@openhi/constructs 0.0.116 → 0.0.117

package/lib/firehose-archive-transform.handler.mjs

@@ -2,7 +2,7 @@ import {
   handler,
   parseCurrentResourceKeys,
   shouldDropAsGlobalTableReplicationRecord
-} from "./chunk-X5MHU7DA.mjs";
+} from "./chunk-I7IIPV5X.mjs";
 import "./chunk-CEOAGPYY.mjs";
 import "./chunk-LZOMFHX3.mjs";
 export {

package/lib/index.d.mts

@@ -1,5 +1,5 @@
 import { OPEN_HI_STAGE, OPEN_HI_DEPLOYMENT_TARGET_ROLE, OpenHiEnvironmentConfig, OpenHiConfig } from '@openhi/config';
-import { Stage, StageProps, App, AppProps, Stack, StackProps, RemovalPolicy } from 'aws-cdk-lib';
+import { Stage, StageProps, App, AppProps, Stack, StackProps, RemovalPolicy, Duration } from 'aws-cdk-lib';
 import { IConstruct, Construct } from 'constructs';
 import { Certificate, CertificateProps, ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import { HttpApiProps, HttpApi, IHttpApi, DomainName } from 'aws-cdk-lib/aws-apigatewayv2';
@@ -9,7 +9,7 @@ import { Key, KeyProps, IKey } from 'aws-cdk-lib/aws-kms';
 import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
 import { D as DynamoDbStreamKinesisRecord } from './dynamodb-stream-record-CJtV6a1t.mjs';
 import * as events from 'aws-cdk-lib/aws-events';
-import { EventBus, EventBusProps, Rule, IEventBus } from 'aws-cdk-lib/aws-events';
+import { EventBus, Archive, EventBusProps, Rule, IEventBus } from 'aws-cdk-lib/aws-events';
 import * as kinesis from 'aws-cdk-lib/aws-kinesis';
 import * as kinesisfirehose from 'aws-cdk-lib/aws-kinesisfirehose';
 import * as s3 from 'aws-cdk-lib/aws-s3';
@@ -722,9 +722,14 @@ declare class WorkflowDedupConsumerNameInvalidError extends Error {
     constructor(message: string);
 }
 
-/**
- * @see sites/www-docs/content/packages/@openhi/constructs/components/event-bridge/data-event-bus.md
- */
+interface DataEventBusOptions {
+    /**
+     * Retention for the bus's event archive. Defaults to 7 days. Pass
+     * `Duration.days(0)` (or omit and override the archive in a subclass)
+     * to disable archiving entirely.
+     */
+    readonly archiveRetention?: Duration;
+}
 declare class DataEventBus extends EventBus {
     /*****************************************************************************
      *
@@ -734,7 +739,16 @@ declare class DataEventBus extends EventBus {
      *
      ****************************************************************************/
     static getEventBusName(scope: Construct): string;
-    constructor(scope: Construct, props?: EventBusProps);
+    /**
+     * Replay archive of every event written to this bus, retained for the
+     * configured TTL (default 7 days). Enables EventBridge `StartReplay`
+     * for incident response and ad-hoc backfill.
+     *
+     * Named `replayArchive` rather than `archive` to avoid shadowing the
+     * inherited `EventBus.archive(id, options)` instance method.
+     */
+    readonly replayArchive: Archive;
+    constructor(scope: Construct, props?: (EventBusProps & DataEventBusOptions) | undefined);
 }
 
 /**
@@ -2226,4 +2240,4 @@ declare class RenameCascadeWorkflow extends Construct {
     constructor(scope: Construct, props: RenameCascadeWorkflowProps);
 }
 
-export { type BuildParameterNameProps, ChildHostedZone, type ChildHostedZoneProps, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, ControlEventBus, DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES, DATA_STORE_CHANGE_DETAIL_TYPE, DATA_STORE_CHANGE_EVENT_SOURCE, DEMO_DATA_PLANE_FIXTURES, DataEventBus, DataStoreHistoricalArchive, type DataStoreHistoricalArchiveProps, DataStorePostgresReplica, type DataStorePostgresReplicaProps, type DemoWorkspaceDataPlaneFixtures, DiscoverableStringParameter, type DiscoverableStringParameterProps, DynamoDbDataStore, type DynamoDbDataStoreProps, type FhirCurrentResourceChangeDetail, type GrantConsumerOptions, HostingMode, OPENHI_TAG_SUFFIX_BRANCH_NAME, OPENHI_TAG_SUFFIX_REPO_NAME, OPENHI_TAG_SUFFIX_SERVICE_TYPE, OPENHI_TAG_SUFFIX_STAGE_TYPE, OpenHiApp, type OpenHiAppProps, OpenHiAuthService, type OpenHiAuthServiceProps, OpenHiDataService, type OpenHiDataServiceProps, OpenHiEnvironment, type OpenHiEnvironmentProps, OpenHiGlobalService, type OpenHiGlobalServiceProps, OpenHiGraphqlService, type OpenHiGraphqlServiceProps, OpenHiRestApiService, type OpenHiRestApiServiceProps, OpenHiService, type OpenHiServiceProps, type OpenHiServiceType, OpenHiStage, type OpenHiStageProps, OpenHiWebsiteService, type OpenHiWebsiteServiceProps, OpsEventBus, OwningDeleteCascadeLambdas, type OwningDeleteCascadeLambdasProps, OwningDeleteCascadeWorkflow, type OwningDeleteCascadeWorkflowProps, POSTGRES_REPLICA_CLUSTER_ARN_SSM_NAME, POSTGRES_REPLICA_DATABASE_NAME_SSM_NAME, POSTGRES_REPLICA_SECRET_ARN_SSM_NAME, PlatformDeployBridge, PlatformDeployBridgeLambda, type PlatformDeployBridgeLambdaProps, type PlatformDeployBridgeProps, PostAuthenticationLambda, PostConfirmationLambda, type PostConfirmationLambdaProps, PreTokenGenerationLambda, type PreTokenGenerationLambdaProps, ProvisionDefaultWorkspaceLambda, type ProvisionDefaultWorkspaceLambdaProps, REST_API_BASE_URL_SSM_NAME, RenameCascadeLambdas, type RenameCascadeLambdasProps, RenameCascadeWorkflow, type RenameCascadeWorkflowProps, RootGraphqlApi, type RootGraphqlApiProps, RootHostedZone, RootHttpApi, type RootHttpApiProps, RootWildcardCertificate, SEED_SYSTEM_DATA_ACTOR_SYSTEM, SEED_SYSTEM_DATA_CONSUMER_NAME, SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR, SSM_PARAM_NAME_FULL_DOMAIN, STATIC_HOSTING_SERVICE_TYPE, SeedDemoDataLambda, type SeedDemoDataLambdaProps, SeedDemoDataWorkflow, type SeedDemoDataWorkflowProps, SeedSystemDataLambda, type SeedSystemDataLambdaProps, SeedSystemDataWorkflow, type SeedSystemDataWorkflowProps, StaticContent, type StaticContentProps, StaticHosting, type StaticHostingProps, UserOnboardingWorkflow, type UserOnboardingWorkflowProps, WorkflowDedupConsumerNameInvalidError, WorkflowDedupTable, WorkflowDedupTableDuplicateError, type WorkflowDedupTableProps, buildFhirCurrentResourceChangeDetail, getDynamoDbDataStoreTableName, getPostgresReplicaSchemaName, getWorkflowDedupTableName, openHiTagKey };
+export { type BuildParameterNameProps, ChildHostedZone, type ChildHostedZoneProps, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, ControlEventBus, DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES, DATA_STORE_CHANGE_DETAIL_TYPE, DATA_STORE_CHANGE_EVENT_SOURCE, DEMO_DATA_PLANE_FIXTURES, DataEventBus, type DataEventBusOptions, DataStoreHistoricalArchive, type DataStoreHistoricalArchiveProps, DataStorePostgresReplica, type DataStorePostgresReplicaProps, type DemoWorkspaceDataPlaneFixtures, DiscoverableStringParameter, type DiscoverableStringParameterProps, DynamoDbDataStore, type DynamoDbDataStoreProps, type FhirCurrentResourceChangeDetail, type GrantConsumerOptions, HostingMode, OPENHI_TAG_SUFFIX_BRANCH_NAME, OPENHI_TAG_SUFFIX_REPO_NAME, OPENHI_TAG_SUFFIX_SERVICE_TYPE, OPENHI_TAG_SUFFIX_STAGE_TYPE, OpenHiApp, type OpenHiAppProps, OpenHiAuthService, type OpenHiAuthServiceProps, OpenHiDataService, type OpenHiDataServiceProps, OpenHiEnvironment, type OpenHiEnvironmentProps, OpenHiGlobalService, type OpenHiGlobalServiceProps, OpenHiGraphqlService, type OpenHiGraphqlServiceProps, OpenHiRestApiService, type OpenHiRestApiServiceProps, OpenHiService, type OpenHiServiceProps, type OpenHiServiceType, OpenHiStage, type OpenHiStageProps, OpenHiWebsiteService, type OpenHiWebsiteServiceProps, OpsEventBus, OwningDeleteCascadeLambdas, type OwningDeleteCascadeLambdasProps, OwningDeleteCascadeWorkflow, type OwningDeleteCascadeWorkflowProps, POSTGRES_REPLICA_CLUSTER_ARN_SSM_NAME, POSTGRES_REPLICA_DATABASE_NAME_SSM_NAME, POSTGRES_REPLICA_SECRET_ARN_SSM_NAME, PlatformDeployBridge, PlatformDeployBridgeLambda, type PlatformDeployBridgeLambdaProps, type PlatformDeployBridgeProps, PostAuthenticationLambda, PostConfirmationLambda, type PostConfirmationLambdaProps, PreTokenGenerationLambda, type PreTokenGenerationLambdaProps, ProvisionDefaultWorkspaceLambda, type ProvisionDefaultWorkspaceLambdaProps, REST_API_BASE_URL_SSM_NAME, RenameCascadeLambdas, type RenameCascadeLambdasProps, RenameCascadeWorkflow, type RenameCascadeWorkflowProps, RootGraphqlApi, type RootGraphqlApiProps, RootHostedZone, RootHttpApi, type RootHttpApiProps, RootWildcardCertificate, SEED_SYSTEM_DATA_ACTOR_SYSTEM, SEED_SYSTEM_DATA_CONSUMER_NAME, SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR, SSM_PARAM_NAME_FULL_DOMAIN, STATIC_HOSTING_SERVICE_TYPE, SeedDemoDataLambda, type SeedDemoDataLambdaProps, SeedDemoDataWorkflow, type SeedDemoDataWorkflowProps, SeedSystemDataLambda, type SeedSystemDataLambdaProps, SeedSystemDataWorkflow, type SeedSystemDataWorkflowProps, StaticContent, type StaticContentProps, StaticHosting, type StaticHostingProps, UserOnboardingWorkflow, type UserOnboardingWorkflowProps, WorkflowDedupConsumerNameInvalidError, WorkflowDedupTable, WorkflowDedupTableDuplicateError, type WorkflowDedupTableProps, buildFhirCurrentResourceChangeDetail, getDynamoDbDataStoreTableName, getPostgresReplicaSchemaName, getWorkflowDedupTableName, openHiTagKey };

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-import { RemovalPolicy, App, AppProps, Stage, StageProps, Stack, StackProps } from 'aws-cdk-lib';
+import { Duration, RemovalPolicy, App, AppProps, Stage, StageProps, Stack, StackProps } from 'aws-cdk-lib';
 import { Construct, IConstruct } from 'constructs';
 import { ICertificate, Certificate, CertificateProps } from 'aws-cdk-lib/aws-certificatemanager';
 import { IHttpApi, HttpApiProps, HttpApi, DomainName } from 'aws-cdk-lib/aws-apigatewayv2';
@@ -8,7 +8,7 @@ import { Key, KeyProps, IKey } from 'aws-cdk-lib/aws-kms';
 import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
 import { AttributeValue } from '@aws-sdk/client-dynamodb';
 import * as events from 'aws-cdk-lib/aws-events';
-import { EventBus, EventBusProps, Rule, IEventBus } from 'aws-cdk-lib/aws-events';
+import { EventBus, EventBusProps, Archive, Rule, IEventBus } from 'aws-cdk-lib/aws-events';
 import * as kinesis from 'aws-cdk-lib/aws-kinesis';
 import * as kinesisfirehose from 'aws-cdk-lib/aws-kinesisfirehose';
 import * as s3 from 'aws-cdk-lib/aws-s3';
@@ -1359,9 +1359,14 @@ declare class WorkflowDedupConsumerNameInvalidError extends Error {
     constructor(message: string);
 }
 
-/**
- * @see sites/www-docs/content/packages/@openhi/constructs/components/event-bridge/data-event-bus.md
- */
+interface DataEventBusOptions {
+    /**
+     * Retention for the bus's event archive. Defaults to 7 days. Pass
+     * `Duration.days(0)` (or omit and override the archive in a subclass)
+     * to disable archiving entirely.
+     */
+    readonly archiveRetention?: Duration;
+}
 declare class DataEventBus extends EventBus {
     /*****************************************************************************
      *
@@ -1371,7 +1376,16 @@ declare class DataEventBus extends EventBus {
      *
      ****************************************************************************/
     static getEventBusName(scope: Construct): string;
-    constructor(scope: Construct, props?: EventBusProps);
+    /**
+     * Replay archive of every event written to this bus, retained for the
+     * configured TTL (default 7 days). Enables EventBridge `StartReplay`
+     * for incident response and ad-hoc backfill.
+     *
+     * Named `replayArchive` rather than `archive` to avoid shadowing the
+     * inherited `EventBus.archive(id, options)` instance method.
+     */
+    readonly replayArchive: Archive;
+    constructor(scope: Construct, props?: (EventBusProps & DataEventBusOptions) | undefined);
 }
 
 /**
@@ -2864,4 +2878,4 @@ declare class RenameCascadeWorkflow extends Construct {
 }
 
 export { BRIDGED_STATUSES, CLOUDFORMATION_EVENT_SOURCE, CLOUDFORMATION_STACK_STATUS_CHANGE_DETAIL_TYPE, CONTROL_EVENT_BUS_NAME_ENV_VAR, ChildHostedZone, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, ControlEventBus, DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES, DATA_STORE_CHANGE_DETAIL_TYPE, DATA_STORE_CHANGE_EVENT_SOURCE, DEMO_DATA_PLANE_FIXTURES, DEMO_PERIOD, DEMO_TENANT_SPECS, DEMO_URN_SYSTEM, DEV_USERS, DataEventBus, DataStoreHistoricalArchive, DataStorePostgresReplica, DiscoverableStringParameter, DynamoDbDataStore, OPENHI_REPO_TAG_KEY_ENV_VAR, OPENHI_RESOURCE_URN_SYSTEM, OPENHI_TAG_KEY_PREFIX_ENV_VAR, OPENHI_TAG_SUFFIX_BRANCH_NAME, OPENHI_TAG_SUFFIX_REPO_NAME, OPENHI_TAG_SUFFIX_SERVICE_TYPE, OPENHI_TAG_SUFFIX_STAGE_TYPE, OWNING_DELETE_CASCADE_CONSUMER_NAME, OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY, OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES, OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR, OpenHiApp, OpenHiAuthService, OpenHiDataService, OpenHiEnvironment, OpenHiGlobalService, OpenHiGraphqlService, OpenHiRestApiService, OpenHiService, OpenHiStage, OpenHiWebsiteService, OpsEventBus, OwningDeleteCascadeLambdas, OwningDeleteCascadeWorkflow, PLACEHOLDER_TENANT_ID, PLACEHOLDER_WORKSPACE_ID, PLATFORM_DEPLOY_BRIDGE_ACTOR_SYSTEM, PLATFORM_SCOPE_TENANT_ID, POSTGRES_REPLICA_CLUSTER_ARN_SSM_NAME, POSTGRES_REPLICA_DATABASE_NAME_SSM_NAME, POSTGRES_REPLICA_SECRET_ARN_SSM_NAME, PROVISION_DEFAULT_WORKSPACE_DETAIL_TYPE, PlatformDeployBridge, PlatformDeployBridgeLambda, PostAuthenticationLambda, PostConfirmationLambda, PreTokenGenerationLambda, ProvisionDefaultWorkspaceLambda, RENAME_CASCADE_CONSUMER_NAME, RENAME_CASCADE_DEFAULT_CONCURRENCY, RENAME_CASCADE_FAILED_THRESHOLD, RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR, RENAME_CASCADE_SLOW_THRESHOLD_SECONDS, REST_API_BASE_URL_SSM_NAME, RenameCascadeLambdas, RenameCascadeWorkflow, RootGraphqlApi, RootHostedZone, RootHttpApi, RootWildcardCertificate, SEED_DEMO_DATA_CONSUMER_NAME, SEED_SYSTEM_DATA_ACTOR_SYSTEM, SEED_SYSTEM_DATA_CONSUMER_NAME, SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR, SSM_PARAM_NAME_FULL_DOMAIN, STATIC_HOSTING_SERVICE_TYPE, SeedDemoDataLambda, SeedDemoDataWorkflow, SeedSystemDataLambda, SeedSystemDataWorkflow, StaticContent, StaticHosting, USER_ONBOARDING_EVENT_SOURCE, UserOnboardingWorkflow, WorkflowDedupConsumerNameInvalidError, WorkflowDedupTable, WorkflowDedupTableDuplicateError, buildFhirCurrentResourceChangeDetail, buildProvisionDefaultWorkspaceRequestedDetail, demoMembershipId, demoRoleAssignmentId, demoRolesForUserInTenant, demoScenarioIdentifier, getDynamoDbDataStoreTableName, getPostgresReplicaSchemaName, getWorkflowDedupTableName, openHiTagKey, openhiResourceIdentifier };
-export type { BridgedStatus, BuildParameterNameProps, CascadeChunkInput, CascadeFinalizeInput, CascadeFinalizeOutput, CascadeListInput, CascadeListOutput, ChildHostedZoneProps, CloudFormationStackStatusChangeDetail, DataStoreHistoricalArchiveProps, DataStorePostgresReplicaProps, DemoDevUser, DemoTenantSpec, DemoWorkspaceDataPlaneFixtures, DemoWorkspaceSpec, DiscoverableStringParameterProps, DynamoDbDataStoreProps, FhirCurrentResourceChangeDetail, GrantConsumerOptions, HostingMode, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiGraphqlServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps, OpenHiWebsiteServiceProps, OwningDeleteCascadeLambdasProps, OwningDeleteCascadeWorkflowProps, PlatformDeployBridgeLambdaProps, PlatformDeployBridgeProps, PostConfirmationLambdaProps, PreTokenGenerationLambdaProps, ProvisionDefaultWorkspaceLambdaProps, ProvisionDefaultWorkspaceRequestedDetail, RenameCascadeChunkInput, RenameCascadeFinalizeInput, RenameCascadeFinalizeOutput, RenameCascadeLambdasProps, RenameCascadeListInput, RenameCascadeListOutput, RenameCascadeWorkflowProps, RootGraphqlApiProps, RootHttpApiProps, SeedDemoDataLambdaProps, SeedDemoDataWorkflowProps, SeedSystemDataLambdaProps, SeedSystemDataWorkflowProps, StaticContentProps, StaticHostingProps, UserOnboardingWorkflowProps, WorkflowDedupTableProps };
+export type { BridgedStatus, BuildParameterNameProps, CascadeChunkInput, CascadeFinalizeInput, CascadeFinalizeOutput, CascadeListInput, CascadeListOutput, ChildHostedZoneProps, CloudFormationStackStatusChangeDetail, DataEventBusOptions, DataStoreHistoricalArchiveProps, DataStorePostgresReplicaProps, DemoDevUser, DemoTenantSpec, DemoWorkspaceDataPlaneFixtures, DemoWorkspaceSpec, DiscoverableStringParameterProps, DynamoDbDataStoreProps, FhirCurrentResourceChangeDetail, GrantConsumerOptions, HostingMode, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiGraphqlServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps, OpenHiWebsiteServiceProps, OwningDeleteCascadeLambdasProps, OwningDeleteCascadeWorkflowProps, PlatformDeployBridgeLambdaProps, PlatformDeployBridgeProps, PostConfirmationLambdaProps, PreTokenGenerationLambdaProps, ProvisionDefaultWorkspaceLambdaProps, ProvisionDefaultWorkspaceRequestedDetail, RenameCascadeChunkInput, RenameCascadeFinalizeInput, RenameCascadeFinalizeOutput, RenameCascadeLambdasProps, RenameCascadeListInput, RenameCascadeListOutput, RenameCascadeWorkflowProps, RootGraphqlApiProps, RootHttpApiProps, SeedDemoDataLambdaProps, SeedDemoDataWorkflowProps, SeedSystemDataLambdaProps, SeedSystemDataWorkflowProps, StaticContentProps, StaticHostingProps, UserOnboardingWorkflowProps, WorkflowDedupTableProps };

package/lib/index.js

@@ -2022,7 +2022,9 @@ var WorkflowDedupConsumerNameInvalidError = class extends Error {
 };
 
 // src/components/event-bridge/data-event-bus.ts
+var import_aws_cdk_lib8 = require("aws-cdk-lib");
 var import_aws_events = require("aws-cdk-lib/aws-events");
+var DEFAULT_ARCHIVE_RETENTION = import_aws_cdk_lib8.Duration.days(7);
 var DataEventBus = class _DataEventBus extends import_aws_events.EventBus {
   /*****************************************************************************
    *
@@ -2035,11 +2037,19 @@ var DataEventBus = class _DataEventBus extends import_aws_events.EventBus {
     const stack = OpenHiService.of(scope);
     return `datav1${stack.branchHash}`;
   }
-  constructor(scope, props) {
+  constructor(scope, props = void 0) {
+    const { archiveRetention, ...busProps } = props ?? {};
     super(scope, "data-event-bus-v1", {
-      ...props,
+      ...busProps,
       eventBusName: _DataEventBus.getEventBusName(scope)
     });
+    this.replayArchive = new import_aws_events.Archive(this, "Archive", {
+      sourceEventBus: this,
+      archiveName: `${_DataEventBus.getEventBusName(scope)}-archive`,
+      description: "Replay archive for the OpenHI data event bus (data-store change notifications).",
+      eventPattern: { account: [import_aws_cdk_lib8.Stack.of(this).account] },
+      retention: archiveRetention ?? DEFAULT_ARCHIVE_RETENTION
+    });
   }
 };
 
@@ -2090,7 +2100,7 @@ var ControlEventBus = class _ControlEventBus extends import_aws_events3.EventBus
 // src/components/postgres/data-store-postgres-replica.ts
 var import_node_fs5 = __toESM(require("fs"));
 var import_node_path5 = __toESM(require("path"));
-var import_aws_cdk_lib8 = require("aws-cdk-lib");
+var import_aws_cdk_lib9 = require("aws-cdk-lib");
 var ec2 = __toESM(require("aws-cdk-lib/aws-ec2"));
 var import_aws_lambda5 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_event_sources = require("aws-cdk-lib/aws-lambda-event-sources");
@@ -2156,7 +2166,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
     super(scope, id);
     this.databaseName = props.databaseName ?? DEFAULT_DATABASE_NAME;
     this.schemaName = getPostgresReplicaSchemaName(props.branchHash);
-    const region = import_aws_cdk_lib8.Stack.of(this).region;
+    const region = import_aws_cdk_lib9.Stack.of(this).region;
     this.vpc = props.vpc ?? new ec2.Vpc(this, "Vpc", {
       availabilityZones: [`${region}a`, `${region}b`],
       natGateways: 0,
@@ -2192,7 +2202,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
       entry: resolveHandlerEntry5(__dirname),
       runtime: import_aws_lambda5.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib8.Duration.minutes(1),
+      timeout: import_aws_cdk_lib9.Duration.minutes(1),
       vpc: this.vpc,
       vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
       description: "Replicates DynamoDB current-resource changes into the Postgres `resources` JSONB table (ADR 2026-04-17-01).",
@@ -2219,7 +2229,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
       new import_aws_lambda_event_sources.KinesisEventSource(props.kinesisStream, {
         startingPosition: import_aws_lambda5.StartingPosition.LATEST,
         batchSize: 100,
-        maxBatchingWindow: import_aws_cdk_lib8.Duration.seconds(5),
+        maxBatchingWindow: import_aws_cdk_lib9.Duration.seconds(5),
         retryAttempts: 10,
         bisectBatchOnError: true,
         parallelizationFactor: 2,
@@ -2252,7 +2262,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
 };
 
 // src/components/route-53/child-hosted-zone.ts
-var import_aws_cdk_lib9 = require("aws-cdk-lib");
+var import_aws_cdk_lib10 = require("aws-cdk-lib");
 var import_aws_route53 = require("aws-cdk-lib/aws-route53");
 var ChildHostedZone = class extends import_aws_route53.HostedZone {
   constructor(scope, id, props) {
@@ -2261,7 +2271,7 @@ var ChildHostedZone = class extends import_aws_route53.HostedZone {
       zone: props.parentHostedZone,
       recordName: this.zoneName,
       values: this.hostedZoneNameServers || [],
-      ttl: import_aws_cdk_lib9.Duration.minutes(5)
+      ttl: import_aws_cdk_lib10.Duration.minutes(5)
     });
   }
 };
@@ -2284,7 +2294,7 @@ var import_constructs9 = require("constructs");
 // src/components/static-hosting/static-hosting.ts
 var fs6 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
-var import_aws_cdk_lib10 = require("aws-cdk-lib");
+var import_aws_cdk_lib11 = require("aws-cdk-lib");
 var import_aws_cloudfront = require("aws-cdk-lib/aws-cloudfront");
 var import_aws_cloudfront_origins = require("aws-cdk-lib/aws-cloudfront-origins");
 var import_aws_lambda6 = require("aws-cdk-lib/aws-lambda");
@@ -2335,9 +2345,9 @@ var _StaticHosting = class _StaticHosting extends import_constructs8.Construct {
     const cachePolicy = new import_aws_cloudfront.CachePolicy(this, "cache-policy", {
       cachePolicyName: `static-hosting-${stack.branchHash}`,
       comment: "Static hosting default: 60s default / 300s max, gzip+brotli.",
-      defaultTtl: import_aws_cdk_lib10.Duration.seconds(60),
-      minTtl: import_aws_cdk_lib10.Duration.seconds(0),
-      maxTtl: import_aws_cdk_lib10.Duration.seconds(300),
+      defaultTtl: import_aws_cdk_lib11.Duration.seconds(60),
+      minTtl: import_aws_cdk_lib11.Duration.seconds(0),
+      maxTtl: import_aws_cdk_lib11.Duration.seconds(300),
       headerBehavior: import_aws_cloudfront.CacheHeaderBehavior.none(),
       queryStringBehavior: import_aws_cloudfront.CacheQueryStringBehavior.none(),
       cookieBehavior: import_aws_cloudfront.CacheCookieBehavior.none(),
@@ -2492,7 +2502,7 @@ var import_constructs11 = require("constructs");
 // src/workflows/control-plane/platform-deploy-bridge/platform-deploy-bridge-lambda.ts
 var import_node_fs6 = __toESM(require("fs"));
 var import_node_path6 = __toESM(require("path"));
-var import_aws_cdk_lib11 = require("aws-cdk-lib");
+var import_aws_cdk_lib12 = require("aws-cdk-lib");
 var import_aws_events4 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam2 = require("aws-cdk-lib/aws-iam");
@@ -2516,15 +2526,15 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
       OPENHI_TAG_SUFFIX_REPO_NAME
     );
     const tagKeyPrefix = `${service.appName}:`;
-    const ownStackName = import_aws_cdk_lib11.Stack.of(this).stackName;
-    const ownSuffix = `-${service.serviceId}-${import_aws_cdk_lib11.Stack.of(this).account}-${import_aws_cdk_lib11.Stack.of(this).region}`;
+    const ownStackName = import_aws_cdk_lib12.Stack.of(this).stackName;
+    const ownSuffix = `-${service.serviceId}-${import_aws_cdk_lib12.Stack.of(this).account}-${import_aws_cdk_lib12.Stack.of(this).region}`;
     const sharedPrefix = ownStackName.endsWith(ownSuffix) ? ownStackName.slice(0, -ownSuffix.length) : service.branchHash;
-    const stackIdPrefix = `arn:aws:cloudformation:${import_aws_cdk_lib11.Stack.of(this).region}:${import_aws_cdk_lib11.Stack.of(this).account}:stack/${sharedPrefix}-`;
+    const stackIdPrefix = `arn:aws:cloudformation:${import_aws_cdk_lib12.Stack.of(this).region}:${import_aws_cdk_lib12.Stack.of(this).account}:stack/${sharedPrefix}-`;
     this.lambda = new import_aws_lambda_nodejs7.NodejsFunction(this, "handler", {
       entry: resolveHandlerEntry6(__dirname),
       runtime: import_aws_lambda7.Runtime.NODEJS_LATEST,
       memorySize: 256,
-      timeout: import_aws_cdk_lib11.Duration.seconds(30),
+      timeout: import_aws_cdk_lib12.Duration.seconds(30),
       environment: {
         [CONTROL_EVENT_BUS_NAME_ENV_VAR]: props.controlEventBus.eventBusName,
         [OPENHI_REPO_TAG_KEY_ENV_VAR]: repoTagKey,
@@ -2536,7 +2546,7 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
         effect: import_aws_iam2.Effect.ALLOW,
         actions: ["cloudformation:DescribeStacks"],
         resources: [
-          `arn:aws:cloudformation:${import_aws_cdk_lib11.Stack.of(this).region}:${import_aws_cdk_lib11.Stack.of(this).account}:stack/*`
+          `arn:aws:cloudformation:${import_aws_cdk_lib12.Stack.of(this).region}:${import_aws_cdk_lib12.Stack.of(this).account}:stack/*`
         ]
       })
     );
@@ -2555,7 +2565,7 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
       targets: [
         new import_aws_events_targets.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib11.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib12.Duration.hours(2)
         })
       ]
     });
@@ -3268,7 +3278,7 @@ _validateFixturesAgainstTenantSpecs();
 // src/workflows/control-plane/seed-demo-data/seed-demo-data-lambda.ts
 var import_node_fs7 = __toESM(require("fs"));
 var import_node_path7 = __toESM(require("path"));
-var import_aws_cdk_lib12 = require("aws-cdk-lib");
+var import_aws_cdk_lib13 = require("aws-cdk-lib");
 var import_aws_events6 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets2 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam3 = require("aws-cdk-lib/aws-iam");
@@ -6162,7 +6172,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
       entry: resolveHandlerEntry7(__dirname),
       runtime: import_aws_lambda8.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib12.Duration.minutes(2),
+      timeout: import_aws_cdk_lib13.Duration.minutes(2),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR]: props.userPool.userPoolId
@@ -6191,7 +6201,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
           "cognito-idp:AdminSetUserPassword"
         ],
         resources: [
-          import_aws_cdk_lib12.Stack.of(this).formatArn({
+          import_aws_cdk_lib13.Stack.of(this).formatArn({
             service: "cognito-idp",
             resource: "userpool",
             resourceName: props.userPool.userPoolId
@@ -6208,7 +6218,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
       targets: [
         new import_aws_events_targets2.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib12.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
         })
       ]
     });
@@ -6243,7 +6253,7 @@ var SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR = "CONTROL_EVENT_BUS_NAME";
 var import_node_fs8 = __toESM(require("fs"));
 var import_node_path8 = __toESM(require("path"));
 var import_types13 = require("@openhi/types");
-var import_aws_cdk_lib13 = require("aws-cdk-lib");
+var import_aws_cdk_lib14 = require("aws-cdk-lib");
 var import_aws_events7 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets3 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam4 = require("aws-cdk-lib/aws-iam");
@@ -6265,7 +6275,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       entry: resolveHandlerEntry8(__dirname),
       runtime: import_aws_lambda9.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib13.Duration.minutes(1),
+      timeout: import_aws_cdk_lib14.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR]: props.controlEventBus.eventBusName
@@ -6287,7 +6297,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       })
     );
     props.controlEventBus.grantPutEventsTo(this.lambda);
-    const hostStackName = import_aws_cdk_lib13.Stack.of(this).stackName;
+    const hostStackName = import_aws_cdk_lib14.Stack.of(this).stackName;
     this.rule = new import_aws_events7.Rule(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
@@ -6302,7 +6312,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       targets: [
         new import_aws_events_targets3.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib14.Duration.hours(2)
         })
       ]
     });
@@ -6464,7 +6474,7 @@ var buildProvisionDefaultWorkspaceRequestedDetail = (event) => {
 // src/workflows/control-plane/user-onboarding/provision-default-workspace-lambda.ts
 var import_node_fs9 = __toESM(require("fs"));
 var import_node_path9 = __toESM(require("path"));
-var import_aws_cdk_lib14 = require("aws-cdk-lib");
+var import_aws_cdk_lib15 = require("aws-cdk-lib");
 var import_aws_events8 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets4 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam5 = require("aws-cdk-lib/aws-iam");
@@ -6511,7 +6521,7 @@ var ProvisionDefaultWorkspaceLambda = class extends import_constructs16.Construc
       targets: [
         new import_aws_events_targets4.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib14.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib15.Duration.hours(2)
         })
       ]
     });
@@ -7331,7 +7341,7 @@ var OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR = "OWNING_DELETE_OPS_EVENT_BUS_NAME";
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-lambdas.ts
 var import_node_fs12 = __toESM(require("fs"));
 var import_node_path12 = __toESM(require("path"));
-var import_aws_cdk_lib15 = require("aws-cdk-lib");
+var import_aws_cdk_lib16 = require("aws-cdk-lib");
 var import_aws_iam8 = require("aws-cdk-lib/aws-iam");
 var import_aws_lambda13 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_nodejs13 = require("aws-cdk-lib/aws-lambda-nodejs");
@@ -7355,7 +7365,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: listResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7369,7 +7379,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: deleteResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7388,7 +7398,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: finalizeResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
@@ -7406,7 +7416,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
 };
 
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-workflow.ts
-var import_aws_cdk_lib16 = require("aws-cdk-lib");
+var import_aws_cdk_lib17 = require("aws-cdk-lib");
 var import_aws_events9 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets5 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions = require("aws-cdk-lib/aws-stepfunctions");
@@ -7521,7 +7531,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       }
     });
     const interPageWait = new import_aws_stepfunctions.Wait(this, "inter-page-wait", {
-      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib16.Duration.seconds(0))
+      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib17.Duration.seconds(0))
     });
     const isExhausted = new import_aws_stepfunctions.Choice(this, "is-exhausted");
     const finalize = new import_aws_stepfunctions_tasks.LambdaInvoke(this, "finalize", {
@@ -7552,7 +7562,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       // Long timeout because real-world cascades can run minutes when
       // a workspace has thousands of members. The stuck-cascade alarm
       // fires at 15 minutes; the state machine itself does not abort.
-      timeout: import_aws_cdk_lib16.Duration.hours(2)
+      timeout: import_aws_cdk_lib17.Duration.hours(2)
     });
     this.rule = new import_aws_events9.Rule(this, "rule", {
       eventBus: props.dataEventBus,
@@ -7563,7 +7573,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       targets: [
         new import_aws_events_targets5.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib16.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib17.Duration.hours(2)
         })
       ]
     });
@@ -7581,7 +7591,7 @@ var RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR = "RENAME_CASCADE_OPS_EVENT_BUS_NAME";
 // src/workflows/control-plane/rename-cascade/rename-cascade-lambdas.ts
 var import_node_fs13 = __toESM(require("fs"));
 var import_node_path13 = __toESM(require("path"));
-var import_aws_cdk_lib17 = require("aws-cdk-lib");
+var import_aws_cdk_lib18 = require("aws-cdk-lib");
 var import_aws_iam9 = require("aws-cdk-lib/aws-iam");
 var import_aws_lambda14 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_nodejs14 = require("aws-cdk-lib/aws-lambda-nodejs");
@@ -7605,7 +7615,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: listResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7619,7 +7629,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: rewriteResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7638,7 +7648,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: finalizeResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         [RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
       }
@@ -7654,7 +7664,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
 };
 
 // src/workflows/control-plane/rename-cascade/rename-cascade-workflow.ts
-var import_aws_cdk_lib18 = require("aws-cdk-lib");
+var import_aws_cdk_lib19 = require("aws-cdk-lib");
 var import_aws_events10 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets6 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions2 = require("aws-cdk-lib/aws-stepfunctions");
@@ -7804,7 +7814,7 @@ var RenameCascadeWorkflow = class extends import_constructs23.Construct {
       // Long timeout — large renames may rewrite thousands of rows;
       // the `CascadeSlow` alarm fires at 300s p99 but the state
       // machine itself does not abort.
-      timeout: import_aws_cdk_lib18.Duration.hours(2)
+      timeout: import_aws_cdk_lib19.Duration.hours(2)
     });
     this.rule = new import_aws_events10.Rule(this, "rule", {
       eventBus: props.dataEventBus,
@@ -7815,7 +7825,7 @@ var RenameCascadeWorkflow = class extends import_constructs23.Construct {
       targets: [
         new import_aws_events_targets6.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib18.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib19.Duration.hours(2)
         })
       ]
     });