@composurecdk/sns 0.3.0 → 0.3.2

package/README.md

@@ -1,8 +1,8 @@
 # @composurecdk/sns
 
-SNS topic builder for [ComposureCDK](../../README.md).
+SNS topic and subscription builders for [ComposureCDK](../../README.md).
 
-This package provides a fluent builder for SNS topics with secure, AWS-recommended defaults. It wraps the CDK [Topic](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.Topic.html) construct — refer to the CDK documentation for the full set of configurable properties.
+This package provides fluent builders for SNS topics and subscriptions with secure, AWS-recommended defaults. They wrap the CDK [Topic](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.Topic.html) and [Subscription](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.Subscription.html) constructs — refer to the CDK documentation for the full set of configurable properties.
 
 ## Topic Builder
 
@@ -47,6 +47,10 @@ The builder creates [AWS-recommended CloudWatch alarms](https://docs.aws.amazon.
 | --------------------------------------------------- | --------------------------------------------------------------- | ----------------- | ------------ |
 | `numberOfNotificationsFailed`                       | NumberOfNotificationsFailed (Sum, 1 min)                        | > 0               | Always       |
 | `numberOfNotificationsFilteredOutInvalidAttributes` | NumberOfNotificationsFilteredOut-InvalidAttributes (Sum, 1 min) | > 0               | Always       |
+| `numberOfNotificationsRedrivenToDlq`                | NumberOfNotificationsRedrivenToDlq (Sum, 1 min)                 | > 0               | Always[^dlq] |
+| `numberOfNotificationsFailedToRedriveToDlq`         | NumberOfNotificationsFailedToRedriveToDlq (Sum, 1 min)          | > 0               | Always[^dlq] |
+
+[^dlq]: Metric only emits when a subscription on the topic has a dead-letter queue attached and SNS attempts redrive. `TreatMissingData` defaults to `notBreaching`, so the alarm stays quiet on topics without DLQs. Attach a DLQ via the `SubscriptionBuilder`'s `.deadLetterQueue(...)` — see [SNS DLQ docs](https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html).
 
 The defaults are exported as `TOPIC_ALARM_DEFAULTS` for visibility and testing:
 
@@ -122,6 +126,85 @@ for (const alarm of Object.values(result.alarms)) {
 }
 ```
 
+## Adding Subscriptions to a Topic
+
+For the common case where a topic and its subscriptions are declared together, use `addSubscription` on the topic builder. It accepts any CDK [`ITopicSubscription`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.ITopicSubscription.html) (e.g. `EmailSubscription`, `LambdaSubscription`, `SqsSubscription`) and binds it via `ITopicSubscription.bind(topic)` — the same path CDK uses for `topic.addSubscription(...)`, so endpoint-specific wire-up (Lambda invoke permission, SQS queue policy, KMS decrypt policy) happens automatically.
+
+```ts
+import { createTopicBuilder } from "@composurecdk/sns";
+import { EmailSubscription, LambdaSubscription } from "aws-cdk-lib/aws-sns-subscriptions";
+
+const result = createTopicBuilder()
+  .topicName("alerts")
+  .addSubscription("ops", new EmailSubscription("ops@example.com"))
+  .addSubscription("handler", new LambdaSubscription(alertHandler))
+  .build(stack, "Alerts");
+
+result.subscriptions.ops; // AWS SNS Subscription construct
+```
+
+Each subscription is exposed on `result.subscriptions` under the key supplied to `addSubscription`.
+
+Cross-component subscriptions can be declared with `ref(...)` inside a [`compose`](../core/README.md) system, so the subscription's endpoint is resolved from another component's build output at build time:
+
+```ts
+import { compose, ref } from "@composurecdk/core";
+import { createTopicBuilder } from "@composurecdk/sns";
+import { createFunctionBuilder, type FunctionBuilderResult } from "@composurecdk/lambda";
+import { LambdaSubscription } from "aws-cdk-lib/aws-sns-subscriptions";
+
+const system = compose(
+  {
+    handler: createFunctionBuilder()./* ... */,
+    alerts: createTopicBuilder().addSubscription(
+      "handler",
+      ref("handler", (r: FunctionBuilderResult) => new LambdaSubscription(r.function)),
+    ),
+  },
+  { handler: [], alerts: ["handler"] },
+);
+```
+
+## Subscription Builder
+
+```ts
+import { createSubscriptionBuilder } from "@composurecdk/sns";
+import { SubscriptionProtocol } from "aws-cdk-lib/aws-sns";
+
+const emailAlerts = createSubscriptionBuilder()
+  .topic(budgetTopic)
+  .protocol(SubscriptionProtocol.EMAIL)
+  .endpoint("ops@example.com")
+  .build(stack, "BudgetEmailSubscription");
+```
+
+Every [SubscriptionProps](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.SubscriptionProps.html) property is available as a fluent setter. `topic` and `deadLetterQueue` additionally accept a `Ref` so the subscription can be composed with a `TopicBuilder` (or any other component) without post-build wiring:
+
+```ts
+import { compose, ref } from "@composurecdk/core";
+import { createTopicBuilder, createSubscriptionBuilder } from "@composurecdk/sns";
+import { SubscriptionProtocol } from "aws-cdk-lib/aws-sns";
+
+const system = compose(
+  {
+    budget: createTopicBuilder().topicName("budget-alerts"),
+    email: createSubscriptionBuilder()
+      .topic(ref("budget", (r) => r.topic))
+      .protocol(SubscriptionProtocol.EMAIL)
+      .endpoint("ops@example.com"),
+  },
+  { budget: [], email: ["budget"] },
+);
+```
+
+### Subscription reliability
+
+Attaching a dead-letter queue is the primary reliability control for SNS subscriptions ([AWS Well-Architected — Reliability Pillar](https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/welcome.html), [SNS DLQ docs](https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html)). Pass a queue via `.deadLetterQueue(queue)` or a `ref` to one; the builder does not create a DLQ automatically because the queue resource needs to be caller-owned.
+
+The CloudWatch metrics that surface delivery failures (`NumberOfNotificationsRedrivenToDlq`, `NumberOfNotificationsFailedToRedriveToDlq`) are topic-level, so the recommended alarms for them live on the `TopicBuilder` (see [Recommended Alarms](#recommended-alarms) above) and only report data once at least one subscription has a DLQ attached.
+
+Also note: `SubscriptionProtocol.HTTP` is allowed for compatibility; prefer `HTTPS` for transport encryption ([SNS security best practices](https://docs.aws.amazon.com/sns/latest/dg/sns-security-best-practices.html)).
+
 ## Examples
 
 - [LambdaApiStack](../examples/src/lambda-api-app.ts) — REST API with TopicBuilder for alarm actions

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { createTopicBuilder, type TopicBuilderResult, type ITopicBuilder, } from "./topic-builder.js";
 export { TOPIC_DEFAULTS } from "./defaults.js";
-export { type TopicAlarmConfig } from "./alarm-config.js";
-export { TOPIC_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { type TopicAlarmConfig } from "./topic-alarm-config.js";
+export { TOPIC_ALARM_DEFAULTS } from "./topic-alarm-defaults.js";
+export { createSubscriptionBuilder, type ISubscriptionBuilder, type SubscriptionBuilderResult, } from "./subscription-builder.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export { createTopicBuilder, } from "./topic-builder.js";
 export { TOPIC_DEFAULTS } from "./defaults.js";
-export { TOPIC_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { TOPIC_ALARM_DEFAULTS } from "./topic-alarm-defaults.js";
+export { createSubscriptionBuilder, } from "./subscription-builder.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,yBAAyB,GAG1B,MAAM,2BAA2B,CAAC"}

package/dist/subscription-builder.d.ts

@@ -0,0 +1,100 @@
+import { type ITopic, Subscription, type SubscriptionProps } from "aws-cdk-lib/aws-sns";
+import type { IQueue } from "aws-cdk-lib/aws-sqs";
+import { type IConstruct } from "constructs";
+import { type IBuilder, type Lifecycle, type Resolvable } from "@composurecdk/core";
+/**
+ * Configuration properties for the SNS subscription builder.
+ *
+ * Extends the CDK {@link SubscriptionProps} but accepts {@link Resolvable}
+ * values for `topic` and `deadLetterQueue` so the builder can be wired to
+ * other components via {@link ref} inside a {@link compose}d system.
+ */
+interface SubscriptionBuilderProps extends Omit<SubscriptionProps, "topic" | "deadLetterQueue"> {
+    /**
+     * The topic to subscribe to. Accepts a concrete {@link ITopic} or a
+     * {@link Ref} to another component's output (e.g. a `TopicBuilder`).
+     */
+    topic: Resolvable<ITopic>;
+    /**
+     * Dead-letter queue for messages that cannot be delivered to the
+     * subscribed endpoint. Accepts a concrete {@link IQueue} or a
+     * {@link Ref} to another component's output.
+     *
+     * Attaching a DLQ is the primary reliability control for SNS
+     * subscriptions. Redrive and redrive-failure alarms are created on the
+     * subscribed {@link TopicBuilder} since the underlying metrics are
+     * topic-level.
+     *
+     * @see https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html
+     * @default - no dead letter queue
+     */
+    deadLetterQueue?: Resolvable<IQueue>;
+}
+/**
+ * The build output of an {@link ISubscriptionBuilder}. Contains the CDK
+ * constructs created during {@link Lifecycle.build}, keyed by role.
+ */
+export interface SubscriptionBuilderResult {
+    /** The SNS subscription construct created by the builder. */
+    subscription: Subscription;
+}
+/**
+ * A fluent builder for configuring and creating an AWS SNS subscription.
+ *
+ * Each configuration property from the CDK {@link SubscriptionProps} is
+ * exposed as an overloaded method: call with a value to set it (returns the
+ * builder for chaining), or call with no arguments to read the current
+ * value.
+ *
+ * The builder implements {@link Lifecycle}, so it can be used directly as a
+ * component in a {@link compose | composed system}. Its `topic` and
+ * `deadLetterQueue` properties accept {@link Resolvable} values so they can
+ * be supplied by another component's build output via {@link ref}.
+ *
+ * Recommended CloudWatch alarms related to subscription delivery (redrive
+ * to DLQ, failed redrive to DLQ) are emitted against topic-level metrics,
+ * so they live on {@link createTopicBuilder} rather than here.
+ *
+ * @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sns.Subscription.html
+ *
+ * @example
+ * ```ts
+ * const emailAlerts = createSubscriptionBuilder()
+ *   .topic(ref("topic", (r: TopicBuilderResult) => r.topic))
+ *   .protocol(SubscriptionProtocol.EMAIL)
+ *   .endpoint("ops@example.com");
+ * ```
+ */
+export type ISubscriptionBuilder = IBuilder<SubscriptionBuilderProps, SubscriptionBuilder>;
+declare class SubscriptionBuilder implements Lifecycle<SubscriptionBuilderResult> {
+    props: Partial<SubscriptionBuilderProps>;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): SubscriptionBuilderResult;
+}
+/**
+ * Creates a new {@link ISubscriptionBuilder} for configuring an AWS SNS
+ * subscription.
+ *
+ * This is the entry point for defining an SNS subscription component. The
+ * returned builder exposes every {@link SubscriptionProps} property as a
+ * fluent setter/getter and implements {@link Lifecycle} for use with
+ * {@link compose}.
+ *
+ * @returns A fluent builder for an AWS SNS subscription.
+ *
+ * @example
+ * ```ts
+ * const system = compose(
+ *   {
+ *     topic: createTopicBuilder().topicName("budget-alerts"),
+ *     email: createSubscriptionBuilder()
+ *       .topic(ref("topic", (r: TopicBuilderResult) => r.topic))
+ *       .protocol(SubscriptionProtocol.EMAIL)
+ *       .endpoint("ops@example.com"),
+ *   },
+ *   { topic: [], email: ["topic"] },
+ * );
+ * ```
+ */
+export declare function createSubscriptionBuilder(): ISubscriptionBuilder;
+export {};
+//# sourceMappingURL=subscription-builder.d.ts.map

package/dist/subscription-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-builder.d.ts","sourceRoot":"","sources":["../src/subscription-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,UAAU,wBAAyB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC7F;;;OAGG;IACH,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE1B;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,6DAA6D;IAC7D,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAE3F,cAAM,mBAAoB,YAAW,SAAS,CAAC,yBAAyB,CAAC;IACvE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAM;IAE9C,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,yBAAyB;CAmC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,IAAI,oBAAoB,CAEhE"}

package/dist/subscription-builder.js

@@ -0,0 +1,57 @@
+import { Subscription } from "aws-cdk-lib/aws-sns";
+import { Builder, resolve, } from "@composurecdk/core";
+class SubscriptionBuilder {
+    props = {};
+    build(scope, id, context = {}) {
+        const { topic, deadLetterQueue, protocol, endpoint, ...rest } = this.props;
+        if (topic === undefined) {
+            throw new Error(`SubscriptionBuilder "${id}": topic is required. Call .topic(...) with an ITopic or a Ref before building.`);
+        }
+        if (protocol === undefined) {
+            throw new Error(`SubscriptionBuilder "${id}": protocol is required. Call .protocol(...) with a SubscriptionProtocol before building.`);
+        }
+        if (endpoint === undefined) {
+            throw new Error(`SubscriptionBuilder "${id}": endpoint is required. Call .endpoint(...) with the subscriber endpoint before building.`);
+        }
+        const resolvedTopic = resolve(topic, context);
+        const resolvedDlq = deadLetterQueue !== undefined ? resolve(deadLetterQueue, context) : undefined;
+        const subscriptionProps = {
+            ...rest,
+            protocol,
+            endpoint,
+            topic: resolvedTopic,
+            ...(resolvedDlq !== undefined ? { deadLetterQueue: resolvedDlq } : {}),
+        };
+        const subscription = new Subscription(scope, id, subscriptionProps);
+        return { subscription };
+    }
+}
+/**
+ * Creates a new {@link ISubscriptionBuilder} for configuring an AWS SNS
+ * subscription.
+ *
+ * This is the entry point for defining an SNS subscription component. The
+ * returned builder exposes every {@link SubscriptionProps} property as a
+ * fluent setter/getter and implements {@link Lifecycle} for use with
+ * {@link compose}.
+ *
+ * @returns A fluent builder for an AWS SNS subscription.
+ *
+ * @example
+ * ```ts
+ * const system = compose(
+ *   {
+ *     topic: createTopicBuilder().topicName("budget-alerts"),
+ *     email: createSubscriptionBuilder()
+ *       .topic(ref("topic", (r: TopicBuilderResult) => r.topic))
+ *       .protocol(SubscriptionProtocol.EMAIL)
+ *       .endpoint("ops@example.com"),
+ *   },
+ *   { topic: [], email: ["topic"] },
+ * );
+ * ```
+ */
+export function createSubscriptionBuilder() {
+    return Builder(SubscriptionBuilder);
+}
+//# sourceMappingURL=subscription-builder.js.map

package/dist/subscription-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-builder.js","sourceRoot":"","sources":["../src/subscription-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,YAAY,EAA0B,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EACL,OAAO,EAIP,OAAO,GACR,MAAM,oBAAoB,CAAC;AAsE5B,MAAM,mBAAmB;IACvB,KAAK,GAAsC,EAAE,CAAC;IAE9C,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,UAAkC,EAAE;QAEpC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,iFAAiF,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,2FAA2F,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,4FAA4F,CACvH,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,WAAW,GACf,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,MAAM,iBAAiB,GAAsB;YAC3C,GAAG,IAAI;YACP,QAAQ;YACR,QAAQ;YACR,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAEpE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,OAAO,CAAgD,mBAAmB,CAAC,CAAC;AACrF,CAAC"}

package/dist/{alarm-config.d.ts → topic-alarm-config.d.ts}

@@ -34,5 +34,34 @@ export interface TopicAlarmConfig {
      * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#SNS
      */
     numberOfNotificationsFilteredOutInvalidAttributes?: AlarmConfig | false;
+    /**
+     * Alarm when messages are moved to a subscription's dead-letter queue
+     * because SNS could not deliver them to the subscribed endpoint.
+     *
+     * This metric is topic-level even though DLQs are attached per subscription,
+     * so the recommended alarm lives on the topic. It only emits data when at
+     * least one subscription on the topic has a DLQ attached and SNS attempts
+     * redrive; {@link TreatMissingData.NOT_BREACHING} keeps it quiet otherwise.
+     *
+     * Metric: `AWS/SNS NumberOfNotificationsRedrivenToDlq`, statistic Sum,
+     * period 1 minute, dimension `TopicName`.
+     * Default threshold: > 0 redrives.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#SNS
+     * @see https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html
+     */
+    numberOfNotificationsRedrivenToDlq?: AlarmConfig | false;
+    /**
+     * Alarm when messages could not even be moved to a dead-letter queue.
+     * Indicates a misconfiguration (e.g. missing SNS permission on the DLQ)
+     * that results in message loss.
+     *
+     * Metric: `AWS/SNS NumberOfNotificationsFailedToRedriveToDlq`, statistic Sum,
+     * period 1 minute, dimension `TopicName`.
+     * Default threshold: > 0 failed redrives.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#SNS
+     */
+    numberOfNotificationsFailedToRedriveToDlq?: AlarmConfig | false;
 }
-//# sourceMappingURL=alarm-config.d.ts.map
+//# sourceMappingURL=topic-alarm-config.d.ts.map

package/dist/topic-alarm-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-alarm-config.d.ts","sourceRoot":"","sources":["../src/topic-alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAElD;;;;;;;;;OASG;IACH,iDAAiD,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAExE;;;;;;;;;;;;;;;OAeG;IACH,kCAAkC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEzD;;;;;;;;;;OAUG;IACH,yCAAyC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACjE"}

package/dist/topic-alarm-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=topic-alarm-config.js.map

package/dist/topic-alarm-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-alarm-config.js","sourceRoot":"","sources":["../src/topic-alarm-config.ts"],"names":[],"mappings":""}

package/dist/{alarm-defaults.d.ts → topic-alarm-defaults.d.ts}

@@ -3,6 +3,8 @@ interface TopicAlarmDefaults {
     enabled: true;
     numberOfNotificationsFailed: Required<AlarmConfig>;
     numberOfNotificationsFilteredOutInvalidAttributes: Required<AlarmConfig>;
+    numberOfNotificationsRedrivenToDlq: Required<AlarmConfig>;
+    numberOfNotificationsFailedToRedriveToDlq: Required<AlarmConfig>;
 }
 /**
  * AWS-recommended default alarm configuration for SNS topics.
@@ -11,4 +13,4 @@ interface TopicAlarmDefaults {
  */
 export declare const TOPIC_ALARM_DEFAULTS: TopicAlarmDefaults;
 export {};
-//# sourceMappingURL=alarm-defaults.d.ts.map
+//# sourceMappingURL=topic-alarm-defaults.d.ts.map

package/dist/topic-alarm-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-alarm-defaults.d.ts","sourceRoot":"","sources":["../src/topic-alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,UAAU,kBAAkB;IAC1B,OAAO,EAAE,IAAI,CAAC;IACd,2BAA2B,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,iDAAiD,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzE,kCAAkC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,yCAAyC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAClE;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,kBAkClC,CAAC"}

package/dist/{alarm-defaults.js → topic-alarm-defaults.js}

@@ -20,5 +20,19 @@ export const TOPIC_ALARM_DEFAULTS = {
         datapointsToAlarm: 1,
         treatMissingData: TreatMissingData.NOT_BREACHING,
     },
+    /** Any redrive to a subscription DLQ indicates a delivery failure worth investigating; threshold 0. */
+    numberOfNotificationsRedrivenToDlq: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+    /** Any failure to redrive to a DLQ means message loss; threshold 0. */
+    numberOfNotificationsFailedToRedriveToDlq: {
+        threshold: 0,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
 };
-//# sourceMappingURL=alarm-defaults.js.map
+//# sourceMappingURL=topic-alarm-defaults.js.map

package/dist/topic-alarm-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-alarm-defaults.js","sourceRoot":"","sources":["../src/topic-alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAW9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,OAAO,EAAE,IAAI;IAEb,gEAAgE;IAChE,2BAA2B,EAAE;QAC3B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,mGAAmG;IACnG,iDAAiD,EAAE;QACjD,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,uGAAuG;IACvG,kCAAkC,EAAE;QAClC,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,uEAAuE;IACvE,yCAAyC,EAAE;QACzC,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC"}

package/dist/topic-alarms.d.ts

@@ -3,7 +3,7 @@ import type { ITopic } from "aws-cdk-lib/aws-sns";
 import type { IConstruct } from "constructs";
 import type { AlarmDefinition } from "@composurecdk/cloudwatch";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
-import type { TopicAlarmConfig } from "./alarm-config.js";
+import type { TopicAlarmConfig } from "./topic-alarm-config.js";
 /**
  * Resolves the recommended alarm configuration into fully-resolved
  * {@link AlarmDefinition}s for an SNS topic.

package/dist/topic-alarms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"topic-alarms.d.ts","sourceRoot":"","sources":["../src/topic-alarms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,KAAK,EAAsB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAoC,MAAM,0BAA0B,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAM1D;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CA0CnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,GAAG,KAAK,GAAG,SAAS,EAC5C,YAAY,GAAE,sBAAsB,CAAC,MAAM,CAAC,EAAO,GAClD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAUvB"}
+{"version":3,"file":"topic-alarms.d.ts","sourceRoot":"","sources":["../src/topic-alarms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,KAAK,EAAsB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAoC,MAAM,0BAA0B,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAMhE;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CAkFnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,GAAG,KAAK,GAAG,SAAS,EAC5C,YAAY,GAAE,sBAAsB,CAAC,MAAM,CAAC,EAAO,GAClD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAUvB"}

package/dist/topic-alarms.js

@@ -1,7 +1,7 @@
 import { Duration } from "aws-cdk-lib";
 import { ComparisonOperator } from "aws-cdk-lib/aws-cloudwatch";
 import { createAlarms, resolveAlarmConfig } from "@composurecdk/cloudwatch";
-import { TOPIC_ALARM_DEFAULTS } from "./alarm-defaults.js";
+import { TOPIC_ALARM_DEFAULTS } from "./topic-alarm-defaults.js";
 const METRIC_PERIOD = Duration.minutes(1);
 const METRIC_PERIOD_LABEL = `${String(METRIC_PERIOD.toMinutes())} minute`;
 /**
@@ -40,6 +40,38 @@ export function resolveTopicAlarmDefinitions(topic, config) {
             description: `SNS topic messages are being filtered out due to invalid subscription filter policy attributes. Threshold: > ${String(cfg.threshold)} filtered messages in ${METRIC_PERIOD_LABEL}.`,
         });
     }
+    if (config?.numberOfNotificationsRedrivenToDlq !== false) {
+        const cfg = resolveAlarmConfig(config?.numberOfNotificationsRedrivenToDlq, TOPIC_ALARM_DEFAULTS.numberOfNotificationsRedrivenToDlq);
+        definitions.push({
+            key: "numberOfNotificationsRedrivenToDlq",
+            metric: topic.metric("NumberOfNotificationsRedrivenToDlq", {
+                period: METRIC_PERIOD,
+                statistic: "Sum",
+            }),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `SNS topic is redriving messages to a subscription dead-letter queue, indicating delivery failures. Threshold: > ${String(cfg.threshold)} redrives in ${METRIC_PERIOD_LABEL}.`,
+        });
+    }
+    if (config?.numberOfNotificationsFailedToRedriveToDlq !== false) {
+        const cfg = resolveAlarmConfig(config?.numberOfNotificationsFailedToRedriveToDlq, TOPIC_ALARM_DEFAULTS.numberOfNotificationsFailedToRedriveToDlq);
+        definitions.push({
+            key: "numberOfNotificationsFailedToRedriveToDlq",
+            metric: topic.metric("NumberOfNotificationsFailedToRedriveToDlq", {
+                period: METRIC_PERIOD,
+                statistic: "Sum",
+            }),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `SNS topic failed to redrive a message to a subscription dead-letter queue; messages may be lost. Threshold: > ${String(cfg.threshold)} failed redrives in ${METRIC_PERIOD_LABEL}.`,
+        });
+    }
     return definitions;
 }
 /**

package/dist/topic-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"topic-alarms.js","sourceRoot":"","sources":["../src/topic-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAc,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EAA0B,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,2BAA2B,KAAK,KAAK,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,2BAA2B,EACnC,oBAAoB,CAAC,2BAA2B,CACjD,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,KAAK,CAAC,iCAAiC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC1E,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,+DAA+D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,mBAAmB,GAAG;SACxI,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,iDAAiD,KAAK,KAAK,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,iDAAiD,EACzD,oBAAoB,CAAC,iDAAiD,CACvE,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,mDAAmD;YACxD,MAAM,EAAE,KAAK,CAAC,uDAAuD,CAAC;gBACpE,MAAM,EAAE,aAAa;aACtB,CAAC;YACF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,gHAAgH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,mBAAmB,GAAG;SAClM,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAA4C,EAC5C,eAAiD,EAAE;IAEnD,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzD,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"topic-alarms.js","sourceRoot":"","sources":["../src/topic-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAc,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EAA0B,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,2BAA2B,KAAK,KAAK,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,2BAA2B,EACnC,oBAAoB,CAAC,2BAA2B,CACjD,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,KAAK,CAAC,iCAAiC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC1E,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,+DAA+D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,mBAAmB,GAAG;SACxI,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,iDAAiD,KAAK,KAAK,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,iDAAiD,EACzD,oBAAoB,CAAC,iDAAiD,CACvE,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,mDAAmD;YACxD,MAAM,EAAE,KAAK,CAAC,uDAAuD,CAAC;gBACpE,MAAM,EAAE,aAAa;aACtB,CAAC;YACF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,gHAAgH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,mBAAmB,GAAG;SAClM,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,kCAAkC,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,kCAAkC,EAC1C,oBAAoB,CAAC,kCAAkC,CACxD,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,oCAAoC;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,oCAAoC,EAAE;gBACzD,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,mHAAmH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,mBAAmB,GAAG;SAC5L,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,yCAAyC,KAAK,KAAK,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,yCAAyC,EACjD,oBAAoB,CAAC,yCAAyC,CAC/D,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,2CAA2C;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,2CAA2C,EAAE;gBAChE,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EAAE,iHAAiH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,mBAAmB,GAAG;SACjM,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAA4C,EAC5C,eAAiD,EAAE;IAEnD,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzD,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/topic-builder.d.ts

@@ -1,9 +1,9 @@
 import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
-import { type ITopic, Topic, type TopicProps } from "aws-cdk-lib/aws-sns";
+import { type ITopic, type ITopicSubscription, Subscription, Topic, type TopicProps } from "aws-cdk-lib/aws-sns";
 import { type IConstruct } from "constructs";
-import { type IBuilder, type Lifecycle } from "@composurecdk/core";
+import { type IBuilder, type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
-import type { TopicAlarmConfig } from "./alarm-config.js";
+import type { TopicAlarmConfig } from "./topic-alarm-config.js";
 /**
  * Configuration properties for the SNS topic builder.
  *
@@ -45,6 +45,14 @@ export interface TopicBuilderResult {
      * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#SNS
      */
     alarms: Record<string, Alarm>;
+    /**
+     * Subscriptions added to the topic via
+     * {@link ITopicBuilder.addSubscription}, keyed by the name supplied to
+     * that call.
+     *
+     * Always present — `{}` when no subscriptions were added.
+     */
+    subscriptions: Record<string, Subscription>;
 }
 /**
  * A fluent builder for configuring and creating an AWS SNS topic.
@@ -75,8 +83,26 @@ export type ITopicBuilder = IBuilder<TopicBuilderProps, TopicBuilder>;
 declare class TopicBuilder implements Lifecycle<TopicBuilderResult> {
     props: Partial<TopicBuilderProps>;
     private readonly customAlarms;
+    private readonly _subscriptions;
     addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<ITopic>) => AlarmDefinitionBuilder<ITopic>): this;
-    build(scope: IConstruct, id: string): TopicBuilderResult;
+    /**
+     * Register a subscription to be attached to the topic at build time.
+     *
+     * Accepts any {@link ITopicSubscription} (e.g. `EmailSubscription`,
+     * `LambdaSubscription`, `SqsSubscription`) or a {@link Resolvable} so
+     * subscriptions wiring cross-component references (such as a Lambda
+     * function built by a sibling component) can be declared at configuration
+     * time.
+     *
+     * The subscription is bound via `ITopicSubscription.bind(topic)`, which
+     * performs the IAM/resource-policy wire-up required by the endpoint (for
+     * example, `LambdaSubscription.bind` grants the topic permission to
+     * invoke the function; `SqsSubscription.bind` adds the matching SQS queue
+     * policy). The resulting {@link Subscription} construct is exposed on
+     * {@link TopicBuilderResult.subscriptions} under `key`.
+     */
+    addSubscription(key: string, subscription: Resolvable<ITopicSubscription>): this;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): TopicBuilderResult;
 }
 /**
  * Creates a new {@link ITopicBuilder} for configuring an AWS SNS topic.

package/dist/topic-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"topic-builder.d.ts","sourceRoot":"","sources":["../src/topic-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAW,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAI1D;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEtE,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAM;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IAErE,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,kBAAkB;CAczD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAElD"}
+{"version":3,"file":"topic-builder.d.ts","sourceRoot":"","sources":["../src/topic-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EACL,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,YAAY,EACZ,KAAK,EACL,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAOtE,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAM;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAE1D,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAWhF,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kBAAkB;CAyB3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAElD"}

package/dist/topic-builder.js

@@ -1,16 +1,41 @@
-import { Topic } from "aws-cdk-lib/aws-sns";
-import { Builder } from "@composurecdk/core";
+import { Subscription, Topic, } from "aws-cdk-lib/aws-sns";
+import { Builder, resolve, } from "@composurecdk/core";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
 import { createTopicAlarms } from "./topic-alarms.js";
 import { TOPIC_DEFAULTS } from "./defaults.js";
 class TopicBuilder {
     props = {};
     customAlarms = [];
+    _subscriptions = [];
     addAlarm(key, configure) {
         this.customAlarms.push(configure(new AlarmDefinitionBuilder(key)));
         return this;
     }
-    build(scope, id) {
+    /**
+     * Register a subscription to be attached to the topic at build time.
+     *
+     * Accepts any {@link ITopicSubscription} (e.g. `EmailSubscription`,
+     * `LambdaSubscription`, `SqsSubscription`) or a {@link Resolvable} so
+     * subscriptions wiring cross-component references (such as a Lambda
+     * function built by a sibling component) can be declared at configuration
+     * time.
+     *
+     * The subscription is bound via `ITopicSubscription.bind(topic)`, which
+     * performs the IAM/resource-policy wire-up required by the endpoint (for
+     * example, `LambdaSubscription.bind` grants the topic permission to
+     * invoke the function; `SqsSubscription.bind` adds the matching SQS queue
+     * policy). The resulting {@link Subscription} construct is exposed on
+     * {@link TopicBuilderResult.subscriptions} under `key`.
+     */
+    addSubscription(key, subscription) {
+        if (this._subscriptions.some((s) => s.key === key)) {
+            throw new Error(`TopicBuilder.addSubscription: duplicate key "${key}". ` +
+                `Each subscription must use a unique key.`);
+        }
+        this._subscriptions.push({ key, subscription });
+        return this;
+    }
+    build(scope, id, context) {
         const { recommendedAlarms: alarmConfig, ...topicProps } = this.props;
         const mergedProps = {
             ...TOPIC_DEFAULTS,
@@ -18,7 +43,17 @@ class TopicBuilder {
         };
         const topic = new Topic(scope, id, mergedProps);
         const alarms = createTopicAlarms(scope, id, topic, alarmConfig, this.customAlarms);
-        return { topic, alarms };
+        const subscriptions = {};
+        for (const entry of this._subscriptions) {
+            const resolvedSub = resolve(entry.subscription, context ?? {});
+            const subscriptionConfig = resolvedSub.bind(topic);
+            const subscriptionId = `${id}${entry.key[0].toUpperCase()}${entry.key.slice(1)}Subscription`;
+            subscriptions[entry.key] = new Subscription(scope, subscriptionId, {
+                topic,
+                ...subscriptionConfig,
+            });
+        }
+        return { topic, alarms, subscriptions };
     }
 }
 /**

package/dist/topic-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"topic-builder.js","sourceRoot":"","sources":["../src/topic-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,EAAmB,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAiC,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA0E/C,MAAM,YAAY;IAChB,KAAK,GAA+B,EAAE,CAAC;IACtB,YAAY,GAAqC,EAAE,CAAC;IAErE,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAErE,MAAM,WAAW,GAAG;YAClB,GAAG,cAAc;YACjB,GAAG,UAAU;SACO,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEnF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAkC,YAAY,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"topic-builder.js","sourceRoot":"","sources":["../src/topic-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,YAAY,EACZ,KAAK,GAEN,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,OAAO,EAGP,OAAO,GAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAwF/C,MAAM,YAAY;IAChB,KAAK,GAA+B,EAAE,CAAC;IACtB,YAAY,GAAqC,EAAE,CAAC;IACpD,cAAc,GAAwB,EAAE,CAAC;IAE1D,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,GAAW,EAAE,YAA4C;QACvE,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,gDAAgD,GAAG,KAAK;gBACtD,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAErE,MAAM,WAAW,GAAG;YAClB,GAAG,cAAc;YACjB,GAAG,UAAU;SACO,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAiC,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,cAAc,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;YAC7F,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE;gBACjE,KAAK;gBACL,GAAG,kBAAkB;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAkC,YAAY,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/sns",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Composable SNS topic builder with well-architected defaults",
   "repository": {
     "type": "git",
@@ -41,10 +41,10 @@
     "constructs": "^10.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.5.0",
-    "aws-cdk-lib": "^2.245.0",
+    "@types/node": "^25.6.0",
+    "aws-cdk-lib": "^2.250.0",
     "constructs": "^10.6.0",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.4"
   }
 }

package/dist/alarm-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm-config.d.ts","sourceRoot":"","sources":["../src/alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAElD;;;;;;;;;OASG;IACH,iDAAiD,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACzE"}

package/dist/alarm-config.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=alarm-config.js.map

package/dist/alarm-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm-config.js","sourceRoot":"","sources":["../src/alarm-config.ts"],"names":[],"mappings":""}

package/dist/alarm-defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm-defaults.d.ts","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,UAAU,kBAAkB;IAC1B,OAAO,EAAE,IAAI,CAAC;IACd,2BAA2B,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,iDAAiD,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAC1E;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,kBAkBlC,CAAC"}

package/dist/alarm-defaults.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarm-defaults.js","sourceRoot":"","sources":["../src/alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAS9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,OAAO,EAAE,IAAI;IAEb,gEAAgE;IAChE,2BAA2B,EAAE;QAC3B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;IAED,mGAAmG;IACnG,iDAAiD,EAAE;QACjD,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC"}