@mettlecast/domain-cdk-packer 0.2.0

package/dist/__tests__/step-functions-codegen.test.js

@@ -0,0 +1,159 @@
+import { describe, it, expect } from 'vitest';
+import { StepFunctionsCodegen } from '../step-functions-codegen.js';
+describe('StepFunctionsCodegen', () => {
+    const codegen = new StepFunctionsCodegen();
+    describe('generateTaskState', () => {
+        it('should set Next when node has next property', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+                next: 'Step2',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Next).toBe('Step2');
+            expect(state.End).toBeUndefined();
+        });
+        it('should set End=true when node has no next property', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.End).toBe(true);
+            expect(state.Next).toBeUndefined();
+        });
+        it('should generate correct FunctionName from domainId and actionId', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Parameters?.FunctionName).toBe('payments-charge-card');
+        });
+        it('should use label as Comment when provided', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+                label: 'Charge the card',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Comment).toBe('Charge the card');
+        });
+        it('should use default comment format when label is not provided', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Comment).toBe('Invoke domain action payments/charge-card');
+        });
+        it('should include standard Task fields in the state', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Type).toBe('Task');
+            expect(state.Resource).toBe('arn:aws:states:::lambda:invoke');
+            expect(state.Parameters?.['Payload.$']).toBe('$');
+        });
+        it('should include node parameters in the Parameters object', () => {
+            const node = {
+                type: 'domain-action',
+                domainId: 'payments',
+                actionId: 'charge-card',
+                parameters: { amount: 100, currency: 'USD' },
+            };
+            const state = codegen.generateTaskState(node);
+            expect(state.Parameters?.amount).toBe(100);
+            expect(state.Parameters?.currency).toBe('USD');
+        });
+    });
+    describe('generateStateMachine', () => {
+        it('should set StartAt to first node label by default', () => {
+            const nodes = [
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'charge-card',
+                    label: 'Charge Card',
+                    next: 'Validate Payment',
+                },
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'validate-payment',
+                    label: 'Validate Payment',
+                },
+            ];
+            const result = codegen.generateStateMachine(nodes);
+            expect(result.StartAt).toBe('Charge Card');
+        });
+        it('should set StartAt to first node actionId when label is missing', () => {
+            const nodes = [
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'charge-card',
+                    next: 'payments/validate-payment',
+                },
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'validate-payment',
+                },
+            ];
+            const result = codegen.generateStateMachine(nodes);
+            expect(result.StartAt).toBe('payments/charge-card');
+        });
+        it('should include all nodes as states with correct state names', () => {
+            const nodes = [
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'charge-card',
+                    label: 'Charge Card',
+                },
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'validate-payment',
+                    label: 'Validate Payment',
+                },
+            ];
+            const result = codegen.generateStateMachine(nodes);
+            expect(Object.keys(result.States)).toHaveLength(2);
+            expect(result.States['Charge Card']).toBeDefined();
+            expect(result.States['Validate Payment']).toBeDefined();
+        });
+        it('should use custom startAt parameter when provided', () => {
+            const nodes = [
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'charge-card',
+                    label: 'Charge Card',
+                },
+                {
+                    type: 'domain-action',
+                    domainId: 'payments',
+                    actionId: 'validate-payment',
+                    label: 'Validate Payment',
+                },
+            ];
+            const result = codegen.generateStateMachine(nodes, 'CustomStart');
+            expect(result.StartAt).toBe('CustomStart');
+        });
+        it('should handle empty nodes array', () => {
+            const result = codegen.generateStateMachine([]);
+            expect(result.StartAt).toBe('Start');
+            expect(Object.keys(result.States)).toHaveLength(0);
+        });
+    });
+});

package/dist/aspects/iam-boundaries-aspect.d.ts

@@ -0,0 +1,11 @@
+import * as cdk from 'aws-cdk-lib';
+import { IConstruct } from 'constructs';
+export interface IamBoundariesAspectProps {
+    /** ARN of the permission boundary policy to attach to all Lambda roles. */
+    permissionBoundaryArn: string;
+}
+export declare class IamBoundariesAspect implements cdk.IAspect {
+    private readonly props;
+    constructor(props: IamBoundariesAspectProps);
+    visit(node: IConstruct): void;
+}

package/dist/aspects/iam-boundaries-aspect.js

@@ -0,0 +1,15 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+export class IamBoundariesAspect {
+    props;
+    constructor(props) {
+        this.props = props;
+    }
+    visit(node) {
+        if (node instanceof iam.Role) {
+            const cfnRole = node.node.defaultChild;
+            if (cfnRole) {
+                cfnRole.permissionsBoundary = this.props.permissionBoundaryArn;
+            }
+        }
+    }
+}

package/dist/aspects/index.d.ts

@@ -0,0 +1,5 @@
+export { TibTaggingAspect } from './tagging-aspect.js';
+export type { TibTaggingAspectProps } from './tagging-aspect.js';
+export { LogRetentionAspect } from './log-retention-aspect.js';
+export { IamBoundariesAspect } from './iam-boundaries-aspect.js';
+export type { IamBoundariesAspectProps } from './iam-boundaries-aspect.js';

package/dist/aspects/index.js

@@ -0,0 +1,3 @@
+export { TibTaggingAspect } from './tagging-aspect.js';
+export { LogRetentionAspect } from './log-retention-aspect.js';
+export { IamBoundariesAspect } from './iam-boundaries-aspect.js';

package/dist/aspects/log-retention-aspect.d.ts

@@ -0,0 +1,8 @@
+import * as cdk from 'aws-cdk-lib';
+import { IConstruct } from 'constructs';
+export declare class LogRetentionAspect implements cdk.IAspect {
+    private readonly retentionDays;
+    constructor(retentionDays?: number);
+    visit(node: IConstruct): void;
+    private toRetentionDays;
+}

package/dist/aspects/log-retention-aspect.js

@@ -0,0 +1,24 @@
+import * as logs from 'aws-cdk-lib/aws-logs';
+export class LogRetentionAspect {
+    retentionDays;
+    constructor(retentionDays = 30) {
+        this.retentionDays = this.toRetentionDays(retentionDays);
+    }
+    visit(node) {
+        if (node instanceof logs.LogGroup) {
+            const cfnLogGroup = node.node.defaultChild;
+            if (cfnLogGroup) {
+                cfnLogGroup.addPropertyOverride('RetentionInDays', this.retentionDays);
+            }
+        }
+    }
+    toRetentionDays(days) {
+        const map = {
+            30: logs.RetentionDays.ONE_MONTH,
+            90: logs.RetentionDays.THREE_MONTHS,
+            365: logs.RetentionDays.ONE_YEAR,
+            2557: logs.RetentionDays.SEVEN_YEARS,
+        };
+        return map[days] ?? logs.RetentionDays.ONE_MONTH;
+    }
+}

package/dist/aspects/tagging-aspect.d.ts

@@ -0,0 +1,13 @@
+import * as cdk from 'aws-cdk-lib';
+import { IConstruct } from 'constructs';
+export interface TibTaggingAspectProps {
+    env: string;
+    domainId: string;
+    owner?: string;
+    costCenter?: string;
+}
+export declare class TibTaggingAspect implements cdk.IAspect {
+    private readonly props;
+    constructor(props: TibTaggingAspectProps);
+    visit(node: IConstruct): void;
+}

package/dist/aspects/tagging-aspect.js

@@ -0,0 +1,17 @@
+import * as cdk from 'aws-cdk-lib';
+export class TibTaggingAspect {
+    props;
+    constructor(props) {
+        this.props = props;
+    }
+    visit(node) {
+        if (cdk.CfnResource.isCfnResource(node)) {
+            cdk.Tags.of(node).add('tib:env', this.props.env);
+            cdk.Tags.of(node).add('tib:domain', this.props.domainId);
+            if (this.props.owner)
+                cdk.Tags.of(node).add('tib:owner', this.props.owner);
+            if (this.props.costCenter)
+                cdk.Tags.of(node).add('tib:cost-center', this.props.costCenter);
+        }
+    }
+}

package/dist/constructs/action-construct.d.ts

@@ -0,0 +1,35 @@
+import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Construct } from 'constructs';
+import { LambdaFactory } from '../lambda-factory.js';
+import { IamPolicyBuilder } from '../iam/iam-policy-builder.js';
+import type { DomainRegistry } from '../registry.js';
+/**
+ * Configuration properties for ActionConstruct.
+ */
+export interface ActionConstructProps {
+    /** Domain registry containing all action entries. */
+    registry: DomainRegistry;
+    /** Factory for creating Lambda functions from registry entries. */
+    lambdaFactory: LambdaFactory;
+    /** IAM policy builder for granting permissions to Lambda roles. */
+    iamBuilder: IamPolicyBuilder;
+    /**
+     * Allowed origins for Function URL CORS on workspace-visible actions.
+     * Defaults to ['*']. Set to specific dashboard URLs + localhost for production.
+     */
+    corsAllowedOrigins?: string[];
+}
+/**
+ * CDK Construct that synthesises one Lambda per registered action, with optional Function URL for workspace-visible actions.
+ */
+export declare class ActionConstruct extends Construct {
+    /** Lambda function per action id. */
+    readonly functions: Map<string, lambdaNode.NodejsFunction>;
+    /**
+     * Create a new ActionConstruct instance.
+     * @param scope - Parent CDK scope.
+     * @param id - Construct identifier.
+     * @param props - Construct properties.
+     */
+    constructor(scope: Construct, id: string, props: ActionConstructProps);
+}

package/dist/constructs/action-construct.js

@@ -0,0 +1,35 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { Construct } from 'constructs';
+/**
+ * CDK Construct that synthesises one Lambda per registered action, with optional Function URL for workspace-visible actions.
+ */
+export class ActionConstruct extends Construct {
+    /** Lambda function per action id. */
+    functions;
+    /**
+     * Create a new ActionConstruct instance.
+     * @param scope - Parent CDK scope.
+     * @param id - Construct identifier.
+     * @param props - Construct properties.
+     */
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.functions = new Map();
+        for (const entry of props.registry.actions) {
+            const fn = props.lambdaFactory.createFunction(entry, entry.deployment);
+            this.functions.set(entry.id, fn);
+            props.iamBuilder.forAction().forEach((statement) => {
+                fn.addToRolePolicy(statement);
+            });
+            if (entry.visibility === 'workspace') {
+                fn.addFunctionUrl({
+                    authType: lambda.FunctionUrlAuthType.NONE,
+                    cors: {
+                        allowedOrigins: props.corsAllowedOrigins ?? ['*'],
+                        allowedMethods: [lambda.HttpMethod.ALL],
+                    },
+                });
+            }
+        }
+    }
+}

package/dist/constructs/alarm-construct.d.ts

@@ -0,0 +1,19 @@
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { Construct } from 'constructs';
+export interface AlarmConstructProps {
+    domainId: string;
+    lambdaFunctions: lambda.Function[];
+    dlqs: sqs.Queue[];
+    /** SNS topic ARN for alarm notifications. If omitted, alarms are created without actions. */
+    snsTopicArn?: string;
+    /** p99 latency threshold in ms. Default: 5000. */
+    p99ThresholdMs?: number;
+    /** Error rate threshold (0–1). Default: 0.01 (1%). */
+    errorRateThreshold?: number;
+}
+export declare class AlarmConstruct extends Construct {
+    readonly alarms: cloudwatch.Alarm[];
+    constructor(scope: Construct, id: string, props: AlarmConstructProps);
+}

package/dist/constructs/alarm-construct.js

@@ -0,0 +1,58 @@
+import * as cdk from 'aws-cdk-lib';
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import { Construct } from 'constructs';
+export class AlarmConstruct extends Construct {
+    alarms = [];
+    constructor(scope, id, props) {
+        super(scope, id);
+        const snsTopic = props.snsTopicArn
+            ? sns.Topic.fromTopicArn(this, 'AlarmTopic', props.snsTopicArn)
+            : undefined;
+        const alarmAction = snsTopic
+            ? [new cloudwatchActions.SnsAction(snsTopic)]
+            : [];
+        // DLQ depth alarms — fire immediately when any message lands in DLQ
+        for (const dlq of props.dlqs) {
+            const alarm = new cloudwatch.Alarm(this, `DlqAlarm-${dlq.node.id}`, {
+                alarmName: `tib-${props.domainId}-dlq-${dlq.node.id}-depth`,
+                alarmDescription: `DLQ ${dlq.node.id} has messages — investigate failed processing`,
+                metric: dlq.metricApproximateNumberOfMessagesVisible({
+                    period: cdk.Duration.minutes(1),
+                    statistic: 'Maximum',
+                }),
+                threshold: 0,
+                evaluationPeriods: 1,
+                comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+                treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+            });
+            if (alarmAction.length > 0)
+                alarm.addAlarmAction(...alarmAction);
+            this.alarms.push(alarm);
+        }
+        // Lambda error rate alarms
+        const errorThreshold = props.errorRateThreshold ?? 0.01;
+        for (const fn of props.lambdaFunctions) {
+            const errorAlarm = new cloudwatch.Alarm(this, `ErrorAlarm-${fn.node.id}`, {
+                alarmName: `tib-${props.domainId}-${fn.node.id}-error-rate`,
+                alarmDescription: `Lambda ${fn.node.id} error rate exceeded ${errorThreshold * 100}%`,
+                metric: new cloudwatch.MathExpression({
+                    expression: 'errors / invocations',
+                    usingMetrics: {
+                        errors: fn.metricErrors({ period: cdk.Duration.minutes(5) }),
+                        invocations: fn.metricInvocations({ period: cdk.Duration.minutes(5) }),
+                    },
+                    period: cdk.Duration.minutes(5),
+                }),
+                threshold: errorThreshold,
+                evaluationPeriods: 2,
+                comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+                treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+            });
+            if (alarmAction.length > 0)
+                errorAlarm.addAlarmAction(...alarmAction);
+            this.alarms.push(errorAlarm);
+        }
+    }
+}

package/dist/constructs/alarms-construct.d.ts

@@ -0,0 +1,17 @@
+import { Construct } from 'constructs';
+export interface AlarmThresholds {
+    latencyP99Ms?: number;
+    errorRatePct?: number;
+    coldStartRatePct?: number;
+}
+export interface AlarmsConstructProps {
+    domainId: string;
+    envCode: string;
+    endpointId: string;
+    primitiveClass: string;
+    alarmTopicArn: string;
+    thresholds?: AlarmThresholds;
+}
+export declare class AlarmsConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: AlarmsConstructProps);
+}

package/dist/constructs/alarms-construct.js

@@ -0,0 +1,42 @@
+import * as cdk from 'aws-cdk-lib';
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import { Construct } from 'constructs';
+export class AlarmsConstruct extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { domainId, envCode, endpointId, primitiveClass, alarmTopicArn, thresholds = {} } = props;
+        const namespace = `TIB/Domain/${domainId}`;
+        const dims = { domainId, endpointId, primitiveClass };
+        const alarmTopic = sns.Topic.fromTopicArn(scope, `AlarmTopic-${id}`, alarmTopicArn);
+        const latencyThreshold = thresholds.latencyP99Ms ?? 2000;
+        const errorThreshold = thresholds.errorRatePct ?? 1;
+        // p99 latency > threshold (sev3)
+        new cloudwatch.Alarm(this, 'LatencyAlarm', {
+            alarmName: `TIB-${envCode}-${domainId}-${endpointId}-latency-p99`,
+            metric: new cloudwatch.Metric({ namespace, metricName: 'latency_ms', dimensionsMap: dims, statistic: 'p99', period: cdk.Duration.minutes(5) }),
+            threshold: latencyThreshold,
+            evaluationPeriods: 1,
+            comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+        }).addAlarmAction({ bind: () => ({ alarmActionArn: alarmTopicArn }) });
+        // Error count > 0 over 5 min (sev2)
+        new cloudwatch.Alarm(this, 'ErrorAlarm', {
+            alarmName: `TIB-${envCode}-${domainId}-${endpointId}-errors`,
+            metric: new cloudwatch.Metric({ namespace, metricName: 'errors', dimensionsMap: dims, statistic: 'Sum', period: cdk.Duration.minutes(5) }),
+            threshold: 0,
+            evaluationPeriods: 1,
+            comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+        }).addAlarmAction({ bind: () => ({ alarmActionArn: alarmTopicArn }) });
+        // Throttles sustained 5 min (sev2)
+        new cloudwatch.Alarm(this, 'ThrottleAlarm', {
+            alarmName: `TIB-${envCode}-${domainId}-${endpointId}-throttles`,
+            metric: new cloudwatch.Metric({ namespace, metricName: 'throttles', dimensionsMap: dims, statistic: 'Sum', period: cdk.Duration.minutes(5) }),
+            threshold: 0,
+            evaluationPeriods: 1,
+            comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+        }).addAlarmAction({ bind: () => ({ alarmActionArn: alarmTopicArn }) });
+    }
+}

package/dist/constructs/api-construct.d.ts

@@ -0,0 +1,30 @@
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import { Construct } from 'constructs';
+import { LambdaFactory } from '../lambda-factory.js';
+import { IamPolicyBuilder } from '../iam/iam-policy-builder.js';
+import type { DomainRegistry } from '../registry.js';
+/**
+ * Configuration properties for ApiConstruct.
+ */
+export interface ApiConstructProps {
+    /** Domain registry containing all API entries. */
+    registry: DomainRegistry;
+    /** Shared HttpApi to route requests to Lambdas. */
+    httpApi: apigwv2.HttpApi;
+    /** Factory for creating Lambda functions from registry entries. */
+    lambdaFactory: LambdaFactory;
+    /** IAM policy builder for granting permissions to Lambda roles. */
+    iamBuilder: IamPolicyBuilder;
+}
+/**
+ * CDK Construct that synthesises one Lambda per registered API and wires each to the shared HttpApi.
+ */
+export declare class ApiConstruct extends Construct {
+    /**
+     * Create a new ApiConstruct instance.
+     * @param scope - Parent CDK scope.
+     * @param id - Construct identifier.
+     * @param props - Construct properties.
+     */
+    constructor(scope: Construct, id: string, props: ApiConstructProps);
+}

package/dist/constructs/api-construct.js

@@ -0,0 +1,64 @@
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as apigwv2integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import { Construct } from 'constructs';
+/**
+ * CDK Construct that synthesises one Lambda per registered API and wires each to the shared HttpApi.
+ */
+export class ApiConstruct extends Construct {
+    /**
+     * Create a new ApiConstruct instance.
+     * @param scope - Parent CDK scope.
+     * @param id - Construct identifier.
+     * @param props - Construct properties.
+     */
+    constructor(scope, id, props) {
+        super(scope, id);
+        for (const entry of props.registry.apis) {
+            const fn = props.lambdaFactory.createFunction(entry, entry.deployment);
+            props.iamBuilder.forApi().forEach((statement) => {
+                fn.addToRolePolicy(statement);
+            });
+            props.httpApi.addRoutes({
+                path: entry.path,
+                methods: [toHttpMethod(entry.method)],
+                integration: new apigwv2integrations.HttpLambdaIntegration(`${id}${toPascalCase(entry.id)}Integration`, fn),
+            });
+        }
+    }
+}
+/**
+ * Convert kebab-case or snake_case string to PascalCase.
+ * @param s - Input string.
+ * @returns PascalCase string.
+ */
+function toPascalCase(s) {
+    return s
+        .split(/[-_]/)
+        .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))
+        .join('');
+}
+/**
+ * Convert HTTP method string to ApiGatewayV2 HttpMethod enum.
+ * @param method - HTTP method string (e.g., 'GET', 'POST').
+ * @returns HttpMethod enum value.
+ */
+function toHttpMethod(method) {
+    switch (method.toUpperCase()) {
+        case 'GET':
+            return apigwv2.HttpMethod.GET;
+        case 'POST':
+            return apigwv2.HttpMethod.POST;
+        case 'PUT':
+            return apigwv2.HttpMethod.PUT;
+        case 'PATCH':
+            return apigwv2.HttpMethod.PATCH;
+        case 'DELETE':
+            return apigwv2.HttpMethod.DELETE;
+        case 'HEAD':
+            return apigwv2.HttpMethod.HEAD;
+        case 'OPTIONS':
+            return apigwv2.HttpMethod.OPTIONS;
+        default:
+            return apigwv2.HttpMethod.ANY;
+    }
+}

package/dist/constructs/canary-construct.d.ts

@@ -0,0 +1,13 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import { Construct } from 'constructs';
+export interface CanaryConstructProps {
+    domainId: string;
+    lambdaFunctions: lambda.Function[];
+    /** CloudWatch alarms that trigger auto-rollback. Typically from AlarmConstruct. */
+    rollbackAlarms?: cloudwatch.Alarm[];
+}
+export declare class CanaryConstruct extends Construct {
+    readonly aliases: lambda.Alias[];
+    constructor(scope: Construct, id: string, props: CanaryConstructProps);
+}

package/dist/constructs/canary-construct.js

@@ -0,0 +1,30 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as codedeploy from 'aws-cdk-lib/aws-codedeploy';
+import { Construct } from 'constructs';
+export class CanaryConstruct extends Construct {
+    aliases = [];
+    constructor(scope, id, props) {
+        super(scope, id);
+        const app = new codedeploy.LambdaApplication(this, 'DeployApp', {
+            applicationName: `tib-${props.domainId}`,
+        });
+        for (const fn of props.lambdaFunctions) {
+            const alias = new lambda.Alias(this, `${fn.node.id}LiveAlias`, {
+                aliasName: 'live',
+                version: fn.currentVersion,
+            });
+            this.aliases.push(alias);
+            new codedeploy.LambdaDeploymentGroup(this, `${fn.node.id}DeployGroup`, {
+                application: app,
+                alias,
+                deploymentConfig: codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES,
+                alarms: props.rollbackAlarms ?? [],
+                autoRollback: {
+                    failedDeployment: true,
+                    stoppedDeployment: true,
+                    deploymentInAlarm: true,
+                },
+            });
+        }
+    }
+}

package/dist/constructs/cmk-construct.d.ts

@@ -0,0 +1,9 @@
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+export interface CmkConstructProps {
+    domainId: string;
+}
+export declare class CmkConstruct extends Construct {
+    readonly key: kms.Key;
+    constructor(scope: Construct, id: string, props: CmkConstructProps);
+}

package/dist/constructs/cmk-construct.js

@@ -0,0 +1,20 @@
+import * as cdk from 'aws-cdk-lib';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+export class CmkConstruct extends Construct {
+    key;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.key = new kms.Key(this, 'DomainKey', {
+            alias: `tib/${props.domainId}`,
+            description: `TIB domain encryption key for ${props.domainId}`,
+            enableKeyRotation: true,
+            pendingWindow: cdk.Duration.days(30),
+            removalPolicy: cdk.RemovalPolicy.RETAIN,
+        });
+        new cdk.CfnOutput(this, 'DomainKeyArn', {
+            value: this.key.keyArn,
+            description: `CMK ARN for domain ${props.domainId}`,
+        });
+    }
+}