@fntio/infra-client-plugin-example 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParameterScopeError = exports.configuredPrefixes = exports.assertInScope = void 0;
+exports.parametersPlugin = parametersPlugin;
+const path = __importStar(require("node:path"));
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const infra_client_plugin_cdk_1 = require("@fntio/infra-client-plugin-cdk");
+/** The reference plugin: a scoped Parameter Store viewer and editor.
+ *
+ *  Everything a customer writes for their own plugin is here — a manifest, a handler factory, and the
+ *  IAM the handler needs. `addAccessPortal({ plugins: [parametersPlugin(...)] })` is the only wiring. */
+function parametersPlugin(props) {
+    const prefixes = props.prefixes.map((p) => (p.endsWith("/") ? p : `${p}/`));
+    if (!prefixes.length)
+        throw new Error("parametersPlugin needs at least one parameter prefix");
+    return (0, infra_client_plugin_cdk_1.definePlugin)({
+        schemaVersion: 1,
+        id: "parameters",
+        displayName: "Application parameters",
+        description: "Read and edit SSM parameters under the configured prefixes.",
+        version: props.version ?? "1.0.0",
+        hostApiVersion: 1,
+        enabled: props.enabled ?? true,
+        accounts: [{ accountNumber: props.accountNumber, ...(props.region ? { regions: [props.region] } : {}) }],
+        permissions: [
+            { id: "user", label: "View application parameters" },
+            { id: "admin", label: "Edit application parameters", description: "Includes viewing." },
+        ],
+        ui: {
+            assets: path.join(__dirname, "..", "web-dist"),
+            user: { label: "Parameters", icon: "sliders", order: 10, entry: "index.html#/user" },
+            admin: { label: "Parameters", icon: "sliders", order: 10, entry: "index.html#/admin" },
+        },
+        backend: {
+            handlers: { api: (scope) => apiFunction(scope, props.accountNumber, prefixes) },
+            routes: [
+                { id: "list", method: "GET", path: "/parameters", permission: "user", handlerKey: "api" },
+                { id: "get", method: "GET", path: "/parameters/{name}", permission: "user", handlerKey: "api" },
+                { id: "update", method: "PUT", path: "/parameters/{name}", permission: "admin", handlerKey: "api" },
+            ],
+        },
+    });
+}
+function apiFunction(scope, accountNumber, prefixes) {
+    // The bundle is built when this package is built (scripts/build-lambda.mjs), so a deployment
+    // that installs the package needs no bundler of its own.
+    const fn = new lambda.Function(scope, "ParametersApi", {
+        code: lambda.Code.fromAsset(path.join(__dirname, "..", "lambda-dist")),
+        description: "Example plugin API: reads the allowed SSM parameters in this account.",
+        handler: "index.handler",
+        runtime: lambda.Runtime.NODEJS_22_X,
+        timeout: aws_cdk_lib_1.Duration.seconds(10),
+        environment: {
+            PLUGIN_ACCOUNT_NUMBER: accountNumber,
+            PARAMETER_PREFIXES: prefixes.join(","),
+        },
+    });
+    // The policy mirrors the handler's own rule, so neither alone is the only thing standing between a
+    // caller and the rest of the account's parameters.
+    const arns = prefixes.map((prefix) => `arn:aws:ssm:*:${accountNumber}:parameter${prefix}*`);
+    fn.addToRolePolicy(new iam.PolicyStatement({
+        actions: ["ssm:GetParameter", "ssm:GetParameters", "ssm:PutParameter"],
+        resources: arns,
+    }));
+    // GetParametersByPath authorizes on the path itself, not the parameters under it.
+    fn.addToRolePolicy(new iam.PolicyStatement({
+        actions: ["ssm:GetParametersByPath"],
+        resources: prefixes.map((prefix) => `arn:aws:ssm:*:${accountNumber}:parameter${prefix.replace(/\/$/, "")}`),
+    }));
+    return fn;
+}
+// From scope.ts, never from parameters.ts: a re-export here decides what a consumer has to have
+// installed to synthesize, and parameters.ts imports the AWS SDK client the Lambda uses.
+var scope_1 = require("./scope");
+Object.defineProperty(exports, "assertInScope", { enumerable: true, get: function () { return scope_1.assertInScope; } });
+Object.defineProperty(exports, "configuredPrefixes", { enumerable: true, get: function () { return scope_1.configuredPrefixes; } });
+Object.defineProperty(exports, "ParameterScopeError", { enumerable: true, get: function () { return scope_1.ParameterScopeError; } });

package/dist/parameters.d.ts

@@ -0,0 +1,3 @@
+import { SSMClient } from "@aws-sdk/client-ssm";
+import type { ParameterStore } from "./scope";
+export declare function ssmParameterStore(client: SSMClient): ParameterStore;

package/dist/parameters.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssmParameterStore = ssmParameterStore;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+// The SSM-backed half of the plugin's rules, loaded only inside the Lambda. Everything the
+// registration needs lives in scope.ts, which imports nothing from the AWS SDK.
+const isSecret = (type) => type === "SecureString";
+function ssmParameterStore(client) {
+    return {
+        async list(prefixes) {
+            const out = [];
+            for (const prefix of prefixes) {
+                let NextToken;
+                do {
+                    const page = await client.send(new client_ssm_1.GetParametersByPathCommand({ Path: prefix.replace(/\/$/, ""), Recursive: true, WithDecryption: false, NextToken }));
+                    for (const p of page.Parameters ?? []) {
+                        if (!p.Name)
+                            continue;
+                        out.push({
+                            name: p.Name,
+                            type: p.Type ?? "String",
+                            ...(p.LastModifiedDate ? { lastModified: p.LastModifiedDate.toISOString() } : {}),
+                            ...(p.Version === undefined ? {} : { version: p.Version }),
+                        });
+                    }
+                    NextToken = page.NextToken;
+                } while (NextToken);
+            }
+            return out.sort((a, b) => a.name.localeCompare(b.name));
+        },
+        async get(name) {
+            // WithDecryption stays false on purpose: a SecureString comes back as metadata only.
+            const res = await client.send(new client_ssm_1.GetParameterCommand({ Name: name, WithDecryption: false }));
+            const p = res.Parameter ?? {};
+            const secret = isSecret(p.Type);
+            return {
+                name,
+                type: p.Type ?? "String",
+                secret,
+                ...(secret ? {} : { value: p.Value ?? "" }),
+                ...(p.LastModifiedDate ? { lastModified: p.LastModifiedDate.toISOString() } : {}),
+                ...(p.Version === undefined ? {} : { version: p.Version }),
+            };
+        },
+        async put(name, value) {
+            const res = await client.send(new client_ssm_1.PutParameterCommand({ Name: name, Value: value, Overwrite: true }));
+            return res.Version ?? 0;
+        },
+    };
+}

package/dist/scope.d.ts

@@ -0,0 +1,25 @@
+export interface ParameterSummary {
+    readonly name: string;
+    /** SecureString values are never fetched decrypted, so the type is how the UI knows to say so. */
+    readonly type: string;
+    readonly lastModified?: string;
+    readonly version?: number;
+}
+export interface ParameterDetail extends ParameterSummary {
+    /** Absent for a SecureString: this sample never displays a decrypted secret. */
+    readonly value?: string;
+    readonly secret: boolean;
+}
+export declare class ParameterScopeError extends Error {
+}
+/** Prefixes this deployment allows, from the registration. Empty = the plugin can touch nothing. */
+export declare function configuredPrefixes(raw?: string | undefined): string[];
+/** A name is in scope only if it sits under a configured prefix and cannot climb out of it. A `..`
+ *  segment, a missing leading slash, or a name that merely starts with the prefix as a string
+ *  (`/app-secrets` against `/app`) are all refused. */
+export declare function assertInScope(name: string, prefixes: string[]): void;
+export interface ParameterStore {
+    list(prefixes: string[]): Promise<ParameterSummary[]>;
+    get(name: string): Promise<ParameterDetail>;
+    put(name: string, value: string): Promise<number>;
+}

package/dist/scope.js

@@ -0,0 +1,33 @@
+"use strict";
+// What this plugin is willing to touch, and nothing that talks to AWS. The registration
+// (index.ts) re-exports from here, so loading it on a developer's machine never pulls the
+// Lambda's runtime dependencies in with it — a consumer installs the package without them.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParameterScopeError = void 0;
+exports.configuredPrefixes = configuredPrefixes;
+exports.assertInScope = assertInScope;
+class ParameterScopeError extends Error {
+}
+exports.ParameterScopeError = ParameterScopeError;
+/** Prefixes this deployment allows, from the registration. Empty = the plugin can touch nothing. */
+function configuredPrefixes(raw = process.env.PARAMETER_PREFIXES) {
+    return (raw ?? "")
+        .split(",")
+        .map((p) => p.trim())
+        .filter(Boolean)
+        .map((p) => (p.endsWith("/") ? p : `${p}/`));
+}
+/** A name is in scope only if it sits under a configured prefix and cannot climb out of it. A `..`
+ *  segment, a missing leading slash, or a name that merely starts with the prefix as a string
+ *  (`/app-secrets` against `/app`) are all refused. */
+function assertInScope(name, prefixes) {
+    if (!name.startsWith("/"))
+        throw new ParameterScopeError("A parameter name starts with /");
+    if (name.split("/").includes(".."))
+        throw new ParameterScopeError("A parameter name cannot contain ..");
+    if (!/^[a-zA-Z0-9_.\-/]+$/.test(name))
+        throw new ParameterScopeError("That parameter name has characters SSM does not allow");
+    if (!prefixes.some((prefix) => name.startsWith(prefix))) {
+        throw new ParameterScopeError(`This plugin is limited to ${prefixes.join(", ") || "no prefixes"}`);
+    }
+}

package/lambda-dist/index.js

@@ -0,0 +1,254 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  handler: () => handler,
+  route: () => route
+});
+module.exports = __toCommonJS(handler_exports);
+var import_client_ssm2 = require("@aws-sdk/client-ssm");
+
+// ../infra-client-plugin-sdk/src/contracts/manifest.ts
+var PLUGIN_PERMISSIONS = ["user", "admin"];
+var PLUGIN_ACCOUNT_PARAM = "accountNumber";
+var PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+var AWS_ACCOUNT_PATTERN = /^\d{12}$/;
+
+// ../infra-client-plugin-sdk/src/contracts/paths.ts
+var PLUGIN_API_ROOT = "/api/plugins";
+function pluginApiBaseUrl(pluginId) {
+  return `${PLUGIN_API_ROOT}/${pluginId}`;
+}
+function pluginAccountRoot(pluginId) {
+  return `${pluginApiBaseUrl(pluginId)}/accounts/{${PLUGIN_ACCOUNT_PARAM}}`;
+}
+function pluginAccountPath(pluginId, accountNumber) {
+  return pluginAccountRoot(pluginId).replace(`{${PLUGIN_ACCOUNT_PARAM}}`, accountNumber);
+}
+
+// ../infra-client-plugin-sdk/src/contracts/authorizer.ts
+var PLUGIN_AUTHORIZER_CONTEXT_KEYS = [
+  "pluginId",
+  "pluginRevision",
+  "routeId",
+  "accountNumber",
+  "requiredPermission",
+  "subject",
+  "principalType",
+  "correlationId"
+];
+function parsePluginAuthorizerContext(raw) {
+  const ctx = tryParsePluginAuthorizerContext(raw);
+  if (!ctx) throw new Error("plugin authorizer context is missing or malformed");
+  return ctx;
+}
+function tryParsePluginAuthorizerContext(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw;
+  for (const key of PLUGIN_AUTHORIZER_CONTEXT_KEYS) {
+    if (typeof r[key] !== "string" || r[key].length === 0) return null;
+  }
+  if (!PLUGIN_ID_PATTERN.test(r.pluginId)) return null;
+  if (!AWS_ACCOUNT_PATTERN.test(r.accountNumber)) return null;
+  if (!PLUGIN_PERMISSIONS.includes(r.requiredPermission)) return null;
+  if (r.principalType !== "user" && r.principalType !== "service") return null;
+  return {
+    pluginId: r.pluginId,
+    pluginRevision: r.pluginRevision,
+    routeId: r.routeId,
+    accountNumber: r.accountNumber,
+    requiredPermission: r.requiredPermission,
+    subject: r.subject,
+    principalType: r.principalType,
+    correlationId: r.correlationId
+  };
+}
+
+// ../infra-client-plugin-sdk/src/backend/context.ts
+function pluginAuthorizerContextOf(event) {
+  return parsePluginAuthorizerContext(event.requestContext?.authorizer);
+}
+function pluginRoutePath(path, ctx) {
+  const root = pluginAccountPath(ctx.pluginId, ctx.accountNumber);
+  if (path === root) return "/";
+  if (!path.startsWith(`${root}/`)) return null;
+  return path.slice(root.length);
+}
+var SENSITIVE = /token|authorization|secret|password|credential/i;
+function createPluginLogger(ctx, sink = (line) => console.log(line)) {
+  const base = {
+    pluginId: ctx.pluginId,
+    accountNumber: ctx.accountNumber,
+    routeId: ctx.routeId,
+    subject: ctx.subject,
+    principalType: ctx.principalType,
+    correlationId: ctx.correlationId
+  };
+  const write = (level, msg, extra = {}) => {
+    const safe = {};
+    for (const [key, value] of Object.entries(extra)) safe[key] = SENSITIVE.test(key) ? "[redacted]" : value;
+    sink(JSON.stringify({ level, msg, ...safe, ...base }));
+  };
+  return {
+    info: (msg, extra) => write("info", msg, extra),
+    warn: (msg, extra) => write("warn", msg, extra),
+    error: (msg, extra) => write("error", msg, extra)
+  };
+}
+
+// src/parameters.ts
+var import_client_ssm = require("@aws-sdk/client-ssm");
+var isSecret = (type) => type === "SecureString";
+function ssmParameterStore(client) {
+  return {
+    async list(prefixes) {
+      const out = [];
+      for (const prefix of prefixes) {
+        let NextToken;
+        do {
+          const page = await client.send(
+            new import_client_ssm.GetParametersByPathCommand({ Path: prefix.replace(/\/$/, ""), Recursive: true, WithDecryption: false, NextToken })
+          );
+          for (const p of page.Parameters ?? []) {
+            if (!p.Name) continue;
+            out.push({
+              name: p.Name,
+              type: p.Type ?? "String",
+              ...p.LastModifiedDate ? { lastModified: p.LastModifiedDate.toISOString() } : {},
+              ...p.Version === void 0 ? {} : { version: p.Version }
+            });
+          }
+          NextToken = page.NextToken;
+        } while (NextToken);
+      }
+      return out.sort((a, b) => a.name.localeCompare(b.name));
+    },
+    async get(name) {
+      const res = await client.send(new import_client_ssm.GetParameterCommand({ Name: name, WithDecryption: false }));
+      const p = res.Parameter ?? {};
+      const secret = isSecret(p.Type);
+      return {
+        name,
+        type: p.Type ?? "String",
+        secret,
+        ...secret ? {} : { value: p.Value ?? "" },
+        ...p.LastModifiedDate ? { lastModified: p.LastModifiedDate.toISOString() } : {},
+        ...p.Version === void 0 ? {} : { version: p.Version }
+      };
+    },
+    async put(name, value) {
+      const res = await client.send(new import_client_ssm.PutParameterCommand({ Name: name, Value: value, Overwrite: true }));
+      return res.Version ?? 0;
+    }
+  };
+}
+
+// src/scope.ts
+var ParameterScopeError = class extends Error {
+};
+function configuredPrefixes(raw = process.env.PARAMETER_PREFIXES) {
+  return (raw ?? "").split(",").map((p) => p.trim()).filter(Boolean).map((p) => p.endsWith("/") ? p : `${p}/`);
+}
+function assertInScope(name, prefixes) {
+  if (!name.startsWith("/")) throw new ParameterScopeError("A parameter name starts with /");
+  if (name.split("/").includes("..")) throw new ParameterScopeError("A parameter name cannot contain ..");
+  if (!/^[a-zA-Z0-9_.\-/]+$/.test(name)) throw new ParameterScopeError("That parameter name has characters SSM does not allow");
+  if (!prefixes.some((prefix) => name.startsWith(prefix))) {
+    throw new ParameterScopeError(`This plugin is limited to ${prefixes.join(", ") || "no prefixes"}`);
+  }
+}
+
+// src/handler.ts
+var ssm = new import_client_ssm2.SSMClient({});
+var HOME_ACCOUNT = process.env.PLUGIN_ACCOUNT_NUMBER ?? "";
+var json = (statusCode, body) => ({
+  statusCode,
+  headers: { "content-type": "application/json", "cache-control": "no-store" },
+  body: JSON.stringify(body)
+});
+function deps() {
+  return { store: ssmParameterStore(ssm), prefixes: configuredPrefixes(), homeAccount: HOME_ACCOUNT };
+}
+async function handler(event) {
+  return route(event, deps());
+}
+async function route(event, d) {
+  let ctx;
+  try {
+    ctx = pluginAuthorizerContextOf(event);
+  } catch {
+    return json(500, { message: "This request did not come through the portal." });
+  }
+  const log = createPluginLogger(ctx);
+  if (!d.prefixes.length) {
+    log.error("no parameter prefixes configured");
+    return json(500, { message: "This plugin has no parameter prefixes configured." });
+  }
+  if (ctx.accountNumber !== d.homeAccount) {
+    log.error("authorized for an account this plugin does not serve", { requested: ctx.accountNumber });
+    return json(409, { message: `This plugin instance only serves account ${d.homeAccount}.` });
+  }
+  const path = pluginRoutePath(event.path, ctx);
+  if (path === null) return json(400, { message: "That path is outside this plugin." });
+  const method = event.httpMethod.toUpperCase();
+  const name = event.pathParameters?.["name"];
+  try {
+    if (method === "GET" && path === "/parameters") {
+      const parameters = await d.store.list(d.prefixes);
+      log.info("listed parameters", { count: parameters.length });
+      return json(200, { parameters, prefixes: d.prefixes });
+    }
+    if (method === "GET" && name) {
+      const decoded = decodeURIComponent(name);
+      assertInScope(decoded, d.prefixes);
+      const parameter = await d.store.get(decoded);
+      log.info("read parameter", { name: decoded, secret: parameter.secret });
+      return json(200, { parameter });
+    }
+    if (method === "PUT" && name) {
+      const decoded = decodeURIComponent(name);
+      assertInScope(decoded, d.prefixes);
+      const value = JSON.parse(event.body ?? "{}").value;
+      if (typeof value !== "string" || !value.length) {
+        return json(400, { message: "Send a non-empty string value." });
+      }
+      const version = await d.store.put(decoded, value);
+      log.info("updated parameter", { name: decoded, version });
+      return json(200, { name: decoded, version });
+    }
+  } catch (err) {
+    if (err instanceof ParameterScopeError) {
+      log.warn("refused an out-of-scope parameter", { error: err.message });
+      return json(400, { message: err.message });
+    }
+    if (err.name === "ParameterNotFound") {
+      return json(404, { message: "No such parameter." });
+    }
+    log.error("parameter operation failed", { error: err.message });
+    return json(502, { message: "The parameter store did not answer." });
+  }
+  return json(404, { message: `No such route: ${method} ${path}` });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler,
+  route
+});

package/package.json

@@ -1,6 +1,84 @@
 {
   "name": "@fntio/infra-client-plugin-example",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "The reference infra-client plugin: a scoped SSM Parameter Store viewer and editor, and the worked example the plugin docs and agent skills refer to.",
+  "license": "Elastic-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/FNTIO/aws-infrastructure-client.git",
+    "directory": "packages/infra-client-plugin-example"
+  },
+  "homepage": "https://github.com/FNTIO/aws-infrastructure-client/wiki",
+  "bugs": {
+    "url": "https://github.com/FNTIO/aws-infrastructure-client/issues"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "lambda-dist",
+    "web-dist",
+    "web",
+    "src",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "npm run build:web && npm run build:lambda && tsc -p tsconfig.build.json",
+    "build:web": "node scripts/build-web.mjs",
+    "build:lambda": "node scripts/build-lambda.mjs",
+    "prepack": "npm run build",
+    "pretest": "npm run build:lambda",
+    "test": "jest"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "roots": [
+      "<rootDir>/__tests__"
+    ],
+    "testMatch": [
+      "**/*.test.ts"
+    ],
+    "transform": {
+      "^.+\\.tsx?$": [
+        "ts-jest",
+        {
+          "tsconfig": "<rootDir>/tsconfig.jest.json"
+        }
+      ]
+    },
+    "moduleNameMapper": {
+      "^@fntio/infra-client-plugin-sdk$": "<rootDir>/../infra-client-plugin-sdk/src/index.ts",
+      "^@fntio/infra-client-plugin-sdk/(.*)$": "<rootDir>/../infra-client-plugin-sdk/src/$1/index.ts"
+    },
+    "maxWorkers": "50%",
+    "workerIdleMemoryLimit": "2GB"
+  },
+  "dependencies": {
+    "@fntio/infra-client-plugin-sdk": "^0.2.0",
+    "@fntio/infra-client-plugin-cdk": "^0.2.0",
+    "@fntio/infra-client-plugin-ui": "^0.2.0"
+  },
+  "peerDependencies": {
+    "aws-cdk-lib": "^2.263.0",
+    "constructs": "^10.3.0"
+  },
+  "devDependencies": {
+    "@aws-sdk/client-ssm": "^3.600.0",
+    "@types/aws-lambda": "^8.10.145",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^20.19.43",
+    "aws-cdk-lib": "2.263.0",
+    "aws-sdk-client-mock": "^4.0.1",
+    "constructs": "^10.3.0",
+    "esbuild": "^0.23.0",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.0",
+    "typescript": "^5.5.0"
+  }
+}