@openhi/constructs 0.0.1 → 0.0.3

package/lib/index.d.ts

@@ -1,15 +1,14 @@
-import { App, AppProps, Stage, StageProps, Stack, StackProps, RemovalPolicy } from 'aws-cdk-lib';
+import { RemovalPolicy, App, AppProps, Stage, StageProps, Stack, StackProps } from 'aws-cdk-lib';
 import { Construct, IConstruct } from 'constructs';
-import { HttpApiProps, HttpApi, IHttpApi } from 'aws-cdk-lib/aws-apigatewayv2';
-import { GraphqlApiProps } from 'aws-cdk-lib/aws-appsync';
-import { EventBusProps } from 'aws-cdk-lib/aws-events';
+import { ICertificate, Certificate, CertificateProps } from 'aws-cdk-lib/aws-certificatemanager';
+import { IHttpApi, HttpApi, HttpApiProps, DomainName } from 'aws-cdk-lib/aws-apigatewayv2';
+import { GraphqlApi, IGraphqlApi, GraphqlApiProps } from 'aws-cdk-lib/aws-appsync';
+import { UserPool, UserPoolProps, UserPoolClient, UserPoolClientProps, UserPoolDomain, UserPoolDomainProps, IUserPool, IUserPoolClient, IUserPoolDomain } from 'aws-cdk-lib/aws-cognito';
+import { Key, KeyProps, IKey } from 'aws-cdk-lib/aws-kms';
+import { Table, TableProps, ITable } from 'aws-cdk-lib/aws-dynamodb';
+import { EventBus, EventBusProps, IEventBus } from 'aws-cdk-lib/aws-events';
+import { HostedZone, HostedZoneProps, IHostedZone, HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
 import { StringParameterProps, StringParameter } from 'aws-cdk-lib/aws-ssm';
-import { UserPoolProps, IUserPool, IUserPoolClient, IUserPoolDomain } from 'aws-cdk-lib/aws-cognito';
-import { IKey } from 'aws-cdk-lib/aws-kms';
-import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
-import { HostedZoneAttributes, IHostedZone } from 'aws-cdk-lib/aws-route53';
-import { SetOptional } from 'type-fest';
-import { ITable } from 'aws-cdk-lib/aws-dynamodb';
 
 /*******************************************************************************
  *
@@ -296,74 +295,13 @@ declare class OpenHiApp extends App {
     get secondaryEnvironments(): Array<OpenHiEnvironment>;
 }
 
-interface CoreProps {
-    /**
-     * Pass in options for an event bus, optional.
-     */
-    readonly dataEventBusProps?: EventBusProps;
-    /**
-     * Pass in options for an event bus, optional.
-     */
-    readonly opsEventBusProps?: EventBusProps;
-    /**
-     * Optional args for creating HTTP API.
-     */
-    readonly httpApiProps?: HttpApiProps;
-    /**
-     * Optional args for creating the core GraphQL API.
-     */
-    readonly graphqlApiProps?: GraphqlApiProps;
-}
-
 /**
- * Service type identifiers for OpenHI services.
- *
- * @remarks
- * These constants define the different types of services that can be deployed
- * within the OpenHI platform. Each service type represents a distinct domain
- * or functional area with its own data model, API endpoints, and business logic.
- *
- * Service types are used for:
- * - Resource naming and tagging
- * - Service discovery and routing
- * - Deployment context calculations
- * - Cross-service communication patterns
+ * Known OpenHI service type strings. Each service class defines its own
+ * static SERVICE_TYPE (e.g. OpenHiAuthService.SERVICE_TYPE === "auth").
  *
  * @public
  */
-declare const OPEN_HI_SERVICE_TYPE: {
-    /**
-     * Authentication service.
-     *   *
-     * Only one instance of the auth service should exist per environment.
-     */
-    readonly AUTH: "auth";
-    /**
-     * Root shared core services.
-     *
-     * Only one instance of the core service should exist per environment.
-     */
-    readonly CORE: "core";
-    /**
-     * Rest API service.
-     */
-    readonly REST_API: "rest-api";
-    /**
-     * Global Infrastructure stack (Route53, ACM).
-     */
-    readonly GLOBAL: "global";
-    /**
-     * Data service (DynamoDB, S3, persistence).
-     */
-    readonly DATA: "data";
-};
-/**
- * Type representing valid OpenHI service type values. This is a union of the
- * values from {@link OPEN_HI_SERVICE_TYPE}.
- *
- * @public
- */
-type OpenHiServiceType = (typeof OPEN_HI_SERVICE_TYPE)[keyof typeof OPEN_HI_SERVICE_TYPE];
+type OpenHiServiceType = "auth" | "rest-api" | "data" | "global" | "graphql-api";
 /**
  * Properties for creating an {@link OpenHiService} stack.
  *
@@ -398,15 +336,12 @@ interface OpenHiServiceProps extends StackProps {
      * A constant that identifies the service type.
      */
     readonly serviceType?: OpenHiServiceType;
-    /**
-     * Optional props for the core construct.
-     */
-    readonly coreProps?: CoreProps;
 }
 /**
  * Represents an OpenHI service stack within the OpenHI platform.
+ * Subclasses must override {@link serviceType} to return their static SERVICE_TYPE.
  */
-declare class OpenHiService extends Stack {
+declare abstract class OpenHiService extends Stack {
     ohEnv: OpenHiEnvironment;
     props: OpenHiServiceProps;
     /**
@@ -455,12 +390,10 @@ declare class OpenHiService extends Stack {
      */
     readonly config: OpenHiEnvironmentConfig;
     /**
-     * A constant that identifies the service type.
-     */
-    readonly serviceType: (typeof OPEN_HI_SERVICE_TYPE)[keyof typeof OPEN_HI_SERVICE_TYPE] | string;
-    /**
-     * Core construct containing shared infrastructure.
+     * Service type identifier. Override in subclasses to return the class's static SERVICE_TYPE.
+     * Used for parameter names, tags, and service discovery.
      */
+    abstract get serviceType(): OpenHiServiceType | string;
     /**
      * Creates a new OpenHI service stack.
      *
@@ -472,15 +405,148 @@ declare class OpenHiService extends Stack {
      *
      */
     constructor(ohEnv: OpenHiEnvironment, id: string, props?: OpenHiServiceProps);
-    /**
-     * Creates or returns the core construct for shared infrastructure.
-     */
     /**
      * DNS prefix for this branche's child zone.
      */
     get childZonePrefix(): string;
 }
 
+declare class RootWildcardCertificate extends Certificate {
+    /**
+     * Used when storing the Certificate ARN in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "ROOT_WILDCARD_CERT_ARN";
+    /**
+     * Using a special name here since this will be shared and used among many
+     * stacks and services. Use with OpenHiGlobalService.rootWildcardCertificateFromConstruct.
+     */
+    static ssmParameterName(): string;
+    constructor(scope: Construct, props: CertificateProps);
+}
+
+declare class RootHttpApi extends HttpApi {
+    /**
+     * Used when storing the API ID in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "ROOT_HTTP_API";
+    constructor(scope: Construct, props?: HttpApiProps);
+}
+
+interface RootGraphqlApiProps extends GraphqlApiProps {
+}
+declare class RootGraphqlApi extends GraphqlApi {
+    /**
+     * Used when storing the GraphQl API ID in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "ROOT_GRAPHQL_API";
+    static fromConstruct(scope: Construct): IGraphqlApi;
+    constructor(scope: Construct, props?: Omit<RootGraphqlApiProps, "name">);
+}
+
+declare class CognitoUserPool extends UserPool {
+    /**
+     * Used when storing the User Pool ID in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "COGNITO_USER_POOL";
+    constructor(scope: Construct, props?: UserPoolProps);
+}
+
+declare class CognitoUserPoolClient extends UserPoolClient {
+    /**
+     * Used when storing the User Pool Client ID in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "COGNITO_USER_POOL_CLIENT";
+    constructor(scope: Construct, props: UserPoolClientProps);
+}
+
+declare class CognitoUserPoolDomain extends UserPoolDomain {
+    /**
+     * Used when storing the User Pool Domain in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "COGNITO_USER_POOL_DOMAIN";
+    constructor(scope: Construct, props: UserPoolDomainProps);
+}
+
+declare class CognitoUserPoolKmsKey extends Key {
+    /**
+     * Used when storing the KMS Key in SSM.
+     */
+    static readonly SSM_PARAM_NAME = "COGNITO_USER_POOL_KMS_KEY";
+    constructor(scope: Construct, props?: KeyProps);
+}
+
+/**
+ * DynamoDB table name for the data store. Used for cross-stack reference and
+ * deterministic naming per branch. The table backs multiple use cases (e.g.
+ * CRM, CMS, ERP, EHR).
+ */
+declare function getDynamoDbDataStoreTableName(scope: Construct): string;
+interface DynamoDbDataStoreProps extends Omit<TableProps, "tableName" | "removalPolicy"> {
+    /**
+     * Optional removal policy override. If not set, uses the service's default
+     * removal policy (RETAIN for prod, DESTROY otherwise).
+     */
+    readonly removalPolicy?: RemovalPolicy;
+}
+/**
+ * DynamoDB table implementing the single-table design for app data (e.g. FHIR
+ * resources, CRM, CMS, ERP, EHR).
+ *
+ * @see {@link https://github.com/codedrifters/openhi/blob/main/sites/www-docs/content/architecture/dynamodb-single-table-design.md | DynamoDB Single-Table Design}
+ *
+ * Primary key: PK (String), SK (String).
+ * GSIs: GSI1 (reverse reference), GSI2 (identifier lookup), GSI3 (facility ops), GSI4 (resource type list).
+ */
+declare class DynamoDbDataStore extends Table {
+    constructor(scope: Construct, id: string, props?: DynamoDbDataStoreProps);
+}
+
+declare class DataEventBus extends EventBus {
+    /*****************************************************************************
+     *
+     * Return a name for this EventBus based on the stack environment hash. This
+     * name is common across all stacks since it's using the environment hash in
+     * it's name.
+     *
+     ****************************************************************************/
+    static getEventBusName(scope: Construct): string;
+    constructor(scope: Construct, props?: EventBusProps);
+}
+
+declare class OpsEventBus extends EventBus {
+    /*****************************************************************************
+     *
+     * Return a name for this EventBus based on the stack environment hash. This
+     * name is common across all stacks since it's using the environment hash in
+     * it's name.
+     *
+     ****************************************************************************/
+    static getEventBusName(scope: Construct): string;
+    constructor(scope: Construct, props?: EventBusProps);
+}
+
+interface ChildHostedZoneProps extends HostedZoneProps {
+    /**
+     * The root zone we will attach this sub-zone to.
+     */
+    readonly parentHostedZone: IHostedZone;
+}
+declare class ChildHostedZone extends HostedZone {
+    /**
+     * Used when storing the child zone ID in SSM. Use {@link OpenHiGlobalService.childHostedZoneFromConstruct} to look up.
+     */
+    static readonly SSM_PARAM_NAME = "CHILDHOSTEDZONE";
+    constructor(scope: Construct, id: string, props: ChildHostedZoneProps);
+}
+
+/**
+ * Placeholder for root hosted zone. Use {@link OpenHiGlobalService.rootHostedZoneFromConstruct}
+ * to obtain an IHostedZone from attributes (e.g. from config). The root zone is always
+ * created manually and imported via config.
+ */
+declare class RootHostedZone extends Construct {
+}
+
 /*******************************************************************************
  *
  * DiscoverableStringParameterProps: props for creating or looking up SSM
@@ -526,6 +592,12 @@ type BuildParameterNameProps = Pick<DiscoverableStringParameterProps, "ssmParamN
  * the parameter with the name constant.
  */
 declare class DiscoverableStringParameter extends StringParameter {
+    /**
+     * Version of the parameter name format / discoverability schema.
+     * Bump when buildParameterName or tagging semantics change.
+     * Also used to drive replacement of parameters during CloudFormation deploys.
+     */
+    static readonly version = "v1";
     /**
      * Build a param name based on predictable attributes found in services and
      * constructs. Used for storage and retrieval of SSM values across services.
@@ -539,175 +611,134 @@ declare class DiscoverableStringParameter extends StringParameter {
     constructor(scope: Construct, id: string, props: DiscoverableStringParameterProps);
 }
 
-interface OpenHiCoreServiceProps extends OpenHiServiceProps {
-}
-declare class OpenHiCoreService extends OpenHiService {
-    /*****************************************************************************
-     *
-     * PROPS
-     *
-     * Final props calculated from inputs combined with default values.
-     *
-     ****************************************************************************/
-    readonly props: OpenHiCoreServiceProps;
-    constructor(ohEnv: OpenHiEnvironment, props?: OpenHiCoreServiceProps);
-}
-
-interface AuthProps {
+interface OpenHiAuthServiceProps extends OpenHiServiceProps {
     /**
-     * Optional props for creating the user pool.
+     * Optional props for the Cognito User Pool.
      */
     readonly userPoolProps?: UserPoolProps;
 }
 /**
- * Auth construct that manages Cognito authentication resources.
+ * OpenHI Auth Service stack.
  *
  * @remarks
- * The Auth construct provides authentication infrastructure including:
+ * The Auth service manages authentication infrastructure including:
  * - Cognito User Pool for user management and authentication
  * - User Pool Client for application integration
  * - User Pool Domain for hosting the Cognito hosted UI
  * - KMS Key for Cognito User Pool encryption
  *
- * When created in the Auth service (`serviceType === OPEN_HI_SERVICE_TYPE.AUTH`),
- * it creates concrete resources. Otherwise, it imports existing resources
- * from SSM Parameter Store.
+ * Resources are created in protected methods; subclasses may override to customize.
+ * Other stacks obtain auth by calling **OpenHiAuthService.userPoolFromConstruct(scope)**,
+ * **OpenHiAuthService.userPoolClientFromConstruct(scope)**,
+ * **OpenHiAuthService.userPoolDomainFromConstruct(scope)**,
+ * and **OpenHiAuthService.userPoolKmsKeyFromConstruct(scope)** for each resource needed.
  *
- * Use {@link Auth.fromConstruct} to obtain an Auth instance (with resources
- * imported from AUTH SSM parameters) when not in the Auth service, e.g. from
- * the Core construct.
+ * Only one instance of the auth service should exist per environment.
  *
  * @public
  */
-declare class Auth extends Construct {
+declare class OpenHiAuthService extends OpenHiService {
+    props: OpenHiAuthServiceProps;
+    static readonly SERVICE_TYPE = "auth";
     /**
-     * Returns an Auth instance that uses resources imported from AUTH SSM
-     * parameters. Use this when creating Core or other stacks that consume
-     * auth resources; the Auth stack must be deployed first.
-     *
-     * @param scope - Construct scope (e.g. Core); must be in a stack that has
-     *   access to the same account/region as the deployed Auth stack.
+     * Returns an IUserPool by looking up the Auth stack's User Pool ID from SSM.
      */
-    static fromConstruct(scope: Construct): Auth;
+    static userPoolFromConstruct(scope: Construct): IUserPool;
     /**
-     * Is this construct being created in the auth service or elsewhere?
+     * Returns an IUserPoolClient by looking up the Auth stack's User Pool Client ID from SSM.
      */
-    readonly isAuthService: boolean;
+    static userPoolClientFromConstruct(scope: Construct): IUserPoolClient;
     /**
-     * KMS Key used to encrypt the Cognito User Pool. We need a custom key so that
-     * we can decrypt tokens when sending emails using something other than SES.
+     * Returns an IUserPoolDomain by looking up the Auth stack's User Pool Domain from SSM.
      */
-    readonly userPoolKmsKey: IKey;
+    static userPoolDomainFromConstruct(scope: Construct): IUserPoolDomain;
     /**
-     * Cognito User Pool for user management and authentication.
+     * Returns an IKey (KMS) by looking up the Auth stack's User Pool KMS Key ARN from SSM.
      */
+    static userPoolKmsKeyFromConstruct(scope: Construct): IKey;
+    get serviceType(): string;
+    readonly userPoolKmsKey: IKey;
     readonly userPool: IUserPool;
-    /**
-     * Cognito User Pool Client for application integration with the User Pool.
-     */
     readonly userPoolClient: IUserPoolClient;
+    readonly userPoolDomain: IUserPoolDomain;
+    constructor(ohEnv: OpenHiEnvironment, props?: OpenHiAuthServiceProps);
     /**
-     * Cognito User Pool Domain for hosting the Cognito hosted UI.
+     * Creates the KMS key for the Cognito User Pool and exports its ARN to SSM.
+     * Look up via {@link OpenHiAuthService.userPoolKmsKeyFromConstruct}.
+     * Override to customize.
      */
-    readonly userPoolDomain: IUserPoolDomain;
-    constructor(scope: Construct, props?: AuthProps);
-    /*****************************************************************************
-     *
-     * Auth Support
-     *
-     ****************************************************************************/
     protected createUserPoolKmsKey(): IKey;
-    protected createUserPool(props?: UserPoolProps): IUserPool;
-    protected createUserPoolClient(props: {
-        userPool: IUserPool;
-    }): IUserPoolClient;
-    protected createUserPoolDomain(props: {
-        userPool: IUserPool;
-    }): IUserPoolDomain;
-}
-
-interface OpenHiAuthServiceProps extends OpenHiServiceProps {
     /**
-     * Optional props for the auth construct.
+     * Creates the Cognito User Pool and exports its ID to SSM.
+     * Look up via {@link OpenHiAuthService.userPoolFromConstruct}.
+     * Override to customize.
      */
-    readonly authProps?: AuthProps;
-}
-/**
- * OpenHI Auth Service stack.
- *
- * @remarks
- * The Auth service manages authentication infrastructure including:
- * - Cognito User Pool for user management and authentication
- * - User Pool Client for application integration
- * - User Pool Domain for hosting the Cognito hosted UI
- * - KMS Key for Cognito User Pool encryption
- *
- * Only one instance of the auth service should exist per environment.
- *
- * @public
- */
-declare class OpenHiAuthService extends OpenHiService {
-    props: OpenHiAuthServiceProps;
+    protected createUserPool(): IUserPool;
     /**
-     * Auth construct containing authentication resources.
+     * Creates the User Pool Client and exports its ID to SSM (AUTH service type).
+     * Look up via {@link OpenHiAuthService.userPoolClientFromConstruct}.
+     * Override to customize.
      */
-    readonly auth: Auth;
-    constructor(ohEnv: OpenHiEnvironment, props?: OpenHiAuthServiceProps);
+    protected createUserPoolClient(): IUserPoolClient;
+    /**
+     * Creates the User Pool Domain (Cognito hosted UI) and exports domain name to SSM.
+     * Look up via {@link OpenHiAuthService.userPoolDomainFromConstruct}.
+     * Override to customize.
+     */
+    protected createUserPoolDomain(): IUserPoolDomain;
 }
 
-interface GlobalProps {
+interface OpenHiGlobalServiceProps extends OpenHiServiceProps {
+}
+/**
+ * Global Infrastructure stack: owns global DNS and certificates.
+ * Resources (root zone, optional child zone, wildcard cert) are created
+ * in protected methods; subclasses may override to customize.
+ */
+declare class OpenHiGlobalService extends OpenHiService {
+    static readonly SERVICE_TYPE = "global";
     /**
-     * Root zone configuration attributes. Zone name is required, hosted zone ID
-     * is optional.
+     * Returns an IHostedZone from the given attributes (no SSM). Use when the zone is imported from config.
      */
-    readonly rootHostedZoneAttributes: HostedZoneAttributes;
+    static rootHostedZoneFromConstruct(scope: Construct, props: HostedZoneAttributes): IHostedZone;
     /**
-     * Child zone configuration attributes. Zone name is required, hosted zone ID
-     * is optional.
+     * Returns an ICertificate by looking up the Global stack's wildcard cert ARN from SSM.
      */
-    readonly childHostedZoneAttributes?: SetOptional<HostedZoneAttributes, "hostedZoneId">;
-}
-/**
- * Global construct: owns global infrastructure (e.g. DNS and certificate resources).
-
- */
-declare class Global extends Construct {
-    props: GlobalProps;
+    static rootWildcardCertificateFromConstruct(scope: Construct): ICertificate;
     /**
-     * Root hosted zone when config provides zoneName.
+     * Returns an IHostedZone by looking up the child hosted zone ID from SSM. Defaults to GLOBAL service type.
      */
+    static childHostedZoneFromConstruct(scope: Construct, props: {
+        zoneName: string;
+        serviceType?: OpenHiServiceType;
+    }): IHostedZone;
+    get serviceType(): string;
     readonly rootHostedZone: IHostedZone;
+    readonly childHostedZone?: IHostedZone;
+    readonly rootWildcardCertificate: ICertificate;
+    constructor(ohEnv: OpenHiEnvironment, props?: OpenHiGlobalServiceProps);
     /**
-     * Child hosted zone when root zone exists.
+     * Validates that config required for the Global stack is present.
      */
-    readonly childHostedZone?: IHostedZone;
+    protected validateConfig(props: OpenHiGlobalServiceProps): void;
     /**
-     * Root wildcard certificate.
+     * Creates the root hosted zone (imported via attributes from config).
+     * Override to customize or create the zone.
      */
-    readonly rootWildcardCertificate: ICertificate;
-    constructor(scope: Construct, id: string, props: GlobalProps);
-}
-
-interface OpenHiGlobalServiceProps extends OpenHiServiceProps {
-}
-/**
- * Global Infrastructure stack: owns global DNS and certificates
- */
-declare class OpenHiGlobalService extends OpenHiService {
+    protected createRootHostedZone(): IHostedZone;
     /**
-     * Global construct.
+     * Creates the optional child hosted zone (e.g. branch subdomain).
+     * Override to create a child zone when config provides childHostedZoneAttributes.
+     * If you create a ChildHostedZone, also create a DiscoverableStringParameter
+     * with ChildHostedZone.SSM_PARAM_NAME and the zone's hostedZoneId.
      */
-    readonly global: Global;
-    constructor(ohEnv: OpenHiEnvironment, props?: OpenHiGlobalServiceProps);
-}
-
-declare class CoreHttpApi extends HttpApi {
+    protected createChildHostedZone(): IHostedZone | undefined;
     /**
-     * Used when storing the API ID in SSM.
+     * Creates the root wildcard certificate. On main branch, creates a new cert
+     * with DNS validation; otherwise imports from SSM.
+     * Override to customize certificate creation.
      */
-    static readonly SSM_PARAM_NAME = "CORE_HTTP_API";
-    static fromConstruct(scope: Construct): IHttpApi;
-    constructor(scope: Construct, props?: HttpApiProps);
+    protected createRootWildcardCertificate(): ICertificate;
 }
 
 interface OpenHiRestApiServiceProps extends OpenHiServiceProps {
@@ -719,27 +750,120 @@ interface OpenHiRestApiServiceProps extends OpenHiServiceProps {
 declare const REST_API_BASE_URL_SSM_NAME = "REST_API_BASE_URL";
 /**
  * REST API service stack: HTTP API, custom domain, and Lambda; exports base URL via SSM.
+ * Resources are created in protected methods; subclasses may override to customize.
  */
 declare class OpenHiRestApiService extends OpenHiService {
-    readonly coreHttpApi: CoreHttpApi;
+    static readonly SERVICE_TYPE = "rest-api";
+    /**
+     * Returns an IHttpApi by looking up the REST API stack's HTTP API ID from SSM.
+     */
+    static rootHttpApiFromConstruct(scope: Construct): IHttpApi;
+    /**
+     * Returns the REST API base URL (e.g. https://api.example.com) by looking it up from SSM.
+     * Use in other stacks for E2E, scripts, or config.
+     */
+    static restApiBaseUrlFromConstruct(scope: Construct): string;
+    get serviceType(): string;
+    readonly rootHttpApi: RootHttpApi;
     constructor(ohEnv: OpenHiEnvironment, props?: OpenHiRestApiServiceProps);
+    /**
+     * Validates that config required for the REST API stack is present.
+     */
+    protected validateConfig(props: OpenHiRestApiServiceProps): void;
+    /**
+     * Creates the hosted zone reference (imported from config).
+     * Override to customize.
+     */
+    protected createHostedZone(): IHostedZone;
+    /**
+     * Creates the wildcard certificate (imported from Global stack via SSM).
+     * Override to customize.
+     */
+    protected createCertificate(): ICertificate;
+    /**
+     * Returns the API domain name string (e.g. api.example.com or api-{prefix}.example.com).
+     * Override to customize.
+     */
+    protected createApiDomainNameString(hostedZone: IHostedZone): string;
+    /**
+     * Creates the SSM parameter for the REST API base URL.
+     * Look up via {@link OpenHiRestApiService.restApiBaseUrlFromConstruct}.
+     * Override to customize.
+     */
+    protected createRestApiBaseUrlParameter(apiDomainName: string): void;
+    /**
+     * Creates the API Gateway custom domain name resource.
+     * Override to customize.
+     */
+    protected createDomainName(_hostedZone: IHostedZone, certificate: ICertificate): DomainName;
+    /**
+     * Creates the Lambda integration, HTTP routes, and API DNS record.
+     * Override to customize. Uses {@link rootHttpApi} set by the constructor.
+     */
+    protected createRestApiLambdaAndRoutes(hostedZone: IHostedZone, domainName: DomainName): void;
+    /**
+     * Creates the Root HTTP API with default domain mapping and exports API ID to SSM.
+     * Look up via {@link OpenHiRestApiService.rootHttpApiFromConstruct}.
+     * Override to customize.
+     */
+    protected createRootHttpApi(domainName: DomainName): RootHttpApi;
 }
 
 interface OpenHiDataServiceProps extends OpenHiServiceProps {
 }
 /**
- * Data storage service stack: centralizes DynamoDB, S3, and other persistence
- * resources for OpenHI. Creates the single-table data store (CRM, CMS, ERP,
- * EHR); add buckets or other resources as needed.
+ * Data storage service stack: centralizes DynamoDB, S3, EventBridge event buses,
+ * and other persistence resources for OpenHI. Creates the single-table data store
+ * (CRM, CMS, ERP, EHR) and the data/ops event buses in protected methods;
+ * subclasses may override to customize.
  */
 declare class OpenHiDataService extends OpenHiService {
+    static readonly SERVICE_TYPE = "data";
     /**
-     * The single-table DynamoDB data store. Use {@link DynamoDbDataStore.fromConstruct}
+     * Returns the data event bus by name (deterministic per branch). Use from other stacks to obtain an IEventBus reference.
+     */
+    static dataEventBusFromConstruct(scope: Construct): IEventBus;
+    /**
+     * Returns the ops event bus by name (deterministic per branch). Use from other stacks to obtain an IEventBus reference.
+     */
+    static opsEventBusFromConstruct(scope: Construct): IEventBus;
+    /**
+     * Returns the data store table by name. Use from other stacks (e.g. REST API Lambda) to obtain an ITable reference.
+     */
+    static dynamoDbDataStoreFromConstruct(scope: Construct, id?: string): ITable;
+    get serviceType(): string;
+    /**
+     * Event bus for data-related events (ingestion, transformation, storage).
+     * Other stacks obtain it via {@link OpenHiDataService.dataEventBusFromConstruct}.
+     */
+    readonly dataEventBus: IEventBus;
+    /**
+     * Event bus for operational events (monitoring, alerting, system health).
+     * Other stacks obtain it via {@link OpenHiDataService.opsEventBusFromConstruct}.
+     */
+    readonly opsEventBus: IEventBus;
+    /**
+     * The single-table DynamoDB data store. Use {@link OpenHiDataService.dynamoDbDataStoreFromConstruct}
      * from other stacks to obtain an ITable reference by name.
      */
     readonly dataStore: ITable;
     constructor(ohEnv: OpenHiEnvironment, props?: OpenHiDataServiceProps);
+    /**
+     * Creates the data event bus.
+     * Override to customize.
+     */
+    protected createDataEventBus(): IEventBus;
+    /**
+     * Creates the ops event bus.
+     * Override to customize.
+     */
+    protected createOpsEventBus(): IEventBus;
+    /**
+     * Creates the single-table DynamoDB data store.
+     * Override to customize.
+     */
+    protected createDataStore(): ITable;
 }
 
-export { DiscoverableStringParameter, OPEN_HI_SERVICE_TYPE, OpenHiApp, OpenHiAuthService, OpenHiCoreService, OpenHiDataService, OpenHiEnvironment, OpenHiGlobalService, OpenHiRestApiService, OpenHiService, OpenHiStage, REST_API_BASE_URL_SSM_NAME };
-export type { BuildParameterNameProps, DiscoverableStringParameterProps, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiCoreServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps };
+export { ChildHostedZone, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, DataEventBus, DiscoverableStringParameter, DynamoDbDataStore, OpenHiApp, OpenHiAuthService, OpenHiDataService, OpenHiEnvironment, OpenHiGlobalService, OpenHiRestApiService, OpenHiService, OpenHiStage, OpsEventBus, REST_API_BASE_URL_SSM_NAME, RootGraphqlApi, RootHostedZone, RootHttpApi, RootWildcardCertificate, getDynamoDbDataStoreTableName };
+export type { BuildParameterNameProps, ChildHostedZoneProps, DiscoverableStringParameterProps, DynamoDbDataStoreProps, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps, RootGraphqlApiProps };