@fjall/components-infrastructure 2.29.0 → 2.30.3

package/dist/lib/patterns/aws/cicdRole.d.ts

@@ -0,0 +1,67 @@
+import { Construct } from "constructs";
+import { type Role } from "aws-cdk-lib/aws-iam";
+import { type CICDProvider } from "../../resources/aws/cicd/cicdRole";
+export interface CICDRoleProps {
+    /**
+     * The CI/CD provider (github-actions, buildkite, gitlab-ci)
+     */
+    provider: CICDProvider;
+    /**
+     * For GitHub Actions: repository in format "org/repo"
+     * For Buildkite: organization slug
+     * For GitLab CI: project path in format "group/project"
+     */
+    repositoryOrOrg: string;
+    /**
+     * Optional custom role name
+     * Defaults to "FjallDeploy-{provider}-{appName}"
+     */
+    roleName?: string;
+    /**
+     * Optional ARN of existing OIDC provider (skips creation)
+     * Useful when OIDC provider already exists in the account
+     */
+    existingProviderArn?: string;
+}
+/**
+ * High-level pattern for adding CI/CD OIDC authentication to an application.
+ *
+ * This creates an OIDC provider (if needed) and a deploy role that can be assumed
+ * by your CI/CD system without long-lived credentials.
+ *
+ * @example
+ * ```typescript
+ * import { App, CICDRole } from "@fjall/components-infrastructure";
+ *
+ * const app = App.getApp("MyApp");
+ *
+ * // Add GitHub Actions OIDC authentication
+ * const cicdRole = new CICDRole(app, "GitHubDeployRole", {
+ *   provider: "github-actions",
+ *   repositoryOrOrg: "myorg/myrepo"
+ * });
+ *
+ * // Continue with normal application setup
+ * app.addCompute(/* ... *\/);
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Use existing OIDC provider (created via fjall cicd setup)
+ * const cicdRole = new CICDRole(app, "GitHubDeployRole", {
+ *   provider: "github-actions",
+ *   repositoryOrOrg: "myorg/myrepo",
+ *   existingProviderArn: "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
+ * });
+ * ```
+ */
+export declare class CICDRole extends Construct {
+    readonly role: Role;
+    readonly provider: CICDProvider;
+    constructor(scope: Construct, id: string, props: CICDRoleProps);
+    /**
+     * Get the role ARN for use in CI/CD configuration
+     */
+    getRoleArn(): string;
+}
+export default CICDRole;

package/dist/lib/patterns/aws/cicdRole.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CICDRole = void 0;
+const constructs_1 = require("constructs");
+const app_1 = require("../../app");
+const cicdRole_1 = require("../../resources/aws/cicd/cicdRole");
+/**
+ * High-level pattern for adding CI/CD OIDC authentication to an application.
+ *
+ * This creates an OIDC provider (if needed) and a deploy role that can be assumed
+ * by your CI/CD system without long-lived credentials.
+ *
+ * @example
+ * ```typescript
+ * import { App, CICDRole } from "@fjall/components-infrastructure";
+ *
+ * const app = App.getApp("MyApp");
+ *
+ * // Add GitHub Actions OIDC authentication
+ * const cicdRole = new CICDRole(app, "GitHubDeployRole", {
+ *   provider: "github-actions",
+ *   repositoryOrOrg: "myorg/myrepo"
+ * });
+ *
+ * // Continue with normal application setup
+ * app.addCompute(/* ... *\/);
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Use existing OIDC provider (created via fjall cicd setup)
+ * const cicdRole = new CICDRole(app, "GitHubDeployRole", {
+ *   provider: "github-actions",
+ *   repositoryOrOrg: "myorg/myrepo",
+ *   existingProviderArn: "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
+ * });
+ * ```
+ */
+class CICDRole extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        // Get the App instance
+        const app = scope instanceof app_1.default ? scope : app_1.default.getInstance();
+        const networkStack = app.getDefaultNetworkStack();
+        this.provider = props.provider;
+        // Build the config for the factory
+        const config = {
+            provider: props.provider,
+            appName: app["name"],
+            repositoryOrOrg: props.repositoryOrOrg,
+            roleName: props.roleName,
+            existingProviderArn: props.existingProviderArn
+        };
+        // Create the CI/CD role using the factory
+        this.role = cicdRole_1.default.build(`${app["name"]}CICDRole`, config)(app, networkStack.getStack());
+        // Register the role with the network stack
+        networkStack.addConstruct(this.role);
+    }
+    /**
+     * Get the role ARN for use in CI/CD configuration
+     */
+    getRoleArn() {
+        return this.role.roleArn;
+    }
+}
+exports.CICDRole = CICDRole;
+exports.default = CICDRole;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2ljZFJvbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9saWIvcGF0dGVybnMvYXdzL2NpY2RSb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUF1QztBQUV2QyxtQ0FBNEI7QUFDNUIsZ0VBRzJDO0FBNEIzQzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQStCRztBQUNILE1BQWEsUUFBUyxTQUFRLHNCQUFTO0lBSXJDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBb0I7UUFDNUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQix1QkFBdUI7UUFDdkIsTUFBTSxHQUFHLEdBQUcsS0FBSyxZQUFZLGFBQUcsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxhQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDN0QsTUFBTSxZQUFZLEdBQUcsR0FBRyxDQUFDLHNCQUFzQixFQUFFLENBQUM7UUFFbEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDO1FBRS9CLG1DQUFtQztRQUNuQyxNQUFNLE1BQU0sR0FBbUI7WUFDN0IsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLE9BQU8sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQ3BCLGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZTtZQUN0QyxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLG1CQUFtQjtTQUMvQyxDQUFDO1FBRUYsMENBQTBDO1FBQzFDLElBQUksQ0FBQyxJQUFJLEdBQUcsa0JBQWUsQ0FBQyxLQUFLLENBQUMsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FDakUsR0FBRyxFQUNILFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FDeEIsQ0FBQztRQUVGLDJDQUEyQztRQUMzQyxZQUFZLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxVQUFVO1FBQ2YsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUMzQixDQUFDO0NBQ0Y7QUF0Q0QsNEJBc0NDO0FBRUQsa0JBQWUsUUFBUSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IHR5cGUgUm9sZSB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgQXBwIGZyb20gXCIuLi8uLi9hcHBcIjtcbmltcG9ydCBDSUNEUm9sZUZhY3RvcnksIHtcbiAgdHlwZSBDSUNEUHJvdmlkZXIsXG4gIHR5cGUgQ0lDRFJvbGVDb25maWdcbn0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3MvY2ljZC9jaWNkUm9sZVwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIENJQ0RSb2xlUHJvcHMge1xuICAvKipcbiAgICogVGhlIENJL0NEIHByb3ZpZGVyIChnaXRodWItYWN0aW9ucywgYnVpbGRraXRlLCBnaXRsYWItY2kpXG4gICAqL1xuICBwcm92aWRlcjogQ0lDRFByb3ZpZGVyO1xuXG4gIC8qKlxuICAgKiBGb3IgR2l0SHViIEFjdGlvbnM6IHJlcG9zaXRvcnkgaW4gZm9ybWF0IFwib3JnL3JlcG9cIlxuICAgKiBGb3IgQnVpbGRraXRlOiBvcmdhbml6YXRpb24gc2x1Z1xuICAgKiBGb3IgR2l0TGFiIENJOiBwcm9qZWN0IHBhdGggaW4gZm9ybWF0IFwiZ3JvdXAvcHJvamVjdFwiXG4gICAqL1xuICByZXBvc2l0b3J5T3JPcmc6IHN0cmluZztcblxuICAvKipcbiAgICogT3B0aW9uYWwgY3VzdG9tIHJvbGUgbmFtZVxuICAgKiBEZWZhdWx0cyB0byBcIkZqYWxsRGVwbG95LXtwcm92aWRlcn0te2FwcE5hbWV9XCJcbiAgICovXG4gIHJvbGVOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBBUk4gb2YgZXhpc3RpbmcgT0lEQyBwcm92aWRlciAoc2tpcHMgY3JlYXRpb24pXG4gICAqIFVzZWZ1bCB3aGVuIE9JREMgcHJvdmlkZXIgYWxyZWFkeSBleGlzdHMgaW4gdGhlIGFjY291bnRcbiAgICovXG4gIGV4aXN0aW5nUHJvdmlkZXJBcm4/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogSGlnaC1sZXZlbCBwYXR0ZXJuIGZvciBhZGRpbmcgQ0kvQ0QgT0lEQyBhdXRoZW50aWNhdGlvbiB0byBhbiBhcHBsaWNhdGlvbi5cbiAqXG4gKiBUaGlzIGNyZWF0ZXMgYW4gT0lEQyBwcm92aWRlciAoaWYgbmVlZGVkKSBhbmQgYSBkZXBsb3kgcm9sZSB0aGF0IGNhbiBiZSBhc3N1bWVkXG4gKiBieSB5b3VyIENJL0NEIHN5c3RlbSB3aXRob3V0IGxvbmctbGl2ZWQgY3JlZGVudGlhbHMuXG4gKlxuICogQGV4YW1wbGVcbiAqIGBgYHR5cGVzY3JpcHRcbiAqIGltcG9ydCB7IEFwcCwgQ0lDRFJvbGUgfSBmcm9tIFwiQGZqYWxsL2NvbXBvbmVudHMtaW5mcmFzdHJ1Y3R1cmVcIjtcbiAqXG4gKiBjb25zdCBhcHAgPSBBcHAuZ2V0QXBwKFwiTXlBcHBcIik7XG4gKlxuICogLy8gQWRkIEdpdEh1YiBBY3Rpb25zIE9JREMgYXV0aGVudGljYXRpb25cbiAqIGNvbnN0IGNpY2RSb2xlID0gbmV3IENJQ0RSb2xlKGFwcCwgXCJHaXRIdWJEZXBsb3lSb2xlXCIsIHtcbiAqICAgcHJvdmlkZXI6IFwiZ2l0aHViLWFjdGlvbnNcIixcbiAqICAgcmVwb3NpdG9yeU9yT3JnOiBcIm15b3JnL215cmVwb1wiXG4gKiB9KTtcbiAqXG4gKiAvLyBDb250aW51ZSB3aXRoIG5vcm1hbCBhcHBsaWNhdGlvbiBzZXR1cFxuICogYXBwLmFkZENvbXB1dGUoLyogLi4uICpcXC8pO1xuICogYGBgXG4gKlxuICogQGV4YW1wbGVcbiAqIGBgYHR5cGVzY3JpcHRcbiAqIC8vIFVzZSBleGlzdGluZyBPSURDIHByb3ZpZGVyIChjcmVhdGVkIHZpYSBmamFsbCBjaWNkIHNldHVwKVxuICogY29uc3QgY2ljZFJvbGUgPSBuZXcgQ0lDRFJvbGUoYXBwLCBcIkdpdEh1YkRlcGxveVJvbGVcIiwge1xuICogICBwcm92aWRlcjogXCJnaXRodWItYWN0aW9uc1wiLFxuICogICByZXBvc2l0b3J5T3JPcmc6IFwibXlvcmcvbXlyZXBvXCIsXG4gKiAgIGV4aXN0aW5nUHJvdmlkZXJBcm46IFwiYXJuOmF3czppYW06OjEyMzQ1Njc4OTAxMjpvaWRjLXByb3ZpZGVyL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tXCJcbiAqIH0pO1xuICogYGBgXG4gKi9cbmV4cG9ydCBjbGFzcyBDSUNEUm9sZSBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyByZWFkb25seSByb2xlOiBSb2xlO1xuICBwdWJsaWMgcmVhZG9ubHkgcHJvdmlkZXI6IENJQ0RQcm92aWRlcjtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogQ0lDRFJvbGVQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICAvLyBHZXQgdGhlIEFwcCBpbnN0YW5jZVxuICAgIGNvbnN0IGFwcCA9IHNjb3BlIGluc3RhbmNlb2YgQXBwID8gc2NvcGUgOiBBcHAuZ2V0SW5zdGFuY2UoKTtcbiAgICBjb25zdCBuZXR3b3JrU3RhY2sgPSBhcHAuZ2V0RGVmYXVsdE5ldHdvcmtTdGFjaygpO1xuXG4gICAgdGhpcy5wcm92aWRlciA9IHByb3BzLnByb3ZpZGVyO1xuXG4gICAgLy8gQnVpbGQgdGhlIGNvbmZpZyBmb3IgdGhlIGZhY3RvcnlcbiAgICBjb25zdCBjb25maWc6IENJQ0RSb2xlQ29uZmlnID0ge1xuICAgICAgcHJvdmlkZXI6IHByb3BzLnByb3ZpZGVyLFxuICAgICAgYXBwTmFtZTogYXBwW1wibmFtZVwiXSxcbiAgICAgIHJlcG9zaXRvcnlPck9yZzogcHJvcHMucmVwb3NpdG9yeU9yT3JnLFxuICAgICAgcm9sZU5hbWU6IHByb3BzLnJvbGVOYW1lLFxuICAgICAgZXhpc3RpbmdQcm92aWRlckFybjogcHJvcHMuZXhpc3RpbmdQcm92aWRlckFyblxuICAgIH07XG5cbiAgICAvLyBDcmVhdGUgdGhlIENJL0NEIHJvbGUgdXNpbmcgdGhlIGZhY3RvcnlcbiAgICB0aGlzLnJvbGUgPSBDSUNEUm9sZUZhY3RvcnkuYnVpbGQoYCR7YXBwW1wibmFtZVwiXX1DSUNEUm9sZWAsIGNvbmZpZykoXG4gICAgICBhcHAsXG4gICAgICBuZXR3b3JrU3RhY2suZ2V0U3RhY2soKVxuICAgICk7XG5cbiAgICAvLyBSZWdpc3RlciB0aGUgcm9sZSB3aXRoIHRoZSBuZXR3b3JrIHN0YWNrXG4gICAgbmV0d29ya1N0YWNrLmFkZENvbnN0cnVjdCh0aGlzLnJvbGUpO1xuICB9XG5cbiAgLyoqXG4gICAqIEdldCB0aGUgcm9sZSBBUk4gZm9yIHVzZSBpbiBDSS9DRCBjb25maWd1cmF0aW9uXG4gICAqL1xuICBwdWJsaWMgZ2V0Um9sZUFybigpOiBzdHJpbmcge1xuICAgIHJldHVybiB0aGlzLnJvbGUucm9sZUFybjtcbiAgfVxufVxuXG5leHBvcnQgZGVmYXVsdCBDSUNEUm9sZTtcbiJdfQ==

package/dist/lib/patterns/aws/compute.js

@@ -221,6 +221,10 @@ export class ComputeFactory {
                         ...computeProps,
                         appName: app.getName()
                     };
+                    // `ecrRepository` is already defaulted to the app's shared default
+                    // container registry above (line ~323) when omitted — the same
+                    // repo ECS services push into — so a container Lambda always has
+                    // one by this point, whether or not `docker` is set.
                     // Always register Lambda with manifest collector for CLI discovery
                     // This ensures all Lambdas are discoverable for secrets management,
                     // even those that don't currently have secrets configured
@@ -242,6 +246,11 @@ export class ComputeFactory {
                     if (lambdaImportedSecretNames.size > 0) {
                         manifestLambda.importedSecretNames = Array.from(lambdaImportedSecretNames);
                     }
+                    if (lambdaComputeProps.deployment === "container" &&
+                        lambdaComputeProps.docker !== undefined) {
+                        manifestLambda.docker = lambdaComputeProps.docker;
+                        manifestLambda.imageKey = lambdaComputeProps.image ?? id;
+                    }
                     collector.addLambda(manifestLambda);
                     return new LambdaCompute(scope, id, lambdaComputeProps);
                 }

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -8,6 +8,7 @@ import { type ILambdaCompute } from "./interfaces/compute.js";
 import { type ConnectionSpec } from "./interfaces/connector.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
 import { type SecretImport } from "../../resources/aws/secrets/index.js";
+import { type DockerBuild } from "@fjall/util/manifest/schemas";
 export { Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "aws-cdk-lib/aws-lambda";
 /**
  * Lambda function URL configuration.
@@ -114,17 +115,47 @@ interface BaseLambdaProps {
  * automatically set to FROM_IMAGE.
  *
  * @example
+ * // Bring your own image (built/pushed out of band)
  * app.addCompute(ComputeFactory.build("ImageLambda", {
  *   type: "lambda",
  *   deployment: "container",
  *   ecrRepository: app.getDefaultContainerRegistry()
  * }));
+ *
+ * @example
+ * // fjall builds and pushes the image on every `fjall deploy`
+ * app.addCompute(ComputeFactory.build("ImageLambda", {
+ *   type: "lambda",
+ *   deployment: "container",
+ *   docker: { path: "lambda.Dockerfile" }
+ * }));
  */
 export interface ContainerLambdaProps extends BaseLambdaProps {
     /** Container-based deployment using ECR image */
     deployment: "container";
-    /** ECR repository containing the Lambda container image */
-    ecrRepository: Repository | RepositoryImage;
+    /**
+     * ECR repository containing the Lambda container image. Optional when
+     * `docker` is set — defaults to the app's shared default container
+     * registry (the same repo ECS services push into).
+     */
+    ecrRepository?: Repository | RepositoryImage;
+    /**
+     * When set, `fjall deploy` builds and pushes this Dockerfile into the app's
+     * shared default container registry, then wires the function to the
+     * resulting content-hash-tagged image — the same mechanism ECS services
+     * already use. Omit to keep managing the image out of band (the previous
+     * behaviour: the function tracks a moving `:latest` tag in `ecrRepository`).
+     */
+    docker?: DockerBuild;
+    /**
+     * Shared build/tag key for Lambda functions that intentionally run the
+     * same container image (e.g. several handlers packaged from one
+     * Dockerfile). Functions sharing one `image` value build once and share
+     * one content-hash tag. Defaults to this Lambda's own construct id, so
+     * omitting it is safe when no sharing is intended. Only meaningful when
+     * `docker` is set.
+     */
+    image?: string;
 }
 /**
  * Code-based Lambda using inline code or S3.
@@ -177,8 +208,12 @@ export interface ResolvedLambdaDeployment {
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
+ *
+ * `scope`/`id` are only used on the container-with-`docker` path, to create
+ * (or reuse) the per-key `CfnParameter` that `fjall deploy` overrides with
+ * the content-hash tag after building and pushing the image.
  */
-export declare function resolveLambdaDeployment(props: LambdaComputeProps): ResolvedLambdaDeployment;
+export declare function resolveLambdaDeployment(scope: Construct, id: string, props: LambdaComputeProps): ResolvedLambdaDeployment;
 /**
  * Lambda compute wrapper implementing ILambdaCompute.
  * Provides type-safe access to Lambda-specific resources.

package/dist/lib/patterns/aws/computeLambda.js

@@ -4,18 +4,45 @@ import { Repository } from "aws-cdk-lib/aws-ecr";
 import { Construct } from "constructs";
 import { processConnections } from "../../utils/connections.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
+import { getOrCreateImageTagParameter } from "../../resources/aws/compute/imageTagParameter.js";
 import { COMPUTE_DEFAULTS } from "./compute.js";
+import { evaluateBakeGuard } from "@fjall/util/docker";
+import { toKebab } from "@fjall/util";
 // Re-export Lambda types from CDK for user convenience
 export { Architecture, HttpMethod, InvokeMode } from "aws-cdk-lib/aws-lambda";
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
+ *
+ * `scope`/`id` are only used on the container-with-`docker` path, to create
+ * (or reuse) the per-key `CfnParameter` that `fjall deploy` overrides with
+ * the content-hash tag after building and pushing the image.
  */
-export function resolveLambdaDeployment(props) {
+export function resolveLambdaDeployment(scope, id, props) {
     if (props.deployment === "container") {
+        if (!props.ecrRepository) {
+            throw new Error(`Lambda '${id}': ecrRepository is required unless \`docker\` is set ` +
+                "(ComputeFactory fills it in automatically from the app's default container registry when docker is present).");
+        }
         if (!(props.ecrRepository instanceof Repository)) {
             throw new Error("ecrRepository must be a Repository instance for Lambda compute type");
         }
+        if (props.docker !== undefined) {
+            const appPrefix = props.appName !== undefined ? toKebab(props.appName) : "";
+            const findings = evaluateBakeGuard(props.docker.buildArgs, appPrefix).findings;
+            if (findings.length > 0) {
+                throw new Error(`Lambda '${id}': ${findings.map((f) => f.message).join(" ")}`);
+            }
+            const tagKey = props.image ?? id;
+            const param = getOrCreateImageTagParameter(scope, tagKey);
+            return {
+                code: Code.fromEcrImage(props.ecrRepository, {
+                    tagOrDigest: param.valueAsString
+                }),
+                handler: Handler.FROM_IMAGE,
+                runtime: Runtime.FROM_IMAGE
+            };
+        }
         return {
             code: Code.fromEcrImage(props.ecrRepository, {
                 tagOrDigest: COMPUTE_DEFAULTS.ECS.IMAGE_TAG
@@ -40,7 +67,7 @@ export class LambdaCompute extends Construct {
     lambdaFunction;
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, handler, runtime } = resolveLambdaDeployment(props);
+        const { code, handler, runtime } = resolveLambdaDeployment(scope, id, props);
         // Convert presence-based functionUrl config to legacy boolean format
         const functionUrlConfig = props.functionUrl;
         const enableFunctionUrl = functionUrlConfig !== undefined && functionUrlConfig !== false;

package/dist/lib/patterns/aws/hostedZone.d.ts

@@ -0,0 +1,28 @@
+import { Construct } from "constructs";
+import { type ARecordProps, type CnameRecordProps, HostedZone as AWSHostedZone, type MxRecordProps, type NsRecordProps, type TxtRecordProps } from "aws-cdk-lib/aws-route53";
+import { type AwsStack } from "../../resources";
+export interface HostedZoneProps {
+    zoneName: string;
+    hostedZoneId?: string;
+}
+export declare class HostedZoneFactory {
+    static import(stack: AwsStack, hostedZoneId: string, zoneName: string): HostedZone;
+}
+export declare class HostedZone extends Construct {
+    private hostedZone;
+    private hostedZoneId;
+    private importedHostedZone;
+    private zoneName;
+    private scope;
+    constructor(scope: Construct, id: string, props: HostedZoneProps);
+    getInternalHostedZone(): AWSHostedZone;
+    safeZoneName(): string;
+    addHostedZone(zoneName: string): void;
+    importHostedZone(zoneName: string): void;
+    delegateHostedZone(): void;
+    addARecord(props: Omit<ARecordProps, "zone">): void;
+    addCname(props: Omit<CnameRecordProps, "zone">): void;
+    addMx(props: Omit<MxRecordProps, "zone">): void;
+    addNS(props: Omit<NsRecordProps, "zone">): void;
+    addTxt(props: Omit<TxtRecordProps, "zone">): void;
+}

package/dist/lib/patterns/aws/hostedZone.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedZone = exports.HostedZoneFactory = void 0;
+const constructs_1 = require("constructs");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam_1 = require("../../resources/aws/iam");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+function getSafeZoneName(zoneName) {
+    return zoneName.split(".").join("");
+}
+class HostedZoneFactory {
+    static import(stack, hostedZoneId, zoneName) {
+        const safeZoneName = getSafeZoneName(zoneName);
+        return new HostedZone(stack.getStack(), `${safeZoneName}HostedZone`, {
+            hostedZoneId: hostedZoneId,
+            zoneName: zoneName
+        });
+    }
+}
+exports.HostedZoneFactory = HostedZoneFactory;
+class HostedZone extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.scope = scope;
+        this.zoneName = props.zoneName;
+        // If a hostedZoneId is provided import it, unless create a new hosted zone
+        if (!props.hostedZoneId) {
+            this.addHostedZone(props.zoneName);
+            this.hostedZoneId = this.hostedZone.hostedZoneId;
+            this.delegateHostedZone();
+        }
+        else {
+            this.hostedZoneId = props.hostedZoneId;
+            this.importHostedZone(props.zoneName);
+        }
+    }
+    getInternalHostedZone() {
+        return this.hostedZone || this.importedHostedZone;
+    }
+    safeZoneName() {
+        return getSafeZoneName(this.zoneName);
+    }
+    addHostedZone(zoneName) {
+        this.hostedZone = new aws_route53_1.HostedZone(this, `${this.safeZoneName}HostedZone`, {
+            zoneName: zoneName,
+            comment: `Hosted Zone for ${zoneName}`
+        });
+    }
+    importHostedZone(zoneName) {
+        this.importedHostedZone = aws_route53_1.HostedZone.fromHostedZoneAttributes(
+        // HostedZone.fromHostedZoneAttributes explicitly must be passed a stack as parent scope
+        this.scope, 
+        // Use safeZoneName in the id so we can theoretically
+        //  import multiple hosted zones in a single app
+        `${this.safeZoneName()}ImportedHostedZone`, {
+            hostedZoneId: this.hostedZoneId,
+            zoneName: zoneName
+        });
+        aws_cdk_lib_1.Tags.of(this.importedHostedZone).add("fjall:costAllocation:environment", "management");
+        aws_cdk_lib_1.Tags.of(this.importedHostedZone).add("fjall:costAllocation:service", "hostedZone");
+        aws_cdk_lib_1.Tags.of(this.importedHostedZone).add("fjall:costAllocation:domain", zoneName);
+        // Make export name unique by including the stack name to avoid conflicts
+        // when multiple stacks import the same hosted zone
+        const stack = aws_cdk_lib_1.Stack.of(this);
+        const stackName = stack.stackName;
+        const exportName = `${stackName}${this.safeZoneName()}HostedZoneId`;
+        new aws_cdk_lib_1.CfnOutput(this, `${this.safeZoneName()}HostedZoneId`, {
+            key: `${this.safeZoneName()}HostedZoneId`,
+            value: this.hostedZoneId,
+            exportName: exportName
+        });
+    }
+    delegateHostedZone() {
+        const domainName = this.hostedZone.zoneName.split(".", 1);
+        const role = new iam_1.Role(this, `${domainName}DelegateHostedZoneRole`, {
+            assumedBy: new aws_iam_1.OrganizationPrincipal(aws_cdk_lib_1.Fn.importValue("OrganisationId")),
+            roleName: `${domainName}DelegateHostedZoneRole`,
+            inlinePolicies: {
+                ["listHostedZones"]: new aws_iam_1.PolicyDocument({
+                    statements: [
+                        new aws_iam_1.PolicyStatement({
+                            actions: ["route53:ListHostedZonesByName"],
+                            resources: ["*"]
+                        })
+                    ]
+                }),
+                ["changeResourceRecordSets"]: new aws_iam_1.PolicyDocument({
+                    statements: [
+                        new aws_iam_1.PolicyStatement({
+                            actions: ["route53:ChangeResourceRecordSets"],
+                            resources: [
+                                `arn:aws:route53:::hostedzone/${this.hostedZone.hostedZoneId}`
+                            ]
+                        })
+                    ]
+                })
+            }
+        });
+        this.hostedZone.grantDelegation(role);
+        new aws_cdk_lib_1.CfnOutput(this, "DelegateHostedZoneRoleArn", {
+            key: `${domainName}DelegateHostedZoneRoleArn`,
+            value: role.roleArn,
+            exportName: `${domainName}DelegateHostedZoneRoleArn`
+        });
+    }
+    addARecord(props) {
+        new aws_route53_1.ARecord(this, "ARecord", {
+            zone: this.importedHostedZone,
+            recordName: props.recordName,
+            comment: props.comment || `A Record for ${this.importedHostedZone.zoneName}`,
+            target: props.target,
+            ttl: props.ttl
+        });
+    }
+    addCname(props) {
+        new aws_route53_1.CnameRecord(this, ``, {
+            domainName: props.domainName,
+            zone: this.importedHostedZone,
+            comment: props.comment || `CNAME Record for ${this.importedHostedZone.zoneName}`,
+            ttl: props.ttl
+        });
+    }
+    addMx(props) {
+        new aws_route53_1.MxRecord(this, ``, {
+            zone: this.importedHostedZone,
+            comment: props.comment || `MX Record for ${this.importedHostedZone.zoneName}`,
+            values: props.values,
+            ttl: props.ttl
+        });
+    }
+    addNS(props) {
+        new aws_route53_1.NsRecord(this, ``, {
+            zone: this.importedHostedZone,
+            comment: props.comment || `NS Record for ${this.importedHostedZone.zoneName}`,
+            values: props.values,
+            ttl: props.ttl
+        });
+    }
+    addTxt(props) {
+        new aws_route53_1.TxtRecord(this, ``, {
+            zone: this.importedHostedZone,
+            comment: props.comment || `TXT Record for ${this.importedHostedZone.zoneName}`,
+            values: props.values,
+            ttl: props.ttl
+        });
+    }
+}
+exports.HostedZone = HostedZone;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG9zdGVkWm9uZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3MvaG9zdGVkWm9uZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFDdkMsNkNBQXlEO0FBQ3pELGlEQUErQztBQUMvQyxpREFJNkI7QUFDN0IseURBYWlDO0FBSWpDLFNBQVMsZUFBZSxDQUFDLFFBQWdCO0lBQ3ZDLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDdEMsQ0FBQztBQU9ELE1BQWEsaUJBQWlCO0lBQzVCLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBZSxFQUFFLFlBQW9CLEVBQUUsUUFBZ0I7UUFDbkUsTUFBTSxZQUFZLEdBQUcsZUFBZSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRS9DLE9BQU8sSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsWUFBWSxZQUFZLEVBQUU7WUFDbkUsWUFBWSxFQUFFLFlBQVk7WUFDMUIsUUFBUSxFQUFFLFFBQVE7U0FDbkIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBVEQsOENBU0M7QUFFRCxNQUFhLFVBQVcsU0FBUSxzQkFBUztJQVF2QyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXNCO1FBQzlELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbkIsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDO1FBRS9CLDJFQUEyRTtRQUMzRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ25DLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7WUFDakQsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7WUFDdkMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN4QyxDQUFDO0lBQ0gsQ0FBQztJQUVELHFCQUFxQjtRQUNuQixPQUFPLElBQUksQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLGtCQUFrQixDQUFDO0lBQ3BELENBQUM7SUFFRCxZQUFZO1FBQ1YsT0FBTyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxhQUFhLENBQUMsUUFBZ0I7UUFDNUIsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLHdCQUFhLENBQ2pDLElBQUksRUFDSixHQUFHLElBQUksQ0FBQyxZQUFZLFlBQVksRUFDaEM7WUFDRSxRQUFRLEVBQUUsUUFBUTtZQUNsQixPQUFPLEVBQUUsbUJBQW1CLFFBQVEsRUFBRTtTQUN2QyxDQUNGLENBQUM7SUFDSixDQUFDO0lBRUQsZ0JBQWdCLENBQUMsUUFBZ0I7UUFDL0IsSUFBSSxDQUFDLGtCQUFrQixHQUFHLHdCQUFhLENBQUMsd0JBQXdCO1FBQzlELHdGQUF3RjtRQUN4RixJQUFJLENBQUMsS0FBSztRQUVWLHFEQUFxRDtRQUNyRCxnREFBZ0Q7UUFDaEQsR0FBRyxJQUFJLENBQUMsWUFBWSxFQUFFLG9CQUFvQixFQUMxQztZQUNFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtZQUMvQixRQUFRLEVBQUUsUUFBUTtTQUNuQixDQUNGLENBQUM7UUFFRixrQkFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxHQUFHLENBQ2xDLGtDQUFrQyxFQUNsQyxZQUFZLENBQ2IsQ0FBQztRQUNGLGtCQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLEdBQUcsQ0FDbEMsOEJBQThCLEVBQzlCLFlBQVksQ0FDYixDQUFDO1FBQ0Ysa0JBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUMsR0FBRyxDQUNsQyw2QkFBNkIsRUFDN0IsUUFBUSxDQUNULENBQUM7UUFFRix5RUFBeUU7UUFDekUsbURBQW1EO1FBQ25ELE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDbEMsTUFBTSxVQUFVLEdBQUcsR0FBRyxTQUFTLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxjQUFjLENBQUM7UUFFcEUsSUFBSSx1QkFBUyxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxZQUFZLEVBQUUsY0FBYyxFQUFFO1lBQ3hELEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxZQUFZLEVBQUUsY0FBYztZQUN6QyxLQUFLLEVBQUUsSUFBSSxDQUFDLFlBQVk7WUFDeEIsVUFBVSxFQUFFLFVBQVU7U0FDdkIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELGtCQUFrQjtRQUNoQixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQzFELE1BQU0sSUFBSSxHQUFHLElBQUksVUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLFVBQVUsd0JBQXdCLEVBQUU7WUFDakUsU0FBUyxFQUFFLElBQUksK0JBQXFCLENBQUMsZ0JBQUUsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUN0RSxRQUFRLEVBQUUsR0FBRyxVQUFVLHdCQUF3QjtZQUMvQyxjQUFjLEVBQUU7Z0JBQ2QsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLElBQUksd0JBQWMsQ0FBQztvQkFDdEMsVUFBVSxFQUFFO3dCQUNWLElBQUkseUJBQWUsQ0FBQzs0QkFDbEIsT0FBTyxFQUFFLENBQUMsK0JBQStCLENBQUM7NEJBQzFDLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQzt5QkFDakIsQ0FBQztxQkFDSDtpQkFDRixDQUFDO2dCQUNGLENBQUMsMEJBQTBCLENBQUMsRUFBRSxJQUFJLHdCQUFjLENBQUM7b0JBQy9DLFVBQVUsRUFBRTt3QkFDVixJQUFJLHlCQUFlLENBQUM7NEJBQ2xCLE9BQU8sRUFBRSxDQUFDLGtDQUFrQyxDQUFDOzRCQUM3QyxTQUFTLEVBQUU7Z0NBQ1QsZ0NBQWdDLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxFQUFFOzZCQUMvRDt5QkFDRixDQUFDO3FCQUNIO2lCQUNGLENBQUM7YUFDSDtTQUNGLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxVQUFVLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXRDLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsMkJBQTJCLEVBQUU7WUFDL0MsR0FBRyxFQUFFLEdBQUcsVUFBVSwyQkFBMkI7WUFDN0MsS0FBSyxFQUFFLElBQUksQ0FBQyxPQUFPO1lBQ25CLFVBQVUsRUFBRSxHQUFHLFVBQVUsMkJBQTJCO1NBQ3JELENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxVQUFVLENBQUMsS0FBaUM7UUFDakQsSUFBSSxxQkFBTyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUU7WUFDM0IsSUFBSSxFQUFFLElBQUksQ0FBQyxrQkFBa0I7WUFDN0IsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQzVCLE9BQU8sRUFDTCxLQUFLLENBQUMsT0FBTyxJQUFJLGdCQUFnQixJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxFQUFFO1lBQ3JFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7U0FDZixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sUUFBUSxDQUFDLEtBQXFDO1FBQ25ELElBQUkseUJBQVcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ3hCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtZQUM1QixJQUFJLEVBQUUsSUFBSSxDQUFDLGtCQUFrQjtZQUM3QixPQUFPLEVBQ0wsS0FBSyxDQUFDLE9BQU8sSUFBSSxvQkFBb0IsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsRUFBRTtZQUN6RSxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7U0FDZixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQWtDO1FBQzdDLElBQUksc0JBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ3JCLElBQUksRUFBRSxJQUFJLENBQUMsa0JBQWtCO1lBQzdCLE9BQU8sRUFDTCxLQUFLLENBQUMsT0FBTyxJQUFJLGlCQUFpQixJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxFQUFFO1lBQ3RFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7U0FDZixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQWtDO1FBQzdDLElBQUksc0JBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ3JCLElBQUksRUFBRSxJQUFJLENBQUMsa0JBQWtCO1lBQzdCLE9BQU8sRUFDTCxLQUFLLENBQUMsT0FBTyxJQUFJLGlCQUFpQixJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxFQUFFO1lBQ3RFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7U0FDZixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQW1DO1FBQy9DLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ3RCLElBQUksRUFBRSxJQUFJLENBQUMsa0JBQWtCO1lBQzdCLE9BQU8sRUFDTCxLQUFLLENBQUMsT0FBTyxJQUFJLGtCQUFrQixJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxFQUFFO1lBQ3ZFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7U0FDZixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUExS0QsZ0NBMEtDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IENmbk91dHB1dCwgRm4sIFN0YWNrLCBUYWdzIH0gZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgeyBSb2xlIH0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3MvaWFtXCI7XG5pbXBvcnQge1xuICBPcmdhbml6YXRpb25QcmluY2lwYWwsXG4gIFBvbGljeURvY3VtZW50LFxuICBQb2xpY3lTdGF0ZW1lbnRcbn0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7XG4gIEFSZWNvcmQsXG4gIHR5cGUgQVJlY29yZFByb3BzLFxuICBDbmFtZVJlY29yZCxcbiAgdHlwZSBDbmFtZVJlY29yZFByb3BzLFxuICBIb3N0ZWRab25lIGFzIEFXU0hvc3RlZFpvbmUsXG4gIHR5cGUgSUhvc3RlZFpvbmUsXG4gIE14UmVjb3JkLFxuICB0eXBlIE14UmVjb3JkUHJvcHMsXG4gIE5zUmVjb3JkLFxuICB0eXBlIE5zUmVjb3JkUHJvcHMsXG4gIFR4dFJlY29yZCxcbiAgdHlwZSBUeHRSZWNvcmRQcm9wc1xufSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXJvdXRlNTNcIjtcblxuaW1wb3J0IHsgdHlwZSBBd3NTdGFjayB9IGZyb20gXCIuLi8uLi9yZXNvdXJjZXNcIjtcblxuZnVuY3Rpb24gZ2V0U2FmZVpvbmVOYW1lKHpvbmVOYW1lOiBzdHJpbmcpIHtcbiAgcmV0dXJuIHpvbmVOYW1lLnNwbGl0KFwiLlwiKS5qb2luKFwiXCIpO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIEhvc3RlZFpvbmVQcm9wcyB7XG4gIHpvbmVOYW1lOiBzdHJpbmc7XG4gIGhvc3RlZFpvbmVJZD86IHN0cmluZztcbn1cblxuZXhwb3J0IGNsYXNzIEhvc3RlZFpvbmVGYWN0b3J5IHtcbiAgc3RhdGljIGltcG9ydChzdGFjazogQXdzU3RhY2ssIGhvc3RlZFpvbmVJZDogc3RyaW5nLCB6b25lTmFtZTogc3RyaW5nKSB7XG4gICAgY29uc3Qgc2FmZVpvbmVOYW1lID0gZ2V0U2FmZVpvbmVOYW1lKHpvbmVOYW1lKTtcblxuICAgIHJldHVybiBuZXcgSG9zdGVkWm9uZShzdGFjay5nZXRTdGFjaygpLCBgJHtzYWZlWm9uZU5hbWV9SG9zdGVkWm9uZWAsIHtcbiAgICAgIGhvc3RlZFpvbmVJZDogaG9zdGVkWm9uZUlkLFxuICAgICAgem9uZU5hbWU6IHpvbmVOYW1lXG4gICAgfSk7XG4gIH1cbn1cblxuZXhwb3J0IGNsYXNzIEhvc3RlZFpvbmUgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBwcml2YXRlIGhvc3RlZFpvbmU6IEFXU0hvc3RlZFpvbmU7XG4gIHByaXZhdGUgaG9zdGVkWm9uZUlkOiBzdHJpbmc7XG4gIHByaXZhdGUgaW1wb3J0ZWRIb3N0ZWRab25lOiBJSG9zdGVkWm9uZTtcbiAgcHJpdmF0ZSB6b25lTmFtZTogc3RyaW5nO1xuXG4gIHByaXZhdGUgc2NvcGU6IENvbnN0cnVjdDtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogSG9zdGVkWm9uZVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIHRoaXMuc2NvcGUgPSBzY29wZTtcbiAgICB0aGlzLnpvbmVOYW1lID0gcHJvcHMuem9uZU5hbWU7XG5cbiAgICAvLyBJZiBhIGhvc3RlZFpvbmVJZCBpcyBwcm92aWRlZCBpbXBvcnQgaXQsIHVubGVzcyBjcmVhdGUgYSBuZXcgaG9zdGVkIHpvbmVcbiAgICBpZiAoIXByb3BzLmhvc3RlZFpvbmVJZCkge1xuICAgICAgdGhpcy5hZGRIb3N0ZWRab25lKHByb3BzLnpvbmVOYW1lKTtcbiAgICAgIHRoaXMuaG9zdGVkWm9uZUlkID0gdGhpcy5ob3N0ZWRab25lLmhvc3RlZFpvbmVJZDtcbiAgICAgIHRoaXMuZGVsZWdhdGVIb3N0ZWRab25lKCk7XG4gICAgfSBlbHNlIHtcbiAgICAgIHRoaXMuaG9zdGVkWm9uZUlkID0gcHJvcHMuaG9zdGVkWm9uZUlkO1xuICAgICAgdGhpcy5pbXBvcnRIb3N0ZWRab25lKHByb3BzLnpvbmVOYW1lKTtcbiAgICB9XG4gIH1cblxuICBnZXRJbnRlcm5hbEhvc3RlZFpvbmUoKSB7XG4gICAgcmV0dXJuIHRoaXMuaG9zdGVkWm9uZSB8fCB0aGlzLmltcG9ydGVkSG9zdGVkWm9uZTtcbiAgfVxuXG4gIHNhZmVab25lTmFtZSgpIHtcbiAgICByZXR1cm4gZ2V0U2FmZVpvbmVOYW1lKHRoaXMuem9uZU5hbWUpO1xuICB9XG5cbiAgYWRkSG9zdGVkWm9uZSh6b25lTmFtZTogc3RyaW5nKSB7XG4gICAgdGhpcy5ob3N0ZWRab25lID0gbmV3IEFXU0hvc3RlZFpvbmUoXG4gICAgICB0aGlzLFxuICAgICAgYCR7dGhpcy5zYWZlWm9uZU5hbWV9SG9zdGVkWm9uZWAsXG4gICAgICB7XG4gICAgICAgIHpvbmVOYW1lOiB6b25lTmFtZSxcbiAgICAgICAgY29tbWVudDogYEhvc3RlZCBab25lIGZvciAke3pvbmVOYW1lfWBcbiAgICAgIH1cbiAgICApO1xuICB9XG5cbiAgaW1wb3J0SG9zdGVkWm9uZSh6b25lTmFtZTogc3RyaW5nKSB7XG4gICAgdGhpcy5pbXBvcnRlZEhvc3RlZFpvbmUgPSBBV1NIb3N0ZWRab25lLmZyb21Ib3N0ZWRab25lQXR0cmlidXRlcyhcbiAgICAgIC8vIEhvc3RlZFpvbmUuZnJvbUhvc3RlZFpvbmVBdHRyaWJ1dGVzIGV4cGxpY2l0bHkgbXVzdCBiZSBwYXNzZWQgYSBzdGFjayBhcyBwYXJlbnQgc2NvcGVcbiAgICAgIHRoaXMuc2NvcGUsXG5cbiAgICAgIC8vIFVzZSBzYWZlWm9uZU5hbWUgaW4gdGhlIGlkIHNvIHdlIGNhbiB0aGVvcmV0aWNhbGx5XG4gICAgICAvLyAgaW1wb3J0IG11bHRpcGxlIGhvc3RlZCB6b25lcyBpbiBhIHNpbmdsZSBhcHBcbiAgICAgIGAke3RoaXMuc2FmZVpvbmVOYW1lKCl9SW1wb3J0ZWRIb3N0ZWRab25lYCxcbiAgICAgIHtcbiAgICAgICAgaG9zdGVkWm9uZUlkOiB0aGlzLmhvc3RlZFpvbmVJZCxcbiAgICAgICAgem9uZU5hbWU6IHpvbmVOYW1lXG4gICAgICB9XG4gICAgKTtcblxuICAgIFRhZ3Mub2YodGhpcy5pbXBvcnRlZEhvc3RlZFpvbmUpLmFkZChcbiAgICAgIFwiZmphbGw6Y29zdEFsbG9jYXRpb246ZW52aXJvbm1lbnRcIixcbiAgICAgIFwibWFuYWdlbWVudFwiXG4gICAgKTtcbiAgICBUYWdzLm9mKHRoaXMuaW1wb3J0ZWRIb3N0ZWRab25lKS5hZGQoXG4gICAgICBcImZqYWxsOmNvc3RBbGxvY2F0aW9uOnNlcnZpY2VcIixcbiAgICAgIFwiaG9zdGVkWm9uZVwiXG4gICAgKTtcbiAgICBUYWdzLm9mKHRoaXMuaW1wb3J0ZWRIb3N0ZWRab25lKS5hZGQoXG4gICAgICBcImZqYWxsOmNvc3RBbGxvY2F0aW9uOmRvbWFpblwiLFxuICAgICAgem9uZU5hbWVcbiAgICApO1xuXG4gICAgLy8gTWFrZSBleHBvcnQgbmFtZSB1bmlxdWUgYnkgaW5jbHVkaW5nIHRoZSBzdGFjayBuYW1lIHRvIGF2b2lkIGNvbmZsaWN0c1xuICAgIC8vIHdoZW4gbXVsdGlwbGUgc3RhY2tzIGltcG9ydCB0aGUgc2FtZSBob3N0ZWQgem9uZVxuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3Qgc3RhY2tOYW1lID0gc3RhY2suc3RhY2tOYW1lO1xuICAgIGNvbnN0IGV4cG9ydE5hbWUgPSBgJHtzdGFja05hbWV9JHt0aGlzLnNhZmVab25lTmFtZSgpfUhvc3RlZFpvbmVJZGA7XG5cbiAgICBuZXcgQ2ZuT3V0cHV0KHRoaXMsIGAke3RoaXMuc2FmZVpvbmVOYW1lKCl9SG9zdGVkWm9uZUlkYCwge1xuICAgICAga2V5OiBgJHt0aGlzLnNhZmVab25lTmFtZSgpfUhvc3RlZFpvbmVJZGAsXG4gICAgICB2YWx1ZTogdGhpcy5ob3N0ZWRab25lSWQsXG4gICAgICBleHBvcnROYW1lOiBleHBvcnROYW1lXG4gICAgfSk7XG4gIH1cblxuICBkZWxlZ2F0ZUhvc3RlZFpvbmUoKSB7XG4gICAgY29uc3QgZG9tYWluTmFtZSA9IHRoaXMuaG9zdGVkWm9uZS56b25lTmFtZS5zcGxpdChcIi5cIiwgMSk7XG4gICAgY29uc3Qgcm9sZSA9IG5ldyBSb2xlKHRoaXMsIGAke2RvbWFpbk5hbWV9RGVsZWdhdGVIb3N0ZWRab25lUm9sZWAsIHtcbiAgICAgIGFzc3VtZWRCeTogbmV3IE9yZ2FuaXphdGlvblByaW5jaXBhbChGbi5pbXBvcnRWYWx1ZShcIk9yZ2FuaXNhdGlvbklkXCIpKSxcbiAgICAgIHJvbGVOYW1lOiBgJHtkb21haW5OYW1lfURlbGVnYXRlSG9zdGVkWm9uZVJvbGVgLFxuICAgICAgaW5saW5lUG9saWNpZXM6IHtcbiAgICAgICAgW1wibGlzdEhvc3RlZFpvbmVzXCJdOiBuZXcgUG9saWN5RG9jdW1lbnQoe1xuICAgICAgICAgIHN0YXRlbWVudHM6IFtcbiAgICAgICAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgICAgICBhY3Rpb25zOiBbXCJyb3V0ZTUzOkxpc3RIb3N0ZWRab25lc0J5TmFtZVwiXSxcbiAgICAgICAgICAgICAgcmVzb3VyY2VzOiBbXCIqXCJdXG4gICAgICAgICAgICB9KVxuICAgICAgICAgIF1cbiAgICAgICAgfSksXG4gICAgICAgIFtcImNoYW5nZVJlc291cmNlUmVjb3JkU2V0c1wiXTogbmV3IFBvbGljeURvY3VtZW50KHtcbiAgICAgICAgICBzdGF0ZW1lbnRzOiBbXG4gICAgICAgICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICAgICAgYWN0aW9uczogW1wicm91dGU1MzpDaGFuZ2VSZXNvdXJjZVJlY29yZFNldHNcIl0sXG4gICAgICAgICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgICAgICAgIGBhcm46YXdzOnJvdXRlNTM6Ojpob3N0ZWR6b25lLyR7dGhpcy5ob3N0ZWRab25lLmhvc3RlZFpvbmVJZH1gXG4gICAgICAgICAgICAgIF1cbiAgICAgICAgICAgIH0pXG4gICAgICAgICAgXVxuICAgICAgICB9KVxuICAgICAgfVxuICAgIH0pO1xuXG4gICAgdGhpcy5ob3N0ZWRab25lLmdyYW50RGVsZWdhdGlvbihyb2xlKTtcblxuICAgIG5ldyBDZm5PdXRwdXQodGhpcywgXCJEZWxlZ2F0ZUhvc3RlZFpvbmVSb2xlQXJuXCIsIHtcbiAgICAgIGtleTogYCR7ZG9tYWluTmFtZX1EZWxlZ2F0ZUhvc3RlZFpvbmVSb2xlQXJuYCxcbiAgICAgIHZhbHVlOiByb2xlLnJvbGVBcm4sXG4gICAgICBleHBvcnROYW1lOiBgJHtkb21haW5OYW1lfURlbGVnYXRlSG9zdGVkWm9uZVJvbGVBcm5gXG4gICAgfSk7XG4gIH1cblxuICBwdWJsaWMgYWRkQVJlY29yZChwcm9wczogT21pdDxBUmVjb3JkUHJvcHMsIFwiem9uZVwiPikge1xuICAgIG5ldyBBUmVjb3JkKHRoaXMsIFwiQVJlY29yZFwiLCB7XG4gICAgICB6b25lOiB0aGlzLmltcG9ydGVkSG9zdGVkWm9uZSxcbiAgICAgIHJlY29yZE5hbWU6IHByb3BzLnJlY29yZE5hbWUsXG4gICAgICBjb21tZW50OlxuICAgICAgICBwcm9wcy5jb21tZW50IHx8IGBBIFJlY29yZCBmb3IgJHt0aGlzLmltcG9ydGVkSG9zdGVkWm9uZS56b25lTmFtZX1gLFxuICAgICAgdGFyZ2V0OiBwcm9wcy50YXJnZXQsXG4gICAgICB0dGw6IHByb3BzLnR0bFxuICAgIH0pO1xuICB9XG5cbiAgcHVibGljIGFkZENuYW1lKHByb3BzOiBPbWl0PENuYW1lUmVjb3JkUHJvcHMsIFwiem9uZVwiPikge1xuICAgIG5ldyBDbmFtZVJlY29yZCh0aGlzLCBgYCwge1xuICAgICAgZG9tYWluTmFtZTogcHJvcHMuZG9tYWluTmFtZSxcbiAgICAgIHpvbmU6IHRoaXMuaW1wb3J0ZWRIb3N0ZWRab25lLFxuICAgICAgY29tbWVudDpcbiAgICAgICAgcHJvcHMuY29tbWVudCB8fCBgQ05BTUUgUmVjb3JkIGZvciAke3RoaXMuaW1wb3J0ZWRIb3N0ZWRab25lLnpvbmVOYW1lfWAsXG4gICAgICB0dGw6IHByb3BzLnR0bFxuICAgIH0pO1xuICB9XG5cbiAgcHVibGljIGFkZE14KHByb3BzOiBPbWl0PE14UmVjb3JkUHJvcHMsIFwiem9uZVwiPikge1xuICAgIG5ldyBNeFJlY29yZCh0aGlzLCBgYCwge1xuICAgICAgem9uZTogdGhpcy5pbXBvcnRlZEhvc3RlZFpvbmUsXG4gICAgICBjb21tZW50OlxuICAgICAgICBwcm9wcy5jb21tZW50IHx8IGBNWCBSZWNvcmQgZm9yICR7dGhpcy5pbXBvcnRlZEhvc3RlZFpvbmUuem9uZU5hbWV9YCxcbiAgICAgIHZhbHVlczogcHJvcHMudmFsdWVzLFxuICAgICAgdHRsOiBwcm9wcy50dGxcbiAgICB9KTtcbiAgfVxuXG4gIHB1YmxpYyBhZGROUyhwcm9wczogT21pdDxOc1JlY29yZFByb3BzLCBcInpvbmVcIj4pIHtcbiAgICBuZXcgTnNSZWNvcmQodGhpcywgYGAsIHtcbiAgICAgIHpvbmU6IHRoaXMuaW1wb3J0ZWRIb3N0ZWRab25lLFxuICAgICAgY29tbWVudDpcbiAgICAgICAgcHJvcHMuY29tbWVudCB8fCBgTlMgUmVjb3JkIGZvciAke3RoaXMuaW1wb3J0ZWRIb3N0ZWRab25lLnpvbmVOYW1lfWAsXG4gICAgICB2YWx1ZXM6IHByb3BzLnZhbHVlcyxcbiAgICAgIHR0bDogcHJvcHMudHRsXG4gICAgfSk7XG4gIH1cblxuICBwdWJsaWMgYWRkVHh0KHByb3BzOiBPbWl0PFR4dFJlY29yZFByb3BzLCBcInpvbmVcIj4pIHtcbiAgICBuZXcgVHh0UmVjb3JkKHRoaXMsIGBgLCB7XG4gICAgICB6b25lOiB0aGlzLmltcG9ydGVkSG9zdGVkWm9uZSxcbiAgICAgIGNvbW1lbnQ6XG4gICAgICAgIHByb3BzLmNvbW1lbnQgfHwgYFRYVCBSZWNvcmQgZm9yICR7dGhpcy5pbXBvcnRlZEhvc3RlZFpvbmUuem9uZU5hbWV9YCxcbiAgICAgIHZhbHVlczogcHJvcHMudmFsdWVzLFxuICAgICAgdHRsOiBwcm9wcy50dGxcbiAgICB9KTtcbiAgfVxufVxuIl19