@mettlecast/domain-cdk-packer 0.2.34 → 0.2.36

package/dist/DomainStack.d.ts

@@ -28,7 +28,7 @@ export interface DomainStackProps extends cdk.StackProps {
     /** Security group for domain Lambdas — must allow egress to Aurora SG. */
     lambdaSg?: ec2.ISecurityGroup;
     /** Shared HTTP API Gateway — when provided, domain routes are added here instead of creating a separate API. */
-    httpApi?: apigwv2.HttpApi;
+    httpApi?: apigwv2.IHttpApi;
     /** Enable CMK encryption for DynamoDB, S3, SQS. */
     enableCmk?: boolean;
     /** Enable WAF WebACL on the domain API Gateway. */
@@ -55,13 +55,9 @@ export interface DomainStackProps extends cdk.StackProps {
      */
     allowCredentials?: boolean;
 }
-/**
- * Top-level CDK Stack that composes all domain constructs from a single DomainRegistry input.
- * Uses grouped Lambdas for each primitive type to reduce deployment artifact size.
- */
 export declare class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */
-    readonly httpApi: apigwv2.HttpApi;
+    readonly httpApi: apigwv2.IHttpApi;
     /** Map of primitive-type key to Lambda function ARN, used by FlowsStack for direct invocation. */
     readonly lambdaArns: Record<string, string>;
     /**

package/dist/DomainStack.js

@@ -22,6 +22,30 @@ import { CanaryConstruct } from './constructs/canary-construct.js';
  * Top-level CDK Stack that composes all domain constructs from a single DomainRegistry input.
  * Uses grouped Lambdas for each primitive type to reduce deployment artifact size.
  */
+/** L1 helper: adds a route to an existing HTTP API using CfnRoute + CfnIntegration. */
+function addRouteToApi(scope, fn, path, methods, apiId, authType, authorizer) {
+    const id = path.replace(/[^a-zA-Z0-9]/g, '_').replace(/^_/, 'api');
+    const integ = new apigwv2.CfnIntegration(scope, 'Integ_' + id, {
+        apiId,
+        integrationType: 'AWS_PROXY',
+        integrationUri: fn.functionArn,
+        payloadFormatVersion: '2.0',
+    });
+    fn.addPermission('Perm_' + id, {
+        principal: new iam.ServicePrincipal('apigateway.amazonaws.com'),
+        sourceArn: 'arn:aws:execute-api:' + cdk.Aws.REGION + ':' + cdk.Aws.ACCOUNT_ID + ':' + apiId + '/*',
+    });
+    const routeKey = methods[0] === apigwv2.HttpMethod.GET ? 'GET ' + path : 'POST ' + path;
+    const route = new apigwv2.CfnRoute(scope, 'Route_' + id, {
+        apiId,
+        routeKey,
+        target: 'integrations/' + integ.ref,
+    });
+    if (authType === 'jwt' && authorizer) {
+        route.authorizationType = 'JWT';
+        route.authorizerId = authorizer.ref ?? authorizer.authorizerId ?? '';
+    }
+}
 export class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */
     httpApi;
@@ -177,7 +201,7 @@ export class DomainStack extends cdk.Stack {
                 else {
                     apiRoute = apiRouteBase;
                 }
-                this.httpApi.addRoutes(apiRoute);
+                addRouteToApi(this, fn, api.path, [toHttpMethod(api.method)], this.httpApi.httpApiId, api.authType, jwtAuthorizer);
             }
         }
         // Deploy webhooks as grouped Lambdas
@@ -220,11 +244,7 @@ export class DomainStack extends cdk.Stack {
             // Add routes for each webhook entry
             for (const webhook of registry.webhooks) {
                 const fn = webhookLambdas[0]; // Grouped Lambda or first dedicated
-                this.httpApi.addRoutes({
-                    path: webhook.path,
-                    methods: [apigwv2.HttpMethod.POST],
-                    integration: new apigwv2integrations.HttpLambdaIntegration(`Webhooks${toPascalCase(webhook.id)}Integration`, fn),
-                });
+                addRouteToApi(this, fn, webhook.path, [apigwv2.HttpMethod.POST], this.httpApi.httpApiId);
             }
         }
         // Deploy event subscribers as grouped Lambdas
@@ -489,16 +509,8 @@ export class DomainStack extends cdk.Stack {
                 DB_SECRET_ARN: dbSecretArn ?? '',
             },
         });
-        this.httpApi.addRoutes({
-            path: '/_health',
-            methods: [apigwv2.HttpMethod.GET],
-            integration: new apigwv2integrations.HttpLambdaIntegration('HealthIntegration', healthConstruct.healthFn),
-        });
-        this.httpApi.addRoutes({
-            path: '/_ready',
-            methods: [apigwv2.HttpMethod.GET],
-            integration: new apigwv2integrations.HttpLambdaIntegration('ReadyIntegration', healthConstruct.readyFn),
-        });
+        addRouteToApi(this, healthConstruct.healthFn, '/_health', [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
+        addRouteToApi(this, healthConstruct.readyFn, '/_ready', [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
         // Create CloudWatch dashboard for all primitives
         const allEndpoints = [
             ...registry.apis.map(a => ({ id: a.id, primitiveClass: 'api' })),

package/dist/__tests__/pack-flows.test.js

@@ -262,6 +262,345 @@ describe('packFlows', () => {
         expect(stack.taskTokensTableName).toBeDefined();
         expect(stack.taskTokensTableArn).toBeDefined();
     });
+    it('translates map step with iterator to ASL Map state', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'map-flow',
+                    name: 'Map Flow',
+                    steps: [
+                        {
+                            type: 'flow-control',
+                            control: 'map',
+                            name: 'ProcessBatch',
+                            iterator: [
+                                { type: 'flow-control', control: 'pass', name: 'Transform' },
+                                { type: 'flow-control', control: 'succeed', name: 'Done' },
+                            ],
+                            next: 'Finish',
+                        },
+                        { type: 'flow-control', control: 'succeed', name: 'Finish' },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-map', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['map-flow']).toBeDefined();
+    });
+    it('throws when map step has empty iterator', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'bad-map-flow',
+                    name: 'Bad Map Flow',
+                    steps: [
+                        {
+                            type: 'flow-control',
+                            control: 'map',
+                            name: 'EmptyMap',
+                            iterator: [],
+                        },
+                    ],
+                },
+            ],
+        };
+        expect(() => {
+            packFlows(registry, app, 'test-bad-map', {
+                domainLambdaArns: {},
+                eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+            });
+        }).toThrow(/empty iterator/);
+    });
+    it('translates domain-query dynamodb-get-item to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'ddb-get-flow',
+                    name: 'DDB Get Flow',
+                    steps: [
+                        {
+                            type: 'domain-query',
+                            queryType: 'dynamodb-get-item',
+                            name: 'FetchItem',
+                            domainId: 'auth',
+                            key: { PK: 'CONFIG', SK: 'default' },
+                            next: 'Done',
+                        },
+                        { type: 'flow-control', control: 'succeed', name: 'Done' },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-ddb-get', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['ddb-get-flow']).toBeDefined();
+    });
+    it('translates domain-query dynamodb-query to ASL Task with all params', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'ddb-query-flow',
+                    name: 'DDB Query Flow',
+                    steps: [
+                        {
+                            type: 'domain-query',
+                            queryType: 'dynamodb-query',
+                            name: 'QueryItems',
+                            domainId: 'users',
+                            keyConditionExpression: '#pk = :pkVal',
+                            expressionAttributeValues: { ':pkVal': { type: 'S', value: 'USER' } },
+                            expressionAttributeNames: { '#pk': 'PK' },
+                            filterExpression: '#status = :status',
+                            indexName: 'GSI1',
+                            limit: 50,
+                            scanIndexForward: false,
+                            next: 'Done',
+                        },
+                        { type: 'flow-control', control: 'succeed', name: 'Done' },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-ddb-query', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['ddb-query-flow']).toBeDefined();
+    });
+    it('translates domain-query s3-get-object to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 's3-get-flow',
+                    name: 'S3 Get Flow',
+                    steps: [
+                        {
+                            type: 'domain-query',
+                            queryType: 's3-get-object',
+                            name: 'ReadFile',
+                            domainId: 'data',
+                            key: 'inbound/daily.csv',
+                            next: 'Done',
+                        },
+                        { type: 'flow-control', control: 'succeed', name: 'Done' },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-s3-get', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['s3-get-flow']).toBeDefined();
+    });
+    it('translates aws-service sns-publish to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'sns-flow',
+                    name: 'SNS Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'sns-publish',
+                            name: 'Notify',
+                            topicArn: 'arn:aws:sns:us-east-1:123:alerts',
+                            message: 'Done',
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-sns', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['sns-flow']).toBeDefined();
+    });
+    it('translates aws-service glue-start-job-run to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'glue-flow',
+                    name: 'Glue Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'glue-start-job-run',
+                            name: 'RunETL',
+                            jobName: 'transform-data',
+                            arguments: { '--source': 's3://b/input' },
+                            timeout: 60,
+                            workerType: 'G.1X',
+                            numberOfWorkers: 4,
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-glue', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['glue-flow']).toBeDefined();
+    });
+    it('translates aws-service batch-submit-job to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'batch-flow',
+                    name: 'Batch Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'batch-submit-job',
+                            name: 'Compute',
+                            batchJobName: 'heavy-compute',
+                            jobQueue: 'high-memory',
+                            jobDefinition: 'python-transform',
+                            parameters: { '--input': 's3://b/data.csv' },
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-batch', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['batch-flow']).toBeDefined();
+    });
+    it('translates aws-service step-functions-start-execution to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'subflow-flow',
+                    name: 'Subflow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'step-functions-start-execution',
+                            name: 'RunSubflow',
+                            stateMachineArn: 'arn:aws:states:us-east-1:123:stateMachine:my-flow',
+                            input: { userId: 'abc' },
+                            executionName: 'sub-1',
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-subflow', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['subflow-flow']).toBeDefined();
+    });
+    it('translates aws-service https-call to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'https-flow',
+                    name: 'HTTPS Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'https-call',
+                            name: 'Webhook',
+                            endpoint: 'https://api.example.com/callback',
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: { status: 'done' },
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-https', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['https-flow']).toBeDefined();
+    });
+    it('translates aws-service sqs-send-message to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'sqs-flow',
+                    name: 'SQS Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'sqs-send-message',
+                            name: 'Enqueue',
+                            queueUrl: 'https://sqs.us-east-1.amazonaws.com/123456789012/my-queue',
+                            messageBody: 'Done',
+                            delaySeconds: 10,
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-sqs', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['sqs-flow']).toBeDefined();
+    });
+    it('translates aws-service athena-start-query to ASL Task', () => {
+        const app = new cdk.App();
+        const registry = {
+            schemaVersion: '1',
+            flows: [
+                {
+                    id: 'athena-flow',
+                    name: 'Athena Flow',
+                    steps: [
+                        {
+                            type: 'aws-service',
+                            serviceAction: 'athena-start-query',
+                            name: 'Analyze',
+                            queryString: 'SELECT count(*) FROM events',
+                            database: 'analytics',
+                            outputLocation: 's3://bucket/results/',
+                            workGroup: 'primary',
+                        },
+                    ],
+                },
+            ],
+        };
+        const stack = packFlows(registry, app, 'test-athena', {
+            domainLambdaArns: {},
+            eventBusArn: 'arn:aws:events:us-east-1:123:event-bus/test',
+        });
+        expect(stack.flowArnMap['athena-flow']).toBeDefined();
+    });
 });
 describe('IamPolicyBuilder.forFlow', () => {
     it('returns empty array when no action ARNs', async () => {

package/dist/constructs/waf-construct.d.ts

@@ -3,7 +3,7 @@ import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import { Construct } from 'constructs';
 export interface WafConstructProps {
     domainId: string;
-    httpApi: apigwv2.HttpApi;
+    httpApi: apigwv2.IHttpApi;
     /** Requests per 5-minute window per IP before blocking. Default: 2000. */
     rateLimit?: number;
 }

package/dist/flow-registry.d.ts

@@ -24,6 +24,130 @@ export interface SerialDomainEventStep {
     version: number;
     next?: string;
 }
+export interface SerialDomainQueryDynamoGetItemStep {
+    type: 'domain-query';
+    queryType: 'dynamodb-get-item';
+    name: string;
+    domainId: string;
+    key: {
+        PK: string;
+        SK: string;
+    };
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialDomainQueryDynamoQueryStep {
+    type: 'domain-query';
+    queryType: 'dynamodb-query';
+    name: string;
+    domainId: string;
+    keyConditionExpression: string;
+    expressionAttributeValues: Record<string, {
+        type: 'S' | 'N' | 'B';
+        value: string;
+    }>;
+    expressionAttributeNames?: Record<string, string>;
+    filterExpression?: string;
+    indexName?: string;
+    limit?: number;
+    scanIndexForward?: boolean;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialDomainQueryS3GetObjectStep {
+    type: 'domain-query';
+    queryType: 's3-get-object';
+    name: string;
+    domainId: string;
+    key: string;
+    resultPath?: string;
+    next?: string;
+}
+export type SerialDomainQueryStep = SerialDomainQueryDynamoGetItemStep | SerialDomainQueryDynamoQueryStep | SerialDomainQueryS3GetObjectStep;
+export interface SerialAwsServiceSnsPublishStep {
+    type: 'aws-service';
+    serviceAction: 'sns-publish';
+    name: string;
+    topicArn: string;
+    message: string;
+    subject?: string;
+    messageAttributes?: Record<string, {
+        dataType: string;
+        stringValue: string;
+    }>;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceGlueStartJobRunStep {
+    type: 'aws-service';
+    serviceAction: 'glue-start-job-run';
+    name: string;
+    jobName: string;
+    arguments?: Record<string, string>;
+    timeout?: number;
+    workerType?: 'Standard' | 'G.1X' | 'G.2X';
+    numberOfWorkers?: number;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceBatchSubmitJobStep {
+    type: 'aws-service';
+    serviceAction: 'batch-submit-job';
+    name: string;
+    batchJobName: string;
+    jobQueue: string;
+    jobDefinition: string;
+    parameters?: Record<string, string>;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceStepFunctionsStartExecutionStep {
+    type: 'aws-service';
+    serviceAction: 'step-functions-start-execution';
+    name: string;
+    stateMachineArn: string;
+    input?: Record<string, unknown>;
+    executionName?: string;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceHttpsCallStep {
+    type: 'aws-service';
+    serviceAction: 'https-call';
+    name: string;
+    endpoint: string;
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    headers?: Record<string, string>;
+    body?: unknown;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceSqsSendMessageStep {
+    type: 'aws-service';
+    serviceAction: 'sqs-send-message';
+    name: string;
+    queueUrl: string;
+    messageBody: string;
+    delaySeconds?: number;
+    messageAttributes?: Record<string, {
+        dataType: string;
+        stringValue: string;
+    }>;
+    resultPath?: string;
+    next?: string;
+}
+export interface SerialAwsServiceAthenaStartQueryStep {
+    type: 'aws-service';
+    serviceAction: 'athena-start-query';
+    name: string;
+    queryString: string;
+    database: string;
+    outputLocation: string;
+    workGroup?: string;
+    resultPath?: string;
+    next?: string;
+}
+export type SerialAwsServiceStep = SerialAwsServiceSnsPublishStep | SerialAwsServiceGlueStartJobRunStep | SerialAwsServiceBatchSubmitJobStep | SerialAwsServiceStepFunctionsStartExecutionStep | SerialAwsServiceHttpsCallStep | SerialAwsServiceSqsSendMessageStep | SerialAwsServiceAthenaStartQueryStep;
 export type SerialFlowControlStep = {
     type: 'flow-control';
     control: 'choice';
@@ -39,6 +163,14 @@ export type SerialFlowControlStep = {
     name: string;
     branches: SerialFlowStep[][];
     next?: string;
+} | {
+    type: 'flow-control';
+    control: 'map';
+    name: string;
+    iterator: SerialFlowStep[];
+    itemsPath?: string;
+    maxConcurrency?: number;
+    next?: string;
 } | {
     type: 'flow-control';
     control: 'wait';
@@ -62,7 +194,7 @@ export type SerialFlowControlStep = {
     result?: unknown;
     next?: string;
 };
-export type SerialFlowStep = SerialDomainActionStep | SerialDomainApiStep | SerialDomainEventStep | SerialFlowControlStep;
+export type SerialFlowStep = SerialDomainActionStep | SerialDomainApiStep | SerialDomainEventStep | SerialDomainQueryStep | SerialAwsServiceStep | SerialFlowControlStep;
 export interface FlowRegistryEntry {
     id: string;
     owningDomain?: string;

package/dist/index.d.ts

@@ -31,6 +31,6 @@ export { packDomain } from './pack-domain.js';
 export type { PackDomainOptions } from './pack-domain.js';
 export { StepFunctionsCodegen } from './step-functions-codegen.js';
 export type { DomainActionFlowNode, StepFunctionsTaskState } from './step-functions-codegen.js';
-export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialFlowControlStep } from './flow-registry.js';
+export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialDomainQueryStep, SerialAwsServiceStep, SerialFlowControlStep } from './flow-registry.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
 export type { PackFlowsOptions } from './pack-flows.js';

package/dist/pack-flows.d.ts

@@ -23,6 +23,9 @@ export declare class FlowsStack extends cdk.Stack {
     private translateToAsl;
     private translateStep;
     private translateFlowControl;
+    private translateDomainQuery;
+    private translateAwsService;
+    private collectAllSteps;
 }
 /** Convenience: construct a FlowsStack from a registry. */
 export declare function packFlows(registry: FlowRegistry, app: cdk.App, stackId: string, options: PackFlowsOptions): FlowsStack;

package/dist/pack-flows.js

@@ -51,8 +51,9 @@ export class FlowsStack extends cdk.Stack {
             stateMachineType,
         });
         // Grant lambda:InvokeFunction for each domain-action step this flow calls.
+        const allSteps = this.collectAllSteps(flow.steps);
         const actionArns = [
-            ...new Set(flow.steps
+            ...new Set(allSteps
                 .filter((s) => s.type === 'domain-action')
                 .map(s => options.domainLambdaArns[`${s.domainId}-action`])
                 .filter((arn) => !!arn)),
@@ -63,6 +64,85 @@ export class FlowsStack extends cdk.Stack {
                 resources: actionArns,
             }));
         }
+        // Grant DynamoDB and S3 read permissions for domain-query steps
+        const ddbDomains = new Set();
+        const s3Domains = new Set();
+        for (const s of allSteps) {
+            if (s.type === 'domain-query') {
+                if (s.queryType === 'dynamodb-get-item' || s.queryType === 'dynamodb-query') {
+                    ddbDomains.add(s.domainId);
+                }
+                else if (s.queryType === 's3-get-object') {
+                    s3Domains.add(s.domainId);
+                }
+            }
+        }
+        for (const domainId of ddbDomains) {
+            stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                actions: ['dynamodb:GetItem', 'dynamodb:Query'],
+                resources: [
+                    this.formatArn({ service: 'dynamodb', resource: `table/tib-${domainId}` }),
+                    this.formatArn({ service: 'dynamodb', resource: `table/tib-${domainId}/index/*` }),
+                ],
+            }));
+        }
+        for (const domainId of s3Domains) {
+            stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                actions: ['s3:GetObject'],
+                resources: [`arn:aws:s3:::tib-${domainId}/*`],
+            }));
+        }
+        // Grant IAM for aws-service steps
+        for (const s of allSteps) {
+            if (s.type !== 'aws-service')
+                continue;
+            if (s.serviceAction === 'sns-publish') {
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['sns:Publish'],
+                    resources: [s.topicArn],
+                }));
+            }
+            else if (s.serviceAction === 'glue-start-job-run') {
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['glue:StartJobRun'],
+                    resources: [this.formatArn({ service: 'glue', resource: `job/${s.jobName}` })],
+                }));
+            }
+            else if (s.serviceAction === 'batch-submit-job') {
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['batch:SubmitJob'],
+                    resources: [
+                        this.formatArn({ service: 'batch', resource: `job-queue/${s.jobQueue}` }),
+                        this.formatArn({ service: 'batch', resource: `job-definition/${s.jobDefinition}` }),
+                    ],
+                }));
+            }
+            else if (s.serviceAction === 'step-functions-start-execution') {
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['states:StartExecution'],
+                    resources: [s.stateMachineArn],
+                }));
+            }
+            else if (s.serviceAction === 'sqs-send-message') {
+                const urlMatch = s.queueUrl.match(/sqs\.([^.]+)\.amazonaws\.com\/(\d+)\/(.+)/);
+                const queueArn = urlMatch
+                    ? `arn:aws:sqs:${urlMatch[1]}:${urlMatch[2]}:${urlMatch[3]}`
+                    : s.queueUrl;
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['sqs:SendMessage'],
+                    resources: [queueArn],
+                }));
+            }
+            else if (s.serviceAction === 'athena-start-query') {
+                const workGroup = s.workGroup ?? 'primary';
+                stateMachine.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['athena:StartQueryExecution', 'athena:GetQueryExecution', 'athena:GetQueryResults'],
+                    resources: [
+                        this.formatArn({ service: 'athena', resource: `workgroup/${workGroup}` }),
+                    ],
+                }));
+            }
+        }
         return stateMachine;
     }
     translateToAsl(flow, options) {
@@ -126,6 +206,10 @@ export class FlowsStack extends cdk.Stack {
                     ...(step.next ? { Next: step.next } : { End: true }),
                 };
             }
+            case 'domain-query':
+                return this.translateDomainQuery(step, flowId);
+            case 'aws-service':
+                return this.translateAwsService(step, flowId);
             case 'flow-control':
                 return this.translateFlowControl(step, options, flowId);
         }
@@ -145,6 +229,25 @@ export class FlowsStack extends cdk.Stack {
                 });
                 return { Type: 'Parallel', Branches: branches, ...(step.next ? { Next: step.next } : { End: true }) };
             }
+            case 'map': {
+                if (step.iterator.length === 0)
+                    throw new Error(`packFlows: map step ${step.name} in flow ${flowId} has empty iterator`);
+                const iteratorStates = {};
+                for (const s of step.iterator)
+                    iteratorStates[s.name] = this.translateStep(s, options, flowId);
+                const mapState = {
+                    Type: 'Map',
+                    ItemsPath: step.itemsPath ?? '$',
+                    Iterator: {
+                        StartAt: step.iterator[0].name,
+                        States: iteratorStates,
+                    },
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.maxConcurrency && step.maxConcurrency > 0)
+                    mapState.MaxConcurrency = step.maxConcurrency;
+                return mapState;
+            }
             case 'wait':
                 return { Type: 'Wait', Seconds: step.seconds, ...(step.next ? { Next: step.next } : { End: true }) };
             case 'succeed':
@@ -155,6 +258,219 @@ export class FlowsStack extends cdk.Stack {
                 return { Type: 'Pass', Result: step.result, ...(step.next ? { Next: step.next } : { End: true }) };
         }
     }
+    translateDomainQuery(step, flowId) {
+        switch (step.queryType) {
+            case 'dynamodb-get-item': {
+                const tableName = `tib-${step.domainId}`;
+                const key = {};
+                for (const [k, v] of Object.entries(step.key)) {
+                    key[k] = v.startsWith('$') ? { 'S.$': v } : { S: v };
+                }
+                const getItem = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::aws-sdk:dynamodb:getItem',
+                    Parameters: { TableName: tableName, Key: key },
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    getItem.ResultPath = step.resultPath;
+                return getItem;
+            }
+            case 'dynamodb-query': {
+                const tableName = `tib-${step.domainId}`;
+                const eav = {};
+                for (const [k, v] of Object.entries(step.expressionAttributeValues)) {
+                    eav[k] = v.value.startsWith('$') ? { [`${v.type}.$`]: v.value } : { [v.type]: v.value };
+                }
+                const params = {
+                    TableName: tableName,
+                    KeyConditionExpression: step.keyConditionExpression,
+                    ExpressionAttributeValues: eav,
+                };
+                if (step.expressionAttributeNames)
+                    params.ExpressionAttributeNames = step.expressionAttributeNames;
+                if (step.filterExpression)
+                    params.FilterExpression = step.filterExpression;
+                if (step.indexName)
+                    params.IndexName = step.indexName;
+                if (step.limit)
+                    params.Limit = step.limit;
+                if (step.scanIndexForward !== undefined)
+                    params.ScanIndexForward = step.scanIndexForward;
+                const query = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::aws-sdk:dynamodb:query',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    query.ResultPath = step.resultPath;
+                return query;
+            }
+            case 's3-get-object': {
+                const bucketName = `tib-${step.domainId}`;
+                const getObject = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::aws-sdk:s3:getObject',
+                    Parameters: { Bucket: bucketName, Key: step.key },
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    getObject.ResultPath = step.resultPath;
+                return getObject;
+            }
+        }
+    }
+    translateAwsService(step, flowId) {
+        switch (step.serviceAction) {
+            case 'sns-publish': {
+                const params = {
+                    TopicArn: step.topicArn,
+                    Message: step.message,
+                };
+                if (step.subject)
+                    params.Subject = step.subject;
+                if (step.messageAttributes)
+                    params.MessageAttributes = step.messageAttributes;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::sns:publish',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'glue-start-job-run': {
+                const params = { JobName: step.jobName };
+                if (step.arguments)
+                    params.Arguments = step.arguments;
+                if (step.timeout)
+                    params.Timeout = step.timeout;
+                if (step.workerType)
+                    params.WorkerType = step.workerType;
+                if (step.numberOfWorkers)
+                    params.NumberOfWorkers = step.numberOfWorkers;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::glue:startJobRun',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'batch-submit-job': {
+                const params = {
+                    JobName: step.batchJobName,
+                    JobQueue: step.jobQueue,
+                    JobDefinition: step.jobDefinition,
+                };
+                if (step.parameters)
+                    params.Parameters = step.parameters;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::batch:submitJob',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'step-functions-start-execution': {
+                const params = {
+                    StateMachineArn: step.stateMachineArn,
+                };
+                if (step.input)
+                    params.Input = step.input;
+                if (step.executionName)
+                    params.Name = step.executionName;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::states:startExecution',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'https-call': {
+                const params = {
+                    Url: step.endpoint,
+                    Method: step.method,
+                };
+                if (step.headers)
+                    params.Headers = step.headers;
+                if (step.body)
+                    params.RequestBody = step.body;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::https:invoke',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'sqs-send-message': {
+                const params = {
+                    QueueUrl: step.queueUrl,
+                    MessageBody: step.messageBody,
+                };
+                if (step.delaySeconds !== undefined)
+                    params.DelaySeconds = step.delaySeconds;
+                if (step.messageAttributes)
+                    params.MessageAttributes = step.messageAttributes;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::sqs:sendMessage',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+            case 'athena-start-query': {
+                const params = {
+                    QueryString: step.queryString,
+                    QueryExecutionContext: { Database: step.database },
+                    ResultConfiguration: { OutputLocation: step.outputLocation },
+                };
+                if (step.workGroup)
+                    params.WorkGroup = step.workGroup;
+                const state = {
+                    Type: 'Task',
+                    Resource: 'arn:aws:states:::athena:startQueryExecution',
+                    Parameters: params,
+                    ...(step.next ? { Next: step.next } : { End: true }),
+                };
+                if (step.resultPath)
+                    state.ResultPath = step.resultPath;
+                return state;
+            }
+        }
+    }
+    collectAllSteps(steps) {
+        const result = [];
+        for (const step of steps) {
+            result.push(step);
+            if (step.type === 'flow-control' && step.control === 'parallel') {
+                for (const branch of step.branches) {
+                    result.push(...this.collectAllSteps(branch));
+                }
+            }
+            if (step.type === 'flow-control' && step.control === 'map') {
+                result.push(...this.collectAllSteps(step.iterator));
+            }
+        }
+        return result;
+    }
 }
 /** Convenience: construct a FlowsStack from a registry. */
 export function packFlows(registry, app, stackId, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",