@openhi/constructs 0.0.111 → 0.0.112

package/lib/index.mjs

@@ -1,9 +1,15 @@
+import {
+  DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES,
+  DATA_STORE_CHANGE_DETAIL_TYPE,
+  DATA_STORE_CHANGE_EVENT_SOURCE,
+  buildFhirCurrentResourceChangeDetail
+} from "./chunk-CEOAGPYY.mjs";
 import {
   SEED_SYSTEM_DATA_ACTOR_SYSTEM,
   SEED_SYSTEM_DATA_CONSUMER_NAME,
   SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR,
   import_workflows as import_workflows2
-} from "./chunk-AGF3RAAZ.mjs";
+} from "./chunk-WPCBVDFZ.mjs";
 import {
   DEMO_PERIOD,
   DEMO_TENANT_SPECS,
@@ -29,14 +35,23 @@ import {
   import_workflows,
   openhiResourceIdentifier,
   rolePartitionKey
-} from "./chunk-7Q2IJ2J5.mjs";
+} from "./chunk-CUUKXDB2.mjs";
 import {
-  DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES,
-  DATA_STORE_CHANGE_DETAIL_TYPE,
-  DATA_STORE_CHANGE_EVENT_SOURCE,
-  buildFhirCurrentResourceChangeDetail
-} from "./chunk-CEOAGPYY.mjs";
-import "./chunk-7FUAMZOF.mjs";
+  OWNING_DELETE_CASCADE_CONSUMER_NAME,
+  OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY,
+  OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES,
+  OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR,
+  import_workflows as import_workflows3
+} from "./chunk-7RZHFI77.mjs";
+import {
+  RENAME_CASCADE_CONSUMER_NAME,
+  RENAME_CASCADE_DEFAULT_CONCURRENCY,
+  RENAME_CASCADE_FAILED_THRESHOLD,
+  RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR,
+  RENAME_CASCADE_SLOW_THRESHOLD_SECONDS,
+  import_workflows as import_workflows4
+} from "./chunk-23PUSHBV.mjs";
+import "./chunk-53OHXLIL.mjs";
 import {
   PROVISION_DEFAULT_WORKSPACE_DETAIL_TYPE,
   USER_ONBOARDING_EVENT_SOURCE,
@@ -53,10 +68,14 @@ import {
 } from "./chunk-VXX4I3EF.mjs";
 import {
   require_lib
-} from "./chunk-SYBADQXI.mjs";
-import "./chunk-MULKGFIJ.mjs";
-import "./chunk-IS4VQRI4.mjs";
-import "./chunk-QR5JVSCF.mjs";
+} from "./chunk-ZM4GDHHC.mjs";
+import "./chunk-GBDIGTNV.mjs";
+import "./chunk-HQ67J7BP.mjs";
+import "./chunk-QJDHVMKT.mjs";
+import "./chunk-QMBJ4VHC.mjs";
+import "./chunk-FYHBHHWK.mjs";
+import "./chunk-6NBGYGFL.mjs";
+import "./chunk-TRY7JGWO.mjs";
 import {
   __commonJS,
   __toESM
@@ -1006,7 +1025,7 @@ var DynamoDbDataStore = class extends Table {
 };
 
 // src/components/dynamodb/workflow-dedup-table.ts
-var import_workflows3 = __toESM(require_lib());
+var import_workflows5 = __toESM(require_lib());
 import { Annotations } from "aws-cdk-lib";
 import { AttributeType as AttributeType2, BillingMode as BillingMode2, Table as Table2 } from "aws-cdk-lib/aws-dynamodb";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
@@ -1082,7 +1101,7 @@ var _WorkflowDedupTable = class _WorkflowDedupTable extends Construct5 {
     _WorkflowDedupTable.assertConsumerNameStatic(consumerName);
     const tableName = _WorkflowDedupTable.tableNameFromLookup(scope);
     const tableArn = _WorkflowDedupTable.tableArnFromLookup(scope);
-    fn.addEnvironment(import_workflows3.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR, tableName);
+    fn.addEnvironment(import_workflows5.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR, tableName);
     if (options.defaultTtlSeconds !== void 0) {
       fn.addEnvironment(
         "OPENHI_WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS",
@@ -1118,9 +1137,9 @@ var _WorkflowDedupTable = class _WorkflowDedupTable extends Construct5 {
         "consumerName must be non-empty."
       );
     }
-    if (consumerName.length > import_workflows3.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH) {
+    if (consumerName.length > import_workflows5.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH) {
       throw new WorkflowDedupConsumerNameInvalidError(
-        `consumerName must be at most ${import_workflows3.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH} chars; got ${consumerName.length}.`
+        `consumerName must be at most ${import_workflows5.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH} chars; got ${consumerName.length}.`
       );
     }
     if (/\s/.test(consumerName)) {
@@ -1143,7 +1162,7 @@ var _WorkflowDedupTable = class _WorkflowDedupTable extends Construct5 {
       );
     }
     this.registeredConsumers.add(consumerName);
-    fn.addEnvironment(import_workflows3.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR, this.table.tableName);
+    fn.addEnvironment(import_workflows5.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR, this.table.tableName);
     if (options.defaultTtlSeconds !== void 0) {
       fn.addEnvironment(
         "OPENHI_WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS",
@@ -2904,7 +2923,521 @@ var _OpenHiGraphqlService = class _OpenHiGraphqlService extends OpenHiService {
 };
 _OpenHiGraphqlService.SERVICE_TYPE = "graphql-api";
 var OpenHiGraphqlService = _OpenHiGraphqlService;
+
+// src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-lambdas.ts
+import fs12 from "fs";
+import path12 from "path";
+import { Duration as Duration11 } from "aws-cdk-lib";
+import { Effect as Effect8, PolicyStatement as PolicyStatement8 } from "aws-cdk-lib/aws-iam";
+import { Runtime as Runtime12 } from "aws-cdk-lib/aws-lambda";
+import { NodejsFunction as NodejsFunction12 } from "aws-cdk-lib/aws-lambda-nodejs";
+import { Construct as Construct19 } from "constructs";
+function resolveHandlerEntry12(dirname, handlerName) {
+  const sameDir = path12.join(dirname, handlerName);
+  if (fs12.existsSync(sameDir)) {
+    return { entry: sameDir, handler: "handler" };
+  }
+  const libDir = path12.join(dirname, "..", "..", "..", "..", "lib", handlerName);
+  return { entry: libDir, handler: "handler" };
+}
+var OwningDeleteCascadeLambdas = class extends Construct19 {
+  constructor(scope, props) {
+    super(scope, "owning-delete-cascade-lambdas");
+    const listResolved = resolveHandlerEntry12(
+      __dirname,
+      "list-chunks.handler.js"
+    );
+    this.listChunks = new NodejsFunction12(this, "list-chunks-handler", {
+      entry: listResolved.entry,
+      runtime: Runtime12.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration11.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grant(this.listChunks, "dynamodb:Query");
+    const deleteResolved = resolveHandlerEntry12(
+      __dirname,
+      "delete-chunk.handler.js"
+    );
+    this.deleteChunk = new NodejsFunction12(this, "delete-chunk-handler", {
+      entry: deleteResolved.entry,
+      runtime: Runtime12.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration11.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grant(
+      this.deleteChunk,
+      "dynamodb:DeleteItem",
+      "dynamodb:UpdateItem",
+      "dynamodb:PutItem"
+    );
+    const finalizeResolved = resolveHandlerEntry12(
+      __dirname,
+      "finalize.handler.js"
+    );
+    this.finalize = new NodejsFunction12(this, "finalize-handler", {
+      entry: finalizeResolved.entry,
+      runtime: Runtime12.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration11.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
+        [OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
+      }
+    });
+    props.dataStoreTable.grant(this.finalize, "dynamodb:DeleteItem");
+    this.finalize.addToRolePolicy(
+      new PolicyStatement8({
+        effect: Effect8.ALLOW,
+        actions: ["events:PutEvents"],
+        resources: [props.opsEventBus.eventBusArn]
+      })
+    );
+  }
+};
+
+// src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-workflow.ts
+import { Duration as Duration12 } from "aws-cdk-lib";
+import { Rule as Rule5 } from "aws-cdk-lib/aws-events";
+import { SfnStateMachine } from "aws-cdk-lib/aws-events-targets";
+import {
+  Choice,
+  Condition,
+  CustomState,
+  DefinitionBody,
+  Pass,
+  StateMachine,
+  Succeed,
+  TaskInput,
+  Wait,
+  WaitTime
+} from "aws-cdk-lib/aws-stepfunctions";
+import { LambdaInvoke } from "aws-cdk-lib/aws-stepfunctions-tasks";
+import { Construct as Construct20 } from "constructs";
+var OwningDeleteCascadeWorkflow = class extends Construct20 {
+  constructor(scope, props) {
+    super(scope, "owning-delete-cascade-workflow");
+    this.lambdas = new OwningDeleteCascadeLambdas(this, {
+      dataStoreTable: props.dataStoreTable,
+      opsEventBus: props.opsEventBus
+    });
+    const concurrency = props.cascadeMapConcurrency ?? OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY;
+    const initState = new Pass(this, "init-state", {
+      parameters: {
+        "ownerType.$": "$.detail.payload.ownerType",
+        "ownerId.$": "$.detail.payload.ownerId",
+        "tenantId.$": "$.detail.payload.tenantId",
+        cursors: {},
+        projectionsRemoved: 0,
+        chunkCount: 0,
+        // Used by the finalize step to compute `durationMs`.
+        "startedAt.$": "$$.Execution.StartTime",
+        // Propagate envelope identity for ADR-016 causation chaining.
+        "eventId.$": "$.detail.eventId",
+        "correlationId.$": "$.detail.correlationId",
+        "causationId.$": "$.detail.eventId"
+      }
+    });
+    const listChunks = new LambdaInvoke(this, "list-chunks", {
+      lambdaFunction: this.lambdas.listChunks,
+      resultPath: "$.listResult",
+      retryOnServiceExceptions: true
+    });
+    const updateAfterList = new Pass(this, "update-after-list", {
+      parameters: {
+        "ownerType.$": "$.ownerType",
+        "ownerId.$": "$.ownerId",
+        "tenantId.$": "$.tenantId",
+        "cursors.$": "$.listResult.Payload.cursors",
+        "projectionsRemoved.$": "$.listResult.Payload.projectionsRemoved",
+        "chunkCount.$": "$.listResult.Payload.chunkCount",
+        "exhausted.$": "$.listResult.Payload.exhausted",
+        "chunks.$": "$.listResult.Payload.chunks",
+        "startedAt.$": "$.startedAt",
+        "eventId.$": "$.eventId",
+        "correlationId.$": "$.correlationId",
+        "causationId.$": "$.causationId"
+      }
+    });
+    const rewriteChunks = new CustomState(this, "rewrite-chunks", {
+      stateJson: {
+        Type: "Map",
+        ItemsPath: "$.chunks",
+        MaxConcurrency: concurrency,
+        ResultPath: "$.rewriteResults",
+        ItemSelector: {
+          // The handler receives `CascadeChunkInput` verbatim from the
+          // `listChunks` output, no additional wrapping.
+          "ownerType.$": "$$.Map.Item.Value.ownerType",
+          "ownerId.$": "$$.Map.Item.Value.ownerId",
+          "tenantId.$": "$$.Map.Item.Value.tenantId",
+          "rows.$": "$$.Map.Item.Value.rows",
+          "chunkToken.$": "$$.Map.Item.Value.chunkToken"
+        },
+        ItemProcessor: {
+          ProcessorConfig: {
+            // Inline mode (NOT Distributed). Per TR-022 Choice 2A.
+            Mode: "INLINE"
+          },
+          StartAt: "DeleteChunk",
+          States: {
+            DeleteChunk: {
+              Type: "Task",
+              Resource: "arn:aws:states:::lambda:invoke",
+              Parameters: {
+                FunctionName: this.lambdas.deleteChunk.functionArn,
+                "Payload.$": "$"
+              },
+              Retry: [
+                {
+                  ErrorEquals: [
+                    "DynamoDB.ProvisionedThroughputExceededException",
+                    "DynamoDB.ThrottlingException",
+                    "DynamoDB.TransactionConflictException",
+                    "Lambda.ServiceException",
+                    "Lambda.AWSLambdaException",
+                    "Lambda.SdkClientException"
+                  ],
+                  IntervalSeconds: 1,
+                  MaxAttempts: 3,
+                  BackoffRate: 2,
+                  MaxDelaySeconds: 30
+                }
+              ],
+              Catch: [
+                {
+                  // Replay path: the rows in this chunk are already
+                  // gone. Treat as a no-op success so the outer loop
+                  // keeps draining the partition.
+                  ErrorEquals: ["DynamoDB.TransactionCanceledException"],
+                  Next: "ChunkAlreadyDeleted"
+                }
+              ],
+              End: true
+            },
+            ChunkAlreadyDeleted: {
+              Type: "Succeed"
+            }
+          }
+        }
+      }
+    });
+    const interPageWait = new Wait(this, "inter-page-wait", {
+      time: WaitTime.duration(Duration12.seconds(0))
+    });
+    const isExhausted = new Choice(this, "is-exhausted");
+    const finalize = new LambdaInvoke(this, "finalize", {
+      lambdaFunction: this.lambdas.finalize,
+      payload: TaskInput.fromObject({
+        "ownerType.$": "$.ownerType",
+        "ownerId.$": "$.ownerId",
+        "tenantId.$": "$.tenantId",
+        "projectionsRemoved.$": "$.projectionsRemoved",
+        "chunkCount.$": "$.chunkCount",
+        "startedAt.$": "$.startedAt",
+        "eventId.$": "$.eventId",
+        "correlationId.$": "$.correlationId",
+        "causationId.$": "$.causationId"
+      }),
+      resultPath: "$.finalizeResult",
+      retryOnServiceExceptions: true
+    });
+    const success = new Succeed(this, "success");
+    const definition = initState.next(listChunks).next(updateAfterList).next(rewriteChunks).next(interPageWait).next(
+      isExhausted.when(
+        Condition.booleanEquals("$.exhausted", true),
+        finalize.next(success)
+      ).otherwise(listChunks)
+    );
+    this.stateMachine = new StateMachine(this, "state-machine", {
+      definitionBody: DefinitionBody.fromChainable(definition),
+      // Long timeout because real-world cascades can run minutes when
+      // a workspace has thousands of members. The stuck-cascade alarm
+      // fires at 15 minutes; the state machine itself does not abort.
+      timeout: Duration12.hours(2)
+    });
+    this.rule = new Rule5(this, "rule", {
+      eventBus: props.dataEventBus,
+      eventPattern: {
+        source: [import_workflows3.OPENHI_DATA_SOURCE],
+        detailType: [import_workflows3.ControlPlaneOwningDeleteV1.detailType]
+      },
+      targets: [
+        new SfnStateMachine(this.stateMachine, {
+          retryAttempts: 2,
+          maxEventAge: Duration12.hours(2)
+        })
+      ]
+    });
+  }
+};
+
+// src/workflows/control-plane/rename-cascade/rename-cascade-lambdas.ts
+import fs13 from "fs";
+import path13 from "path";
+import { Duration as Duration13 } from "aws-cdk-lib";
+import { Effect as Effect9, PolicyStatement as PolicyStatement9 } from "aws-cdk-lib/aws-iam";
+import { Runtime as Runtime13 } from "aws-cdk-lib/aws-lambda";
+import { NodejsFunction as NodejsFunction13 } from "aws-cdk-lib/aws-lambda-nodejs";
+import { Construct as Construct21 } from "constructs";
+function resolveHandlerEntry13(dirname, handlerName) {
+  const sameDir = path13.join(dirname, handlerName);
+  if (fs13.existsSync(sameDir)) {
+    return { entry: sameDir, handler: "handler" };
+  }
+  const libDir = path13.join(dirname, "..", "..", "..", "..", "lib", handlerName);
+  return { entry: libDir, handler: "handler" };
+}
+var RenameCascadeLambdas = class extends Construct21 {
+  constructor(scope, props) {
+    super(scope, "rename-cascade-lambdas");
+    const listResolved = resolveHandlerEntry13(
+      __dirname,
+      "rename-list-targets.handler.js"
+    );
+    this.listTargets = new NodejsFunction13(this, "list-targets-handler", {
+      entry: listResolved.entry,
+      runtime: Runtime13.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration13.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grant(this.listTargets, "dynamodb:Query");
+    const rewriteResolved = resolveHandlerEntry13(
+      __dirname,
+      "rename-rewrite-chunk.handler.js"
+    );
+    this.rewriteChunk = new NodejsFunction13(this, "rewrite-chunk-handler", {
+      entry: rewriteResolved.entry,
+      runtime: Runtime13.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration13.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grant(
+      this.rewriteChunk,
+      "dynamodb:DeleteItem",
+      "dynamodb:PutItem",
+      "dynamodb:UpdateItem"
+    );
+    const finalizeResolved = resolveHandlerEntry13(
+      __dirname,
+      "rename-finalize.handler.js"
+    );
+    this.finalize = new NodejsFunction13(this, "finalize-handler", {
+      entry: finalizeResolved.entry,
+      runtime: Runtime13.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: Duration13.minutes(1),
+      environment: {
+        [RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
+      }
+    });
+    this.finalize.addToRolePolicy(
+      new PolicyStatement9({
+        effect: Effect9.ALLOW,
+        actions: ["events:PutEvents"],
+        resources: [props.opsEventBus.eventBusArn]
+      })
+    );
+  }
+};
+
+// src/workflows/control-plane/rename-cascade/rename-cascade-workflow.ts
+import { Duration as Duration14 } from "aws-cdk-lib";
+import { Rule as Rule6 } from "aws-cdk-lib/aws-events";
+import { SfnStateMachine as SfnStateMachine2 } from "aws-cdk-lib/aws-events-targets";
+import {
+  Choice as Choice2,
+  Condition as Condition2,
+  CustomState as CustomState2,
+  DefinitionBody as DefinitionBody2,
+  Pass as Pass2,
+  StateMachine as StateMachine2,
+  Succeed as Succeed2,
+  TaskInput as TaskInput2
+} from "aws-cdk-lib/aws-stepfunctions";
+import { LambdaInvoke as LambdaInvoke2 } from "aws-cdk-lib/aws-stepfunctions-tasks";
+import { Construct as Construct22 } from "constructs";
+var RenameCascadeWorkflow = class extends Construct22 {
+  constructor(scope, props) {
+    super(scope, "rename-cascade-workflow");
+    this.lambdas = new RenameCascadeLambdas(this, {
+      dataStoreTable: props.dataStoreTable,
+      opsEventBus: props.opsEventBus
+    });
+    const concurrency = props.cascadeMapConcurrency ?? RENAME_CASCADE_DEFAULT_CONCURRENCY;
+    const initState = new Pass2(this, "init-state", {
+      parameters: {
+        "entityType.$": "$.detail.payload.entityType",
+        "entityId.$": "$.detail.payload.entityId",
+        "tenantId.$": "$.detail.payload.tenantId",
+        "oldName.$": "$.detail.payload.oldName",
+        "newName.$": "$.detail.payload.newName",
+        "oldNormalizedName.$": "$.detail.payload.oldNormalizedName",
+        "newNormalizedName.$": "$.detail.payload.newNormalizedName",
+        cursors: {},
+        itemsRewritten: 0,
+        chunkCount: 0,
+        "startedAt.$": "$$.Execution.StartTime",
+        "eventId.$": "$.detail.eventId",
+        "correlationId.$": "$.detail.correlationId",
+        "causationId.$": "$.detail.eventId"
+      }
+    });
+    const listTargets = new LambdaInvoke2(this, "list-targets", {
+      lambdaFunction: this.lambdas.listTargets,
+      resultPath: "$.listResult",
+      retryOnServiceExceptions: true
+    });
+    const updateAfterList = new Pass2(this, "update-after-list", {
+      parameters: {
+        "entityType.$": "$.entityType",
+        "entityId.$": "$.entityId",
+        "tenantId.$": "$.tenantId",
+        "oldName.$": "$.oldName",
+        "newName.$": "$.newName",
+        "oldNormalizedName.$": "$.oldNormalizedName",
+        "newNormalizedName.$": "$.newNormalizedName",
+        "cursors.$": "$.listResult.Payload.cursors",
+        "itemsRewritten.$": "$.listResult.Payload.itemsRewritten",
+        "chunkCount.$": "$.listResult.Payload.chunkCount",
+        "exhausted.$": "$.listResult.Payload.exhausted",
+        "chunks.$": "$.listResult.Payload.chunks",
+        "startedAt.$": "$.startedAt",
+        "eventId.$": "$.eventId",
+        "correlationId.$": "$.correlationId",
+        "causationId.$": "$.causationId"
+      }
+    });
+    const rewriteChunks = new CustomState2(this, "rewrite-chunks", {
+      stateJson: {
+        Type: "Map",
+        ItemsPath: "$.chunks",
+        MaxConcurrency: concurrency,
+        ResultPath: "$.rewriteResults",
+        ItemSelector: {
+          "entityType.$": "$$.Map.Item.Value.entityType",
+          "entityId.$": "$$.Map.Item.Value.entityId",
+          "tenantId.$": "$$.Map.Item.Value.tenantId",
+          "targets.$": "$$.Map.Item.Value.targets",
+          "chunkToken.$": "$$.Map.Item.Value.chunkToken"
+        },
+        ItemProcessor: {
+          ProcessorConfig: {
+            // DISTRIBUTED mode — per TR-023 (NOT INLINE; that is
+            // TR-022's territory).
+            Mode: "DISTRIBUTED",
+            ExecutionType: "STANDARD"
+          },
+          StartAt: "RewriteChunk",
+          States: {
+            RewriteChunk: {
+              Type: "Task",
+              Resource: "arn:aws:states:::lambda:invoke",
+              Parameters: {
+                FunctionName: this.lambdas.rewriteChunk.functionArn,
+                "Payload.$": "$"
+              },
+              Retry: [
+                {
+                  ErrorEquals: [
+                    "DynamoDB.ProvisionedThroughputExceededException",
+                    "DynamoDB.ThrottlingException",
+                    "DynamoDB.TransactionConflictException",
+                    "Lambda.ServiceException",
+                    "Lambda.AWSLambdaException",
+                    "Lambda.SdkClientException"
+                  ],
+                  IntervalSeconds: 1,
+                  MaxAttempts: 5,
+                  BackoffRate: 2,
+                  MaxDelaySeconds: 30
+                }
+              ],
+              Catch: [
+                {
+                  // Replay path: the rewrite race "lost to a later
+                  // write" per TR-023 idempotency. Treat as a no-op
+                  // success so the outer loop keeps draining the page.
+                  ErrorEquals: ["DynamoDB.TransactionCanceledException"],
+                  Next: "ChunkAlreadyRewritten"
+                }
+              ],
+              End: true
+            },
+            ChunkAlreadyRewritten: {
+              Type: "Succeed"
+            }
+          }
+        }
+      }
+    });
+    const isExhausted = new Choice2(this, "is-exhausted");
+    const finalize = new LambdaInvoke2(this, "finalize", {
+      lambdaFunction: this.lambdas.finalize,
+      payload: TaskInput2.fromObject({
+        "entityType.$": "$.entityType",
+        "entityId.$": "$.entityId",
+        "tenantId.$": "$.tenantId",
+        "newName.$": "$.newName",
+        "itemsRewritten.$": "$.itemsRewritten",
+        "chunkCount.$": "$.chunkCount",
+        "startedAt.$": "$.startedAt",
+        "eventId.$": "$.eventId",
+        "correlationId.$": "$.correlationId",
+        "causationId.$": "$.causationId"
+      }),
+      resultPath: "$.finalizeResult",
+      retryOnServiceExceptions: true
+    });
+    const success = new Succeed2(this, "success");
+    const definition = initState.next(listTargets).next(updateAfterList).next(rewriteChunks).next(
+      isExhausted.when(
+        Condition2.booleanEquals("$.exhausted", true),
+        finalize.next(success)
+      ).otherwise(listTargets)
+    );
+    this.stateMachine = new StateMachine2(this, "state-machine", {
+      definitionBody: DefinitionBody2.fromChainable(definition),
+      // Long timeout — large renames may rewrite thousands of rows;
+      // the `CascadeSlow` alarm fires at 300s p99 but the state
+      // machine itself does not abort.
+      timeout: Duration14.hours(2)
+    });
+    this.rule = new Rule6(this, "rule", {
+      eventBus: props.dataEventBus,
+      eventPattern: {
+        source: [import_workflows4.OPENHI_DATA_SOURCE],
+        detailType: [import_workflows4.ControlPlaneRenameV1.detailType]
+      },
+      targets: [
+        new SfnStateMachine2(this.stateMachine, {
+          retryAttempts: 2,
+          maxEventAge: Duration14.hours(2)
+        })
+      ]
+    });
+  }
+};
+var export_ControlPlaneOwningDeleteCompleteV1 = import_workflows3.ControlPlaneOwningDeleteCompleteV1;
+var export_ControlPlaneOwningDeleteFailedV1 = import_workflows3.ControlPlaneOwningDeleteFailedV1;
+var export_ControlPlaneOwningDeleteV1 = import_workflows3.ControlPlaneOwningDeleteV1;
+var export_ControlPlaneRenameCompleteV1 = import_workflows4.ControlPlaneRenameCompleteV1;
+var export_ControlPlaneRenameFailedV1 = import_workflows4.ControlPlaneRenameFailedV1;
+var export_ControlPlaneRenameV1 = import_workflows4.ControlPlaneRenameV1;
+var export_OWNING_ENTITY_TYPE = import_workflows3.OWNING_ENTITY_TYPE;
 var export_PlatformDeploymentCompletedV1 = import_workflows2.PlatformDeploymentCompletedV1;
+var export_RENAMABLE_ENTITY_TYPE = import_workflows4.RENAMABLE_ENTITY_TYPE;
 export {
   BRIDGED_STATUSES,
   CLOUDFORMATION_EVENT_SOURCE,
@@ -2917,6 +3450,12 @@ export {
   CognitoUserPoolDomain,
   CognitoUserPoolKmsKey,
   ControlEventBus,
+  export_ControlPlaneOwningDeleteCompleteV1 as ControlPlaneOwningDeleteCompleteV1,
+  export_ControlPlaneOwningDeleteFailedV1 as ControlPlaneOwningDeleteFailedV1,
+  export_ControlPlaneOwningDeleteV1 as ControlPlaneOwningDeleteV1,
+  export_ControlPlaneRenameCompleteV1 as ControlPlaneRenameCompleteV1,
+  export_ControlPlaneRenameFailedV1 as ControlPlaneRenameFailedV1,
+  export_ControlPlaneRenameV1 as ControlPlaneRenameV1,
   DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES,
   DATA_STORE_CHANGE_DETAIL_TYPE,
   DATA_STORE_CHANGE_EVENT_SOURCE,
@@ -2936,6 +3475,11 @@ export {
   OPENHI_TAG_SUFFIX_REPO_NAME,
   OPENHI_TAG_SUFFIX_SERVICE_TYPE,
   OPENHI_TAG_SUFFIX_STAGE_TYPE,
+  OWNING_DELETE_CASCADE_CONSUMER_NAME,
+  OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY,
+  OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES,
+  OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR,
+  export_OWNING_ENTITY_TYPE as OWNING_ENTITY_TYPE,
   OpenHiApp,
   OpenHiAuthService,
   OpenHiDataService,
@@ -2946,6 +3490,8 @@ export {
   OpenHiService,
   OpenHiStage,
   OpsEventBus,
+  OwningDeleteCascadeLambdas,
+  OwningDeleteCascadeWorkflow,
   PLACEHOLDER_TENANT_ID,
   PLACEHOLDER_WORKSPACE_ID,
   PLATFORM_DEPLOY_BRIDGE_ACTOR_SYSTEM,
@@ -2961,7 +3507,15 @@ export {
   PostConfirmationLambda,
   PreTokenGenerationLambda,
   ProvisionDefaultWorkspaceLambda,
+  export_RENAMABLE_ENTITY_TYPE as RENAMABLE_ENTITY_TYPE,
+  RENAME_CASCADE_CONSUMER_NAME,
+  RENAME_CASCADE_DEFAULT_CONCURRENCY,
+  RENAME_CASCADE_FAILED_THRESHOLD,
+  RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR,
+  RENAME_CASCADE_SLOW_THRESHOLD_SECONDS,
   REST_API_BASE_URL_SSM_NAME,
+  RenameCascadeLambdas,
+  RenameCascadeWorkflow,
   RootGraphqlApi,
   RootHostedZone,
   RootHttpApi,