@ctxpipe/aws-cdk 0.0.0-beta-20260528142254

package/lib/internal/outputs-construct.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OutputsConstruct = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+class OutputsConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        new cdk.CfnOutput(this, "AppUrl", {
+            value: props.appUrl,
+        });
+        new cdk.CfnOutput(this, "AlbDnsName", {
+            value: props.albDnsName,
+        });
+        new cdk.CfnOutput(this, "DatabaseUrlSecretArn", {
+            value: props.databaseUrlSecretArn,
+        });
+        new cdk.CfnOutput(this, "ModelProviderSecretArn", {
+            value: props.modelProviderSecretArn,
+        });
+        new cdk.CfnOutput(this, "SmtpSecretArn", {
+            value: props.smtpSecretArn,
+        });
+        if (props.connectorSecretArn) {
+            new cdk.CfnOutput(this, "ConnectorSecretArn", {
+                value: props.connectorSecretArn,
+            });
+        }
+    }
+}
+exports.OutputsConstruct = OutputsConstruct;
+//# sourceMappingURL=outputs-construct.js.map

package/lib/internal/outputs-construct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outputs-construct.js","sourceRoot":"","sources":["../../src/internal/outputs-construct.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AACnC,2CAAuC;AAGvC,MAAa,gBAAiB,SAAQ,sBAAS;IAC7C,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA4B;QAC3E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE;YAChC,KAAK,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE;YACpC,KAAK,EAAE,KAAK,CAAC,UAAU;SACxB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,sBAAsB,EAAE;YAC9C,KAAK,EAAE,KAAK,CAAC,oBAAoB;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,wBAAwB,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,sBAAsB;SACpC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,aAAa;SAC3B,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,oBAAoB,EAAE;gBAC5C,KAAK,EAAE,KAAK,CAAC,kBAAkB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA1BD,4CA0BC"}

package/lib/internal/secrets-construct.d.ts

@@ -0,0 +1,7 @@
+import { Construct } from "constructs";
+import type { SecretsConstructProps, SecretsResources } from "./contracts";
+export declare class SecretsConstruct extends Construct {
+    readonly resources: SecretsResources;
+    constructor(scope: Construct, id: string, props: SecretsConstructProps);
+}
+//# sourceMappingURL=secrets-construct.d.ts.map

package/lib/internal/secrets-construct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-construct.d.ts","sourceRoot":"","sources":["../../src/internal/secrets-construct.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3E,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,SAAgB,SAAS,EAAE,gBAAgB,CAAC;gBAEzB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CA6M9E"}

package/lib/internal/secrets-construct.js

@@ -0,0 +1,211 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsConstruct = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const ses = __importStar(require("aws-cdk-lib/aws-ses"));
+const secretsmanager = __importStar(require("aws-cdk-lib/aws-secretsmanager"));
+const cr = __importStar(require("aws-cdk-lib/custom-resources"));
+const constructs_1 = require("constructs");
+class SecretsConstruct extends constructs_1.Construct {
+    resources;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const authSecret = new secretsmanager.Secret(this, "AuthSecret", {
+            generateSecretString: {
+                secretStringTemplate: "{}",
+                generateStringKey: "AUTH_SECRET",
+                passwordLength: 64,
+            },
+        });
+        const databaseUrl = cdk.Fn.join("", [
+            "postgresql://ctxpipe:",
+            props.dataPlane.dbCredentialsSecret.secretValueFromJson("password").toString(),
+            "@",
+            props.dataPlane.dbCluster.clusterEndpoint.hostname,
+            ":",
+            cdk.Token.asString(props.dataPlane.dbCluster.clusterEndpoint.port),
+            "/",
+            props.databaseName,
+        ]);
+        const databaseUrlSecret = new secretsmanager.Secret(this, "DatabaseUrlSecret", {
+            secretObjectValue: {
+                DATABASE_URL: cdk.SecretValue.unsafePlainText(databaseUrl),
+            },
+        });
+        const modelProviderSecret = new secretsmanager.Secret(this, "ModelProviderSecret", {
+            secretObjectValue: {
+                API_KEY: props.modelProviderApiKey,
+            },
+        });
+        const sesIdentity = new ses.EmailIdentity(this, "SesIdentity", {
+            // The hosted zone passed to CtxPipe is expected to be public.
+            identity: ses.Identity.publicHostedZone(props.hostedZone),
+        });
+        const sesSmtpUser = new iam.User(this, "SesSmtpUser");
+        sesIdentity.grantSendEmail(sesSmtpUser);
+        sesSmtpUser.addToPolicy(new iam.PolicyStatement({
+            actions: ["ses:SendEmail", "ses:SendRawEmail"],
+            resources: ["*"],
+        }));
+        const sesSmtpAccessKey = new iam.CfnAccessKey(this, "SesSmtpAccessKey", {
+            userName: sesSmtpUser.userName,
+        });
+        const smtpPasswordFunction = new lambda.Function(this, "SesSmtpPasswordFunction", {
+            runtime: lambda.Runtime.NODEJS_20_X,
+            handler: "index.handler",
+            timeout: cdk.Duration.seconds(15),
+            code: lambda.Code.fromInline(`
+          const crypto = require("crypto");
+          function sign(key, message) {
+            return crypto.createHmac("sha256", key).update(message, "utf8").digest();
+          }
+          function toSmtpPassword(secretAccessKey, region) {
+            const kDate = sign("AWS4" + secretAccessKey, "11111111");
+            const kRegion = sign(kDate, region);
+            const kService = sign(kRegion, "ses");
+            const kSigning = sign(kService, "aws4_request");
+            const kMessage = sign(kSigning, "SendRawEmail");
+            return Buffer.concat([Buffer.from([0x04]), kMessage]).toString("base64");
+          }
+          exports.handler = async (event) => {
+            if (event.RequestType === "Delete") {
+              return { PhysicalResourceId: event.PhysicalResourceId || "ses-smtp-config" };
+            }
+            const accessKeyId = event.ResourceProperties.AccessKeyId;
+            const secretAccessKey = event.ResourceProperties.SecretAccessKey;
+            const region = event.ResourceProperties.Region;
+            const fromAddress = event.ResourceProperties.FromAddress;
+            const normalizedFromAddress = String(fromAddress).replace(/\\.$/, "");
+            const smtpPassword = toSmtpPassword(secretAccessKey, region);
+            const encodedUser = encodeURIComponent(accessKeyId);
+            const encodedPass = encodeURIComponent(smtpPassword);
+            return {
+              PhysicalResourceId: "ses-smtp-config",
+              Data: {
+                SmtpConnectionUrl: "smtps://" + encodedUser + ":" + encodedPass + "@email-smtp." + region + ".amazonaws.com:465",
+                EmailFromAddress: normalizedFromAddress
+              }
+            };
+          };
+        `),
+        });
+        const smtpProvider = new cr.Provider(this, "SesSmtpProvider", {
+            onEventHandler: smtpPasswordFunction,
+        });
+        const smtpConfiguration = new cdk.CustomResource(this, "SesSmtpConfig", {
+            serviceToken: smtpProvider.serviceToken,
+            properties: {
+                AccessKeyId: sesSmtpAccessKey.ref,
+                SecretAccessKey: sesSmtpAccessKey.attrSecretAccessKey,
+                Region: cdk.Stack.of(this).region,
+                FromAddress: props.emailFromAddress,
+            },
+        });
+        const smtpSecret = new secretsmanager.Secret(this, "SmtpSecret", {
+            secretObjectValue: {
+                SMTP_CONNECTION_URL: cdk.SecretValue.unsafePlainText(smtpConfiguration.getAttString("SmtpConnectionUrl")),
+                EMAIL_FROM_ADDRESS: cdk.SecretValue.unsafePlainText(smtpConfiguration.getAttString("EmailFromAddress")),
+            },
+        });
+        smtpSecret.node.addDependency(sesIdentity);
+        const connectorSecret = props.connectorSecrets
+            ? new secretsmanager.Secret(this, "ConnectorSecret", {
+                secretObjectValue: {
+                    ...(props.connectorSecrets.githubAppId
+                        ? { GITHUB_APP_ID: props.connectorSecrets.githubAppId }
+                        : {}),
+                    ...(props.connectorSecrets.githubPrivateKey
+                        ? { GITHUB_PRIVATE_KEY: props.connectorSecrets.githubPrivateKey }
+                        : {}),
+                    ...(props.connectorSecrets.githubWebhookSecret
+                        ? { GITHUB_WEBHOOK_SECRET: props.connectorSecrets.githubWebhookSecret }
+                        : {}),
+                    ...(props.connectorSecrets.githubClientId
+                        ? { GITHUB_CLIENT_ID: props.connectorSecrets.githubClientId }
+                        : {}),
+                    ...(props.connectorSecrets.githubClientSecret
+                        ? { GITHUB_CLIENT_SECRET: props.connectorSecrets.githubClientSecret }
+                        : {}),
+                    ...(props.connectorSecrets.atlassianClientId
+                        ? { ATLASSIAN_CLIENT_ID: props.connectorSecrets.atlassianClientId }
+                        : {}),
+                    ...(props.connectorSecrets.atlassianClientSecret
+                        ? {
+                            ATLASSIAN_CLIENT_SECRET: props.connectorSecrets.atlassianClientSecret,
+                        }
+                        : {}),
+                },
+            })
+            : undefined;
+        const connectorEnv = {};
+        if (connectorSecret) {
+            if (props.connectorSecrets?.githubAppId) {
+                connectorEnv.GITHUB_APP_ID = ecs.Secret.fromSecretsManager(connectorSecret, "GITHUB_APP_ID");
+            }
+            if (props.connectorSecrets?.githubPrivateKey) {
+                connectorEnv.GITHUB_PRIVATE_KEY = ecs.Secret.fromSecretsManager(connectorSecret, "GITHUB_PRIVATE_KEY");
+            }
+            if (props.connectorSecrets?.githubWebhookSecret) {
+                connectorEnv.GITHUB_WEBHOOK_SECRET = ecs.Secret.fromSecretsManager(connectorSecret, "GITHUB_WEBHOOK_SECRET");
+            }
+            if (props.connectorSecrets?.githubClientId) {
+                connectorEnv.GITHUB_CLIENT_ID = ecs.Secret.fromSecretsManager(connectorSecret, "GITHUB_CLIENT_ID");
+            }
+            if (props.connectorSecrets?.githubClientSecret) {
+                connectorEnv.GITHUB_CLIENT_SECRET = ecs.Secret.fromSecretsManager(connectorSecret, "GITHUB_CLIENT_SECRET");
+            }
+            if (props.connectorSecrets?.atlassianClientId) {
+                connectorEnv.ATLASSIAN_CLIENT_ID = ecs.Secret.fromSecretsManager(connectorSecret, "ATLASSIAN_CLIENT_ID");
+            }
+            if (props.connectorSecrets?.atlassianClientSecret) {
+                connectorEnv.ATLASSIAN_CLIENT_SECRET = ecs.Secret.fromSecretsManager(connectorSecret, "ATLASSIAN_CLIENT_SECRET");
+            }
+        }
+        this.resources = {
+            authSecret,
+            databaseUrlSecret,
+            modelProviderSecret,
+            smtpSecret,
+            connectorSecret,
+            connectorEnv,
+        };
+    }
+}
+exports.SecretsConstruct = SecretsConstruct;
+//# sourceMappingURL=secrets-construct.js.map

package/lib/internal/secrets-construct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-construct.js","sourceRoot":"","sources":["../../src/internal/secrets-construct.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AACnC,yDAA2C;AAC3C,yDAA2C;AAC3C,+DAAiD;AAEjD,yDAA2C;AAC3C,+EAAiE;AACjE,iEAAmD;AACnD,2CAAuC;AAGvC,MAAa,gBAAiB,SAAQ,sBAAS;IAC7B,SAAS,CAAmB;IAE5C,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA4B;QAC3E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE;YAC/D,oBAAoB,EAAE;gBACpB,oBAAoB,EAAE,IAAI;gBAC1B,iBAAiB,EAAE,aAAa;gBAChC,cAAc,EAAE,EAAE;aACnB;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,uBAAuB;YACvB,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;YAC9E,GAAG;YACH,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ;YAClD,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC;YAClE,GAAG;YACH,KAAK,CAAC,YAAY;SACnB,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC7E,iBAAiB,EAAE;gBACjB,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC;aAC3D;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE;YACjF,iBAAiB,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,mBAAmB;aACnC;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE;YAC7D,8DAA8D;YAC9D,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CACrC,KAAK,CAAC,UAAuC,CAC9C;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACtD,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,WAAW,CAAC,WAAW,CACrB,IAAI,GAAG,CAAC,eAAe,CAAC;YACtB,OAAO,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;YAC9C,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CACH,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE;YACtE,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE;YAChF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiC1B,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE;YAC5D,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE;YACtE,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,UAAU,EAAE;gBACV,WAAW,EAAE,gBAAgB,CAAC,GAAG;gBACjC,eAAe,EAAE,gBAAgB,CAAC,mBAAmB;gBACrD,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM;gBACjC,WAAW,EAAE,KAAK,CAAC,gBAAgB;aACpC;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE;YAC/D,iBAAiB,EAAE;gBACjB,mBAAmB,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAClD,iBAAiB,CAAC,YAAY,CAAC,mBAAmB,CAAC,CACpD;gBACD,kBAAkB,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CACjD,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CACnD;aACF;SACF,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB;YAC5C,CAAC,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE;gBACjD,iBAAiB,EAAE;oBACjB,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW;wBACpC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE;wBACvD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;wBACzC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;wBACjE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,mBAAmB;wBAC5C,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,gBAAgB,CAAC,mBAAmB,EAAE;wBACvE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc;wBACvC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE;wBAC7D,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,kBAAkB;wBAC3C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,kBAAkB,EAAE;wBACrE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB;wBAC1C,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;wBACnE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB;wBAC9C,CAAC,CAAC;4BACE,uBAAuB,EAAE,KAAK,CAAC,gBAAgB,CAAC,qBAAqB;yBACtE;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,YAAY,GAA+B,EAAE,CAAC;QACpD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,gBAAgB,EAAE,WAAW,EAAE,CAAC;gBACxC,YAAY,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CACxD,eAAe,EACf,eAAe,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;gBAC7C,YAAY,CAAC,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAC7D,eAAe,EACf,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;gBAChD,YAAY,CAAC,qBAAqB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAChE,eAAe,EACf,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;gBAC3C,YAAY,CAAC,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAC3D,eAAe,EACf,kBAAkB,CACnB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;gBAC/C,YAAY,CAAC,oBAAoB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAC/D,eAAe,EACf,sBAAsB,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;gBAC9C,YAAY,CAAC,mBAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAC9D,eAAe,EACf,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;gBAClD,YAAY,CAAC,uBAAuB,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAClE,eAAe,EACf,yBAAyB,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,GAAG;YACf,UAAU;YACV,iBAAiB;YACjB,mBAAmB;YACnB,UAAU;YACV,eAAe;YACf,YAAY;SACb,CAAC;IACJ,CAAC;CACF;AAhND,4CAgNC"}

package/lib/internal/services-construct.d.ts

@@ -0,0 +1,7 @@
+import { Construct } from "constructs";
+import type { ServiceResources, ServicesConstructProps } from "./contracts";
+export declare class ServicesConstruct extends Construct {
+    readonly resources: ServiceResources;
+    constructor(scope: Construct, id: string, props: ServicesConstructProps);
+}
+//# sourceMappingURL=services-construct.d.ts.map

package/lib/internal/services-construct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services-construct.d.ts","sourceRoot":"","sources":["../../src/internal/services-construct.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE5E,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,SAAgB,SAAS,EAAE,gBAAgB,CAAC;gBAEzB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB;CAqF/E"}

package/lib/internal/services-construct.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServicesConstruct = void 0;
+const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
+const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
+const constructs_1 = require("constructs");
+class ServicesConstruct extends constructs_1.Construct {
+    resources;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const backendService = new ecs.FargateService(this, "BackendService", {
+            cluster: props.networking.cluster,
+            taskDefinition: props.tasks.backendTask,
+            desiredCount: props.sizeProfile.services.backendDesiredCount,
+            circuitBreaker: {
+                rollback: true,
+            },
+            assignPublicIp: false,
+            securityGroups: [props.networking.appSecurityGroup],
+            cloudMapOptions: {
+                name: "backend",
+            },
+            vpcSubnets: {
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+        });
+        const workerService = new ecs.FargateService(this, "WorkerService", {
+            cluster: props.networking.cluster,
+            taskDefinition: props.tasks.workerTask,
+            desiredCount: props.sizeProfile.services.workerDesiredCount,
+            circuitBreaker: {
+                rollback: true,
+            },
+            assignPublicIp: false,
+            securityGroups: [props.networking.appSecurityGroup],
+            cloudMapOptions: {
+                name: "worker",
+            },
+            vpcSubnets: {
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+        });
+        const uiService = new ecs.FargateService(this, "UiService", {
+            cluster: props.networking.cluster,
+            taskDefinition: props.tasks.uiTask,
+            desiredCount: props.sizeProfile.services.uiDesiredCount,
+            circuitBreaker: {
+                rollback: true,
+            },
+            assignPublicIp: false,
+            securityGroups: [props.networking.appSecurityGroup],
+            cloudMapOptions: {
+                name: "ui",
+            },
+            vpcSubnets: {
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+        });
+        const codesearchService = new ecs.FargateService(this, "CodesearchService", {
+            cluster: props.networking.cluster,
+            taskDefinition: props.tasks.codesearchTask,
+            desiredCount: props.sizeProfile.services.codesearchDesiredCount,
+            circuitBreaker: {
+                rollback: true,
+            },
+            assignPublicIp: false,
+            securityGroups: [props.networking.appSecurityGroup],
+            cloudMapOptions: {
+                name: "codesearch",
+            },
+            vpcSubnets: {
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+        });
+        if (props.migrateDependency) {
+            backendService.node.addDependency(props.migrateDependency);
+            workerService.node.addDependency(props.migrateDependency);
+            uiService.node.addDependency(props.migrateDependency);
+            codesearchService.node.addDependency(props.migrateDependency);
+        }
+        this.resources = {
+            backendService,
+            workerService,
+            uiService,
+            codesearchService,
+        };
+    }
+}
+exports.ServicesConstruct = ServicesConstruct;
+//# sourceMappingURL=services-construct.js.map

package/lib/internal/services-construct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services-construct.js","sourceRoot":"","sources":["../../src/internal/services-construct.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yDAA2C;AAC3C,yDAA2C;AAC3C,2CAAuC;AAGvC,MAAa,iBAAkB,SAAQ,sBAAS;IAC9B,SAAS,CAAmB;IAE5C,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA6B;QAC5E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE;YACpE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;YACjC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACvC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB;YAC5D,cAAc,EAAE;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACnD,eAAe,EAAE;gBACf,IAAI,EAAE,SAAS;aAChB;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE;YAClE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;YACjC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACtC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB;YAC3D,cAAc,EAAE;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACnD,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;aACf;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE;YAC1D,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;YACjC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAClC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc;YACvD,cAAc,EAAE;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACnD,eAAe,EAAE;gBACf,IAAI,EAAE,IAAI;aACX;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB;aAC/C;SACF,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,EAAE;YAC1E,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;YACjC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;YAC1C,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,sBAAsB;YAC/D,cAAc,EAAE;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACnD,eAAe,EAAE;gBACf,IAAI,EAAE,YAAY;aACnB;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC3D,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtD,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG;YACf,cAAc;YACd,aAAa;YACb,SAAS;YACT,iBAAiB;SAClB,CAAC;IACJ,CAAC;CACF;AAxFD,8CAwFC"}

package/lib/internal/task-definitions-construct.d.ts

@@ -0,0 +1,8 @@
+import { Construct } from "constructs";
+import type { TaskDefinitionsConstructProps, TaskDefinitionsResources } from "./contracts";
+export declare class TaskDefinitionsConstruct extends Construct {
+    readonly resources: TaskDefinitionsResources;
+    constructor(scope: Construct, id: string, props: TaskDefinitionsConstructProps);
+    private grantTaskSecrets;
+}
+//# sourceMappingURL=task-definitions-construct.d.ts.map

package/lib/internal/task-definitions-construct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-definitions-construct.d.ts","sourceRoot":"","sources":["../../src/internal/task-definitions-construct.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACzB,MAAM,aAAa,CAAC;AAErB,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,SAAgB,SAAS,EAAE,wBAAwB,CAAC;gBAEjC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B;IAyMrF,OAAO,CAAC,gBAAgB;CAgBzB"}

package/lib/internal/task-definitions-construct.js

@@ -0,0 +1,204 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaskDefinitionsConstruct = void 0;
+const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
+const constructs_1 = require("constructs");
+class TaskDefinitionsConstruct extends constructs_1.Construct {
+    resources;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const appUrl = `https://${props.customDomain.domainName}`;
+        const backendTask = new ecs.FargateTaskDefinition(this, "BackendTask", {
+            memoryLimitMiB: props.sizeProfile.tasks.backend.memoryLimitMiB,
+            cpu: props.sizeProfile.tasks.backend.cpu,
+        });
+        const workerTask = new ecs.FargateTaskDefinition(this, "WorkerTask", {
+            memoryLimitMiB: props.sizeProfile.tasks.worker.memoryLimitMiB,
+            cpu: props.sizeProfile.tasks.worker.cpu,
+        });
+        const uiTask = new ecs.FargateTaskDefinition(this, "UiTask", {
+            memoryLimitMiB: props.sizeProfile.tasks.ui.memoryLimitMiB,
+            cpu: props.sizeProfile.tasks.ui.cpu,
+        });
+        const codesearchTask = new ecs.FargateTaskDefinition(this, "CodesearchTask", {
+            memoryLimitMiB: props.sizeProfile.tasks.codesearch.memoryLimitMiB,
+            cpu: props.sizeProfile.tasks.codesearch.cpu,
+        });
+        codesearchTask.addVolume({
+            name: "codesearch-data",
+            efsVolumeConfiguration: {
+                fileSystemId: props.dataPlane.codesearchFileSystem.fileSystemId,
+                transitEncryption: "ENABLED",
+            },
+        });
+        backendTask.addContainer("backend", {
+            image: ecs.ContainerImage.fromRegistry(`ghcr.io/ctxpipe-ai/backend:${props.defaultImageTag}`),
+            environment: {
+                NODE_ENV: "production",
+                PORT: "3000",
+                AUTH_BASE_URL: appUrl,
+                AUTH_ALLOWED_ORIGINS: appUrl,
+                OTEL_SERVICE_NAME: "backend",
+                GRAPH_DB_PROVIDER: "neptune",
+                GRAPH_DB_URI: props.dataPlane.graphDbUri,
+                [`GRAPH_DB_URI_${props.orgSlug}`]: props.dataPlane.graphDbUri,
+                UI_PROXY_URL: "http://ui.ctxpipe.local:3002",
+                CODESEARCH_URL: "http://codesearch.ctxpipe.local:3001",
+                MODEL_PROVIDER_URL: props.modelProviderBaseUrl,
+                MODEL_FAST_NAME: props.modelProviderDefaultModel,
+            },
+            secrets: {
+                AUTH_SECRET: ecs.Secret.fromSecretsManager(props.secrets.authSecret, "AUTH_SECRET"),
+                DATABASE_URL: ecs.Secret.fromSecretsManager(props.secrets.databaseUrlSecret, "DATABASE_URL"),
+                MODEL_PROVIDER_API_KEY: ecs.Secret.fromSecretsManager(props.secrets.modelProviderSecret, "API_KEY"),
+                SMTP_CONNECTION_URL: ecs.Secret.fromSecretsManager(props.secrets.smtpSecret, "SMTP_CONNECTION_URL"),
+                EMAIL_FROM_ADDRESS: ecs.Secret.fromSecretsManager(props.secrets.smtpSecret, "EMAIL_FROM_ADDRESS"),
+                ...props.secrets.connectorEnv,
+            },
+            portMappings: [{ containerPort: 3000 }],
+            logging: ecs.LogDrivers.awsLogs({ streamPrefix: "ctxpipe-backend" }),
+        });
+        workerTask.addContainer("worker", {
+            image: ecs.ContainerImage.fromRegistry(`ghcr.io/ctxpipe-ai/worker:${props.defaultImageTag}`),
+            environment: {
+                NODE_ENV: "production",
+                AUTH_BASE_URL: appUrl,
+                AUTH_ALLOWED_ORIGINS: appUrl,
+                GRAPH_DB_PROVIDER: "neptune",
+                GRAPH_DB_URI: props.dataPlane.graphDbUri,
+                [`GRAPH_DB_URI_${props.orgSlug}`]: props.dataPlane.graphDbUri,
+                UI_PROXY_URL: "http://ui.ctxpipe.local:3002",
+                CODESEARCH_URL: "http://codesearch.ctxpipe.local:3001",
+                MODEL_PROVIDER_URL: props.modelProviderBaseUrl,
+                MODEL_FAST_NAME: props.modelProviderDefaultModel,
+            },
+            secrets: {
+                AUTH_SECRET: ecs.Secret.fromSecretsManager(props.secrets.authSecret, "AUTH_SECRET"),
+                DATABASE_URL: ecs.Secret.fromSecretsManager(props.secrets.databaseUrlSecret, "DATABASE_URL"),
+                MODEL_PROVIDER_API_KEY: ecs.Secret.fromSecretsManager(props.secrets.modelProviderSecret, "API_KEY"),
+                SMTP_CONNECTION_URL: ecs.Secret.fromSecretsManager(props.secrets.smtpSecret, "SMTP_CONNECTION_URL"),
+                EMAIL_FROM_ADDRESS: ecs.Secret.fromSecretsManager(props.secrets.smtpSecret, "EMAIL_FROM_ADDRESS"),
+                ...props.secrets.connectorEnv,
+            },
+            logging: ecs.LogDrivers.awsLogs({ streamPrefix: "ctxpipe-worker" }),
+        });
+        uiTask.addContainer("ui", {
+            image: ecs.ContainerImage.fromRegistry(`ghcr.io/ctxpipe-ai/ui:${props.defaultImageTag}`),
+            environment: {
+                NODE_ENV: "production",
+                PORT: "3002",
+                VITE_PUBLIC_API_URL: appUrl,
+            },
+            portMappings: [{ containerPort: 3002 }],
+            logging: ecs.LogDrivers.awsLogs({ streamPrefix: "ctxpipe-ui" }),
+        });
+        const codesearchContainer = codesearchTask.addContainer("codesearch", {
+            image: ecs.ContainerImage.fromRegistry(`ghcr.io/ctxpipe-ai/codesearch:${props.defaultImageTag}`),
+            environment: {
+                NODE_ENV: "production",
+                PORT: "3001",
+                AUTH_TOKEN_AUDIENCE_CODESEARCH: "codesearch",
+                ZOEKT_WEBSERVER_URL: "http://127.0.0.1:6070",
+            },
+            secrets: {
+                AUTH_SECRET: ecs.Secret.fromSecretsManager(props.secrets.authSecret, "AUTH_SECRET"),
+                DATABASE_URL: ecs.Secret.fromSecretsManager(props.secrets.databaseUrlSecret, "DATABASE_URL"),
+            },
+            portMappings: [{ containerPort: 3001 }],
+            logging: ecs.LogDrivers.awsLogs({ streamPrefix: "ctxpipe-codesearch" }),
+        });
+        codesearchContainer.addMountPoints({
+            sourceVolume: "codesearch-data",
+            containerPath: "/data",
+            readOnly: false,
+        });
+        const migrateTask = new ecs.FargateTaskDefinition(this, "MigrateTask", {
+            memoryLimitMiB: props.sizeProfile.tasks.migrate.memoryLimitMiB,
+            cpu: props.sizeProfile.tasks.migrate.cpu,
+        });
+        migrateTask.addContainer("migrate", {
+            image: ecs.ContainerImage.fromRegistry(`ghcr.io/ctxpipe-ai/backend:${props.defaultImageTag}`),
+            command: ["bun", "run", "apps/backend/src/db/migrate.ts"],
+            secrets: {
+                AUTH_SECRET: ecs.Secret.fromSecretsManager(props.secrets.authSecret, "AUTH_SECRET"),
+                DATABASE_URL: ecs.Secret.fromSecretsManager(props.secrets.databaseUrlSecret, "DATABASE_URL"),
+            },
+            logging: ecs.LogDrivers.awsLogs({ streamPrefix: "ctxpipe-migrate" }),
+        });
+        this.grantTaskSecrets(backendTask, [
+            props.secrets.authSecret,
+            props.secrets.databaseUrlSecret,
+            props.secrets.modelProviderSecret,
+            props.secrets.smtpSecret,
+            props.secrets.connectorSecret,
+        ]);
+        this.grantTaskSecrets(workerTask, [
+            props.secrets.authSecret,
+            props.secrets.databaseUrlSecret,
+            props.secrets.modelProviderSecret,
+            props.secrets.smtpSecret,
+            props.secrets.connectorSecret,
+        ]);
+        this.grantTaskSecrets(codesearchTask, [
+            props.secrets.authSecret,
+            props.secrets.databaseUrlSecret,
+        ]);
+        this.grantTaskSecrets(migrateTask, [
+            props.secrets.authSecret,
+            props.secrets.databaseUrlSecret,
+        ]);
+        this.resources = {
+            backendTask,
+            workerTask,
+            uiTask,
+            codesearchTask,
+            migrateTask,
+        };
+    }
+    grantTaskSecrets(task, secrets) {
+        const principals = [task.taskRole, task.executionRole].filter((role) => role !== undefined);
+        for (const secret of secrets) {
+            if (!secret) {
+                continue;
+            }
+            for (const principal of principals) {
+                secret.grantRead(principal);
+            }
+        }
+    }
+}
+exports.TaskDefinitionsConstruct = TaskDefinitionsConstruct;
+//# sourceMappingURL=task-definitions-construct.js.map