@ctxpipe/aws-cdk 1.0.1

package/README.md

@@ -0,0 +1,108 @@
+# @ctxpipe/aws-cdk
+
+TypeScript AWS CDK library for deploying ctxpipe self-host infrastructure with one high-level construct: `CtxPipe`.
+
+## Quickstart
+
+```ts
+import * as cdk from "aws-cdk-lib";
+import { CtxPipe } from "@ctxpipe/aws-cdk";
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, "CtxPipeStack");
+
+new CtxPipe(stack, "CtxPipe", {
+  orgSlug: "acme",
+  customDomain: {
+    domainName: "app.example.com",
+    hostedZoneId: "Z0123456789ABCDEF",
+  },
+  modelProvider: {
+    baseUrl: "https://api.openai.com/v1",
+    apiKey: cdk.SecretValue.unsafePlainText("replace-model-api-key"),
+    defaultModel: "gpt-4.1-mini",
+  },
+});
+```
+
+Deploy with your CDK app as usual (`cdk synth`, then `cdk deploy`).
+
+## Required props
+
+- `modelProvider`: OpenAI-compatible model endpoint, key, and model ID.
+- `orgSlug`: organization slug used by the deployed instance. Neptune is single-graph per cluster, so this construct configures one org per stack.
+- `customDomain`: provide `domainName` and `hostedZoneId` to set the public URL to `https://<domainName>` and add:
+  - ACM certificate for the domain (DNS validated in the provided hosted zone),
+  - Route53 DNS validation records required by ACM,
+  - Route53 ALB alias records,
+  - HTTPS listener on ALB,
+  - HTTP -> HTTPS redirect.
+  The same hosted zone ID is also used for SES domain identity and DKIM records.
+
+## Optional props
+
+- `connectorSecrets`: deployment-wide connector secrets (GitHub/Atlassian). Omit for first boot if connectors are not configured yet.
+- `serviceImageTag`: optional — one GHCR tag for every service image (backend, worker, UI, codesearch, migrate). When omitted, defaults to the commit SHA embedded at package build time (aligned with GHCR `:sha` tags for that commit), or `latest` if Git was unavailable when the package was built.
+- `infraDefaults`: minor defaults such as AZ count, NAT gateways, DB name, backup retention days.
+
+## What `CtxPipe` provisions
+
+- VPC with public + private subnets and NAT egress.
+- ECS cluster and Fargate services for backend, worker, ui, and codesearch.
+  - Service deployments use ECS deployment circuit breaker with automatic rollback.
+- Deploy-time database migration as a one-off ECS Fargate task triggered by a CloudFormation custom resource before service deployment.
+- Aurora PostgreSQL (private), Neptune cluster + instance (private), EFS (codesearch `/data`).
+- Secrets Manager secrets for database URL, model provider, and optional connectors.
+- SES domain identity + DKIM records + SMTP credentials in Secrets Manager for backend email delivery.
+- Public ALB routing to backend only (UI/codesearch remain internal-only).
+- Outputs for app URL and key secret ARNs.
+- Backup defaults enabled for Aurora, Neptune, and EFS.
+
+Runtime defaults injected by the construct include:
+
+- `GRAPH_DB_PROVIDER=neptune`
+- `GRAPH_DB_URI` from Neptune endpoint
+- `GRAPH_DB_URI_<orgSlug>` from the same Neptune endpoint
+- `UI_PROXY_URL=http://ui.ctxpipe.local:3002`
+- `CODESEARCH_URL=http://codesearch.ctxpipe.local:3001`
+- `AUTH_SECRET` generated in Secrets Manager and injected into backend/worker/codesearch/migrate tasks
+- `DATABASE_URL` secret injected into backend/worker/codesearch tasks
+- `SMTP_CONNECTION_URL` and `EMAIL_FROM_ADDRESS` injected into backend from SES SMTP credentials
+  - `EMAIL_FROM_ADDRESS` is always `ctxpipe-noreply@<hosted-zone-apex>`
+
+## Deploy-time migrations
+
+`CtxPipe` runs Postgres migrations automatically during `cdk deploy` by executing an internal one-off ECS task before the long-running ECS services are deployed or updated.
+
+- This migration step is part of the construct internals; consumers do not need to run `ecs run-task` manually.
+- A failed migration fails the CloudFormation deployment, preventing partially-updated services.
+- The migration custom-resource flow is bounded by Lambda/CloudFormation timing limits (up to 15 minutes per deployment operation). If your migrations can exceed that window, run heavy schema/data backfills outside this deploy-time hook (for example with a separate migration workflow).
+
+## Image-tag coupling note
+
+Each `@ctxpipe/aws-cdk` npm release is built from a monorepo commit. GHCR publishes `ghcr.io/ctxpipe-ai/*` images tagged with that commit SHA on `main`. Published packages embed that SHA as the default image tag when `serviceImageTag` is omitted, so ECS task definitions stay aligned with the construct version you installed. Override `serviceImageTag` when you need a different registry tag (for example PR preview images).
+
+## Environment checklist
+
+### Customer-supplied (required)
+
+- `AUTH_BASE_URL` (derived from `customDomain.domainName`)
+- `MODEL_PROVIDER_URL`, `MODEL_PROVIDER_API_KEY`, and `MODEL_FAST_NAME` (provided through `modelProvider`)
+
+### CDK-generated defaults
+
+- `AUTH_SECRET` (Secrets Manager generated value)
+- `DATABASE_URL` (Secrets Manager + Aurora endpoint)
+- `GRAPH_DB_PROVIDER=neptune`
+- `GRAPH_DB_URI` (Neptune endpoint)
+- `GRAPH_DB_URI_<orgSlug>` (Neptune endpoint for the configured org slug)
+- `UI_PROXY_URL` and `CODESEARCH_URL` (internal service DNS)
+- `SMTP_CONNECTION_URL` and `EMAIL_FROM_ADDRESS` (SES SMTP + Secrets Manager)
+
+Because Neptune is single-graph per cluster, this construct does not support multi-tenant self-hosting in one stack. Deploy separate stacks for separate org slugs.
+
+### Optional second deploy (connector onboarding)
+
+- `GITHUB_APP_ID`, `GITHUB_PRIVATE_KEY`, `GITHUB_WEBHOOK_SECRET`
+- `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`
+- `ATLASSIAN_CLIENT_ID`, `ATLASSIAN_CLIENT_SECRET`

package/lib/ctxpipe.d.ts

@@ -0,0 +1,19 @@
+import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import { Construct } from "constructs";
+import type { CtxPipeProps } from "./types";
+export declare class CtxPipe extends Construct {
+    readonly appUrl: string;
+    readonly databaseUrlSecret: secretsmanager.ISecret;
+    readonly modelProviderSecret: secretsmanager.ISecret;
+    readonly smtpSecret: secretsmanager.ISecret;
+    readonly connectorSecret?: secretsmanager.ISecret;
+    constructor(scope: Construct, id: string, props: CtxPipeProps);
+    private validateModelProvider;
+    private validateOrgSlug;
+    private resolveDefaults;
+    private resolveCustomDomain;
+    private resolveHostedZoneName;
+    private normalizeHostedZoneId;
+    private toHostedZoneApiId;
+}
+//# sourceMappingURL=ctxpipe.d.ts.map

package/lib/ctxpipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctxpipe.d.ts","sourceRoot":"","sources":["../src/ctxpipe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAcvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK5C,qBAAa,OAAQ,SAAQ,SAAS;IACpC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,iBAAiB,EAAE,cAAc,CAAC,OAAO,CAAC;IAC1D,SAAgB,mBAAmB,EAAE,cAAc,CAAC,OAAO,CAAC;IAC5D,SAAgB,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;IACnD,SAAgB,eAAe,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;gBAEtC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA0EpE,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,mBAAmB;IAsB3B,OAAO,CAAC,qBAAqB;IAiE7B,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,iBAAiB;CAK1B"}

package/lib/ctxpipe.js

@@ -0,0 +1,232 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CtxPipe = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const acm = __importStar(require("aws-cdk-lib/aws-certificatemanager"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const route53 = __importStar(require("aws-cdk-lib/aws-route53"));
+const cr = __importStar(require("aws-cdk-lib/custom-resources"));
+const constructs_1 = require("constructs");
+const pinned_service_image_tag_1 = require("./pinned-service-image-tag");
+const data_plane_construct_1 = require("./internal/data-plane-construct");
+const ingress_construct_1 = require("./internal/ingress-construct");
+const migrate_on_deploy_construct_1 = require("./internal/migrate-on-deploy-construct");
+const networking_construct_1 = require("./internal/networking-construct");
+const outputs_construct_1 = require("./internal/outputs-construct");
+const secrets_construct_1 = require("./internal/secrets-construct");
+const services_construct_1 = require("./internal/services-construct");
+const task_definitions_construct_1 = require("./internal/task-definitions-construct");
+const DEFAULT_BACKUP_RETENTION_DAYS = 7;
+const ORG_SLUG_PATTERN = /^[a-z0-9-]+$/;
+class CtxPipe extends constructs_1.Construct {
+    appUrl;
+    databaseUrlSecret;
+    modelProviderSecret;
+    smtpSecret;
+    connectorSecret;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.validateOrgSlug(props);
+        this.validateModelProvider(props);
+        const resolvedCustomDomain = this.resolveCustomDomain(props);
+        const defaults = this.resolveDefaults(props, resolvedCustomDomain);
+        const networking = new networking_construct_1.NetworkingConstruct(this, "Networking", {
+            maxAzs: 2,
+            natGateways: 1,
+        });
+        const dataPlane = new data_plane_construct_1.DataPlaneConstruct(this, "DataPlane", {
+            networking: networking.resources,
+            defaults,
+        });
+        const secrets = new secrets_construct_1.SecretsConstruct(this, "Secrets", {
+            dataPlane: dataPlane.resources,
+            databaseName: defaults.databaseName,
+            modelProviderApiKey: props.modelProvider.apiKey,
+            hostedZone: resolvedCustomDomain.hostedZone,
+            connectorSecrets: props.connectorSecrets,
+            emailFromAddress: defaults.emailFromAddress,
+        });
+        const taskDefinitions = new task_definitions_construct_1.TaskDefinitionsConstruct(this, "TaskDefinitions", {
+            orgSlug: props.orgSlug,
+            networking: networking.resources,
+            dataPlane: dataPlane.resources,
+            secrets: secrets.resources,
+            customDomain: resolvedCustomDomain,
+            modelProviderBaseUrl: props.modelProvider.baseUrl,
+            modelProviderDefaultModel: props.modelProvider.defaultModel,
+            defaultImageTag: defaults.defaultImageTag,
+        });
+        const migrateOnDeploy = new migrate_on_deploy_construct_1.MigrateOnDeployConstruct(this, "MigrateOnDeploy", {
+            networking: networking.resources,
+            dataPlane: dataPlane.resources,
+            tasks: taskDefinitions.resources,
+            secrets: secrets.resources,
+        });
+        const services = new services_construct_1.ServicesConstruct(this, "Services", {
+            networking: networking.resources,
+            tasks: taskDefinitions.resources,
+            migrateDependency: migrateOnDeploy.resources.migrateResource,
+        });
+        const ingress = new ingress_construct_1.IngressConstruct(this, "Ingress", {
+            networking: networking.resources,
+            backendService: services.resources.backendService,
+            customDomain: resolvedCustomDomain,
+        });
+        this.databaseUrlSecret = secrets.resources.databaseUrlSecret;
+        this.modelProviderSecret = secrets.resources.modelProviderSecret;
+        this.smtpSecret = secrets.resources.smtpSecret;
+        this.connectorSecret = secrets.resources.connectorSecret;
+        this.appUrl = ingress.resources.appUrl;
+        new outputs_construct_1.OutputsConstruct(this, "Outputs", {
+            appUrl: this.appUrl,
+            albDnsName: networking.resources.alb.loadBalancerDnsName,
+            databaseUrlSecretArn: this.databaseUrlSecret.secretArn,
+            modelProviderSecretArn: this.modelProviderSecret.secretArn,
+            smtpSecretArn: this.smtpSecret.secretArn,
+            connectorSecretArn: this.connectorSecret?.secretArn,
+        });
+    }
+    validateModelProvider(props) {
+        if (props.modelProvider.baseUrl.length === 0) {
+            throw new Error("modelProvider.baseUrl is required");
+        }
+        if (props.modelProvider.defaultModel.length === 0) {
+            throw new Error("modelProvider.defaultModel is required");
+        }
+    }
+    validateOrgSlug(props) {
+        const orgSlug = props.orgSlug.trim();
+        if (orgSlug.length === 0) {
+            throw new Error("orgSlug is required");
+        }
+        if (!ORG_SLUG_PATTERN.test(orgSlug)) {
+            throw new Error("orgSlug must contain only lowercase letters, numbers, or hyphens");
+        }
+    }
+    resolveDefaults(props, customDomain) {
+        const normalizedZoneName = customDomain.hostedZoneName.replace(/\.$/, "");
+        return {
+            databaseName: "ctxpipe",
+            backupRetentionDays: DEFAULT_BACKUP_RETENTION_DAYS,
+            defaultImageTag: pinned_service_image_tag_1.PINNED_SERVICE_IMAGE_TAG,
+            emailFromAddress: `ctxpipe-noreply@${normalizedZoneName}`,
+        };
+    }
+    resolveCustomDomain(props) {
+        const hostedZoneName = this.resolveHostedZoneName(props.customDomain.hostedZoneId);
+        const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, "CustomDomainHostedZone", {
+            hostedZoneId: this.normalizeHostedZoneId(props.customDomain.hostedZoneId),
+            zoneName: hostedZoneName,
+        });
+        return {
+            ...props.customDomain,
+            hostedZone,
+            hostedZoneName,
+            certificate: new acm.Certificate(this, "CustomDomainCertificate", {
+                domainName: props.customDomain.domainName,
+                validation: acm.CertificateValidation.fromDns(hostedZone),
+            }),
+        };
+    }
+    resolveHostedZoneName(hostedZoneId) {
+        const lookup = new cr.AwsCustomResource(this, "HostedZoneLookup", {
+            onCreate: {
+                service: "Route53",
+                action: "getHostedZone",
+                parameters: {
+                    Id: this.toHostedZoneApiId(hostedZoneId),
+                },
+                physicalResourceId: cr.PhysicalResourceId.of(`route53-hosted-zone-${this.normalizeHostedZoneId(hostedZoneId)}`),
+            },
+            onUpdate: {
+                service: "Route53",
+                action: "getHostedZone",
+                parameters: {
+                    Id: this.toHostedZoneApiId(hostedZoneId),
+                },
+                physicalResourceId: cr.PhysicalResourceId.of(`route53-hosted-zone-${this.normalizeHostedZoneId(hostedZoneId)}`),
+            },
+            policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
+                resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
+            }),
+            installLatestAwsSdk: false,
+        });
+        const normalizeFunction = new lambda.Function(this, "HostedZoneNameNormalizeFunction", {
+            runtime: lambda.Runtime.NODEJS_20_X,
+            handler: "index.handler",
+            timeout: cdk.Duration.seconds(15),
+            code: lambda.Code.fromInline(`
+          exports.handler = async (event) => {
+            const physicalId = event.PhysicalResourceId || "hosted-zone-name-normalized";
+            if (event.RequestType === "Delete") {
+              return { PhysicalResourceId: physicalId };
+            }
+
+            const rawName = String(event.ResourceProperties.HostedZoneName || "");
+            const normalizedName = rawName.replace(/\\.$/, "");
+            return {
+              PhysicalResourceId: physicalId,
+              Data: {
+                HostedZoneName: normalizedName
+              }
+            };
+          };
+        `),
+        });
+        const normalizeProvider = new cr.Provider(this, "HostedZoneNameNormalizeProvider", {
+            onEventHandler: normalizeFunction,
+        });
+        const normalizeResource = new cdk.CustomResource(this, "HostedZoneNameNormalize", {
+            serviceToken: normalizeProvider.serviceToken,
+            properties: {
+                HostedZoneName: lookup.getResponseField("HostedZone.Name"),
+            },
+        });
+        return normalizeResource.getAttString("HostedZoneName");
+    }
+    normalizeHostedZoneId(hostedZoneId) {
+        return hostedZoneId.startsWith("/hostedzone/")
+            ? hostedZoneId.slice("/hostedzone/".length)
+            : hostedZoneId;
+    }
+    toHostedZoneApiId(hostedZoneId) {
+        return hostedZoneId.startsWith("/hostedzone/")
+            ? hostedZoneId
+            : `/hostedzone/${hostedZoneId}`;
+    }
+}
+exports.CtxPipe = CtxPipe;
+//# sourceMappingURL=ctxpipe.js.map

package/lib/ctxpipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctxpipe.js","sourceRoot":"","sources":["../src/ctxpipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AACnC,wEAA0D;AAC1D,+DAAiD;AACjD,iEAAmD;AAEnD,iEAAmD;AACnD,2CAAuC;AACvC,yEAAsE;AAKtE,0EAAqE;AACrE,oEAAgE;AAChE,wFAAkF;AAClF,0EAAsE;AACtE,oEAAgE;AAChE,oEAAgE;AAChE,sEAAkE;AAClE,sFAAiF;AAGjF,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,MAAa,OAAQ,SAAQ,sBAAS;IACpB,MAAM,CAAS;IACf,iBAAiB,CAAyB;IAC1C,mBAAmB,CAAyB;IAC5C,UAAU,CAAyB;IACnC,eAAe,CAA0B;IAEzD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAAmB;QAClE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,IAAI,0CAAmB,CAAC,IAAI,EAAE,YAAY,EAAE;YAC7D,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,yCAAkB,CAAC,IAAI,EAAE,WAAW,EAAE;YAC1D,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,oCAAgB,CAAC,IAAI,EAAE,SAAS,EAAE;YACpD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;YAC/C,UAAU,EAAE,oBAAoB,CAAC,UAAU;YAC3C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;SAC5C,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,IAAI,qDAAwB,CAAC,IAAI,EAAE,iBAAiB,EAAE;YAC5E,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,YAAY,EAAE,oBAAoB;YAClC,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO;YACjD,yBAAyB,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;YAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,IAAI,sDAAwB,CAAC,IAAI,EAAE,iBAAiB,EAAE;YAC5E,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,KAAK,EAAE,eAAe,CAAC,SAAS;YAChC,OAAO,EAAE,OAAO,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,sCAAiB,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,KAAK,EAAE,eAAe,CAAC,SAAS;YAChC,iBAAiB,EAAE,eAAe,CAAC,SAAS,CAAC,eAAe;SAC7D,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,oCAAgB,CAAC,IAAI,EAAE,SAAS,EAAE;YACpD,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,cAAc;YACjD,YAAY,EAAE,oBAAoB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC;QAC7D,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;QAC/C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QAEvC,IAAI,oCAAgB,CAAC,IAAI,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB;YACxD,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS;YACtD,sBAAsB,EAAE,IAAI,CAAC,mBAAmB,CAAC,SAAS;YAC1D,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACxC,kBAAkB,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS;SACpD,CAAC,CAAC;IACL,CAAC;IAEO,qBAAqB,CAAC,KAAmB;QAC/C,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,KAAmB;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,KAAmB,EACnB,YAA8C;QAE9C,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO;YACL,YAAY,EAAE,SAAS;YACvB,mBAAmB,EAAE,6BAA6B;YAClD,eAAe,EAAE,mDAAwB;YACzC,gBAAgB,EAAE,mBAAmB,kBAAkB,EAAE;SAC1D,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,KAAmB;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAC5D,IAAI,EACJ,wBAAwB,EACxB;YACE,YAAY,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC;YACzE,QAAQ,EAAE,cAAc;SACzB,CACF,CAAC;QAEF,OAAO;YACL,GAAG,KAAK,CAAC,YAAY;YACrB,UAAU;YACV,cAAc;YACd,WAAW,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,yBAAyB,EAAE;gBAChE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU;gBACzC,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,YAAoB;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE;YAChE,QAAQ,EAAE;gBACR,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE;oBACV,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;iBACzC;gBACD,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAC1C,uBAAuB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAClE;aACF;YACD,QAAQ,EAAE;gBACR,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE;oBACV,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;iBACzC;gBACD,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAC1C,uBAAuB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAClE;aACF;YACD,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,YAAY,CAAC;gBAC9C,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,YAAY;aACnD,CAAC;YACF,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,iCAAiC,EAAE;YACrF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;YACnC,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;SAgB1B,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,iCAAiC,EAAE;YACjF,cAAc,EAAE,iBAAiB;SAClC,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,EAAE;YAChF,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,UAAU,EAAE;gBACV,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;aAC3D;SACF,CAAC,CAAC;QAEH,OAAO,iBAAiB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC1D,CAAC;IAEO,qBAAqB,CAAC,YAAoB;QAChD,OAAO,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC;YAC5C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,YAAY,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,YAAoB;QAC5C,OAAO,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC;YAC5C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,eAAe,YAAY,EAAE,CAAC;IACpC,CAAC;CACF;AAnND,0BAmNC"}

package/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { CtxPipe } from "./ctxpipe";
+export type { CtxPipeConnectorSecretsProps, CtxPipeCustomDomainProps, CtxPipeModelProviderProps, CtxPipeProps, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EACV,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,YAAY,GACb,MAAM,SAAS,CAAC"}

package/lib/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CtxPipe = void 0;
+var ctxpipe_1 = require("./ctxpipe");
+Object.defineProperty(exports, "CtxPipe", { enumerable: true, get: function () { return ctxpipe_1.CtxPipe; } });
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qCAAoC;AAA3B,kGAAA,OAAO,OAAA"}

package/lib/internal/contracts.d.ts

@@ -0,0 +1,119 @@
+import type * as cdk from "aws-cdk-lib";
+import type * as acm from "aws-cdk-lib/aws-certificatemanager";
+import type * as ec2 from "aws-cdk-lib/aws-ec2";
+import type * as ecs from "aws-cdk-lib/aws-ecs";
+import type * as efs from "aws-cdk-lib/aws-efs";
+import type * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type * as neptune from "aws-cdk-lib/aws-neptune";
+import type * as rds from "aws-cdk-lib/aws-rds";
+import type * as route53 from "aws-cdk-lib/aws-route53";
+import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import type { IDependable } from "constructs";
+import type { CtxPipeConnectorSecretsProps, CtxPipeCustomDomainProps } from "../types";
+export interface ResolvedCtxPipeCustomDomainProps extends CtxPipeCustomDomainProps {
+    readonly hostedZone: route53.IHostedZone;
+    readonly hostedZoneName: string;
+    readonly certificate: acm.ICertificate;
+}
+export interface CtxPipeResolvedDefaults {
+    readonly databaseName: string;
+    readonly backupRetentionDays: number;
+    readonly defaultImageTag: string;
+    readonly emailFromAddress: string;
+}
+export interface NetworkingResources {
+    readonly vpc: ec2.Vpc;
+    readonly appSecurityGroup: ec2.SecurityGroup;
+    readonly dbSecurityGroup: ec2.SecurityGroup;
+    readonly neptuneSecurityGroup: ec2.SecurityGroup;
+    readonly efsSecurityGroup: ec2.SecurityGroup;
+    readonly cluster: ecs.Cluster;
+    readonly alb: elbv2.ApplicationLoadBalancer;
+    readonly httpListener: elbv2.ApplicationListener;
+}
+export interface DataPlaneResources {
+    readonly dbCluster: rds.DatabaseCluster;
+    readonly dbCredentialsSecret: secretsmanager.Secret;
+    readonly neptuneCluster: neptune.CfnDBCluster;
+    readonly neptuneInstance: neptune.CfnDBInstance;
+    readonly codesearchFileSystem: efs.FileSystem;
+    readonly graphDbUri: string;
+}
+export interface SecretsResources {
+    readonly authSecret: secretsmanager.Secret;
+    readonly databaseUrlSecret: secretsmanager.Secret;
+    readonly modelProviderSecret: secretsmanager.Secret;
+    readonly smtpSecret: secretsmanager.Secret;
+    readonly connectorSecret?: secretsmanager.Secret;
+    readonly connectorEnv: Record<string, ecs.Secret>;
+}
+export interface TaskDefinitionsResources {
+    readonly backendTask: ecs.FargateTaskDefinition;
+    readonly workerTask: ecs.FargateTaskDefinition;
+    readonly uiTask: ecs.FargateTaskDefinition;
+    readonly codesearchTask: ecs.FargateTaskDefinition;
+    readonly migrateTask: ecs.FargateTaskDefinition;
+}
+export interface ServiceResources {
+    readonly backendService: ecs.FargateService;
+    readonly workerService: ecs.FargateService;
+    readonly uiService: ecs.FargateService;
+    readonly codesearchService: ecs.FargateService;
+}
+export interface IngressResources {
+    readonly appUrl: string;
+}
+export interface MigrateOnDeployResources {
+    readonly migrateResource: cdk.CustomResource;
+}
+export interface NetworkingConstructProps {
+    readonly maxAzs: number;
+    readonly natGateways: number;
+}
+export interface DataPlaneConstructProps {
+    readonly networking: NetworkingResources;
+    readonly defaults: CtxPipeResolvedDefaults;
+}
+export interface SecretsConstructProps {
+    readonly dataPlane: DataPlaneResources;
+    readonly databaseName: string;
+    readonly modelProviderApiKey: cdk.SecretValue;
+    readonly hostedZone: route53.IHostedZone;
+    readonly connectorSecrets?: CtxPipeConnectorSecretsProps;
+    readonly emailFromAddress: string;
+}
+export interface TaskDefinitionsConstructProps {
+    readonly orgSlug: string;
+    readonly networking: NetworkingResources;
+    readonly dataPlane: DataPlaneResources;
+    readonly secrets: SecretsResources;
+    readonly customDomain: ResolvedCtxPipeCustomDomainProps;
+    readonly modelProviderBaseUrl: string;
+    readonly modelProviderDefaultModel: string;
+    readonly defaultImageTag: string;
+}
+export interface ServicesConstructProps {
+    readonly networking: NetworkingResources;
+    readonly tasks: TaskDefinitionsResources;
+    readonly migrateDependency?: IDependable;
+}
+export interface IngressConstructProps {
+    readonly networking: NetworkingResources;
+    readonly backendService: ecs.FargateService;
+    readonly customDomain: ResolvedCtxPipeCustomDomainProps;
+}
+export interface MigrateOnDeployConstructProps {
+    readonly networking: NetworkingResources;
+    readonly dataPlane: DataPlaneResources;
+    readonly tasks: TaskDefinitionsResources;
+    readonly secrets: SecretsResources;
+}
+export interface OutputsConstructProps {
+    readonly appUrl: string;
+    readonly albDnsName: string;
+    readonly databaseUrlSecretArn: string;
+    readonly modelProviderSecretArn: string;
+    readonly smtpSecretArn: string;
+    readonly connectorSecretArn?: string;
+}
+//# sourceMappingURL=contracts.d.ts.map

package/lib/internal/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/internal/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,KAAK,GAAG,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,KAAK,KAAK,MAAM,wCAAwC,CAAC;AACrE,OAAO,KAAK,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAEvF,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,aAAa,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,aAAa,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,aAAa,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,mBAAmB,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;IAChD,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,UAAU,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,qBAAqB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,qBAAqB,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,qBAAqB,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,cAAc,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,cAAc,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,WAAW,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gCAAgC,CAAC;IACxD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,gCAAgC,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC"}

package/lib/internal/contracts.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=contracts.js.map

package/lib/internal/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/internal/contracts.ts"],"names":[],"mappings":""}

package/lib/internal/data-plane-construct.d.ts

@@ -0,0 +1,7 @@
+import { Construct } from "constructs";
+import type { DataPlaneConstructProps, DataPlaneResources } from "./contracts";
+export declare class DataPlaneConstruct extends Construct {
+    readonly resources: DataPlaneResources;
+    constructor(scope: Construct, id: string, props: DataPlaneConstructProps);
+}
+//# sourceMappingURL=data-plane-construct.d.ts.map

package/lib/internal/data-plane-construct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-plane-construct.d.ts","sourceRoot":"","sources":["../../src/internal/data-plane-construct.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE/E,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAgB,SAAS,EAAE,kBAAkB,CAAC;gBAE3B,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CA6EhF"}

package/lib/internal/data-plane-construct.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataPlaneConstruct = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
+const efs = __importStar(require("aws-cdk-lib/aws-efs"));
+const neptune = __importStar(require("aws-cdk-lib/aws-neptune"));
+const rds = __importStar(require("aws-cdk-lib/aws-rds"));
+const secretsmanager = __importStar(require("aws-cdk-lib/aws-secretsmanager"));
+const constructs_1 = require("constructs");
+class DataPlaneConstruct extends constructs_1.Construct {
+    resources;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const dbCredentialsSecret = new secretsmanager.Secret(this, "DatabaseCredentialsSecret", {
+            generateSecretString: {
+                secretStringTemplate: JSON.stringify({ username: "ctxpipe" }),
+                generateStringKey: "password",
+                excludePunctuation: true,
+            },
+        });
+        const dbCluster = new rds.DatabaseCluster(this, "Database", {
+            engine: rds.DatabaseClusterEngine.auroraPostgres({
+                version: rds.AuroraPostgresEngineVersion.of("16.4", "16"),
+            }),
+            credentials: rds.Credentials.fromSecret(dbCredentialsSecret),
+            defaultDatabaseName: props.defaults.databaseName,
+            writer: rds.ClusterInstance.provisioned("writer", {
+                instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MEDIUM),
+            }),
+            backup: {
+                retention: cdk.Duration.days(props.defaults.backupRetentionDays),
+            },
+            vpc: props.networking.vpc,
+            vpcSubnets: {
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+            securityGroups: [props.networking.dbSecurityGroup],
+            storageEncrypted: true,
+            removalPolicy: cdk.RemovalPolicy.SNAPSHOT,
+        });
+        const neptuneSubnetGroup = new neptune.CfnDBSubnetGroup(this, "NeptuneSubnetGroup", {
+            dbSubnetGroupDescription: "Private subnets for ctxpipe neptune",
+            subnetIds: props.networking.vpc.selectSubnets({
+                subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            }).subnetIds,
+        });
+        const neptuneCluster = new neptune.CfnDBCluster(this, "Neptune", {
+            dbSubnetGroupName: neptuneSubnetGroup.ref,
+            vpcSecurityGroupIds: [props.networking.neptuneSecurityGroup.securityGroupId],
+            backupRetentionPeriod: props.defaults.backupRetentionDays,
+            storageEncrypted: true,
+            iamAuthEnabled: false,
+        });
+        neptuneCluster.applyRemovalPolicy(cdk.RemovalPolicy.SNAPSHOT);
+        const neptuneInstance = new neptune.CfnDBInstance(this, "NeptuneInstance", {
+            dbClusterIdentifier: neptuneCluster.ref,
+            dbInstanceClass: "db.t4g.medium",
+        });
+        neptuneInstance.applyRemovalPolicy(cdk.RemovalPolicy.SNAPSHOT);
+        const codesearchFileSystem = new efs.FileSystem(this, "CodesearchEfs", {
+            vpc: props.networking.vpc,
+            encrypted: true,
+            securityGroup: props.networking.efsSecurityGroup,
+            removalPolicy: cdk.RemovalPolicy.RETAIN,
+            lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,
+            performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
+        });
+        const graphDbUri = cdk.Fn.join("", ["bolt+s://", neptuneCluster.attrEndpoint, ":8182"]);
+        this.resources = {
+            dbCluster,
+            dbCredentialsSecret,
+            neptuneCluster,
+            neptuneInstance,
+            codesearchFileSystem,
+            graphDbUri,
+        };
+    }
+}
+exports.DataPlaneConstruct = DataPlaneConstruct;
+//# sourceMappingURL=data-plane-construct.js.map