@mavogel/cdk-vscode-server 0.0.96 → 0.0.97

package/.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

package/.jsii

@@ -4084,8 +4084,8 @@
   "docs": {
     "stability": "experimental"
   },
-  "homepage": "https://github.com/MV-Consulting/cdk-vscode-server.git",
-  "jsiiVersion": "5.9.44 (build 150b837)",
+  "homepage": "https://github.com/mavogel/cdk-vscode-server.git",
+  "jsiiVersion": "5.9.51 (build 95a1df0)",
   "keywords": [
     "aws",
     "cdk",
@@ -4100,15 +4100,16 @@
         "hasDefaultInterfaces": true
       }
     },
+    "tscOutDir": "lib",
     "tscRootDir": "src"
   },
   "name": "@mavogel/cdk-vscode-server",
   "readme": {
-    "markdown": "![Source](https://img.shields.io/github/stars/MV-Consulting/cdk-vscode-server?logo=github&label=GitHub%20Stars)\n[![Build Status](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml)\n[![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)\n[![Latest release](https://img.shields.io/github/release/MV-Consulting/cdk-vscode-server.svg)](https://github.com/MV-Consulting/cdk-vscode-server/releases)\n![GitHub](https://img.shields.io/github/license/MV-Consulting/cdk-vscode-server)\n[![npm](https://img.shields.io/npm/dt/@mavogel/cdk-vscode-server?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n[![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n\n# cdk-vscode-server\n\nRunning your dev IDE vscode on AWS for development and workshop purposes.\n\n> [!Note]\n> This construct is designed for workshop purposes and does not fulfill all security and authentication best practices.\n\n![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I\nwe implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**\n\n## Table of Contents\n\n- [Features](#features)\n- [Usage](#usage)\n  - [Standard](#Standard)\n  - [Pre-populate with Git Repository](#pre-populate-with-git-repository)\n  - [Custom Domain Configuration](#custom-domain-configuration)\n  - [Auto-Stop Configuration](#auto-stop-configuration)\n  - [Custom Installation Steps](#custom-installation-steps)\n- [Solution Design](#solution-design)\n- [Inspiration](#inspiration)\n\n## Features\n\n- ⚡ **Quick Setup**: Spin up and configure your [vscode](https://code.visualstudio.com/) server in under 10 minutes in your AWS account\n- 📏 **Best Practice Setup**: Set up with [projen](https://projen.io/) and a [single configuration file](./.projenrc.ts) to keep your changes centralized.\n- 🤹‍♂️ **Pre-installed packages**: Besides the [vscode](https://code.visualstudio.com/) server, other tools and software packages such as `git`, `docker`, `awscli` `nodejs` and `python` are pre-installed on the EC2 instance.\n- 🌐 **Custom Domain Support**: Use your own domain name with automatic ACM certificate creation and Route53 DNS configuration, or bring your existing certificate.\n- 💰 **Auto-Stop**: Automatically stop EC2 instances after inactivity with Elastic IP retention - save up to 75% on costs for development environments.\n- 🔧 **Custom Install Steps**: Extend the standard installation with your own shell commands to install workshop-specific tools, configure environments, or run setup scripts.\n- 🏗️ **Extensibility**: Pass in properties to the construct, which start with `additional*`. They allow you to extend the configuration to your needs. There are more to come...\n\n## Usage\nActually we supported 2 modes:\n\n### Standard\nThe following steps get you started:\n\n1. Create a new `awscdk-app` via\n```bash\nnpx projen new awscdk-app-ts --package-manager=npm\n```\n3. Add `@mavogel/cdk-vscode-server` as a dependency to your project in the `.projenrc.ts` file\n4. Run `npx projen` to install it\n5. Add the following to the `src/main.ts` file:\n```ts\nimport { App, Stack, StackProps } from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport * as iam from 'aws-cdk-lib/aws-iam';\nimport { Construct } from 'constructs';\nimport {\n  LinuxArchitectureType,\n  LinuxFlavorType,\n  VSCodeServer\n} from '@mavogel/cdk-vscode-server';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    new VSCodeServer(this, 'vscode', {\n      // for example (or simply use the defaults by not setting the properties)\n      instanceVolumeSize: 8,\n      instanceClass: ec2.InstanceClass.M7G,\n      instanceSize: ec2.InstanceSize.LARGE,\n      instanceOperatingSystem: LinuxFlavorType.UBUNTU_24,\n      instanceCpuArchitecture: LinuxArchitectureType.ARM,\n\n      // 👇🏽 or if you want to give the InstanceRole more permissions\n      additionalInstanceRolePolicies: [\n        new iam.PolicyStatement({\n          effect: iam.Effect.ALLOW,\n          actions: [\n            'codebuild:*',\n          ],\n          resources: [\n            `arn:aws:codebuild:*:${Stack.of(this).account}:*/*`,\n          ],\n        }),\n      ]\n\n      // and more... 💡\n    });\n  }\n}\n\nconst env = {\n  account: '123456789912',\n  region: 'eu-central-1',\n};\n\nconst app = new App();\nnew MyStack(app, 'vscode-server', { env });\napp.synth();\n```\n\nand deploy it\n```bash\nnpx projen build\nnpx projen deploy\n```\n\nwith the output\n```console\n✨  Deployment time: 509.87s\n\nOutputs:\ndev.vscodedomainName6729AA39 = https://d1foo65bar4baz.cloudfront.net/?folder=/Workshop\ndev.vscodepassword64FBCA12 = foobarbaz\n```\n\nSee the [examples](./examples) folder for more inspiration.\n\n### Pre-populate with Git Repository\n\nClone a git repository into the VS Code Server's home folder during instance setup - perfect for workshops or development environments with starter code:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // Clone a git repository into the home folder\n  repoUrl: 'https://github.com/aws-samples/my-workshop-repo.git',\n\n  // Optional: customize the home folder path (default: /Workshop)\n  homeFolder: '/MyWorkshop',\n\n  // Optional: specify VS Code user (default: vscode-user)\n  vscodeUser: 'workshop-user',\n});\n```\n\n**What happens:**\n1. During instance setup, the specified git repository is cloned into the user's home folder\n2. VS Code Server opens with the repository already loaded and ready to use\n3. Participants can start coding immediately without manual git clone steps\n\n**Use cases:**\n- Workshop environments with pre-configured starter code\n- Development environments with boilerplate projects\n- Training sessions with example applications\n- Code review sessions with pre-loaded repositories\n\n**Repository requirements:**\n- Must be publicly accessible (no authentication required)\n- HTTPS URLs only (SSH git URLs are not supported)\n- Repository will be cloned using `git clone` during instance initialization\n\nFor complete examples, see [examples/](./examples).\n\n### Custom Domain Configuration\n\nYou can configure your VS Code Server with a custom domain name instead of using the default CloudFront domain. The construct supports three different configuration options:\n\n#### Option 1: Auto-create Certificate with DNS Validation\n```ts\nnew VSCodeServer(this, 'vscode', {\n  domainName: 'vscode.example.com',\n  hostedZoneId: 'Z123EXAMPLE456',  // optional - will auto-discover if not provided\n  autoCreateCertificate: true,\n});\n```\n\nThis will:\n- Create an ACM certificate in us-east-1 (required for CloudFront)\n- Validate the certificate using DNS validation\n- Create a Route53 A record pointing to the CloudFront distribution\n- Configure the CloudFront distribution with the custom domain\n\n#### Option 2: Use Existing Certificate\n```ts\nnew VSCodeServer(this, 'vscode', {\n  domainName: 'vscode.example.com',\n  hostedZoneId: 'Z123EXAMPLE456',\n  certificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012',\n});\n```\n\n**Requirements:**\n- Certificate must be in us-east-1 region\n- Certificate must be validated and ready to use\n- Certificate must include the domain name\n\n#### Option 3: Default (No Custom Domain)\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // No domain configuration - uses CloudFront default domain\n});\n```\n\nFor complete examples, see [examples/custom-domain/main.ts](./examples/custom-domain/main.ts).\n\n6. Then open the domain name in your favorite browser and you'd see the following login screen:\n![vscode-server-ui-login](docs/img/vscode-server-ui-login-min.png)\n\n7. After entering the password, you are logged into VSCode and can start coding :tada:\n\n![vscode-server-ui](docs/img/vscode-server-ui-min.png)\n\n> [!Important]\n> There are issues with copy pasting into the VSCode terminal within the Firefox browser (2025-01-12)\n\n### Auto-Stop Configuration\n\nSave up to 75% on costs by automatically stopping EC2 instances when idle:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  enableAutoStop: true,              // Enable auto-stop feature\n  idleTimeoutMinutes: 30,            // Stop after 30 minutes of no activity (default)\n  idleCheckIntervalMinutes: 5,       // Check for idle activity every 5 minutes (default)\n});\n```\n\n**How it works:**\n1. **Idle Detection**: Monitors CloudFront request metrics at configured intervals (default: every 5 minutes)\n2. **Auto-Stop**: Stops the EC2 instance after the configured idle timeout when no requests are detected\n3. **Static IP**: Allocates an Elastic IP to maintain a consistent public IP address across stop/start cycles\n4. **Manual Resume**: Users can manually start the instance via AWS Console or CLI when needed\n\n**Cost Savings Example:**\n- **Without auto-stop**: m7g.xlarge running 24/7 = ~$120/month\n- **With auto-stop** (8 hours/day, 5 days/week): ~$30/month\n- **Savings**: ~$90/month (75% reduction)\n\n**Additional costs:**\n- Elastic IP (allocated): ~$3.65/month\n- Lambda function (IdleMonitor): ~$0.10/month\n- EventBridge rule: Negligible\n- **Net savings**: ~$86/month per instance\n\n**Architecture Components:**\n- Elastic IP for consistent public addressing\n- EventBridge rule triggering idle monitoring at configured intervals\n- IdleMonitor Lambda function checking CloudWatch metrics for request activity\n- IdleMonitorEnabler custom resource ensuring monitoring only starts after installation completes\n- CloudWatch metrics from CloudFront distribution\n\n**Integration Testing:**\n\nThe stop-on-idle functionality includes comprehensive integration tests (`integ-tests/integ.stop-on-idle.ts`) that verify the complete workflow:\n\n1. **Phase 1 - Verify Auto-Stop**: Waits for the instance to automatically stop after the configured idle timeout\n2. **Phase 2 - Disable IdleMonitor**: Disables the EventBridge rule to prevent the instance from being stopped again during testing\n3. **Phase 3 - Start Instance**: Starts the stopped instance and waits for it to reach the running state\n4. **Phase 4 - Verify Login**: Confirms that VS Code Server is accessible through CloudFront after the instance has been restarted\n\nThis 4-phase test ensures that:\n- Idle detection works correctly based on CloudWatch metrics\n- Instance stops automatically when no activity is detected\n- Instance can be successfully restarted after being stopped\n- VS Code Server remains accessible after stop/start cycles\n- Elastic IP maintains connectivity across state changes\n\nRun integration tests with:\n```bash\nnpm run integ-test\n```\n\n### Custom Installation Steps\n\nExtend the standard VS Code Server installation with your own custom shell commands - perfect for installing workshop-specific tools, configuring development environments, or running setup scripts:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // Add custom installation steps that run after standard setup\n  customInstallSteps: [\n    {\n      name: 'InstallWorkshopTools',\n      commands: [\n        '#!/bin/bash',\n        'echo \"Installing workshop-specific tools\"',\n\n        // Install additional software\n        'curl -fsSL https://get.docker.com | sh',\n        'usermod -aG docker ubuntu',\n\n        // Configure environment\n        'echo \"export WORKSHOP_ENV=production\" >> /home/ubuntu/.bashrc',\n      ],\n    },\n    {\n      name: 'CloneStarterCode',\n      commands: [\n        '#!/bin/bash',\n        'cd /home/ubuntu',\n        'git clone https://github.com/my-org/workshop-starter.git',\n        'chown -R ubuntu:ubuntu workshop-starter',\n      ],\n    },\n  ],\n});\n```\n\n**Key Features:**\n- **Execute After Standard Setup**: Custom steps run after VS Code Server installation completes\n- **Multiple Steps**: Add as many installation steps as needed, executed in order\n- **Full Shell Access**: Run any shell commands with root privileges\n- **Workshop-Friendly**: Pre-install tools, configure environments, or download starter code\n\n**Common Use Cases:**\n- Install additional development tools (Docker, kubectl, terraform)\n- Configure workshop-specific environments and credentials\n- Clone starter code repositories with specific permissions\n- Set up databases or services required for training\n- Download and prepare datasets or assets\n- Configure IDE extensions or settings\n\n**Supported Operating Systems:**\n- Ubuntu 22/24/25\n- Amazon Linux 2023\n\n**Requirements:**\n- Commands execute with root privileges during instance initialization\n- Use absolute paths or ensure proper working directory context\n- Consider idempotency if instance might be restarted\n- Commands run synchronously in the order specified\n\nFor complete examples, see [examples/custom-install-steps/main.ts](./examples/custom-install-steps/main.ts).\n\n## Solution Design\n\n<details>\n  <summary>... if you're curious about click here for the details</summary>\n\n![vscode-server-solution-design](docs/img/vscode-server.drawio-min.png)\n\n</details>\n\n## Inspiration\nThis project was created based on the following inspiration\n\n- [vscode-on-ec2-for-prototyping](https://github.com/aws-samples/vscode-on-ec2-for-prototyping): as baseline, which unfortunately was outdated\n- [aws-terraform-dev-container](https://github.com/awslabs/aws-terraform-dev-container): as baseline for terraform, but unfortunately also outdated\n- [java-on-aws-workshop-ide-only.yaml](https://github.com/aws-samples/java-on-aws/blob/main/labs/unicorn-store/infrastructure/cfn/java-on-aws-workshop-ide-only.yaml): an already synthesized cloudformation stack, which used mostly python as the custom resources\n- [fleet-workshop-team-stack-self.json](https://static.us-east-1.prod.workshops.aws/public/cc4aa67e-5b7a-4df1-abf7-c42502899a25/assets/fleet-workshop-team-stack-self.json): also an already synthesized cloudformation stack, which did much more as I currently implemented here.\n- [eks-workshop-vscode-cfn.yaml](https://github.com/aws-samples/eks-workshop-v2/blob/main/lab/cfn/eks-workshop-vscode-cfn.yaml): another great baseline\n\n\n## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure\n\nHi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.\n\n---\n\n### 🌟 Why Work With Me?\n\n✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.\n✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.\n✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.\n✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.\n\n---\n\n### 🛠 What I Bring to the Table\n\n🔑 **12x AWS Certifications**\nI’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)\n\n⚙️ **Infrastructure as Code (IaC)**\nWith deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.\n\n📦 **DevOps Expertise**\nFrom CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.\n\n🌐 **Hands-On Experience**\nWith over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)\n\n---\n\n### 💼 Let’s Build Something Great Together\n\nI know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.\n\n✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.\n✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.\n✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.\n\n\n<a href=\"https://tinyurl.com/mvc-15min\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n\n---\n\n## 🙌 Acknowledgements\n\nBig shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!\nTheir groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
+    "markdown": "![Source](https://img.shields.io/github/stars/mavogel/cdk-vscode-server?logo=github&label=GitHub%20Stars)\n[![Build Status](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml)\n[![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)\n[![Latest release](https://img.shields.io/github/release/mavogel/cdk-vscode-server.svg)](https://github.com/mavogel/cdk-vscode-server/releases)\n![GitHub](https://img.shields.io/github/license/mavogel/cdk-vscode-server)\n[![npm](https://img.shields.io/npm/dt/@mavogel/cdk-vscode-server?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n[![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n\n# cdk-vscode-server\n\nRunning your dev IDE vscode on AWS for development and workshop purposes.\n\n> [!Note]\n> This construct is designed for workshop purposes and does not fulfill all security and authentication best practices.\n\n![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I\nwe implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**\n\n## Table of Contents\n\n- [Features](#features)\n- [Usage](#usage)\n  - [Standard](#Standard)\n  - [Pre-populate with Git Repository](#pre-populate-with-git-repository)\n  - [Custom Domain Configuration](#custom-domain-configuration)\n  - [Auto-Stop Configuration](#auto-stop-configuration)\n  - [Custom Installation Steps](#custom-installation-steps)\n- [Solution Design](#solution-design)\n- [Inspiration](#inspiration)\n\n## Features\n\n- ⚡ **Quick Setup**: Spin up and configure your [vscode](https://code.visualstudio.com/) server in under 10 minutes in your AWS account\n- 📏 **Best Practice Setup**: Set up with [projen](https://projen.io/) and a [single configuration file](./.projenrc.ts) to keep your changes centralized.\n- 🤹‍♂️ **Pre-installed packages**: Besides the [vscode](https://code.visualstudio.com/) server, other tools and software packages such as `git`, `docker`, `awscli` `nodejs` and `python` are pre-installed on the EC2 instance.\n- 🌐 **Custom Domain Support**: Use your own domain name with automatic ACM certificate creation and Route53 DNS configuration, or bring your existing certificate.\n- 💰 **Auto-Stop**: Automatically stop EC2 instances after inactivity with Elastic IP retention - save up to 75% on costs for development environments.\n- 🔧 **Custom Install Steps**: Extend the standard installation with your own shell commands to install workshop-specific tools, configure environments, or run setup scripts.\n- 🏗️ **Extensibility**: Pass in properties to the construct, which start with `additional*`. They allow you to extend the configuration to your needs. There are more to come...\n\n## Usage\nActually we supported 2 modes:\n\n### Standard\nThe following steps get you started:\n\n1. Create a new `awscdk-app` via\n```bash\nnpx projen new awscdk-app-ts --package-manager=npm\n```\n3. Add `@mavogel/cdk-vscode-server` as a dependency to your project in the `.projenrc.ts` file\n4. Run `npx projen` to install it\n5. Add the following to the `src/main.ts` file:\n```ts\nimport { App, Stack, StackProps } from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport * as iam from 'aws-cdk-lib/aws-iam';\nimport { Construct } from 'constructs';\nimport {\n  LinuxArchitectureType,\n  LinuxFlavorType,\n  VSCodeServer\n} from '@mavogel/cdk-vscode-server';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    new VSCodeServer(this, 'vscode', {\n      // for example (or simply use the defaults by not setting the properties)\n      instanceVolumeSize: 8,\n      instanceClass: ec2.InstanceClass.M7G,\n      instanceSize: ec2.InstanceSize.LARGE,\n      instanceOperatingSystem: LinuxFlavorType.UBUNTU_24,\n      instanceCpuArchitecture: LinuxArchitectureType.ARM,\n\n      // 👇🏽 or if you want to give the InstanceRole more permissions\n      additionalInstanceRolePolicies: [\n        new iam.PolicyStatement({\n          effect: iam.Effect.ALLOW,\n          actions: [\n            'codebuild:*',\n          ],\n          resources: [\n            `arn:aws:codebuild:*:${Stack.of(this).account}:*/*`,\n          ],\n        }),\n      ]\n\n      // and more... 💡\n    });\n  }\n}\n\nconst env = {\n  account: '123456789912',\n  region: 'eu-central-1',\n};\n\nconst app = new App();\nnew MyStack(app, 'vscode-server', { env });\napp.synth();\n```\n\nand deploy it\n```bash\nnpx projen build\nnpx projen deploy\n```\n\nwith the output\n```console\n✨  Deployment time: 509.87s\n\nOutputs:\ndev.vscodedomainName6729AA39 = https://d1foo65bar4baz.cloudfront.net/?folder=/Workshop\ndev.vscodepassword64FBCA12 = foobarbaz\n```\n\nSee the [examples](./examples) folder for more inspiration.\n\n### Pre-populate with Git Repository\n\nClone a git repository into the VS Code Server's home folder during instance setup - perfect for workshops or development environments with starter code:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // Clone a git repository into the home folder\n  repoUrl: 'https://github.com/aws-samples/my-workshop-repo.git',\n\n  // Optional: customize the home folder path (default: /Workshop)\n  homeFolder: '/MyWorkshop',\n\n  // Optional: specify VS Code user (default: vscode-user)\n  vscodeUser: 'workshop-user',\n});\n```\n\n**What happens:**\n1. During instance setup, the specified git repository is cloned into the user's home folder\n2. VS Code Server opens with the repository already loaded and ready to use\n3. Participants can start coding immediately without manual git clone steps\n\n**Use cases:**\n- Workshop environments with pre-configured starter code\n- Development environments with boilerplate projects\n- Training sessions with example applications\n- Code review sessions with pre-loaded repositories\n\n**Repository requirements:**\n- Must be publicly accessible (no authentication required)\n- HTTPS URLs only (SSH git URLs are not supported)\n- Repository will be cloned using `git clone` during instance initialization\n\nFor complete examples, see [examples/](./examples).\n\n### Custom Domain Configuration\n\nYou can configure your VS Code Server with a custom domain name instead of using the default CloudFront domain. The construct supports three different configuration options:\n\n#### Option 1: Auto-create Certificate with DNS Validation\n```ts\nnew VSCodeServer(this, 'vscode', {\n  domainName: 'vscode.example.com',\n  hostedZoneId: 'Z123EXAMPLE456',  // optional - will auto-discover if not provided\n  autoCreateCertificate: true,\n});\n```\n\nThis will:\n- Create an ACM certificate in us-east-1 (required for CloudFront)\n- Validate the certificate using DNS validation\n- Create a Route53 A record pointing to the CloudFront distribution\n- Configure the CloudFront distribution with the custom domain\n\n#### Option 2: Use Existing Certificate\n```ts\nnew VSCodeServer(this, 'vscode', {\n  domainName: 'vscode.example.com',\n  hostedZoneId: 'Z123EXAMPLE456',\n  certificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012',\n});\n```\n\n**Requirements:**\n- Certificate must be in us-east-1 region\n- Certificate must be validated and ready to use\n- Certificate must include the domain name\n\n#### Option 3: Default (No Custom Domain)\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // No domain configuration - uses CloudFront default domain\n});\n```\n\nFor complete examples, see [examples/custom-domain/main.ts](./examples/custom-domain/main.ts).\n\n6. Then open the domain name in your favorite browser and you'd see the following login screen:\n![vscode-server-ui-login](docs/img/vscode-server-ui-login-min.png)\n\n7. After entering the password, you are logged into VSCode and can start coding :tada:\n\n![vscode-server-ui](docs/img/vscode-server-ui-min.png)\n\n> [!Important]\n> There are issues with copy pasting into the VSCode terminal within the Firefox browser (2025-01-12)\n\n### Auto-Stop Configuration\n\nSave up to 75% on costs by automatically stopping EC2 instances when idle:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  enableAutoStop: true,              // Enable auto-stop feature\n  idleTimeoutMinutes: 30,            // Stop after 30 minutes of no activity (default)\n  idleCheckIntervalMinutes: 5,       // Check for idle activity every 5 minutes (default)\n});\n```\n\n**How it works:**\n1. **Idle Detection**: Monitors CloudFront request metrics at configured intervals (default: every 5 minutes)\n2. **Auto-Stop**: Stops the EC2 instance after the configured idle timeout when no requests are detected\n3. **Static IP**: Allocates an Elastic IP to maintain a consistent public IP address across stop/start cycles\n4. **Manual Resume**: Users can manually start the instance via AWS Console or CLI when needed\n\n**Cost Savings Example:**\n- **Without auto-stop**: m7g.xlarge running 24/7 = ~$120/month\n- **With auto-stop** (8 hours/day, 5 days/week): ~$30/month\n- **Savings**: ~$90/month (75% reduction)\n\n**Additional costs:**\n- Elastic IP (allocated): ~$3.65/month\n- Lambda function (IdleMonitor): ~$0.10/month\n- EventBridge rule: Negligible\n- **Net savings**: ~$86/month per instance\n\n**Architecture Components:**\n- Elastic IP for consistent public addressing\n- EventBridge rule triggering idle monitoring at configured intervals\n- IdleMonitor Lambda function checking CloudWatch metrics for request activity\n- IdleMonitorEnabler custom resource ensuring monitoring only starts after installation completes\n- CloudWatch metrics from CloudFront distribution\n\n**Integration Testing:**\n\nThe stop-on-idle functionality includes comprehensive integration tests (`integ-tests/integ.stop-on-idle.ts`) that verify the complete workflow:\n\n1. **Phase 1 - Verify Auto-Stop**: Waits for the instance to automatically stop after the configured idle timeout\n2. **Phase 2 - Disable IdleMonitor**: Disables the EventBridge rule to prevent the instance from being stopped again during testing\n3. **Phase 3 - Start Instance**: Starts the stopped instance and waits for it to reach the running state\n4. **Phase 4 - Verify Login**: Confirms that VS Code Server is accessible through CloudFront after the instance has been restarted\n\nThis 4-phase test ensures that:\n- Idle detection works correctly based on CloudWatch metrics\n- Instance stops automatically when no activity is detected\n- Instance can be successfully restarted after being stopped\n- VS Code Server remains accessible after stop/start cycles\n- Elastic IP maintains connectivity across state changes\n\nRun integration tests with:\n```bash\nnpm run integ-test\n```\n\n### Custom Installation Steps\n\nExtend the standard VS Code Server installation with your own custom shell commands - perfect for installing workshop-specific tools, configuring development environments, or running setup scripts:\n\n```ts\nnew VSCodeServer(this, 'vscode', {\n  // Add custom installation steps that run after standard setup\n  customInstallSteps: [\n    {\n      name: 'InstallWorkshopTools',\n      commands: [\n        '#!/bin/bash',\n        'echo \"Installing workshop-specific tools\"',\n\n        // Install additional software\n        'curl -fsSL https://get.docker.com | sh',\n        'usermod -aG docker ubuntu',\n\n        // Configure environment\n        'echo \"export WORKSHOP_ENV=production\" >> /home/ubuntu/.bashrc',\n      ],\n    },\n    {\n      name: 'CloneStarterCode',\n      commands: [\n        '#!/bin/bash',\n        'cd /home/ubuntu',\n        'git clone https://github.com/my-org/workshop-starter.git',\n        'chown -R ubuntu:ubuntu workshop-starter',\n      ],\n    },\n  ],\n});\n```\n\n**Key Features:**\n- **Execute After Standard Setup**: Custom steps run after VS Code Server installation completes\n- **Multiple Steps**: Add as many installation steps as needed, executed in order\n- **Full Shell Access**: Run any shell commands with root privileges\n- **Workshop-Friendly**: Pre-install tools, configure environments, or download starter code\n\n**Common Use Cases:**\n- Install additional development tools (Docker, kubectl, terraform)\n- Configure workshop-specific environments and credentials\n- Clone starter code repositories with specific permissions\n- Set up databases or services required for training\n- Download and prepare datasets or assets\n- Configure IDE extensions or settings\n\n**Supported Operating Systems:**\n- Ubuntu 22/24/25\n- Amazon Linux 2023\n\n**Requirements:**\n- Commands execute with root privileges during instance initialization\n- Use absolute paths or ensure proper working directory context\n- Consider idempotency if instance might be restarted\n- Commands run synchronously in the order specified\n\nFor complete examples, see [examples/custom-install-steps/main.ts](./examples/custom-install-steps/main.ts).\n\n## Solution Design\n\n<details>\n  <summary>... if you're curious about click here for the details</summary>\n\n![vscode-server-solution-design](docs/img/vscode-server.drawio-min.png)\n\n</details>\n\n## Inspiration\nThis project was created based on the following inspiration\n\n- [vscode-on-ec2-for-prototyping](https://github.com/aws-samples/vscode-on-ec2-for-prototyping): as baseline, which unfortunately was outdated\n- [aws-terraform-dev-container](https://github.com/awslabs/aws-terraform-dev-container): as baseline for terraform, but unfortunately also outdated\n- [java-on-aws-workshop-ide-only.yaml](https://github.com/aws-samples/java-on-aws/blob/main/labs/unicorn-store/infrastructure/cfn/java-on-aws-workshop-ide-only.yaml): an already synthesized cloudformation stack, which used mostly python as the custom resources\n- [fleet-workshop-team-stack-self.json](https://static.us-east-1.prod.workshops.aws/public/cc4aa67e-5b7a-4df1-abf7-c42502899a25/assets/fleet-workshop-team-stack-self.json): also an already synthesized cloudformation stack, which did much more as I currently implemented here.\n- [eks-workshop-vscode-cfn.yaml](https://github.com/aws-samples/eks-workshop-v2/blob/main/lab/cfn/eks-workshop-vscode-cfn.yaml): another great baseline\n\n\n## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure\n\nHi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.\n\n---\n\n### 🌟 Why Work With Me?\n\n✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.\n✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.\n✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.\n✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.\n\n---\n\n### 🛠 What I Bring to the Table\n\n🔑 **12x AWS Certifications**\nI’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)\n\n⚙️ **Infrastructure as Code (IaC)**\nWith deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.\n\n📦 **DevOps Expertise**\nFrom CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.\n\n🌐 **Hands-On Experience**\nWith over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)\n\n---\n\n### 💼 Let’s Build Something Great Together\n\nI know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.\n\n✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.\n✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.\n✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.\n\n\n<a href=\"https://tinyurl.com/mvc-15min\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n\n---\n\n## 🙌 Acknowledgements\n\nBig shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!\nTheir groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MV-Consulting/cdk-vscode-server.git"
+    "url": "https://github.com/mavogel/cdk-vscode-server.git"
   },
   "schema": "jsii/0.10.0",
   "targets": {
@@ -5056,6 +5057,6 @@
       "symbolId": "src/vscode-server:VSCodeServerProps"
     }
   },
-  "version": "0.0.96",
-  "fingerprint": "+PrbO8SwG0nLPUDMMEkox1Fv5q2y8FaYYDTYt/WAL98="
+  "version": "0.0.97",
+  "fingerprint": "5rXsvQmSTPp+Y3HFP02+ROtCMzA7JbmxZIJm1olcRDg="
 }

package/README.md

@@ -1,8 +1,8 @@
-![Source](https://img.shields.io/github/stars/MV-Consulting/cdk-vscode-server?logo=github&label=GitHub%20Stars)
-[![Build Status](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml)
+![Source](https://img.shields.io/github/stars/mavogel/cdk-vscode-server?logo=github&label=GitHub%20Stars)
+[![Build Status](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml)
 [![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)
-[![Latest release](https://img.shields.io/github/release/MV-Consulting/cdk-vscode-server.svg)](https://github.com/MV-Consulting/cdk-vscode-server/releases)
-![GitHub](https://img.shields.io/github/license/MV-Consulting/cdk-vscode-server)
+[![Latest release](https://img.shields.io/github/release/mavogel/cdk-vscode-server.svg)](https://github.com/mavogel/cdk-vscode-server/releases)
+![GitHub](https://img.shields.io/github/license/mavogel/cdk-vscode-server)
 [![npm](https://img.shields.io/npm/dt/@mavogel/cdk-vscode-server?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)
 [![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)
 

package/docs/plans/2026-08-09-cdk-nag-v3-migration.md

@@ -0,0 +1,152 @@
+# CDK-Nag v3 Migration Implementation Plan
+
+Created: 2026-08-09
+Author: info@manuel-vogel.de
+Agent: Claude Code
+Status: PENDING
+Approved: Yes
+Iterations: 0
+Worktree: No
+Type: Feature
+
+## Summary
+
+**Goal:** Upgrade `@mavogel/mvc-projen` to its latest published version (`0.0.30`), which forces `cdk-nag@^3.0.1`, bump `aws-cdk-lib` to `2.261.0` to satisfy cdk-nag v3's `>=2.257.0` floor, and migrate all 19 existing `NagSuppressions` call sites across 7 source files to cdk-nag v3's `Validations.of(...).acknowledge(...)` API so the construct still suppresses its known findings and the test suite still asserts zero unacknowledged violations.
+
+## Out of Scope
+
+- Running `npm run integ-test` (real multi-region AWS deployment) — this plan verifies via local build/lint/synth/snapshot only.
+- Bumping `aws-cdk-lib` beyond `2.261.0` to the newest npm release (`2.263.0`) — user chose the version `@mavogel/mvc-projen`'s own migration already validated end-to-end.
+- Any `@mavogel/mvc-projen` version beyond `^0.0.30` (latest published as of this plan).
+- Re-running the release pipeline / publishing this bump — separate from this plan.
+
+## Approach
+
+**Chosen:** Mirror `@mavogel/mvc-projen`'s own validated cdk-nag v2→v3 migration (commit `76fddc5` in `/Users/mavogel/Developer/projects/mvc-projen`), adapted to this repo's 19 suppression call sites across `src/suppress-nags.ts`, `src/vscode-server.ts`, `src/installer/installer.ts`, `src/secret-retriever/secret-retriever.ts`, `src/idle-monitor-enabler/idle-monitor-enabler.ts`, `src/idle-monitor/idle-monitor.ts`, and `src/prefixlist-retriever/prefixlist-retriever.ts`.
+**Why:** That commit already proved the exact API shapes end-to-end against real `aws-cdk-lib@2.261.0` + `cdk-nag@3.0.1` (the author built a standalone harness to confirm 0 unacknowledged violations), so this plan reuses a validated pattern instead of guessing at cdk-nag v3's new API from its changelog alone.
+
+## Global Constraints
+
+- `@mavogel/mvc-projen@^0.0.30` in `.projenrc.ts` `deps` (was `^0.0.25`).
+- `cdkVersion: '2.261.0'` in `.projenrc.ts` (was `'2.190.0'`).
+- `cdk-nag@^3.0.1` — auto-added by `MvcCdkConstructLibrary` once `@mavogel/mvc-projen` is bumped; do not add it manually in `.projenrc.ts` `deps`.
+- Top-level `projen` devDependency must be re-aligned to `^0.101.31` (the version `@mavogel/mvc-projen@0.0.30` itself depends on) — same single-deduped-install reasoning as the prior release-pipeline fix; the existing `depsUpgradeOptions: { exclude: ['projen'] }` guard in `.projenrc.ts` stays as-is (it only blocks the *automated* weekly upgrade from drifting `projen` again, not this deliberate manual bump).
+
+## Context for Implementer
+
+cdk-nag v3 replaces its old `IAspect`-based suppression engine with CDK's native `IPolicyValidationPlugin`/`Validations` framework. Six things matter here:
+
+1. **`NagSuppressions` is fully removed** from cdk-nag v3's public API (verified against the published `cdk-nag@3.0.2` package — no export in any `lib/*.d.ts`). The code will fail to *compile* immediately after the dependency bump lands; this is the expected signal that the migration is required, not a bug to work around. There is no way to land the dependency bump and the suppression-call-site migration as two separately-green tasks — cdk-nag v2 and v3 cannot coexist in one `node_modules` tree, so Task 1 below intentionally bundles both.
+
+2. **Full call-site inventory (verified by `grep -rn "NagSuppressions\." src/`, 19 call sites across 7 files, all importing NagSuppressions from cdk-nag):**
+
+   | File | Call sites | Notes |
+   |------|-----------|-------|
+   | `src/suppress-nags.ts` | 1 | Uses `addResourceSuppressionsByPath` — see item 3 below |
+   | `src/vscode-server.ts` | 9 | Plain `addResourceSuppressions`; includes the IAM4/IAM5 sites noted in item 4 |
+   | `src/installer/installer.ts` | 3 | One call uses `appliesTo: ['Resource::*']` on `AwsSolutions-IAM5` — a granular finding, see item 4 |
+   | `src/secret-retriever/secret-retriever.ts` | 2 | Plain `addResourceSuppressions`, includes an `IAM4` on a Lambda default execution role |
+   | `src/idle-monitor-enabler/idle-monitor-enabler.ts` | 2 | Plain `addResourceSuppressions`, includes an `IAM4` on a Lambda default execution role |
+   | `src/idle-monitor/idle-monitor.ts` | 1 | Plain `addResourceSuppressions`, includes `IAM4` + `IAM5` |
+   | `src/prefixlist-retriever/prefixlist-retriever.ts` | 1 | Plain `addResourceSuppressions`, `IAM5` |
+
+   Every plain-id call site's third positional argument is `true` (v2's `applyToChildren`) and every resource argument is either a single construct or a single-element array — no call site suppresses more than one resource at once.
+
+3. **`suppress-nags.ts:9` uses `addResourceSuppressionsByPath(stack, path, [{id, reason}])`** — a stack + CloudFormation-path-string form, not a construct instance, so it has no direct `Validations.of(construct)` target. `Validations` operates on construct instances, so the migration must first resolve the construct at that path: `Node.of(stack).findAll().find(c => c.node.path === '<path-without-leading-slash-and-stack-name>')` (the v2 path argument `` `/${stack.stackName}/AWS679f53fac002430cb0da5b7982bd2287/Resource` `` is the CDK construct path, minus the leading slash, relative to `app`, not `stack` — resolve exactly against what `Node.of(stack).findAll()` returns before assuming the string form is directly reusable). If no construct exists at that exact path (i.e. it only exists in the synthesized template, not the construct tree), acknowledge on the nearest resolvable ancestor construct instead and note the substitution in the task's completion notes.
+
+4. **Granular per-resource finding ids — not limited to IAM4/IAM5, and not limited to a fixed applyToChildren cascade.** cdk-nag v3 reports a *granular* id embedding the specific managed-policy or resource ARN for any rule that inherently varies per-resource (confirmed for `AwsSolutions-IAM4`/`AwsSolutions-IAM5` against mvc-projen's own migrated example, `assets/cdk-construct/src_crd-example.ts`), e.g. `AwsSolutions-IAM5[Resource::<SomeLogicalId.Arn>:*]` or `AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]`. `Validations.of(x).acknowledge({id, reason})` rejects any id containing more than one `::` (`aws-cdk-lib`'s internal `Validations.qualifyId` validator), so these granular findings need the bypass helper mvc-projen already wrote and validated:
+
+   ```typescript
+   function acknowledgeGranularFinding(construct: Construct, id: string, reason: string): void {
+     construct.node.addMetadata(Validations.ACKNOWLEDGED_RULES_METADATA_KEY, { [id]: reason });
+   }
+   ```
+
+   Separately, v2's third `true` argument (`applyToChildren`) has **no stated v3 equivalent** — `acknowledge()`/the metadata bypass are per-construct, with no built-in cascade to CDK-generated children (e.g. a `Provider`'s internal `LogRetention`/framework-onEvent constructs). A suppression that relied on `applyToChildren` may reappear as a violation on a child construct v3 reports separately.
+
+   Because of both points, the exact set of ids and the constructs they must be acknowledged on **cannot be fully predicted from reading the v2 code** — they depend on this repo's specific construct ids, attached policies, and whatever child constructs v3 walks into. Task 1's recipe: migrate every call site to `Validations`/the bypass helper using the v2 id as a first guess, run the rewritten cdk-nag test with `verbose: true`, read every reported violation id from `policy-validation-report.json`, and add one `acknowledge()`/`acknowledgeGranularFinding()` call per reported id — for ANY rule, not only IAM4/IAM5 — until the violation count is 0. Do not hand-author guessed granular ids; every granular id in the final diff must have been copied from an actual report run.
+
+5. **`suppress-nags.ts`'s target, `AWS679f53fac002430cb0da5b7982bd2287`, is a CDK-owned singleton Lambda logical id** (from CDK's built-in `AwsCustomResource`), which can change across a version jump this large. If it isn't found at the expected path, don't force an ancestor acknowledgement first — check whether the `AwsSolutions-L1` entry in `policy-validation-report.json` names a different path for the same singleton, and acknowledge there instead; only fall back to the nearest ancestor if the finding doesn't appear at all.
+
+6. **Two artifacts outside `src/` reference cdk-nag and are not part of the migration itself:**
+   - `mavogelcdkvscodeserver/` (committed Go bindings, generated by `jsii-pacmak`) pins `github.com/cdklabs/cdk-nag-go/cdknag/v2` in `go.mod` and `jsii/jsii.go`. `publishToGo` is commented out in `.projenrc.ts` (confirmed), so `npx projen build`/`package-all` does not regenerate this directory — it's a pre-existing stale artifact, unrelated to this migration. Leave it untouched (mention, don't fix, per lineage rules) rather than hand-editing it to reference `cdknag/v3`.
+   - `renovate.json5` lists `cdk-nag` inside its Renovate-ignore array, but the file carries a `~~ Generated by projen` banner — it's fully regenerated by `npx projen` from `.projenrc.ts`'s `renovatebotOptions`, so no manual edit is needed there.
+
+## Assumptions
+
+- `Validations` (with `.of()`, `.acknowledge()`, `ACKNOWLEDGED_RULES_METADATA_KEY`) and `AwsSolutionsChecks`'s new `(app, options)` constructor signature exist in `aws-cdk-lib@2.261.0` / `cdk-nag@3.0.1` exactly as used in mvc-projen's validated migration — not independently re-verified against those exact versions' own `.d.ts` in this planning session (they aren't installed yet). Task 1's first step (below) verifies this immediately after `npm install`, before any source file is touched, specifically because the fallback is NOT "adjust syntax mechanically" for every case: if `ACKNOWLEDGED_RULES_METADATA_KEY` is not publicly exported, the granular-finding bypass helper — the plan's only mechanism for IAM4/IAM5 and other ARN-embedded findings — has no implementation and there is no fallback within this plan's approach. In that case, stop and report back rather than improvising a metadata key string or a different bypass mechanism (that would be a design change, not a mechanical syntax fix).
+
+## Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|------------|--------|------------|
+| Guessed/incomplete granular finding ids (any rule, not just IAM4/IAM5) leave real findings silently unacknowledged, and the test passes anyway | Medium | Medium | Task 1's DoD requires an observed 0-violation run (via the report), not just "code compiles" — ids are discovered empirically from actual report output, never hand-guessed |
+| `Validations`/`ACKNOWLEDGED_RULES_METADATA_KEY` API differs from or is absent in the actual installed `aws-cdk-lib@2.261.0`/`cdk-nag@3.0.1` | Low | High | Task 1's first step verifies the API shape immediately after `npm install`, before touching any source file; absence of the metadata key export is a stop-and-report condition, not an improvised workaround |
+| The 71-minor-version `aws-cdk-lib` jump (2.190.0 → 2.261.0) changes CDK L2 default behavior beyond cdk-nag itself (VPC/CloudFront/Lambda/etc. defaults), silently altering the deployed stack | Medium | High | Task 2 requires a manual review of the regenerated Jest snapshot diff — not a blind `jest -u` accept — and any security- or behavior-relevant change gets called out explicitly in the completion report |
+| jsii 5.9→6.0 (bundled with the `@mavogel/mvc-projen` bump) breaks `jsii-diff`/`jsii-pacmak`/docgen compatibility | Low | Medium | Covered by Task 2's full `npx projen build`, which runs all three; any incompatibility surfaces as a build failure to fix before the plan is done |
+| Task 1's long red-build window (7 files + regenerated lockfile) has no stated recovery point if the Validations API assumption fails mid-migration | Low | Medium | Key Decisions below requires a clean git checkpoint (commit hash noted, or a user-approved commit/stash) before `npx projen` runs, so an abort can restore the pre-migration green v2 tree via `git reset --hard <hash>` (with user permission) followed by `npm ci` to rebuild `node_modules` at the v2 lockfile — a bare git restore alone leaves a v3 `node_modules` behind |
+
+## Progress Tracking
+
+- [ ] Task 1: Bump mvc-projen/cdkVersion and migrate cdk-nag v2 → v3
+- [ ] Task 2: Regenerate snapshots and verify full build
+
+## Implementation Tasks
+
+### Task 1: Bump mvc-projen/cdkVersion and migrate cdk-nag v2 → v3
+
+**Objective:** Bump `@mavogel/mvc-projen` to `^0.0.30` and `cdkVersion` to `2.261.0` in `.projenrc.ts`, re-synth the generated project files, verify the `Validations` API shape actually installed, then migrate every `NagSuppressions` call site across all 7 affected source files (see Context item 2's inventory table) plus the cdk-nag test block in `test/vscode-server.test.ts` to cdk-nag v3's `Validations` API, discovering the exact granular finding ids empirically. Also updates `CLAUDE.md`'s stale "CDK-nag Integration" section and sweeps README/examples for any other stale reference.
+
+**Files:**
+
+- Modify: `.projenrc.ts` (`deps` mvc-projen version, `cdkVersion`)
+- Modify: `package.json`, `package-lock.json`, `.projen/tasks.json`, `.projen/deps.json`, `.projen/files.json` (regenerated by `npx projen`, not hand-edited)
+- Modify: `src/suppress-nags.ts`
+- Modify: `src/vscode-server.ts`
+- Modify: `src/installer/installer.ts`
+- Modify: `src/secret-retriever/secret-retriever.ts`
+- Modify: `src/idle-monitor-enabler/idle-monitor-enabler.ts`
+- Modify: `src/idle-monitor/idle-monitor.ts`
+- Modify: `src/prefixlist-retriever/prefixlist-retriever.ts`
+- Modify: `test/vscode-server.test.ts`
+- Modify: `CLAUDE.md`
+
+**Key Decisions / Notes:**
+
+- **Checkpoint first:** ensure the working tree is clean and note the current commit hash before running `npx projen` — this task's red-build window spans 7 source files and a regenerated lockfile. If the Assumptions section's API-shape bet turns out wrong and Task 1 must be aborted, the recovery path is `git reset --hard <checkpoint-hash>` (ask the user for permission first — this discards the in-progress migration) followed by `npm ci` to rebuild `node_modules` back at the v2 lockfile; a bare `git checkout` of individual files would leave a v3 `node_modules` installed against v2 source.
+- **Verify the API before migrating any source file:** after `npm install` picks up the bumped deps, read `node_modules/aws-cdk-lib/core/lib/validation/*.d.ts` and confirm `Validations.of()`, `.acknowledge()`, `.addPlugins()`, and `ACKNOWLEDGED_RULES_METADATA_KEY` are exported as used in mvc-projen's reference migration, and confirm `cdk-nag`'s `AwsSolutionsChecks` constructor accepts `(app, options)`. If `ACKNOWLEDGED_RULES_METADATA_KEY` (or any of the above) is missing or shaped differently, STOP — do not improvise a different bypass mechanism — revert to the checkpoint and report back.
+- Same version-alignment reasoning as the prior release-pipeline `/fix`: after bumping `@mavogel/mvc-projen`, also `npm install --save-dev projen@^0.101.31` (or let `npx projen` re-resolve it) so the top-level `projen` matches what `0.0.30` needs — a single deduped install, not a nested copy with mismatched builtin task names.
+- Follow the `Context for Implementer` recipe (items 2–4) for the full inventory, the `addResourceSuppressionsByPath` construct-resolution step in `suppress-nags.ts`, and the empirical granular-id discovery loop covering every rule (not only IAM4/IAM5).
+- Test rewrite pattern (mirrors mvc-projen's validated `assets/cdk-construct/test_index.test.ts`): construct `app` as `new App({ context: { '@aws-cdk/core:validationReportJson': true } })`; register the plugin via `Validations.of(app).addPlugins(new AwsSolutionsChecks(app, { verbose: true }))`; replace the two existing `Annotations.fromStack(...).findWarning/findError` tests with a single test that calls `app.synth()`, reads `<assembly.directory>/policy-validation-report.json` (treat a missing file as zero violations rather than throwing — some CDK versions omit the report entirely when there is nothing to report), flat-maps `pluginReports[].violations`, and asserts the array has length 0. Additionally assert the report/plugin actually ran against the full construct tree (e.g. a non-empty `pluginReports` array, or a known-nonzero count of acknowledged rules) so an accidentally-under-synthesized app can't produce a false-positive 0.
+- The scope moves from stack-level (`Aspects.of(stack)`, v2) to app-level (`Validations.of(app)`, v3), and the single `violations` array replaces two separate warning/error assertions. Confirm `violations` merges both severities (not just errors) by temporarily removing one known `acknowledge()` call and re-running the test — it must reappear as a violation — before restoring it; note the confirmed severity behavior in the completion report rather than assuming it from the API name.
+- Update `CLAUDE.md` line ~201 ("Apply suppressions via `NagSuppressions.addResourceSuppressions()`") to describe `Validations.of(...).acknowledge(...)` instead. Also run `grep -rn "NagSuppressions\|cdk-nag" README.md examples/ API.md renovate.json5 .projenrc.ts` and update any other stale reference found in the same change (Context item 6 already covers why `renovate.json5` itself needs no manual edit).
+- In the completion report, list every acknowledged id (plain and granular) mapped to the v2 suppression it replaces, so any dropped or newly-appeared id is visible rather than silently absorbed into a passing test.
+
+**Definition of Done:**
+
+- [ ] `package.json` shows `@mavogel/mvc-projen: ^0.0.30`, `cdk-nag: ^3.0.1`, and `aws-cdk-lib` peer/dev at `2.261.0`/`^2.261.0`
+- [ ] `grep -rn "from 'cdk-nag'" src/` shows no `NagSuppressions` import anywhere (all 7 previously-importing files migrated)
+- [ ] The rewritten cdk-nag test in `test/vscode-server.test.ts` observes 0 entries in `policy-validation-report.json`'s violations when run, and confirms the plugin actually executed (non-empty report / non-zero acknowledged-rule count)
+- [ ] Verify: `npx jest test/vscode-server.test.ts -t "cdk-nag"` passes (0 failures)
+
+### Task 2: Regenerate snapshots and verify full build
+
+**Objective:** Regenerate the Jest CloudFormation-template snapshots against the new `aws-cdk-lib` version, manually review the diff for anything beyond expected drift, and run the full `npx projen build` (lint, full test suite, `package:js`, `package:python`) to confirm nothing else broke — including that `integ-tests/*.ts` still type-checks under the bumped `aws-cdk-lib`/`@aws-cdk/integ-tests-alpha`.
+
+**Files:**
+
+- Modify: `test/__snapshots__/vscode-server.test.ts.snap`
+- Modify: `API.md` (docgen output, regenerated by `npx projen build`)
+- Modify: any `src/*.ts` file needing a jsii 5.9→6.0 compatibility fix, if the build surfaces one (not expected, but in scope if it happens)
+
+**Key Decisions / Notes:**
+
+- Run `npx jest test/vscode-server.test.ts -u` to regenerate, then `git diff test/__snapshots__/` and read it — every changed line should be attributable to the `aws-cdk-lib` 2.190.0→2.261.0 bump (e.g. updated construct metadata, changed default resource properties). If anything looks security- or behavior-relevant (e.g. a changed IAM policy, a removed encryption setting), call it out explicitly in the completion report rather than silently accepting the snapshot.
+- `integ-tests/*.ts` has no hardcoded `aws-cdk-lib`/`cdk-nag` version references (confirmed during planning) — it just needs to still compile, which the full build's TypeScript step covers; no separate task needed.
+- `npx projen build` regenerates `API.md` via docgen — expect it to change (new/renamed types from the jsii bump are unlikely but possible) and let it land as part of this task rather than treating it as scope creep.
+
+**Definition of Done:**
+
+- [ ] Snapshot diff reviewed; only attributable-to-CDK-bump changes remain (or none)
+- [ ] `npx projen build` exits 0 (lint, full test suite, `package:js`, `package:python`)
+- [ ] Verify: `npx projen build`

package/lib/idle-monitor/idle-monitor.js

@@ -83,5 +83,5 @@ class IdleMonitor extends constructs_1.Construct {
 }
 exports.IdleMonitor = IdleMonitor;
 _a = JSII_RTTI_SYMBOL_1;
-IdleMonitor[_a] = { fqn: "@mavogel/cdk-vscode-server.IdleMonitor", version: "0.0.96" };
+IdleMonitor[_a] = { fqn: "@mavogel/cdk-vscode-server.IdleMonitor", version: "0.0.97" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRsZS1tb25pdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2lkbGUtbW9uaXRvci9pZGxlLW1vbml0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2QkFBNkI7QUFDN0IsNkNBQThDO0FBRzlDLHVEQUF3RDtBQUN4RCx1RUFBd0Y7QUFDeEYsaURBQXNEO0FBQ3RELHVEQUFtRjtBQUNuRixxQ0FBMEM7QUFDMUMsMkNBQXVDO0FBcUN2Qzs7R0FFRztBQUNILE1BQWEsV0FBWSxTQUFRLHNCQUFTO0lBV3hDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBdUI7UUFDL0QsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUkscUJBQWMsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFO1lBQ25ELE9BQU8sRUFBRSxvQkFBTyxDQUFDLFdBQVc7WUFDNUIsT0FBTyxFQUFFLGVBQWU7WUFDeEIsSUFBSSxFQUFFLGlCQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLCtDQUErQyxDQUFDLENBQUM7WUFDM0YsT0FBTyxFQUFFLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUM3QixVQUFVLEVBQUUsR0FBRztZQUNmLFdBQVcsRUFBRTtnQkFDWCxXQUFXLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFVO2dCQUN0QyxlQUFlLEVBQUUsS0FBSyxDQUFDLFlBQVksQ0FBQyxjQUFjO2dCQUNsRCxvQkFBb0IsRUFBRSxLQUFLLENBQUMsa0JBQWtCLENBQUMsUUFBUSxFQUFFO2dCQUN6RCxrQkFBa0IsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsT0FBTzthQUM5RDtTQUNGLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUMzQixJQUFJLHlCQUFlLENBQUM7WUFDbEIsT0FBTyxFQUFFO2dCQUNQLGdDQUFnQztnQkFDaEMsMEJBQTBCO2FBQzNCO1lBQ0QsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDO1NBQ2pCLENBQUMsQ0FDSCxDQUFDO1FBRUYsd0ZBQXdGO1FBQ3hGLGtDQUFrQztRQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FDM0IsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE9BQU8sRUFBRTtnQkFDUCx1QkFBdUI7Z0JBQ3ZCLDRCQUE0QjthQUM3QjtZQUNELFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNqQixDQUFDLENBQ0gsQ0FBQztRQUVGLDJFQUEyRTtRQUMzRSxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FDM0IsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE9BQU8sRUFBRTtnQkFDUCxtQkFBbUI7YUFDcEI7WUFDRCxTQUFTLEVBQUU7Z0JBQ1QsZUFBZSxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLElBQUksbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxhQUFhLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFO2FBQ3ZHO1NBQ0YsQ0FBQyxDQUNILENBQUM7UUFFRiwyREFBMkQ7UUFDM0QseUVBQXlFO1FBQ3pFLDZFQUE2RTtRQUM3RSxNQUFNLGFBQWEsR0FBRyxLQUFLLENBQUMsb0JBQW9CLElBQUksQ0FBQyxDQUFDO1FBQ3RELElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxpQkFBSSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDakQsUUFBUSxFQUFFLHFCQUFRLENBQUMsSUFBSSxDQUFDLHNCQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ3hELE9BQU8sRUFBRSxLQUFLLEVBQUUscURBQXFEO1NBQ3RFLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLElBQUksbUNBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFFckUsdUJBQXVCO1FBQ3ZCLHlCQUFlLENBQUMsdUJBQXVCLENBQ3JDLElBQUksQ0FBQyxRQUFRLEVBQ2I7WUFDRTtnQkFDRSxFQUFFLEVBQUUsbUJBQW1CO2dCQUN2QixNQUFNLEVBQUUsMkRBQTJEO2FBQ3BFO1lBQ0Q7Z0JBQ0UsRUFBRSxFQUFFLG1CQUFtQjtnQkFDdkIsTUFBTSxFQUFFLGlEQUFpRDthQUMxRDtZQUNEO2dCQUNFLEVBQUUsRUFBRSxpQkFBaUI7Z0JBQ3JCLE1BQU0sRUFBRSwrQ0FBK0M7YUFDeEQ7U0FDRixFQUNELElBQUksQ0FDTCxDQUFDO0lBQ0osQ0FBQzs7QUE1Rkgsa0NBNkZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgcGF0aCBmcm9tICdwYXRoJztcbmltcG9ydCB7IER1cmF0aW9uLCBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IElEaXN0cmlidXRpb24gfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY2xvdWRmcm9udCc7XG5pbXBvcnQgeyBJSW5zdGFuY2UgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtZWMyJztcbmltcG9ydCB7IFJ1bGUsIFNjaGVkdWxlIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWV2ZW50cyc7XG5pbXBvcnQgeyBMYW1iZGFGdW5jdGlvbiBhcyBMYW1iZGFGdW5jdGlvblRhcmdldCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1ldmVudHMtdGFyZ2V0cyc7XG5pbXBvcnQgeyBQb2xpY3lTdGF0ZW1lbnQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFJ1bnRpbWUsIENvZGUsIEZ1bmN0aW9uIGFzIExhbWJkYUZ1bmN0aW9uIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWxhbWJkYSc7XG5pbXBvcnQgeyBOYWdTdXBwcmVzc2lvbnMgfSBmcm9tICdjZGstbmFnJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIFByb3BzIGZvciBJZGxlTW9uaXRvciBjb25zdHJ1Y3RcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJZGxlTW9uaXRvclByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBFQzIgaW5zdGFuY2UgdG8gbW9uaXRvclxuICAgKi9cbiAgcmVhZG9ubHkgaW5zdGFuY2U6IElJbnN0YW5jZTtcbiAgLyoqXG4gICAqIFRoZSBDbG91ZEZyb250IGRpc3RyaWJ1dGlvbiB0byBtb25pdG9yIGZvciBhY3Rpdml0eVxuICAgKi9cbiAgcmVhZG9ubHkgZGlzdHJpYnV0aW9uOiBJRGlzdHJpYnV0aW9uO1xuICAvKipcbiAgICogTnVtYmVyIG9mIG1pbnV0ZXMgb2YgaW5hY3Rpdml0eSBiZWZvcmUgc3RvcHBpbmcgdGhlIGluc3RhbmNlXG4gICAqL1xuICByZWFkb25seSBpZGxlVGltZW91dE1pbnV0ZXM6IG51bWJlcjtcbiAgLyoqXG4gICAqIEhvdyBvZnRlbiB0byBjaGVjayBmb3IgaWRsZSBhY3Rpdml0eSAoaW4gbWludXRlcylcbiAgICogQGRlZmF1bHQgNSAtIENoZWNrIGV2ZXJ5IDUgbWludXRlc1xuICAgKi9cbiAgcmVhZG9ubHkgY2hlY2tJbnRlcnZhbE1pbnV0ZXM/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBTa2lwIGluc3RhbmNlIHN0YXR1cyBjaGVja3MgYmVmb3JlIHN0b3BwaW5nXG4gICAqIFdoZW4gdHJ1ZSwgSWRsZU1vbml0b3Igd2lsbCBzdG9wIGlkbGUgaW5zdGFuY2VzIGV2ZW4gaWYgc3RhdHVzIGNoZWNrcyBoYXZlbid0IHBhc3NlZFxuICAgKiBUaGlzIGlzIHVzZWZ1bCBmb3IgaW50ZWdyYXRpb24gdGVzdHMgd2hlcmUgc3RhdHVzIGNoZWNrIGluaXRpYWxpemF0aW9uIHRpbWVcbiAgICogZXhjZWVkcyB0ZXN0IHRpbWVvdXQgbGltaXRzXG4gICAqXG4gICAqIFdBUk5JTkc6IEZvciB0ZXN0aW5nIG9ubHkgLSBpbiBwcm9kdWN0aW9uLCB5b3Ugc2hvdWxkIHdhaXQgZm9yIHN0YXR1cyBjaGVja3NcbiAgICogdG8gcGFzcyBiZWZvcmUgc3RvcHBpbmcgaW5zdGFuY2VzXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBza2lwU3RhdHVzQ2hlY2tzPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBDb25zdHJ1Y3QgdGhhdCBtb25pdG9ycyBDbG91ZEZyb250IHJlcXVlc3QgbWV0cmljcyBhbmQgc3RvcHMgdGhlIEVDMiBpbnN0YW5jZSB3aGVuIGlkbGVcbiAqL1xuZXhwb3J0IGNsYXNzIElkbGVNb25pdG9yIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgLyoqXG4gICAqIFRoZSBMYW1iZGEgZnVuY3Rpb24gdGhhdCBwZXJmb3JtcyBpZGxlIG1vbml0b3JpbmdcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBmdW5jdGlvbjogTGFtYmRhRnVuY3Rpb247XG5cbiAgLyoqXG4gICAqIFRoZSBFdmVudEJyaWRnZSBydWxlIHRoYXQgdHJpZ2dlcnMgaWRsZSBtb25pdG9yaW5nIGNoZWNrc1xuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHNjaGVkdWxlUnVsZTogUnVsZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogSWRsZU1vbml0b3JQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICB0aGlzLmZ1bmN0aW9uID0gbmV3IExhbWJkYUZ1bmN0aW9uKHRoaXMsICdGdW5jdGlvbicsIHtcbiAgICAgIHJ1bnRpbWU6IFJ1bnRpbWUuTk9ERUpTXzIwX1gsXG4gICAgICBoYW5kbGVyOiAnaW5kZXguaGFuZGxlcicsXG4gICAgICBjb2RlOiBDb2RlLmZyb21Bc3NldChwYXRoLmpvaW4oX19kaXJuYW1lLCAnLi4vLi4vYXNzZXRzL2lkbGUtbW9uaXRvci9pZGxlLW1vbml0b3IubGFtYmRhJykpLFxuICAgICAgdGltZW91dDogRHVyYXRpb24uc2Vjb25kcygzMCksXG4gICAgICBtZW1vcnlTaXplOiAyNTYsXG4gICAgICBlbnZpcm9ubWVudDoge1xuICAgICAgICBJTlNUQU5DRV9JRDogcHJvcHMuaW5zdGFuY2UuaW5zdGFuY2VJZCxcbiAgICAgICAgRElTVFJJQlVUSU9OX0lEOiBwcm9wcy5kaXN0cmlidXRpb24uZGlzdHJpYnV0aW9uSWQsXG4gICAgICAgIElETEVfVElNRU9VVF9NSU5VVEVTOiBwcm9wcy5pZGxlVGltZW91dE1pbnV0ZXMudG9TdHJpbmcoKSxcbiAgICAgICAgU0tJUF9TVEFUVVNfQ0hFQ0tTOiBwcm9wcy5za2lwU3RhdHVzQ2hlY2tzID8gJ3RydWUnIDogJ2ZhbHNlJyxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICB0aGlzLmZ1bmN0aW9uLmFkZFRvUm9sZVBvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ2Nsb3Vkd2F0Y2g6R2V0TWV0cmljU3RhdGlzdGljcycsXG4gICAgICAgICAgJ2Nsb3Vkd2F0Y2g6R2V0TWV0cmljRGF0YScsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogWycqJ10sXG4gICAgICB9KSxcbiAgICApO1xuXG4gICAgLy8gRGVzY3JpYmVJbnN0YW5jZXMgYW5kIERlc2NyaWJlSW5zdGFuY2VTdGF0dXMgZG9uJ3Qgc3VwcG9ydCByZXNvdXJjZS1sZXZlbCBwZXJtaXNzaW9uc1xuICAgIC8vIFRoZXkgcmVxdWlyZSB3aWxkY2FyZCByZXNvdXJjZXNcbiAgICB0aGlzLmZ1bmN0aW9uLmFkZFRvUm9sZVBvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ2VjMjpEZXNjcmliZUluc3RhbmNlcycsXG4gICAgICAgICAgJ2VjMjpEZXNjcmliZUluc3RhbmNlU3RhdHVzJyxcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbJyonXSxcbiAgICAgIH0pLFxuICAgICk7XG5cbiAgICAvLyBTdG9wSW5zdGFuY2VzIHN1cHBvcnRzIHJlc291cmNlLWxldmVsIHBlcm1pc3Npb25zLCBzbyB3ZSBjYW4gcmVzdHJpY3QgaXRcbiAgICB0aGlzLmZ1bmN0aW9uLmFkZFRvUm9sZVBvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ2VjMjpTdG9wSW5zdGFuY2VzJyxcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgICAgYGFybjphd3M6ZWMyOiR7U3RhY2sub2YodGhpcykucmVnaW9ufToke1N0YWNrLm9mKHRoaXMpLmFjY291bnR9Omluc3RhbmNlLyR7cHJvcHMuaW5zdGFuY2UuaW5zdGFuY2VJZH1gLFxuICAgICAgICBdLFxuICAgICAgfSksXG4gICAgKTtcblxuICAgIC8vIENyZWF0ZSBFdmVudEJyaWRnZSBydWxlIHRvIHRyaWdnZXIgYXQgc3BlY2lmaWVkIGludGVydmFsXG4gICAgLy8gTk9URTogUnVsZSBpcyBjcmVhdGVkIGluIERJU0FCTEVEIHN0YXRlIGFuZCBtdXN0IGJlIGV4cGxpY2l0bHkgZW5hYmxlZFxuICAgIC8vIGFmdGVyIGluc3RhbGxhdGlvbiBjb21wbGV0ZXMgdG8gcHJldmVudCBzdG9wcGluZyB0aGUgaW5zdGFuY2UgZHVyaW5nIHNldHVwXG4gICAgY29uc3QgY2hlY2tJbnRlcnZhbCA9IHByb3BzLmNoZWNrSW50ZXJ2YWxNaW51dGVzID8/IDU7XG4gICAgdGhpcy5zY2hlZHVsZVJ1bGUgPSBuZXcgUnVsZSh0aGlzLCAnU2NoZWR1bGVSdWxlJywge1xuICAgICAgc2NoZWR1bGU6IFNjaGVkdWxlLnJhdGUoRHVyYXRpb24ubWludXRlcyhjaGVja0ludGVydmFsKSksXG4gICAgICBlbmFibGVkOiBmYWxzZSwgLy8gU3RhcnQgZGlzYWJsZWQsIHdpbGwgYmUgZW5hYmxlZCBhZnRlciBpbnN0YWxsYXRpb25cbiAgICB9KTtcblxuICAgIHRoaXMuc2NoZWR1bGVSdWxlLmFkZFRhcmdldChuZXcgTGFtYmRhRnVuY3Rpb25UYXJnZXQodGhpcy5mdW5jdGlvbikpO1xuXG4gICAgLy8gQ0RLLW5hZyBzdXBwcmVzc2lvbnNcbiAgICBOYWdTdXBwcmVzc2lvbnMuYWRkUmVzb3VyY2VTdXBwcmVzc2lvbnMoXG4gICAgICB0aGlzLmZ1bmN0aW9uLFxuICAgICAgW1xuICAgICAgICB7XG4gICAgICAgICAgaWQ6ICdBd3NTb2x1dGlvbnMtSUFNNCcsXG4gICAgICAgICAgcmVhc29uOiAnTWFuYWdlZCBwb2xpY2llcyBhY2NlcHRhYmxlIGZvciB3b3Jrc2hvcCBMYW1iZGEgZnVuY3Rpb25zJyxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIGlkOiAnQXdzU29sdXRpb25zLUlBTTUnLFxuICAgICAgICAgIHJlYXNvbjogJ0Nsb3VkV2F0Y2ggbWV0cmljcyByZXF1aXJlIHdpbGRjYXJkIHBlcm1pc3Npb25zJyxcbiAgICAgICAgfSxcbiAgICAgICAge1xuICAgICAgICAgIGlkOiAnQXdzU29sdXRpb25zLUwxJyxcbiAgICAgICAgICByZWFzb246ICdMYXRlc3QgcnVudGltZSBub3QgcmVxdWlyZWQgZm9yIHRoaXMgZnVuY3Rpb24nLFxuICAgICAgICB9LFxuICAgICAgXSxcbiAgICAgIHRydWUsXG4gICAgKTtcbiAgfVxufVxuIl19

package/lib/vscode-server.js

@@ -648,7 +648,7 @@ class VSCodeServer extends constructs_1.Construct {
 }
 exports.VSCodeServer = VSCodeServer;
 _a = JSII_RTTI_SYMBOL_1;
-VSCodeServer[_a] = { fqn: "@mavogel/cdk-vscode-server.VSCodeServer", version: "0.0.96" };
+VSCodeServer[_a] = { fqn: "@mavogel/cdk-vscode-server.VSCodeServer", version: "0.0.97" };
 /**
  * Tags all the resources in the construct
  */

package/mavogelcdkvscodeserver/README.md

@@ -1,8 +1,8 @@
-![Source](https://img.shields.io/github/stars/MV-Consulting/cdk-vscode-server?logo=github&label=GitHub%20Stars)
-[![Build Status](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/MV-Consulting/cdk-vscode-server/actions/workflows/build.yml)
+![Source](https://img.shields.io/github/stars/mavogel/cdk-vscode-server?logo=github&label=GitHub%20Stars)
+[![Build Status](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml/badge.svg)](https://github.com/mavogel/cdk-vscode-server/actions/workflows/build.yml)
 [![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)
-[![Latest release](https://img.shields.io/github/release/MV-Consulting/cdk-vscode-server.svg)](https://github.com/MV-Consulting/cdk-vscode-server/releases)
-![GitHub](https://img.shields.io/github/license/MV-Consulting/cdk-vscode-server)
+[![Latest release](https://img.shields.io/github/release/mavogel/cdk-vscode-server.svg)](https://github.com/mavogel/cdk-vscode-server/releases)
+![GitHub](https://img.shields.io/github/license/mavogel/cdk-vscode-server)
 [![npm](https://img.shields.io/npm/dt/@mavogel/cdk-vscode-server?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)
 [![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)
 

package/mavogelcdkvscodeserver/VSCodeServer.go

@@ -2,10 +2,10 @@ package mavogelcdkvscodeserver
 
 import (
 	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
-	_init_ "github.com/MV-Consulting/cdk-vscode-server/mavogelcdkvscodeserver/jsii"
+	_init_ "github.com/mavogel/cdk-vscode-server/mavogelcdkvscodeserver/jsii"
 
 	"github.com/aws/constructs-go/constructs/v10"
-	"github.com/MV-Consulting/cdk-vscode-server/mavogelcdkvscodeserver/internal"
+	"github.com/mavogel/cdk-vscode-server/mavogelcdkvscodeserver/internal"
 )
 
 // VSCodeServer - spin it up in under 10 minutes.

package/mavogelcdkvscodeserver/go.mod

@@ -1,4 +1,4 @@
-module github.com/MV-Consulting/cdk-vscode-server/mavogelcdkvscodeserver
+module github.com/mavogel/cdk-vscode-server/mavogelcdkvscodeserver
 
 go 1.23
 

package/package.json

@@ -3,7 +3,7 @@
   "description": "Running VS Code Server on AWS",
   "repository": {
     "type": "git",
-    "url": "https://github.com/MV-Consulting/cdk-vscode-server.git"
+    "url": "https://github.com/mavogel/cdk-vscode-server.git"
   },
   "scripts": {
     "build": "projen build",
@@ -50,13 +50,13 @@
   "devDependencies": {
     "@aws-cdk/integ-runner": "2.190.0",
     "@aws-cdk/integ-tests-alpha": "2.190.0-alpha.0",
-    "@aws-sdk/client-cloudwatch": "^3.1075.0",
-    "@aws-sdk/client-dynamodb": "^3.1075.0",
-    "@aws-sdk/client-ec2": "^3.1075.0",
-    "@aws-sdk/client-eventbridge": "^3.1075.0",
-    "@aws-sdk/client-secrets-manager": "^3.1075.0",
-    "@aws-sdk/client-ssm": "^3.1075.0",
-    "@aws-sdk/lib-dynamodb": "^3.1075.0",
+    "@aws-sdk/client-cloudwatch": "^3.1106.0",
+    "@aws-sdk/client-dynamodb": "^3.1106.0",
+    "@aws-sdk/client-ec2": "^3.1106.0",
+    "@aws-sdk/client-eventbridge": "^3.1106.0",
+    "@aws-sdk/client-secrets-manager": "^3.1106.0",
+    "@aws-sdk/client-ssm": "^3.1106.0",
+    "@aws-sdk/lib-dynamodb": "^3.1106.0",
     "@commitlint/cli": "^20.1.0",
     "@commitlint/config-conventional": "^20.0.0",
     "@stylistic/eslint-plugin": "^2",
@@ -69,7 +69,7 @@
     "aws-cdk-lib": "2.190.0",
     "awslint": "2.190.0-alpha.0",
     "commit-and-tag-version": "^12",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "eslint": "^9",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
@@ -77,12 +77,12 @@
     "jest": "^30.4.2",
     "jest-junit": "^17",
     "jsii": "~5.9.0",
-    "jsii-diff": "^1.137.0",
+    "jsii-diff": "^1.139.0",
     "jsii-docgen": "^10.5.0",
-    "jsii-pacmak": "^1.137.0",
+    "jsii-pacmak": "^1.139.0",
     "jsii-rosetta": "~5.9.0",
-    "projen": "0.100.6",
-    "ts-jest": "^29.4.11",
+    "projen": "^0.99.80",
+    "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3"
   },
@@ -121,7 +121,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.96",
+  "version": "0.0.97",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [