- * Validates and brands a string as an {@link AlarmName}. The string is used
- * verbatim — no sanitisation — so what the caller writes is exactly what
- * appears in CloudWatch.
+ * The CloudWatch AlarmName constraint. Its character set is exactly the shared
+ * `charSets.ALNUM` + `charSets.AWS_NAME_PUNCT` spine with no property-specific
+ * tail — a clean reuse of the catalogue fragments. See ADR-0010.
+ */
+const ALARM_NAME = (0, cloudformation_1.stringConstraint)({
+    name: "CloudWatch AlarmName",
+    charClass: `${cloudformation_1.charSets.ALNUM}${cloudformation_1.charSets.AWS_NAME_PUNCT}`,
+    minLength: 1,
+    maxLength: 255,
+    allowed: "A-Z a-z 0-9 space and - _ . / # : ( ) + = @",
+    source: "https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html",
+});
+/** Validates a CloudWatch alarm name against {@link ALARM_NAME}. @throws on invalid input. */
+function validateAlarmName(value) {
+    (0, cloudformation_1.validateString)(value, ALARM_NAME);
+}
+/**
+ * Validates and brands a string as an {@link AlarmName}. Surrounding whitespace
+ * is trimmed, then the value is used verbatim — so what the caller writes is
+ * exactly what appears in CloudWatch.
  *
  * @throws If the input is empty, exceeds 255 chars, or contains characters
- * outside CloudWatch's allowed set: `[A-Za-z0-9-_./#:()+ =@]`.
+ * outside CloudWatch's allowed set.
  */
 function alarmName(input) {
     const trimmed = input.trim();
-    if (trimmed.length === 0) {
-        throw new Error("alarm name cannot be empty");
-    }
-    if (trimmed.length > MAX_LEN) {
-        throw new Error(`alarm name exceeds ${String(MAX_LEN)} chars: "${trimmed}"`);
-    }
-    if (!VALID_CHARS.test(trimmed)) {
-        throw new Error(`alarm name contains invalid characters (allowed: A-Z a-z 0-9 - _ . / # : ( ) + = @ space): "${trimmed}"`);
-    }
+    validateAlarmName(trimmed);
     return trimmed;
 }
 /**

package/dist/commonjs/alarm-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-name.js","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":";;AAoBA,8BAcC;AAQD,sCAGC;AAMD,sBAQC;AAlDD,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,YAAY,OAAO,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,+FAA+F,OAAO,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,OAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAA2B,EAAE,GAAG,GAAG,GAAG;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"alarm-name.js","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":";;AA2BA,8CAEC;AAUD,8BAIC;AAQD,sCAGC;AAMD,sBAQC;AApED,iEAA0F;AAW1F;;;;GAIG;AACH,MAAM,UAAU,GAAG,IAAA,iCAAgB,EAAC;IAClC,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,GAAG,yBAAQ,CAAC,KAAK,GAAG,yBAAQ,CAAC,cAAc,EAAE;IACxD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,OAAO,EAAE,6CAA6C;IACtD,MAAM,EACJ,0FAA0F;CAC7F,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAA,+BAAc,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAA2B,EAAE,GAAG,GAAG,GAAG;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC"}

package/dist/commonjs/alarm-threshold-basis.d.ts

@@ -0,0 +1,71 @@
+import type { IConstruct } from "constructs";
+/**
+ * Inputs to {@link resolveAlarmThresholdBasis}.
+ *
+ * @typeParam T - The input value's type (e.g. `Duration`, `number`).
+ */
+export interface AlarmThresholdBasisOptions<T> {
+    /** Construct to annotate when the alarm is skipped. */
+    scope: IConstruct;
+    /**
+     * The value the alarm threshold is derived from. May be `undefined` (the
+     * input was simply not configured) or an unresolved token (e.g. threaded
+     * through a `CfnParameter`).
+     */
+    value: T | undefined;
+    /**
+     * Converts a known-resolved `value` into the numeric basis for the threshold
+     * (e.g. `(d) => d.toMilliseconds()`, or the identity for a raw number). Only
+     * invoked once `value` is confirmed present and resolved, so it is safe to
+     * call conversions that throw on tokens.
+     */
+    resolve: (value: T) => number;
+    /**
+     * Predicate deciding whether `value` is an unresolved token. Defaults to
+     * {@link Token.isUnresolved}. Override for wrapper types that carry their own
+     * check rather than being a token directly — notably a CDK `Duration`, whose
+     * token state is exposed via `value.isUnresolved()`.
+     */
+    isUnresolved?: (value: T) => boolean;
+    /**
+     * Stable warning identifier, also the handle callers pass to
+     * `Annotations.of(scope).acknowledgeWarning(...)` to suppress it. By
+     * convention `@composurecdk/<package>:<slug>`.
+     */
+    warningId: string;
+    /**
+     * Human-readable name of the alarm being skipped, interpolated into the
+     * warning (e.g. `"Lambda duration"`). Phrase it to read after
+     * "Skipping the recommended ".
+     */
+    alarmLabel: string;
+    /**
+     * How a caller can intentionally suppress the warning, interpolated into the
+     * warning's closing sentence (e.g. `"recommendedAlarms({ duration: false })"`).
+     */
+    suppressHint: string;
+}
+/**
+ * Resolves the numeric basis for a derived-threshold alarm, short-circuiting
+ * when the basis cannot be known at synth time.
+ *
+ * Recommended alarms whose threshold is a function of a configured input (a
+ * percentage of a timeout, of a reserved-concurrency limit, etc.) can only be
+ * rendered when that input is concrete. When the input is an unresolved token —
+ * e.g. a value threaded through a `CfnParameter` — there is no number to derive
+ * from at synth time, and unit-converting it would either throw or silently
+ * produce a meaningless threshold. In that case this annotates `scope` with a
+ * standardized, acknowledgeable warning and returns `undefined`, signalling the
+ * caller to omit the alarm.
+ *
+ * Returns `undefined` (without warning) when `value` is `undefined`, since an
+ * unconfigured input is not a skipped guardrail. The escape hatch that disables
+ * the alarm entirely (e.g. `recommendedAlarms({ duration: false })`) belongs at
+ * the call site, ahead of this call.
+ *
+ * @returns The resolved numeric basis, or `undefined` when the alarm should be
+ *   omitted.
+ * @see https://github.com/laazyj/composureCDK/issues/196
+ */
+export declare function resolveAlarmThresholdBasis<T>(opts: AlarmThresholdBasisOptions<T>): number | undefined;
+//# sourceMappingURL=alarm-threshold-basis.d.ts.map

package/dist/commonjs/alarm-threshold-basis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-threshold-basis.d.ts","sourceRoot":"","sources":["../../src/alarm-threshold-basis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,uDAAuD;IACvD,KAAK,EAAE,UAAU,CAAC;IAElB;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IAErB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAErC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,MAAM,GAAG,SAAS,CAgBpB"}

package/dist/commonjs/alarm-threshold-basis.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAlarmThresholdBasis = resolveAlarmThresholdBasis;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+/**
+ * Resolves the numeric basis for a derived-threshold alarm, short-circuiting
+ * when the basis cannot be known at synth time.
+ *
+ * Recommended alarms whose threshold is a function of a configured input (a
+ * percentage of a timeout, of a reserved-concurrency limit, etc.) can only be
+ * rendered when that input is concrete. When the input is an unresolved token —
+ * e.g. a value threaded through a `CfnParameter` — there is no number to derive
+ * from at synth time, and unit-converting it would either throw or silently
+ * produce a meaningless threshold. In that case this annotates `scope` with a
+ * standardized, acknowledgeable warning and returns `undefined`, signalling the
+ * caller to omit the alarm.
+ *
+ * Returns `undefined` (without warning) when `value` is `undefined`, since an
+ * unconfigured input is not a skipped guardrail. The escape hatch that disables
+ * the alarm entirely (e.g. `recommendedAlarms({ duration: false })`) belongs at
+ * the call site, ahead of this call.
+ *
+ * @returns The resolved numeric basis, or `undefined` when the alarm should be
+ *   omitted.
+ * @see https://github.com/laazyj/composureCDK/issues/196
+ */
+function resolveAlarmThresholdBasis(opts) {
+    if (opts.value === undefined)
+        return undefined;
+    const isUnresolved = opts.isUnresolved ?? aws_cdk_lib_1.Token.isUnresolved;
+    if (isUnresolved(opts.value)) {
+        aws_cdk_lib_1.Annotations.of(opts.scope).addWarningV2(opts.warningId, `Skipping the recommended ${opts.alarmLabel} alarm: its threshold is derived from a ` +
+            `value that is an unresolved token and cannot be resolved to a concrete threshold at ` +
+            `synth time. Set a literal value, add the alarm explicitly via addAlarm() with a fixed ` +
+            `threshold, or suppress this warning with ${opts.suppressHint}.`);
+        return undefined;
+    }
+    return opts.resolve(opts.value);
+}
+//# sourceMappingURL=alarm-threshold-basis.js.map

package/dist/commonjs/alarm-threshold-basis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-threshold-basis.js","sourceRoot":"","sources":["../../src/alarm-threshold-basis.ts"],"names":[],"mappings":";;AA8EA,gEAkBC;AAhGD,6CAAiD;AAwDjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,0BAA0B,CACxC,IAAmC;IAEnC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAK,CAAC,YAAY,CAAC;IAC7D,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CACrC,IAAI,CAAC,SAAS,EACd,4BAA4B,IAAI,CAAC,UAAU,0CAA0C;YACnF,sFAAsF;YACtF,wFAAwF;YACxF,4CAA4C,IAAI,CAAC,YAAY,GAAG,CACnE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/commonjs/index.d.ts

@@ -1,11 +1,26 @@
+import { validateAlarmName } from "./alarm-name.js";
 export type { AlarmConfig, AlarmConfigDefaults } from "./alarm-config.js";
 export type { AlarmDefinition, AlarmMetric } from "./alarm-definition.js";
 export { AlarmDefinitionBuilder } from "./alarm-definition-builder.js";
 export { type AlarmName, alarmName } from "./alarm-name.js";
+export { type AlarmThresholdBasisOptions, resolveAlarmThresholdBasis, } from "./alarm-threshold-basis.js";
 export { defaultAlarmName } from "./default-alarm-name.js";
 export { createAlarms } from "./create-alarms.js";
 export { resolveAlarmConfig, type ResolvedAlarmConfig } from "./resolve-alarm-config.js";
 export { alarmActionsPolicy } from "./policies/alarm-actions-policy.js";
 export type { AlarmActionsPolicyConfig, AlarmMatchContext, AlarmMatcher, } from "./policies/alarm-actions-policy.js";
 export { alarmNamePolicy, type AlarmNamePolicyConfig, type AlarmNameRule, type AlarmNameTransformContext, } from "./policies/alarm-name-policy.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private. The branded {@link alarmName} constructor layers on top of the
+ * same validation. See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        alarmName: typeof validateAlarmName;
+    };
+    sanitize: {};
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACL,KAAK,0BAA0B,EAC/B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;CAGO,CAAC"}

package/dist/commonjs/index.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.alarmNamePolicy = exports.alarmActionsPolicy = exports.resolveAlarmConfig = exports.createAlarms = exports.defaultAlarmName = exports.alarmName = exports.AlarmDefinitionBuilder = void 0;
+exports.constraints = exports.alarmNamePolicy = exports.alarmActionsPolicy = exports.resolveAlarmConfig = exports.createAlarms = exports.defaultAlarmName = exports.resolveAlarmThresholdBasis = exports.alarmName = exports.AlarmDefinitionBuilder = void 0;
+const alarm_name_js_1 = require("./alarm-name.js");
 var alarm_definition_builder_js_1 = require("./alarm-definition-builder.js");
 Object.defineProperty(exports, "AlarmDefinitionBuilder", { enumerable: true, get: function () { return alarm_definition_builder_js_1.AlarmDefinitionBuilder; } });
-var alarm_name_js_1 = require("./alarm-name.js");
-Object.defineProperty(exports, "alarmName", { enumerable: true, get: function () { return alarm_name_js_1.alarmName; } });
+var alarm_name_js_2 = require("./alarm-name.js");
+Object.defineProperty(exports, "alarmName", { enumerable: true, get: function () { return alarm_name_js_2.alarmName; } });
+var alarm_threshold_basis_js_1 = require("./alarm-threshold-basis.js");
+Object.defineProperty(exports, "resolveAlarmThresholdBasis", { enumerable: true, get: function () { return alarm_threshold_basis_js_1.resolveAlarmThresholdBasis; } });
 var default_alarm_name_js_1 = require("./default-alarm-name.js");
 Object.defineProperty(exports, "defaultAlarmName", { enumerable: true, get: function () { return default_alarm_name_js_1.defaultAlarmName; } });
 var create_alarms_js_1 = require("./create-alarms.js");
@@ -15,4 +18,15 @@ var alarm_actions_policy_js_1 = require("./policies/alarm-actions-policy.js");
 Object.defineProperty(exports, "alarmActionsPolicy", { enumerable: true, get: function () { return alarm_actions_policy_js_1.alarmActionsPolicy; } });
 var alarm_name_policy_js_1 = require("./policies/alarm-name-policy.js");
 Object.defineProperty(exports, "alarmNamePolicy", { enumerable: true, get: function () { return alarm_name_policy_js_1.alarmNamePolicy; } });
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private. The branded {@link alarmName} constructor layers on top of the
+ * same validation. See ADR-0010.
+ */
+exports.constraints = {
+    validate: { alarmName: alarm_name_js_1.validateAlarmName },
+    sanitize: {},
+};
 //# sourceMappingURL=index.js.map

package/dist/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAEA,6EAAuE;AAA9D,qIAAA,sBAAsB,OAAA;AAC/B,iDAA4D;AAAnC,0GAAA,SAAS,OAAA;AAClC,iEAA2D;AAAlD,yHAAA,gBAAgB,OAAA;AACzB,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,qEAAyF;AAAhF,6HAAA,kBAAkB,OAAA;AAC3B,8EAAwE;AAA/D,6HAAA,kBAAkB,OAAA;AAM3B,wEAKyC;AAJvC,uHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AACA,mDAAoD;AAIpD,6EAAuE;AAA9D,qIAAA,sBAAsB,OAAA;AAC/B,iDAA4D;AAAnC,0GAAA,SAAS,OAAA;AAClC,uEAGoC;AADlC,sIAAA,0BAA0B,OAAA;AAE5B,iEAA2D;AAAlD,yHAAA,gBAAgB,OAAA;AACzB,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,qEAAyF;AAAhF,6HAAA,kBAAkB,OAAA;AAC3B,8EAAwE;AAA/D,6HAAA,kBAAkB,OAAA;AAM3B,wEAKyC;AAJvC,uHAAA,eAAe,OAAA;AAMjB;;;;;;GAMG;AACU,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,EAAE,SAAS,EAAE,iCAAiB,EAAE;IAC1C,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/dist/esm/alarm-name.d.ts

@@ -7,13 +7,15 @@ declare const alarmNameBrand: unique symbol;
 export type AlarmName = string & {
     readonly [alarmNameBrand]: true;
 };
+/** Validates a CloudWatch alarm name against {@link ALARM_NAME}. @throws on invalid input. */
+export declare function validateAlarmName(value: string): void;
 /**
- * Validates and brands a string as an {@link AlarmName}. The string is used
- * verbatim — no sanitisation — so what the caller writes is exactly what
- * appears in CloudWatch.
+ * Validates and brands a string as an {@link AlarmName}. Surrounding whitespace
+ * is trimmed, then the value is used verbatim — so what the caller writes is
+ * exactly what appears in CloudWatch.
  *
  * @throws If the input is empty, exceeds 255 chars, or contains characters
- * outside CloudWatch's allowed set: `[A-Za-z0-9-_./#:()+ =@]`.
+ * outside CloudWatch's allowed set.
  */
 export declare function alarmName(input: string): AlarmName;
 /**

package/dist/esm/alarm-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-name.d.ts","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAKrE;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAclD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,SAAM,GAAG,SAAS,CAG/E;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3C"}
+{"version":3,"file":"alarm-name.d.ts","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AAEA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAiBrE,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,SAAM,GAAG,SAAS,CAG/E;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3C"}

package/dist/esm/alarm-name.js

@@ -1,24 +1,32 @@
-const VALID_CHARS = /^[A-Za-z0-9\-_./#:()+ =@]+$/;
-const MAX_LEN = 255;
+import { charSets, stringConstraint, validateString } from "@composurecdk/cloudformation";
 /**
- * Validates and brands a string as an {@link AlarmName}. The string is used
- * verbatim — no sanitisation — so what the caller writes is exactly what
- * appears in CloudWatch.
+ * The CloudWatch AlarmName constraint. Its character set is exactly the shared
+ * `charSets.ALNUM` + `charSets.AWS_NAME_PUNCT` spine with no property-specific
+ * tail — a clean reuse of the catalogue fragments. See ADR-0010.
+ */
+const ALARM_NAME = stringConstraint({
+    name: "CloudWatch AlarmName",
+    charClass: `${charSets.ALNUM}${charSets.AWS_NAME_PUNCT}`,
+    minLength: 1,
+    maxLength: 255,
+    allowed: "A-Z a-z 0-9 space and - _ . / # : ( ) + = @",
+    source: "https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html",
+});
+/** Validates a CloudWatch alarm name against {@link ALARM_NAME}. @throws on invalid input. */
+export function validateAlarmName(value) {
+    validateString(value, ALARM_NAME);
+}
+/**
+ * Validates and brands a string as an {@link AlarmName}. Surrounding whitespace
+ * is trimmed, then the value is used verbatim — so what the caller writes is
+ * exactly what appears in CloudWatch.
  *
  * @throws If the input is empty, exceeds 255 chars, or contains characters
- * outside CloudWatch's allowed set: `[A-Za-z0-9-_./#:()+ =@]`.
+ * outside CloudWatch's allowed set.
  */
 export function alarmName(input) {
     const trimmed = input.trim();
-    if (trimmed.length === 0) {
-        throw new Error("alarm name cannot be empty");
-    }
-    if (trimmed.length > MAX_LEN) {
-        throw new Error(`alarm name exceeds ${String(MAX_LEN)} chars: "${trimmed}"`);
-    }
-    if (!VALID_CHARS.test(trimmed)) {
-        throw new Error(`alarm name contains invalid characters (allowed: A-Z a-z 0-9 - _ . / # : ( ) + = @ space): "${trimmed}"`);
-    }
+    validateAlarmName(trimmed);
     return trimmed;
 }
 /**

package/dist/esm/alarm-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"alarm-name.js","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,YAAY,OAAO,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,+FAA+F,OAAO,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,OAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAA2B,EAAE,GAAG,GAAG,GAAG;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"alarm-name.js","sourceRoot":"","sources":["../../src/alarm-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAW1F;;;;GAIG;AACH,MAAM,UAAU,GAAG,gBAAgB,CAAC;IAClC,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,cAAc,EAAE;IACxD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,OAAO,EAAE,6CAA6C;IACtD,MAAM,EACJ,0FAA0F;CAC7F,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAA2B,EAAE,GAAG,GAAG,GAAG;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;AACnB,CAAC"}

package/dist/esm/alarm-threshold-basis.d.ts

@@ -0,0 +1,71 @@
+import type { IConstruct } from "constructs";
+/**
+ * Inputs to {@link resolveAlarmThresholdBasis}.
+ *
+ * @typeParam T - The input value's type (e.g. `Duration`, `number`).
+ */
+export interface AlarmThresholdBasisOptions<T> {
+    /** Construct to annotate when the alarm is skipped. */
+    scope: IConstruct;
+    /**
+     * The value the alarm threshold is derived from. May be `undefined` (the
+     * input was simply not configured) or an unresolved token (e.g. threaded
+     * through a `CfnParameter`).
+     */
+    value: T | undefined;
+    /**
+     * Converts a known-resolved `value` into the numeric basis for the threshold
+     * (e.g. `(d) => d.toMilliseconds()`, or the identity for a raw number). Only
+     * invoked once `value` is confirmed present and resolved, so it is safe to
+     * call conversions that throw on tokens.
+     */
+    resolve: (value: T) => number;
+    /**
+     * Predicate deciding whether `value` is an unresolved token. Defaults to
+     * {@link Token.isUnresolved}. Override for wrapper types that carry their own
+     * check rather than being a token directly — notably a CDK `Duration`, whose
+     * token state is exposed via `value.isUnresolved()`.
+     */
+    isUnresolved?: (value: T) => boolean;
+    /**
+     * Stable warning identifier, also the handle callers pass to
+     * `Annotations.of(scope).acknowledgeWarning(...)` to suppress it. By
+     * convention `@composurecdk/<package>:<slug>`.
+     */
+    warningId: string;
+    /**
+     * Human-readable name of the alarm being skipped, interpolated into the
+     * warning (e.g. `"Lambda duration"`). Phrase it to read after
+     * "Skipping the recommended ".
+     */
+    alarmLabel: string;
+    /**
+     * How a caller can intentionally suppress the warning, interpolated into the
+     * warning's closing sentence (e.g. `"recommendedAlarms({ duration: false })"`).
+     */
+    suppressHint: string;
+}
+/**
+ * Resolves the numeric basis for a derived-threshold alarm, short-circuiting
+ * when the basis cannot be known at synth time.
+ *
+ * Recommended alarms whose threshold is a function of a configured input (a
+ * percentage of a timeout, of a reserved-concurrency limit, etc.) can only be
+ * rendered when that input is concrete. When the input is an unresolved token —
+ * e.g. a value threaded through a `CfnParameter` — there is no number to derive
+ * from at synth time, and unit-converting it would either throw or silently
+ * produce a meaningless threshold. In that case this annotates `scope` with a
+ * standardized, acknowledgeable warning and returns `undefined`, signalling the
+ * caller to omit the alarm.
+ *
+ * Returns `undefined` (without warning) when `value` is `undefined`, since an
+ * unconfigured input is not a skipped guardrail. The escape hatch that disables
+ * the alarm entirely (e.g. `recommendedAlarms({ duration: false })`) belongs at
+ * the call site, ahead of this call.
+ *
+ * @returns The resolved numeric basis, or `undefined` when the alarm should be
+ *   omitted.
+ * @see https://github.com/laazyj/composureCDK/issues/196
+ */
+export declare function resolveAlarmThresholdBasis<T>(opts: AlarmThresholdBasisOptions<T>): number | undefined;
+//# sourceMappingURL=alarm-threshold-basis.d.ts.map

package/dist/esm/alarm-threshold-basis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-threshold-basis.d.ts","sourceRoot":"","sources":["../../src/alarm-threshold-basis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,uDAAuD;IACvD,KAAK,EAAE,UAAU,CAAC;IAElB;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IAErB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAErC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,MAAM,GAAG,SAAS,CAgBpB"}

package/dist/esm/alarm-threshold-basis.js

@@ -0,0 +1,37 @@
+import { Annotations, Token } from "aws-cdk-lib";
+/**
+ * Resolves the numeric basis for a derived-threshold alarm, short-circuiting
+ * when the basis cannot be known at synth time.
+ *
+ * Recommended alarms whose threshold is a function of a configured input (a
+ * percentage of a timeout, of a reserved-concurrency limit, etc.) can only be
+ * rendered when that input is concrete. When the input is an unresolved token —
+ * e.g. a value threaded through a `CfnParameter` — there is no number to derive
+ * from at synth time, and unit-converting it would either throw or silently
+ * produce a meaningless threshold. In that case this annotates `scope` with a
+ * standardized, acknowledgeable warning and returns `undefined`, signalling the
+ * caller to omit the alarm.
+ *
+ * Returns `undefined` (without warning) when `value` is `undefined`, since an
+ * unconfigured input is not a skipped guardrail. The escape hatch that disables
+ * the alarm entirely (e.g. `recommendedAlarms({ duration: false })`) belongs at
+ * the call site, ahead of this call.
+ *
+ * @returns The resolved numeric basis, or `undefined` when the alarm should be
+ *   omitted.
+ * @see https://github.com/laazyj/composureCDK/issues/196
+ */
+export function resolveAlarmThresholdBasis(opts) {
+    if (opts.value === undefined)
+        return undefined;
+    const isUnresolved = opts.isUnresolved ?? Token.isUnresolved;
+    if (isUnresolved(opts.value)) {
+        Annotations.of(opts.scope).addWarningV2(opts.warningId, `Skipping the recommended ${opts.alarmLabel} alarm: its threshold is derived from a ` +
+            `value that is an unresolved token and cannot be resolved to a concrete threshold at ` +
+            `synth time. Set a literal value, add the alarm explicitly via addAlarm() with a fixed ` +
+            `threshold, or suppress this warning with ${opts.suppressHint}.`);
+        return undefined;
+    }
+    return opts.resolve(opts.value);
+}
+//# sourceMappingURL=alarm-threshold-basis.js.map

package/dist/esm/alarm-threshold-basis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-threshold-basis.js","sourceRoot":"","sources":["../../src/alarm-threshold-basis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAwDjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAmC;IAEnC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC;IAC7D,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CACrC,IAAI,CAAC,SAAS,EACd,4BAA4B,IAAI,CAAC,UAAU,0CAA0C;YACnF,sFAAsF;YACtF,wFAAwF;YACxF,4CAA4C,IAAI,CAAC,YAAY,GAAG,CACnE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/esm/index.d.ts

@@ -1,11 +1,26 @@
+import { validateAlarmName } from "./alarm-name.js";
 export type { AlarmConfig, AlarmConfigDefaults } from "./alarm-config.js";
 export type { AlarmDefinition, AlarmMetric } from "./alarm-definition.js";
 export { AlarmDefinitionBuilder } from "./alarm-definition-builder.js";
 export { type AlarmName, alarmName } from "./alarm-name.js";
+export { type AlarmThresholdBasisOptions, resolveAlarmThresholdBasis, } from "./alarm-threshold-basis.js";
 export { defaultAlarmName } from "./default-alarm-name.js";
 export { createAlarms } from "./create-alarms.js";
 export { resolveAlarmConfig, type ResolvedAlarmConfig } from "./resolve-alarm-config.js";
 export { alarmActionsPolicy } from "./policies/alarm-actions-policy.js";
 export type { AlarmActionsPolicyConfig, AlarmMatchContext, AlarmMatcher, } from "./policies/alarm-actions-policy.js";
 export { alarmNamePolicy, type AlarmNamePolicyConfig, type AlarmNameRule, type AlarmNameTransformContext, } from "./policies/alarm-name-policy.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private. The branded {@link alarmName} constructor layers on top of the
+ * same validation. See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        alarmName: typeof validateAlarmName;
+    };
+    sanitize: {};
+};
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACL,KAAK,0BAA0B,EAC/B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;CAGO,CAAC"}

package/dist/esm/index.js

@@ -1,8 +1,21 @@
+import { validateAlarmName } from "./alarm-name.js";
 export { AlarmDefinitionBuilder } from "./alarm-definition-builder.js";
 export { alarmName } from "./alarm-name.js";
+export { resolveAlarmThresholdBasis, } from "./alarm-threshold-basis.js";
 export { defaultAlarmName } from "./default-alarm-name.js";
 export { createAlarms } from "./create-alarms.js";
 export { resolveAlarmConfig } from "./resolve-alarm-config.js";
 export { alarmActionsPolicy } from "./policies/alarm-actions-policy.js";
 export { alarmNamePolicy, } from "./policies/alarm-name-policy.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical in
+ * every builder package; the underlying constraint definition stays
+ * module-private. The branded {@link alarmName} constructor layers on top of the
+ * same validation. See ADR-0010.
+ */
+export const constraints = {
+    validate: { alarmName: validateAlarmName },
+    sanitize: {},
+};
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAkB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAMxE,OAAO,EACL,eAAe,GAIhB,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAkB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAEL,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAMxE,OAAO,EACL,eAAe,GAIhB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC1C,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/cloudwatch",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Composable CloudWatch alarm primitives for composureCDK resource packages",
   "repository": {
     "type": "git",
@@ -20,7 +20,19 @@
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest"
   },
-  "keywords": [],
+  "keywords": [
+    "aws",
+    "cdk",
+    "aws-cdk",
+    "infrastructure-as-code",
+    "iac",
+    "composurecdk",
+    "cloudwatch",
+    "alarm",
+    "monitoring",
+    "metrics",
+    "observability"
+  ],
   "author": "Jason Duffett (https://github.com/laazyj)",
   "license": "MIT",
   "publishConfig": {
@@ -37,15 +49,16 @@
     }
   },
   "peerDependencies": {
-    "aws-cdk-lib": "^2.1.0",
+    "@composurecdk/cloudformation": "^0.8.0",
+    "aws-cdk-lib": "^2.93.0",
     "constructs": "^10.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
-    "aws-cdk-lib": "^2.257.0",
+    "@types/node": "^25.9.3",
+    "aws-cdk-lib": "^2.258.1",
     "constructs": "^10.6.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.8"
   },
   "exports": {
     "./package.json": "./package.json",