@fntio/infra-client 0.0.0-stage → 0.5.0

package/dist/lib/access-portal.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addAccessPortal = addAccessPortal;
+const registration_1 = require("./plugins/registration");
+const audit_log_1 = require("./audit-log");
+const data_stack_1 = require("./data-stack");
+const creds_stack_1 = require("./creds-stack");
+const web_stack_1 = require("./web-stack");
+const web_cert_stack_1 = require("./web-cert-stack");
+const network_stack_1 = require("./network-stack");
+const network_validation_1 = require("./network-validation");
+const dimensions_validation_1 = require("./dimensions-validation");
+const web_acl_1 = require("./constructs/web-acl");
+const federation_1 = require("./federation");
+/** Every hub stack as one unit — NOT a `cdk.Stage`: a Stage prefixes every
+ *  construct path, renaming physical names and replacing live resources. */
+function addAccessPortal(scope, props) {
+    const { project, resourcePrefix, sites } = props;
+    const env = { account: project.env.account, region: project.env.region };
+    (0, network_validation_1.assertValidResourcePrefix)(resourcePrefix);
+    // Without this the VPN feature deploys silently absent (/network → 501).
+    if (project.network && !sites) {
+        throw new Error("project.network is set but no `sites` were passed — resolve them with " +
+            "resolveSites(project.network) and pass them in.");
+    }
+    // Zone names here are compared with endsWith() and joined into record
+    // names — a trailing dot never matches and builds off-by-one FQDNs.
+    for (const [label, zoneName] of Object.entries({
+        "issuer.zoneName": project.issuer.zoneName,
+        "email.zoneName": project.email?.zoneName,
+        "web.zoneName": project.web?.zoneName,
+        "network.zoneName": project.network?.zoneName,
+    })) {
+        if (zoneName?.endsWith(".")) {
+            throw new Error(`${label} ("${zoneName}") must not end with a dot.`);
+        }
+    }
+    const waf = (0, web_acl_1.resolveWaf)(project.waf);
+    const plugins = (0, registration_1.resolvePlugins)(project.plugins, props.plugins);
+    const auditRetentionDays = (0, audit_log_1.resolveAuditRetentionDays)(project.audit);
+    // Validated once, consumed by both stacks (pool attributes + trigger; provider + client).
+    const federation = (0, federation_1.resolveFederation)(project.loginMethods.federation, project.env.region);
+    // Security Hub CloudFormation.3 for prod; a prod teardown lifts it first
+    // (runbook "Tear down").
+    const hubStack = { env, terminationProtection: project.prod };
+    const dataStack = new data_stack_1.DataStack(scope, "DataStack", {
+        ...hubStack,
+        prod: project.prod,
+        email: project.email
+            ? { dmarcReportEmail: (0, creds_stack_1.resolveAlertEmails)(project.alertEmail)[0], ...project.email }
+            : undefined,
+    });
+    // CloudFront only takes certs and WAF web ACLs from us-east-1, wherever
+    // the app deploys — hence the companion stack + cross-region references.
+    // Always present: the issuer's certificate is minted there.
+    const webCertStack = new web_cert_stack_1.WebCertStack(scope, "WebCertStack", {
+        ...hubStack,
+        env: { account: project.env.account, region: "us-east-1" },
+        crossRegionReferences: true,
+        resourcePrefix,
+        issuer: project.issuer,
+        web: project.web,
+        waf,
+    });
+    // Dev shares ride the network block: no sites, no shares (validated even when disabled).
+    const devShares = project.network && sites ? (0, network_validation_1.resolveDevShares)(project.network.devShares) : undefined;
+    // Validated even when disabled; only an ENABLED block reaches the API env and config.json.
+    const dimensions = (0, dimensions_validation_1.resolveAccountDimensions)(project.accountDimensions);
+    const accountDimensions = dimensions?.enabled ? dimensions : undefined;
+    const credsStack = new creds_stack_1.CredsStack(scope, "CredsStack", {
+        ...hubStack,
+        crossRegionReferences: true,
+        resourcePrefix,
+        prod: project.prod,
+        passkeyDomain: project.web?.domainName,
+        appUrl: project.web ? `https://${project.web.domainName}` : undefined,
+        accountsTable: dataStack.accountsTable,
+        rolesTable: dataStack.rolesTable,
+        requestsTable: dataStack.requestsTable,
+        auditTable: dataStack.auditTable,
+        auditRetentionDays,
+        groupsTable: dataStack.groupsTable,
+        resourcesTable: dataStack.resourcesTable,
+        accessTable: dataStack.accessTable,
+        revocationsTable: dataStack.revocationsTable,
+        serviceUsersTable: dataStack.serviceUsersTable,
+        plugins: plugins && { ...plugins, catalogTable: dataStack.pluginCatalogTable, assetsBucket: dataStack.pluginAssetsBucket },
+        loginMethods: project.loginMethods,
+        federation,
+        firstAdmin: project.firstAdmin,
+        projectName: project.projectName,
+        issuer: {
+            keyVersions: [1],
+            signerVersion: 1,
+            ...project.issuer,
+            certificate: webCertStack.issuerCertificate,
+            webAclArn: webCertStack.issuerWebAclArn,
+        },
+        alertEmail: project.alertEmail,
+        email: project.email,
+        waf,
+        accessLogsBucket: dataStack.accessLogsBucket,
+        configAccounts: Object.entries(project.rolesByAccount).map(([accountNumber, roles]) => ({
+            accountNumber,
+            roles: roles.map((r) => r.roleName),
+        })),
+        networkSites: sites?.map((s) => ({
+            id: s.id,
+            displayName: s.displayName,
+            controlUrl: s.controlUrl,
+            accounts: s.accounts,
+            splitDns: s.splitDns,
+            connectorVpcs: s.connectorVpcs,
+        })),
+        // Only an ENABLED block reaches the API env — absent = the routes answer 501.
+        devShares: devShares?.enabled ? devShares : undefined,
+        accountDimensions,
+    });
+    const webStack = new web_stack_1.WebStack(scope, "WebStack", {
+        ...hubStack,
+        crossRegionReferences: true,
+        resourcePrefix,
+        api: credsStack.api,
+        userPool: credsStack.userPool,
+        branding: { projectName: project.projectName, ...project.branding },
+        mfa: project.loginMethods.mfa,
+        passkey: project.loginMethods.passkey,
+        federation,
+        web: project.web,
+        certificate: webCertStack.certificate,
+        webAclArn: webCertStack.webAclArn,
+        // VPN is opt-in: without sites the web app hides its Network pages.
+        network: !!(project.network && sites),
+        // Only an ENABLED block reaches config.json — absent = the UI hides the feature.
+        devShares: devShares?.enabled ? devShares : undefined,
+        accountDimensions,
+        webAssetPath: props.webAssetPath,
+        plugins: plugins && {
+            discoveryRefreshSeconds: plugins.discoveryRefreshSeconds,
+            assetsBucketName: dataStack.pluginAssetsBucket.bucketName,
+        },
+        accessLogsBucket: dataStack.accessLogsBucket,
+    });
+    // Site ids and control-plane URLs are permanent once anything enrolls (same class of invariant
+    // as the issuer).
+    let networkStack;
+    if (project.network && sites) {
+        networkStack = new network_stack_1.NetworkStack(scope, "NetworkStack", {
+            ...hubStack,
+            resourcePrefix,
+            hostedZoneId: project.network.hostedZoneId,
+            zoneName: project.network.zoneName,
+            subdomain: project.network.subdomain,
+            sites,
+            prod: project.prod,
+            containerInsights: project.network.containerInsights,
+            mirrorImages: project.network.mirrorImages,
+            resourcesTable: dataStack.resourcesTable,
+            accessTable: dataStack.accessTable,
+            groupsTable: dataStack.groupsTable,
+            accessLogsBucket: dataStack.accessLogsBucket,
+            alertTopic: credsStack.alertTopic,
+            auditLog: { table: dataStack.auditTable, retentionDays: auditRetentionDays },
+        });
+        // Which site a connector joins is decided by which minter its account
+        // may invoke; redeploy NetworkStack after editing the lists.
+        for (const site of sites) {
+            for (const principal of site.connectorAccounts) {
+                networkStack.grantConnectorAccount(site.id, principal);
+            }
+        }
+    }
+    return { dataStack, credsStack, webCertStack, webStack, networkStack };
+}

package/dist/lib/audit-log.d.ts

@@ -0,0 +1,18 @@
+import type * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import type * as iam from "aws-cdk-lib/aws-iam";
+/** `audit` — the activity log's knobs (wiki Configuration Reference). */
+export interface AuditConfig {
+    /** How long activity rows are kept, in days (30–3650). Default 400: outlasts the 12-month access review. */
+    readonly retentionDays?: number;
+}
+export declare const DEFAULT_AUDIT_RETENTION_DAYS = 400;
+/** Validated at synth: an out-of-range retention would silently become the default in the Lambda. */
+export declare function resolveAuditRetentionDays(config: AuditConfig | undefined): number;
+/** Where a Lambda writes activity rows: the table and the retention every row's TTL derives from. */
+export interface AuditLogTarget {
+    readonly table: dynamodb.ITable;
+    readonly retentionDays: number;
+}
+/** Env + grant for any Lambda that records activity (services/auditService.ts reads both names). */
+export declare function auditLogEnv(target: AuditLogTarget): Record<string, string>;
+export declare function grantAuditLogWrite(grantee: iam.IGrantable, target: AuditLogTarget): void;

package/dist/lib/audit-log.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_AUDIT_RETENTION_DAYS = void 0;
+exports.resolveAuditRetentionDays = resolveAuditRetentionDays;
+exports.auditLogEnv = auditLogEnv;
+exports.grantAuditLogWrite = grantAuditLogWrite;
+exports.DEFAULT_AUDIT_RETENTION_DAYS = 400;
+/** Validated at synth: an out-of-range retention would silently become the default in the Lambda. */
+function resolveAuditRetentionDays(config) {
+    const days = config?.retentionDays ?? exports.DEFAULT_AUDIT_RETENTION_DAYS;
+    if (!Number.isInteger(days) || days < 30 || days > 3650) {
+        throw new Error(`audit.retentionDays (${String(config?.retentionDays)}) must be a whole number of days between 30 and 3650.`);
+    }
+    return days;
+}
+/** Env + grant for any Lambda that records activity (services/auditService.ts reads both names). */
+function auditLogEnv(target) {
+    return {
+        AUDIT_TABLE_NAME: target.table.tableName,
+        AUDIT_RETENTION_DAYS: String(target.retentionDays),
+    };
+}
+function grantAuditLogWrite(grantee, target) {
+    target.table.grantWriteData(grantee);
+}

package/dist/lib/connector-stack.d.ts

@@ -0,0 +1,28 @@
+import * as cdk from "aws-cdk-lib";
+import { Construct } from "constructs";
+import { IAccessPortalHub } from "./access-portal-hub";
+export interface ConnectorStackProps extends cdk.StackProps {
+    /** The hub this connector belongs to (`AccessPortalHub.fromAttributes`). */
+    readonly hub: IAccessPortalHub;
+    /** Site (routing domain) this VPC joins — decides the control plane and
+     *  WHICH minter this account invokes (the site-selection security boundary). */
+    readonly site: string;
+    /** VPC (in this stack's account) to make reachable — looked up at synth. */
+    readonly vpcId: string;
+    /** CIDRs to advertise — usually just that VPC's CIDR. */
+    readonly routes: string[];
+    /** Container Insights on the connector cluster (Security Hub ECS.12). */
+    readonly containerInsights?: boolean;
+    /** Run the connector from a copy of its image in this account's own registry (config
+     *  `network.mirrorImages`). Default false. */
+    readonly mirrorImages?: boolean;
+    /** Tells this VPC from the account's others (config `connectorVpcs[].name`):
+     *  suffixes the node hostname and the SG-manager/resolver function names, so
+     *  two stacks in one account never collide. Omit for the one unnamed VPC. */
+    readonly name?: string;
+}
+/** One per connector VPC, deployed with that account's credentials; the
+ *  flexible path uses TailnetConnector + SgManager directly instead. */
+export declare class ConnectorStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props: ConnectorStackProps);
+}

package/dist/lib/connector-stack.js

@@ -0,0 +1,81 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorStack = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
+const tailnet_connector_1 = require("./constructs/tailnet-connector");
+const sg_manager_1 = require("./constructs/sg-manager");
+const tailnet_resolver_1 = require("./constructs/tailnet-resolver");
+const naming_1 = require("../lambdacode/network/naming");
+/** One per connector VPC, deployed with that account's credentials; the
+ *  flexible path uses TailnetConnector + SgManager directly instead. */
+class ConnectorStack extends cdk.Stack {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        if (props.name !== undefined)
+            (0, naming_1.assertConnectorName)(props.name, "ConnectorStack");
+        const vpc = ec2.Vpc.fromLookup(this, "Vpc", { vpcId: props.vpcId });
+        const connector = new tailnet_connector_1.TailnetConnector(this, "Connector", {
+            vpc,
+            controlUrl: props.hub.controlUrl(props.site),
+            routes: props.routes,
+            minter: props.hub.connectorKeyMinter(this, props.site),
+            containerInsights: props.containerInsights,
+            mirrorImages: props.mirrorImages,
+            hostname: (0, naming_1.connectorHostname)(this.account, props.name), // the reconciler's contract (naming.ts)
+        });
+        // The reconciler reaches this account itself only from the hub's region; elsewhere only
+        // its relay can (see `connectorVpcs.<account>.region`).
+        const trustedInvoker = this.region === props.hub.region
+            ? props.hub.aclReconcilerPrincipal()
+            : props.hub.aclReconcilerRelayPrincipal();
+        new sg_manager_1.SgManager(this, "SgManager", {
+            resourcePrefix: props.hub.resourcePrefix,
+            vpc,
+            connectorSecurityGroup: connector.securityGroup,
+            trustedInvoker,
+            name: props.name,
+        });
+        new tailnet_resolver_1.TailnetResolver(this, "TailnetResolver", {
+            resourcePrefix: props.hub.resourcePrefix,
+            site: props.site,
+            vpc,
+            trustedInvoker,
+            name: props.name,
+        });
+    }
+}
+exports.ConnectorStack = ConnectorStack;

package/dist/lib/constructs/app-function.d.ts

@@ -0,0 +1,14 @@
+import { Construct } from "constructs";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+export interface AppFunctionProps extends Omit<lambda.FunctionProps, "code" | "runtime" | "handler"> {
+    /** Directory name under the package's assets/ — a prebuilt bundle produced
+     *  by scripts/bundle-lambdas.mjs (prepack runs it at publish time). */
+    readonly asset: string;
+    /** Exported name inside the bundle's index.js (default "handler"). */
+    readonly handler?: string;
+}
+/** Node Lambda over PREBUILT bundles — identical bytes wherever the synth
+ *  runs. Extends lambda.Function so the CFN logical ids never moved. */
+export declare class AppFunction extends lambda.Function {
+    constructor(scope: Construct, id: string, props: AppFunctionProps);
+}

package/dist/lib/constructs/app-function.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppFunction = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const aws_logs_1 = require("aws-cdk-lib/aws-logs");
+const pkg_paths_1 = require("../pkg-paths");
+/** Node Lambda over PREBUILT bundles — identical bytes wherever the synth
+ *  runs. Extends lambda.Function so the CFN logical ids never moved. */
+class AppFunction extends lambda.Function {
+    constructor(scope, id, props) {
+        const { asset, handler, ...rest } = props;
+        const dir = path.join((0, pkg_paths_1.packageRoot)(), "assets", asset);
+        if (!fs.existsSync(path.join(dir, "index.js"))) {
+            throw new Error(`Missing prebuilt bundle assets/${asset}/index.js — run ` +
+                `"node scripts/bundle-lambdas.mjs" in the package first (cdk.json ` +
+                `and prepack run it automatically).`);
+        }
+        // npm strips `node_modules` at EVERY depth from tarballs — deps ship as
+        // `vendor_modules` and local bundling restores the runtime name.
+        const vendor = path.join(dir, "vendor_modules");
+        const code = fs.existsSync(vendor)
+            ? lambda.Code.fromAsset(dir, {
+                bundling: {
+                    image: cdk.DockerImage.fromRegistry("scratch"), // never used
+                    local: {
+                        tryBundle(outputDir) {
+                            fs.cpSync(dir, outputDir, { recursive: true });
+                            fs.renameSync(path.join(outputDir, "vendor_modules"), path.join(outputDir, "node_modules"));
+                            return true;
+                        },
+                    },
+                },
+            })
+            : lambda.Code.fromAsset(dir);
+        super(scope, id, {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            // CDK-named group (never collides with pre-existing /aws/lambda/<fn>
+            // ones); three months bounds cost, default is never-expire.
+            logGroup: new aws_logs_1.LogGroup(scope, `${id}Logs`, {
+                retention: aws_logs_1.RetentionDays.THREE_MONTHS,
+            }),
+            code,
+            handler: `index.${handler ?? "handler"}`,
+            ...rest,
+        });
+    }
+}
+exports.AppFunction = AppFunction;

package/dist/lib/constructs/app-table.d.ts

@@ -0,0 +1,12 @@
+import { Construct } from "constructs";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+export interface AppTableProps extends dynamodb.TableProps {
+    /** true = RETAIN on stack delete + point-in-time recovery + deletion
+     *  protection. Default false (sandbox: DESTROY, no PITR). */
+    readonly prod?: boolean;
+}
+/** Table defaults (on-demand, prod hardening). Extends dynamodb.Table so the
+ *  CFN logical id is unchanged — no replacement of data-bearing tables. */
+export declare class AppTable extends dynamodb.Table {
+    constructor(scope: Construct, id: string, props: AppTableProps);
+}

package/dist/lib/constructs/app-table.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppTable = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const dynamodb = __importStar(require("aws-cdk-lib/aws-dynamodb"));
+/** Table defaults (on-demand, prod hardening). Extends dynamodb.Table so the
+ *  CFN logical id is unchanged — no replacement of data-bearing tables. */
+class AppTable extends dynamodb.Table {
+    constructor(scope, id, props) {
+        const { prod = false, ...tableProps } = props;
+        super(scope, id, {
+            ...tableProps,
+            billingMode: tableProps.billingMode ?? dynamodb.BillingMode.PAY_PER_REQUEST,
+            removalPolicy: prod ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            pointInTimeRecoverySpecification: prod
+                ? { pointInTimeRecoveryEnabled: true }
+                : undefined,
+            // Security Hub DynamoDB.6. RETAIN already skips the table on teardown, so
+            // this only blocks a direct DeleteTable; pass false one deploy before
+            // removing a table for good.
+            deletionProtection: tableProps.deletionProtection ?? prod,
+        });
+    }
+}
+exports.AppTable = AppTable;

package/dist/lib/constructs/mirrored-image.d.ts

@@ -0,0 +1,12 @@
+import { Construct } from "constructs";
+import * as ecs from "aws-cdk-lib/aws-ecs";
+/** A copy of a public image (`host/path:tag`) in this account's own registry, made once at deploy. A task
+ *  that starts later (a restart, a replacement) then needs only AWS, not the public registry being reachable
+ *  at that moment. Every task definition using `image` must depend on `copy`, or its service can start a
+ *  task before the image is there. */
+export declare function mirroredImage(scope: Construct, id: string, source: string): {
+    image: ecs.ContainerImage;
+    copy: Construct;
+};
+/** The image for one task definition: straight from its public registry, or mirrored. */
+export declare function taskImage(scope: Construct, id: string, source: string, mirror: boolean | undefined, taskDefinition: ecs.TaskDefinition): ecs.ContainerImage;

package/dist/lib/constructs/mirrored-image.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mirroredImage = mirroredImage;
+exports.taskImage = taskImage;
+const cdk = __importStar(require("aws-cdk-lib"));
+const ecr = __importStar(require("aws-cdk-lib/aws-ecr"));
+const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
+/** Loaded only when mirroring is on: the package (about 50 MB, with its own `constructs` floor) is an
+ *  optional peer, so deployments that leave the option off install nothing extra. */
+function copyTool() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return require("cdk-ecr-deployment");
+    }
+    catch {
+        throw new Error(`mirrorImages needs the "cdk-ecr-deployment" package: run "npm install cdk-ecr-deployment" in your deployment project.`);
+    }
+}
+/** A copy of a public image (`host/path:tag`) in this account's own registry, made once at deploy. A task
+ *  that starts later (a restart, a replacement) then needs only AWS, not the public registry being reachable
+ *  at that moment. Every task definition using `image` must depend on `copy`, or its service can start a
+ *  task before the image is there. */
+function mirroredImage(scope, id, source) {
+    const tag = source.slice(source.lastIndexOf(":") + 1);
+    const ecrdeploy = copyTool();
+    const repository = new ecr.Repository(scope, `${id}Repo`, {
+        imageScanOnPush: true,
+        // Not IMMUTABLE: a rollback re-runs the copy onto a tag that already exists, and a refused
+        // overwrite there would strand the stack in UPDATE_ROLLBACK_FAILED. The tag is our own pin.
+        lifecycleRules: [{ maxImageCount: 5 }],
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+        emptyOnDelete: true,
+    });
+    const copy = new ecrdeploy.ECRDeployment(scope, `${id}Copy`, {
+        src: new ecrdeploy.DockerImageName(source),
+        dest: new ecrdeploy.DockerImageName(repository.repositoryUriForTag(tag)),
+    });
+    return { image: ecs.ContainerImage.fromEcrRepository(repository, tag), copy };
+}
+/** The image for one task definition: straight from its public registry, or mirrored. */
+function taskImage(scope, id, source, mirror, taskDefinition) {
+    if (!mirror)
+        return ecs.ContainerImage.fromRegistry(source);
+    const mirrored = mirroredImage(scope, id, source);
+    taskDefinition.node.addDependency(mirrored.copy);
+    return mirrored.image;
+}

package/dist/lib/constructs/monitoring.d.ts

@@ -0,0 +1,21 @@
+import { Construct } from "constructs";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as sns from "aws-cdk-lib/aws-sns";
+export interface MonitoringProps {
+    /** Ops alert recipients, one subscription each. AWS sends every address a
+     *  "Confirm subscription" email on first deploy — it gets nothing until clicked. */
+    readonly alertEmails: readonly string[];
+    /** The vend API Lambda — error/throttle alarms + DENIED-spike on its logs. */
+    readonly vendingFn: lambda.Function;
+    /** Public issuer URL; the canary probes its discovery document + JWKS. */
+    readonly issuerUrl: string;
+    /** The active signer's KMS key id — the canary requires it in the JWKS. */
+    readonly signingKeyId: string;
+}
+/** Lambda error/throttle alarms, a DENIED-spike alarm, and an issuer health
+ *  canary — all fanned out through one SNS topic. */
+export declare class Monitoring extends Construct {
+    /** All alarms notify here; add subscriptions to add recipients. */
+    readonly topic: sns.Topic;
+    constructor(scope: Construct, id: string, props: MonitoringProps);
+}