@openhi/constructs 0.0.116 → 0.0.118

package/lib/index.js

@@ -1127,6 +1127,16 @@ var OpenHiService = class extends import_aws_cdk_lib4.Stack {
       ),
       6
     );
+    const releaseBranchHash = (0, import_utils.hashString)(
+      [
+        appName,
+        ohEnv.deploymentTargetRole,
+        account,
+        region,
+        defaultReleaseBranch
+      ].join("-"),
+      6
+    );
     const stackHash = (0, import_utils.hashString)(
       [
         appName,
@@ -1157,6 +1167,7 @@ var OpenHiService = class extends import_aws_cdk_lib4.Stack {
     this.branchName = branchName;
     this.environmentHash = environmentHash;
     this.branchHash = branchHash;
+    this.releaseBranchHash = releaseBranchHash;
     this.stackHash = stackHash;
     this.node.setContext(
       `availability-zones:account=${account}:region=${region}`,
@@ -2022,7 +2033,9 @@ var WorkflowDedupConsumerNameInvalidError = class extends Error {
 };
 
 // src/components/event-bridge/data-event-bus.ts
+var import_aws_cdk_lib8 = require("aws-cdk-lib");
 var import_aws_events = require("aws-cdk-lib/aws-events");
+var DEFAULT_ARCHIVE_RETENTION = import_aws_cdk_lib8.Duration.days(7);
 var DataEventBus = class _DataEventBus extends import_aws_events.EventBus {
   /*****************************************************************************
    *
@@ -2035,11 +2048,19 @@ var DataEventBus = class _DataEventBus extends import_aws_events.EventBus {
     const stack = OpenHiService.of(scope);
     return `datav1${stack.branchHash}`;
   }
-  constructor(scope, props) {
+  constructor(scope, props = void 0) {
+    const { archiveRetention, ...busProps } = props ?? {};
     super(scope, "data-event-bus-v1", {
-      ...props,
+      ...busProps,
       eventBusName: _DataEventBus.getEventBusName(scope)
     });
+    this.replayArchive = new import_aws_events.Archive(this, "Archive", {
+      sourceEventBus: this,
+      archiveName: `${_DataEventBus.getEventBusName(scope)}-archive`,
+      description: "Replay archive for the OpenHI data event bus (data-store change notifications).",
+      eventPattern: { account: [import_aws_cdk_lib8.Stack.of(this).account] },
+      retention: archiveRetention ?? DEFAULT_ARCHIVE_RETENTION
+    });
   }
 };
 
@@ -2090,7 +2111,7 @@ var ControlEventBus = class _ControlEventBus extends import_aws_events3.EventBus
 // src/components/postgres/data-store-postgres-replica.ts
 var import_node_fs5 = __toESM(require("fs"));
 var import_node_path5 = __toESM(require("path"));
-var import_aws_cdk_lib8 = require("aws-cdk-lib");
+var import_aws_cdk_lib9 = require("aws-cdk-lib");
 var ec2 = __toESM(require("aws-cdk-lib/aws-ec2"));
 var import_aws_lambda5 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_event_sources = require("aws-cdk-lib/aws-lambda-event-sources");
@@ -2156,7 +2177,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
     super(scope, id);
     this.databaseName = props.databaseName ?? DEFAULT_DATABASE_NAME;
     this.schemaName = getPostgresReplicaSchemaName(props.branchHash);
-    const region = import_aws_cdk_lib8.Stack.of(this).region;
+    const region = import_aws_cdk_lib9.Stack.of(this).region;
     this.vpc = props.vpc ?? new ec2.Vpc(this, "Vpc", {
       availabilityZones: [`${region}a`, `${region}b`],
       natGateways: 0,
@@ -2192,7 +2213,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
       entry: resolveHandlerEntry5(__dirname),
       runtime: import_aws_lambda5.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib8.Duration.minutes(1),
+      timeout: import_aws_cdk_lib9.Duration.minutes(1),
       vpc: this.vpc,
       vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
       description: "Replicates DynamoDB current-resource changes into the Postgres `resources` JSONB table (ADR 2026-04-17-01).",
@@ -2219,7 +2240,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
       new import_aws_lambda_event_sources.KinesisEventSource(props.kinesisStream, {
         startingPosition: import_aws_lambda5.StartingPosition.LATEST,
         batchSize: 100,
-        maxBatchingWindow: import_aws_cdk_lib8.Duration.seconds(5),
+        maxBatchingWindow: import_aws_cdk_lib9.Duration.seconds(5),
         retryAttempts: 10,
         bisectBatchOnError: true,
         parallelizationFactor: 2,
@@ -2252,7 +2273,7 @@ var DataStorePostgresReplica = class extends import_constructs6.Construct {
 };
 
 // src/components/route-53/child-hosted-zone.ts
-var import_aws_cdk_lib9 = require("aws-cdk-lib");
+var import_aws_cdk_lib10 = require("aws-cdk-lib");
 var import_aws_route53 = require("aws-cdk-lib/aws-route53");
 var ChildHostedZone = class extends import_aws_route53.HostedZone {
   constructor(scope, id, props) {
@@ -2261,7 +2282,7 @@ var ChildHostedZone = class extends import_aws_route53.HostedZone {
       zone: props.parentHostedZone,
       recordName: this.zoneName,
       values: this.hostedZoneNameServers || [],
-      ttl: import_aws_cdk_lib9.Duration.minutes(5)
+      ttl: import_aws_cdk_lib10.Duration.minutes(5)
     });
   }
 };
@@ -2276,15 +2297,36 @@ var RootHostedZone = class extends import_constructs7.Construct {
 };
 
 // src/components/static-hosting/static-content.ts
-var import_aws_s32 = require("aws-cdk-lib/aws-s3");
 var import_aws_s3_deployment = require("aws-cdk-lib/aws-s3-deployment");
 var import_change_case2 = require("change-case");
-var import_constructs9 = require("constructs");
+var import_constructs8 = require("constructs");
+var StaticContent = class extends import_constructs8.Construct {
+  constructor(scope, id, props) {
+    super(scope, id);
+    const stack = OpenHiService.of(scope);
+    const {
+      bucket,
+      contentSourceDirectory,
+      contentDestinationDirectory = "/",
+      subDomain = stack.branchName,
+      fullDomain
+    } = props;
+    const keyPrefix = [(0, import_change_case2.paramCase)(subDomain), fullDomain].join(".");
+    const isTestEnv = process.env.JEST_WORKER_ID !== void 0;
+    const sources = isTestEnv ? [] : [import_aws_s3_deployment.Source.asset(contentSourceDirectory)];
+    new import_aws_s3_deployment.BucketDeployment(this, "deploy", {
+      sources,
+      destinationBucket: bucket,
+      retainOnDelete: false,
+      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`
+    });
+  }
+};
 
 // src/components/static-hosting/static-hosting.ts
 var fs6 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
-var import_aws_cdk_lib10 = require("aws-cdk-lib");
+var import_aws_cdk_lib11 = require("aws-cdk-lib");
 var import_aws_cloudfront = require("aws-cdk-lib/aws-cloudfront");
 var import_aws_cloudfront_origins = require("aws-cdk-lib/aws-cloudfront-origins");
 var import_aws_lambda6 = require("aws-cdk-lib/aws-lambda");
@@ -2293,9 +2335,9 @@ var import_aws_logs = require("aws-cdk-lib/aws-logs");
 var import_aws_route532 = require("aws-cdk-lib/aws-route53");
 var import_aws_route53_targets = require("aws-cdk-lib/aws-route53-targets");
 var import_aws_s3 = require("aws-cdk-lib/aws-s3");
-var import_constructs8 = require("constructs");
+var import_constructs9 = require("constructs");
 var STATIC_HOSTING_SERVICE_TYPE = "website";
-var _StaticHosting = class _StaticHosting extends import_constructs8.Construct {
+var _StaticHosting = class _StaticHosting extends import_constructs9.Construct {
   constructor(scope, id, props = {}) {
     super(scope, id);
     const stack = OpenHiService.of(scope);
@@ -2335,9 +2377,9 @@ var _StaticHosting = class _StaticHosting extends import_constructs8.Construct {
     const cachePolicy = new import_aws_cloudfront.CachePolicy(this, "cache-policy", {
       cachePolicyName: `static-hosting-${stack.branchHash}`,
       comment: "Static hosting default: 60s default / 300s max, gzip+brotli.",
-      defaultTtl: import_aws_cdk_lib10.Duration.seconds(60),
-      minTtl: import_aws_cdk_lib10.Duration.seconds(0),
-      maxTtl: import_aws_cdk_lib10.Duration.seconds(300),
+      defaultTtl: import_aws_cdk_lib11.Duration.seconds(60),
+      minTtl: import_aws_cdk_lib11.Duration.seconds(0),
+      maxTtl: import_aws_cdk_lib11.Duration.seconds(300),
       headerBehavior: import_aws_cloudfront.CacheHeaderBehavior.none(),
       queryStringBehavior: import_aws_cloudfront.CacheQueryStringBehavior.none(),
       cookieBehavior: import_aws_cloudfront.CacheCookieBehavior.none(),
@@ -2431,35 +2473,6 @@ _StaticHosting.SSM_PARAM_NAME_DISTRIBUTION_DOMAIN = "STATIC_HOSTING_DISTRIBUTION
 _StaticHosting.SSM_PARAM_NAME_DISTRIBUTION_ID = "STATIC_HOSTING_DISTRIBUTION_ID";
 var StaticHosting = _StaticHosting;
 
-// src/components/static-hosting/static-content.ts
-var StaticContent = class extends import_constructs9.Construct {
-  constructor(scope, id, props) {
-    super(scope, id);
-    const stack = OpenHiService.of(scope);
-    const {
-      contentSourceDirectory,
-      contentDestinationDirectory = "/",
-      subDomain = stack.branchName,
-      fullDomain,
-      serviceType = STATIC_HOSTING_SERVICE_TYPE
-    } = props;
-    const keyPrefix = [(0, import_change_case2.paramCase)(subDomain), fullDomain].join(".");
-    const bucketArn = DiscoverableStringParameter.valueForLookupName(this, {
-      ssmParamName: StaticHosting.SSM_PARAM_NAME_BUCKET_ARN,
-      serviceType
-    });
-    const bucket = import_aws_s32.Bucket.fromBucketArn(this, "bucket", bucketArn);
-    const isTestEnv = process.env.JEST_WORKER_ID !== void 0;
-    const sources = isTestEnv ? [] : [import_aws_s3_deployment.Source.asset(contentSourceDirectory)];
-    new import_aws_s3_deployment.BucketDeployment(this, "deploy", {
-      sources,
-      destinationBucket: bucket,
-      retainOnDelete: false,
-      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`
-    });
-  }
-};
-
 // src/services/open-hi-auth-service.ts
 var import_aws_cognito4 = require("aws-cdk-lib/aws-cognito");
 var import_aws_iam6 = require("aws-cdk-lib/aws-iam");
@@ -2492,7 +2505,7 @@ var import_constructs11 = require("constructs");
 // src/workflows/control-plane/platform-deploy-bridge/platform-deploy-bridge-lambda.ts
 var import_node_fs6 = __toESM(require("fs"));
 var import_node_path6 = __toESM(require("path"));
-var import_aws_cdk_lib11 = require("aws-cdk-lib");
+var import_aws_cdk_lib12 = require("aws-cdk-lib");
 var import_aws_events4 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam2 = require("aws-cdk-lib/aws-iam");
@@ -2516,15 +2529,15 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
       OPENHI_TAG_SUFFIX_REPO_NAME
     );
     const tagKeyPrefix = `${service.appName}:`;
-    const ownStackName = import_aws_cdk_lib11.Stack.of(this).stackName;
-    const ownSuffix = `-${service.serviceId}-${import_aws_cdk_lib11.Stack.of(this).account}-${import_aws_cdk_lib11.Stack.of(this).region}`;
+    const ownStackName = import_aws_cdk_lib12.Stack.of(this).stackName;
+    const ownSuffix = `-${service.serviceId}-${import_aws_cdk_lib12.Stack.of(this).account}-${import_aws_cdk_lib12.Stack.of(this).region}`;
     const sharedPrefix = ownStackName.endsWith(ownSuffix) ? ownStackName.slice(0, -ownSuffix.length) : service.branchHash;
-    const stackIdPrefix = `arn:aws:cloudformation:${import_aws_cdk_lib11.Stack.of(this).region}:${import_aws_cdk_lib11.Stack.of(this).account}:stack/${sharedPrefix}-`;
+    const stackIdPrefix = `arn:aws:cloudformation:${import_aws_cdk_lib12.Stack.of(this).region}:${import_aws_cdk_lib12.Stack.of(this).account}:stack/${sharedPrefix}-`;
     this.lambda = new import_aws_lambda_nodejs7.NodejsFunction(this, "handler", {
       entry: resolveHandlerEntry6(__dirname),
       runtime: import_aws_lambda7.Runtime.NODEJS_LATEST,
       memorySize: 256,
-      timeout: import_aws_cdk_lib11.Duration.seconds(30),
+      timeout: import_aws_cdk_lib12.Duration.seconds(30),
       environment: {
         [CONTROL_EVENT_BUS_NAME_ENV_VAR]: props.controlEventBus.eventBusName,
         [OPENHI_REPO_TAG_KEY_ENV_VAR]: repoTagKey,
@@ -2536,7 +2549,7 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
         effect: import_aws_iam2.Effect.ALLOW,
         actions: ["cloudformation:DescribeStacks"],
         resources: [
-          `arn:aws:cloudformation:${import_aws_cdk_lib11.Stack.of(this).region}:${import_aws_cdk_lib11.Stack.of(this).account}:stack/*`
+          `arn:aws:cloudformation:${import_aws_cdk_lib12.Stack.of(this).region}:${import_aws_cdk_lib12.Stack.of(this).account}:stack/*`
         ]
       })
     );
@@ -2555,7 +2568,7 @@ var PlatformDeployBridgeLambda = class extends import_constructs10.Construct {
       targets: [
         new import_aws_events_targets.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib11.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib12.Duration.hours(2)
         })
       ]
     });
@@ -3268,7 +3281,7 @@ _validateFixturesAgainstTenantSpecs();
 // src/workflows/control-plane/seed-demo-data/seed-demo-data-lambda.ts
 var import_node_fs7 = __toESM(require("fs"));
 var import_node_path7 = __toESM(require("path"));
-var import_aws_cdk_lib12 = require("aws-cdk-lib");
+var import_aws_cdk_lib13 = require("aws-cdk-lib");
 var import_aws_events6 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets2 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam3 = require("aws-cdk-lib/aws-iam");
@@ -6162,7 +6175,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
       entry: resolveHandlerEntry7(__dirname),
       runtime: import_aws_lambda8.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib12.Duration.minutes(2),
+      timeout: import_aws_cdk_lib13.Duration.minutes(2),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR]: props.userPool.userPoolId
@@ -6191,7 +6204,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
           "cognito-idp:AdminSetUserPassword"
         ],
         resources: [
-          import_aws_cdk_lib12.Stack.of(this).formatArn({
+          import_aws_cdk_lib13.Stack.of(this).formatArn({
             service: "cognito-idp",
             resource: "userpool",
             resourceName: props.userPool.userPoolId
@@ -6208,7 +6221,7 @@ var SeedDemoDataLambda = class extends import_constructs12.Construct {
       targets: [
         new import_aws_events_targets2.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib12.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
         })
       ]
     });
@@ -6243,7 +6256,7 @@ var SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR = "CONTROL_EVENT_BUS_NAME";
 var import_node_fs8 = __toESM(require("fs"));
 var import_node_path8 = __toESM(require("path"));
 var import_types13 = require("@openhi/types");
-var import_aws_cdk_lib13 = require("aws-cdk-lib");
+var import_aws_cdk_lib14 = require("aws-cdk-lib");
 var import_aws_events7 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets3 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam4 = require("aws-cdk-lib/aws-iam");
@@ -6265,7 +6278,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       entry: resolveHandlerEntry8(__dirname),
       runtime: import_aws_lambda9.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib13.Duration.minutes(1),
+      timeout: import_aws_cdk_lib14.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR]: props.controlEventBus.eventBusName
@@ -6287,7 +6300,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       })
     );
     props.controlEventBus.grantPutEventsTo(this.lambda);
-    const hostStackName = import_aws_cdk_lib13.Stack.of(this).stackName;
+    const hostStackName = import_aws_cdk_lib14.Stack.of(this).stackName;
     this.rule = new import_aws_events7.Rule(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
@@ -6302,7 +6315,7 @@ var SeedSystemDataLambda = class extends import_constructs14.Construct {
       targets: [
         new import_aws_events_targets3.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib14.Duration.hours(2)
         })
       ]
     });
@@ -6464,7 +6477,7 @@ var buildProvisionDefaultWorkspaceRequestedDetail = (event) => {
 // src/workflows/control-plane/user-onboarding/provision-default-workspace-lambda.ts
 var import_node_fs9 = __toESM(require("fs"));
 var import_node_path9 = __toESM(require("path"));
-var import_aws_cdk_lib14 = require("aws-cdk-lib");
+var import_aws_cdk_lib15 = require("aws-cdk-lib");
 var import_aws_events8 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets4 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam5 = require("aws-cdk-lib/aws-iam");
@@ -6511,7 +6524,7 @@ var ProvisionDefaultWorkspaceLambda = class extends import_constructs16.Construc
       targets: [
         new import_aws_events_targets4.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib14.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib15.Duration.hours(2)
         })
       ]
     });
@@ -7170,6 +7183,7 @@ _OpenHiGraphqlService.SERVICE_TYPE = "graphql-api";
 var OpenHiGraphqlService = _OpenHiGraphqlService;
 
 // src/services/open-hi-website-service.ts
+var import_aws_s32 = require("aws-cdk-lib/aws-s3");
 var SSM_PARAM_NAME_FULL_DOMAIN = "WEBSITE_FULL_DOMAIN";
 var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
   /**
@@ -7240,7 +7254,9 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
       });
       this.createFullDomainParameter();
     }
-    this.staticContent = this.createStaticContent();
+    if (props.createStaticContent !== false) {
+      this.staticContent = this.createStaticContent();
+    }
   }
   /**
    * Validates that config required for the website stack is present.
@@ -7253,14 +7269,21 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
     if (!config.zoneName) {
       throw new Error("Zone name is required");
     }
+    if (!config.hostedZoneId) {
+      throw new Error("Hosted zone ID is required to import the website zone");
+    }
   }
   /**
-   * Looks up the child hosted zone published by the Global service.
+   * Imports the website's hosted zone from config attributes (no SSM lookup).
+   * The website attaches DNS records here on the release-branch deploy and
+   * the same zone is imported on feature-branch deploys for any sub-domain
+   * routing.
    * Override to customize.
    */
   createHostedZone() {
-    return OpenHiGlobalService.childHostedZoneFromConstruct(this, {
-      zoneName: this.config.zoneName
+    return OpenHiGlobalService.rootHostedZoneFromConstruct(this, {
+      zoneName: this.config.zoneName,
+      hostedZoneId: this.config.hostedZoneId
     });
   }
   /**
@@ -7307,16 +7330,41 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
    * Creates the StaticContent uploader. Always created so feature-branch
    * deploys can publish content to their own sub-domain folder against the
    * release-branch bucket.
+   *
+   * The destination bucket is resolved here so the construct never has to
+   * branch on release-vs-feature: on the release branch we pass the
+   * just-created {@link staticHosting} bucket directly (no SSM round-trip
+   * within a single stack); on every other branch we look up the bucket
+   * ARN published by the release-branch deploy, addressed against
+   * {@link OpenHiService.releaseBranchHash}.
    */
   createStaticContent() {
     const { contentSourceDirectory, contentDestinationDirectory } = this.props;
     return new StaticContent(this, "static-content", {
+      bucket: this.resolveStaticHostingBucket(),
       contentSourceDirectory,
       contentDestinationDirectory,
-      fullDomain: this.fullDomain,
-      serviceType: _OpenHiWebsiteService.SERVICE_TYPE
+      fullDomain: this.fullDomain
     });
   }
+  /**
+   * Returns an {@link IBucket} pointing at the static-hosting bucket the
+   * uploader writes to. On the release-branch deploy this is the bucket
+   * just provisioned by {@link staticHosting}; on every other deploy it's
+   * imported from the bucket ARN the release-branch deploy publishes to
+   * SSM, addressed against {@link OpenHiService.releaseBranchHash}.
+   */
+  resolveStaticHostingBucket() {
+    if (this.staticHosting) {
+      return this.staticHosting.bucket;
+    }
+    const bucketArn = DiscoverableStringParameter.valueForLookupName(this, {
+      ssmParamName: StaticHosting.SSM_PARAM_NAME_BUCKET_ARN,
+      serviceType: _OpenHiWebsiteService.SERVICE_TYPE,
+      branchHash: this.releaseBranchHash
+    });
+    return import_aws_s32.Bucket.fromBucketArn(this, "shared-bucket", bucketArn);
+  }
 };
 _OpenHiWebsiteService.SERVICE_TYPE = "website";
 var OpenHiWebsiteService = _OpenHiWebsiteService;
@@ -7331,7 +7379,7 @@ var OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR = "OWNING_DELETE_OPS_EVENT_BUS_NAME";
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-lambdas.ts
 var import_node_fs12 = __toESM(require("fs"));
 var import_node_path12 = __toESM(require("path"));
-var import_aws_cdk_lib15 = require("aws-cdk-lib");
+var import_aws_cdk_lib16 = require("aws-cdk-lib");
 var import_aws_iam8 = require("aws-cdk-lib/aws-iam");
 var import_aws_lambda13 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_nodejs13 = require("aws-cdk-lib/aws-lambda-nodejs");
@@ -7355,7 +7403,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: listResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7369,7 +7417,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: deleteResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7388,7 +7436,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
       entry: finalizeResolved.entry,
       runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib15.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
@@ -7406,7 +7454,7 @@ var OwningDeleteCascadeLambdas = class extends import_constructs20.Construct {
 };
 
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-workflow.ts
-var import_aws_cdk_lib16 = require("aws-cdk-lib");
+var import_aws_cdk_lib17 = require("aws-cdk-lib");
 var import_aws_events9 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets5 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions = require("aws-cdk-lib/aws-stepfunctions");
@@ -7521,7 +7569,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       }
     });
     const interPageWait = new import_aws_stepfunctions.Wait(this, "inter-page-wait", {
-      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib16.Duration.seconds(0))
+      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib17.Duration.seconds(0))
     });
     const isExhausted = new import_aws_stepfunctions.Choice(this, "is-exhausted");
     const finalize = new import_aws_stepfunctions_tasks.LambdaInvoke(this, "finalize", {
@@ -7552,7 +7600,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       // Long timeout because real-world cascades can run minutes when
       // a workspace has thousands of members. The stuck-cascade alarm
       // fires at 15 minutes; the state machine itself does not abort.
-      timeout: import_aws_cdk_lib16.Duration.hours(2)
+      timeout: import_aws_cdk_lib17.Duration.hours(2)
     });
     this.rule = new import_aws_events9.Rule(this, "rule", {
       eventBus: props.dataEventBus,
@@ -7563,7 +7611,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs21.Construct {
       targets: [
         new import_aws_events_targets5.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib16.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib17.Duration.hours(2)
         })
       ]
     });
@@ -7581,7 +7629,7 @@ var RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR = "RENAME_CASCADE_OPS_EVENT_BUS_NAME";
 // src/workflows/control-plane/rename-cascade/rename-cascade-lambdas.ts
 var import_node_fs13 = __toESM(require("fs"));
 var import_node_path13 = __toESM(require("path"));
-var import_aws_cdk_lib17 = require("aws-cdk-lib");
+var import_aws_cdk_lib18 = require("aws-cdk-lib");
 var import_aws_iam9 = require("aws-cdk-lib/aws-iam");
 var import_aws_lambda14 = require("aws-cdk-lib/aws-lambda");
 var import_aws_lambda_nodejs14 = require("aws-cdk-lib/aws-lambda-nodejs");
@@ -7605,7 +7653,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: listResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7619,7 +7667,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: rewriteResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -7638,7 +7686,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
       entry: finalizeResolved.entry,
       runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib18.Duration.minutes(1),
       environment: {
         [RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
       }
@@ -7654,7 +7702,7 @@ var RenameCascadeLambdas = class extends import_constructs22.Construct {
 };
 
 // src/workflows/control-plane/rename-cascade/rename-cascade-workflow.ts
-var import_aws_cdk_lib18 = require("aws-cdk-lib");
+var import_aws_cdk_lib19 = require("aws-cdk-lib");
 var import_aws_events10 = require("aws-cdk-lib/aws-events");
 var import_aws_events_targets6 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions2 = require("aws-cdk-lib/aws-stepfunctions");
@@ -7804,7 +7852,7 @@ var RenameCascadeWorkflow = class extends import_constructs23.Construct {
       // Long timeout — large renames may rewrite thousands of rows;
       // the `CascadeSlow` alarm fires at 300s p99 but the state
       // machine itself does not abort.
-      timeout: import_aws_cdk_lib18.Duration.hours(2)
+      timeout: import_aws_cdk_lib19.Duration.hours(2)
     });
     this.rule = new import_aws_events10.Rule(this, "rule", {
       eventBus: props.dataEventBus,
@@ -7815,7 +7863,7 @@ var RenameCascadeWorkflow = class extends import_constructs23.Construct {
       targets: [
         new import_aws_events_targets6.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib18.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib19.Duration.hours(2)
         })
       ]
     });