@openhi/constructs 0.0.160 → 0.0.161

package/lib/index.js

@@ -199,7 +199,7 @@ var require_control_plane = __commonJS({
   "../workflows/lib/detail-types/control-plane.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneRenameV1 = exports2.RENAMABLE_ENTITY_TYPE = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.OWNING_ENTITY_TYPE = void 0;
+    exports2.ControlPlaneWorkspaceDeletedV1 = exports2.ControlPlaneWorkspaceCreatedV1 = exports2.ControlPlaneRoleAssignmentDeletedV1 = exports2.ControlPlaneRoleAssignmentCreatedV1 = exports2.ControlPlaneMembershipDeletedV1 = exports2.ControlPlaneMembershipCreatedV1 = exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneRenameV1 = exports2.RENAMABLE_ENTITY_TYPE = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.OWNING_ENTITY_TYPE = void 0;
     var sources_1 = require_sources();
     var registry_1 = require_registry();
     exports2.OWNING_ENTITY_TYPE = {
@@ -241,6 +241,36 @@ var require_control_plane = __commonJS({
       source: sources_1.OPENHI_OPS_SOURCE,
       dedupRequired: true
     });
+    exports2.ControlPlaneMembershipCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.membership-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneMembershipDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.membership-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRoleAssignmentCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.role-assignment-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRoleAssignmentDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.role-assignment-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneWorkspaceCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.workspace-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneWorkspaceDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.workspace-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
   }
 });
 
@@ -299,17 +329,17 @@ var require_publisher = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.WorkflowPublishError = void 0;
     exports2.workflowsClient = workflowsClient;
-    exports2.publishWorkflowEvent = publishWorkflowEvent;
+    exports2.publishWorkflowEvent = publishWorkflowEvent2;
     var node_crypto_1 = require("crypto");
     var client_eventbridge_1 = require("@aws-sdk/client-eventbridge");
     var envelope_version_1 = require_envelope_version();
     var sources_1 = require_sources();
     function workflowsClient(bridge, options = {}) {
       return {
-        publish: (entry, payload, ctx) => publishWorkflowEvent(bridge, entry, payload, ctx, options)
+        publish: (entry, payload, ctx) => publishWorkflowEvent2(bridge, entry, payload, ctx, options)
       };
     }
-    async function publishWorkflowEvent(bridge, entry, payload, ctx, options = {}) {
+    async function publishWorkflowEvent2(bridge, entry, payload, ctx, options = {}) {
       const eventIdGenerator = options.eventIdGenerator ?? (() => (0, node_crypto_1.randomUUID)());
       const correlationIdGenerator = options.correlationIdGenerator ?? (() => (0, node_crypto_1.randomUUID)());
       const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -638,7 +668,7 @@ var require_lib2 = __commonJS({
   "../workflows/lib/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.workflowDedupClient = exports2.recordIfAbsent = exports2.markFailed = exports2.encodeSortKey = exports2.WorkflowDedupTableNameMissingError = exports2.WorkflowDedupInvalidInputError = exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = exports2.parseWorkflowEvent = exports2.UnsupportedEnvelopeVersionError = exports2.InvalidWorkflowEventError = exports2.workflowsClient = exports2.publishWorkflowEvent = exports2.WorkflowPublishError = exports2.isWellFormedDetailType = exports2.defineDetailType = exports2.RENAMABLE_ENTITY_TYPE = exports2.PlatformSystemDataSeededV1 = exports2.PlatformDeploymentCompletedV1 = exports2.OWNING_ENTITY_TYPE = exports2.InvalidDetailTypeRegistrationError = exports2.ControlPlaneRenameV1 = exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.OPENHI_OPS_SOURCE = exports2.OPENHI_DATA_SOURCE = exports2.OPENHI_CONTROL_SOURCE = exports2.DEFAULT_BUS_NAME_BY_SOURCE = exports2.workflowUserActorFromClaims = exports2.isWorkflowUserActor = exports2.isWorkflowSystemActor = exports2.MissingActorContextError = exports2.isSupportedEnvelopeVersion = exports2.ENVELOPE_VERSION = void 0;
+    exports2.workflowDedupClient = exports2.recordIfAbsent = exports2.markFailed = exports2.encodeSortKey = exports2.WorkflowDedupTableNameMissingError = exports2.WorkflowDedupInvalidInputError = exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = exports2.parseWorkflowEvent = exports2.UnsupportedEnvelopeVersionError = exports2.InvalidWorkflowEventError = exports2.workflowsClient = exports2.publishWorkflowEvent = exports2.WorkflowPublishError = exports2.isWellFormedDetailType = exports2.defineDetailType = exports2.RENAMABLE_ENTITY_TYPE = exports2.PlatformSystemDataSeededV1 = exports2.PlatformDeploymentCompletedV1 = exports2.OWNING_ENTITY_TYPE = exports2.InvalidDetailTypeRegistrationError = exports2.ControlPlaneWorkspaceDeletedV1 = exports2.ControlPlaneWorkspaceCreatedV1 = exports2.ControlPlaneRoleAssignmentDeletedV1 = exports2.ControlPlaneRoleAssignmentCreatedV1 = exports2.ControlPlaneRenameV1 = exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.ControlPlaneMembershipDeletedV1 = exports2.ControlPlaneMembershipCreatedV1 = exports2.OPENHI_OPS_SOURCE = exports2.OPENHI_DATA_SOURCE = exports2.OPENHI_CONTROL_SOURCE = exports2.DEFAULT_BUS_NAME_BY_SOURCE = exports2.workflowUserActorFromClaims = exports2.isWorkflowUserActor = exports2.isWorkflowSystemActor = exports2.MissingActorContextError = exports2.isSupportedEnvelopeVersion = exports2.ENVELOPE_VERSION = void 0;
     var envelope_version_1 = require_envelope_version();
     Object.defineProperty(exports2, "ENVELOPE_VERSION", { enumerable: true, get: function() {
       return envelope_version_1.ENVELOPE_VERSION;
@@ -673,6 +703,12 @@ var require_lib2 = __commonJS({
       return sources_1.OPENHI_OPS_SOURCE;
     } });
     var detail_types_1 = require_detail_types();
+    Object.defineProperty(exports2, "ControlPlaneMembershipCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneMembershipCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneMembershipDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneMembershipDeletedV1;
+    } });
     Object.defineProperty(exports2, "ControlPlaneOwningDeleteCompleteV1", { enumerable: true, get: function() {
       return detail_types_1.ControlPlaneOwningDeleteCompleteV1;
     } });
@@ -691,6 +727,18 @@ var require_lib2 = __commonJS({
     Object.defineProperty(exports2, "ControlPlaneRenameV1", { enumerable: true, get: function() {
       return detail_types_1.ControlPlaneRenameV1;
     } });
+    Object.defineProperty(exports2, "ControlPlaneRoleAssignmentCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRoleAssignmentCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRoleAssignmentDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRoleAssignmentDeletedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneWorkspaceCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneWorkspaceCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneWorkspaceDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneWorkspaceDeletedV1;
+    } });
     Object.defineProperty(exports2, "InvalidDetailTypeRegistrationError", { enumerable: true, get: function() {
       return detail_types_1.InvalidDetailTypeRegistrationError;
     } });
@@ -779,6 +827,8 @@ __export(src_exports, {
   CLOUDFORMATION_STACK_STATUS_CHANGE_DETAIL_TYPE: () => CLOUDFORMATION_STACK_STATUS_CHANGE_DETAIL_TYPE,
   CONDITION_CLINICAL_STATUS_SYSTEM: () => CONDITION_CLINICAL_STATUS_SYSTEM,
   CONTROL_EVENT_BUS_NAME_ENV_VAR: () => CONTROL_EVENT_BUS_NAME_ENV_VAR,
+  COUNTER_MAINTENANCE_CONSUMER_NAME: () => COUNTER_MAINTENANCE_CONSUMER_NAME,
+  COUNTER_MAINTENANCE_DETAIL_TYPES: () => COUNTER_MAINTENANCE_DETAIL_TYPES,
   COVERAGE_PAYOR_TYPE_SYSTEM: () => COVERAGE_PAYOR_TYPE_SYSTEM,
   COVERAGE_QMB_STATUS_EXTENSION_URL: () => COVERAGE_QMB_STATUS_EXTENSION_URL,
   COVERAGE_VERIFICATION_DATE_EXTENSION_URL: () => COVERAGE_VERIFICATION_DATE_EXTENSION_URL,
@@ -790,12 +840,22 @@ __export(src_exports, {
   CognitoUserPoolDomain: () => CognitoUserPoolDomain,
   CognitoUserPoolKmsKey: () => CognitoUserPoolKmsKey,
   ControlEventBus: () => ControlEventBus,
-  ControlPlaneOwningDeleteCompleteV1: () => import_workflows5.ControlPlaneOwningDeleteCompleteV1,
-  ControlPlaneOwningDeleteFailedV1: () => import_workflows5.ControlPlaneOwningDeleteFailedV1,
-  ControlPlaneOwningDeleteV1: () => import_workflows5.ControlPlaneOwningDeleteV1,
-  ControlPlaneRenameCompleteV1: () => import_workflows6.ControlPlaneRenameCompleteV1,
-  ControlPlaneRenameFailedV1: () => import_workflows6.ControlPlaneRenameFailedV1,
-  ControlPlaneRenameV1: () => import_workflows6.ControlPlaneRenameV1,
+  ControlPlaneMembershipCreatedV1: () => import_workflows2.ControlPlaneMembershipCreatedV1,
+  ControlPlaneMembershipDeletedV1: () => import_workflows2.ControlPlaneMembershipDeletedV1,
+  ControlPlaneOwningDeleteCompleteV1: () => import_workflows7.ControlPlaneOwningDeleteCompleteV1,
+  ControlPlaneOwningDeleteFailedV1: () => import_workflows7.ControlPlaneOwningDeleteFailedV1,
+  ControlPlaneOwningDeleteV1: () => import_workflows7.ControlPlaneOwningDeleteV1,
+  ControlPlaneRenameCompleteV1: () => import_workflows8.ControlPlaneRenameCompleteV1,
+  ControlPlaneRenameFailedV1: () => import_workflows8.ControlPlaneRenameFailedV1,
+  ControlPlaneRenameV1: () => import_workflows8.ControlPlaneRenameV1,
+  ControlPlaneRoleAssignmentCreatedV1: () => import_workflows2.ControlPlaneRoleAssignmentCreatedV1,
+  ControlPlaneRoleAssignmentDeletedV1: () => import_workflows2.ControlPlaneRoleAssignmentDeletedV1,
+  ControlPlaneWorkspaceCreatedV1: () => import_workflows2.ControlPlaneWorkspaceCreatedV1,
+  ControlPlaneWorkspaceDeletedV1: () => import_workflows2.ControlPlaneWorkspaceDeletedV1,
+  CounterMaintenanceLambda: () => CounterMaintenanceLambda,
+  CounterMaintenanceWorkflow: () => CounterMaintenanceWorkflow,
+  CounterReconciliationLambda: () => CounterReconciliationLambda,
+  CounterReconciliationWorkflow: () => CounterReconciliationWorkflow,
   DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES: () => DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES,
   DATA_STORE_CHANGE_DETAIL_TYPE: () => DATA_STORE_CHANGE_DETAIL_TYPE,
   DEFAULT_PREVIEW_EXPIRATION_DAYS: () => DEFAULT_PREVIEW_EXPIRATION_DAYS,
@@ -858,7 +918,7 @@ __export(src_exports, {
   OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY: () => OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY,
   OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES: () => OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES,
   OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR: () => OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR,
-  OWNING_ENTITY_TYPE: () => import_workflows5.OWNING_ENTITY_TYPE,
+  OWNING_ENTITY_TYPE: () => import_workflows7.OWNING_ENTITY_TYPE,
   OpenHiApp: () => OpenHiApp,
   OpenHiAuthService: () => OpenHiAuthService,
   OpenHiDataService: () => OpenHiDataService,
@@ -904,14 +964,14 @@ __export(src_exports, {
   PerBranchHostname: () => PerBranchHostname,
   PlatformDeployBridge: () => PlatformDeployBridge,
   PlatformDeployBridgeLambda: () => PlatformDeployBridgeLambda,
-  PlatformDeploymentCompletedV1: () => import_workflows4.PlatformDeploymentCompletedV1,
+  PlatformDeploymentCompletedV1: () => import_workflows6.PlatformDeploymentCompletedV1,
   PostAuthenticationLambda: () => PostAuthenticationLambda,
   PostConfirmationLambda: () => PostConfirmationLambda,
   PreTokenGenerationLambda: () => PreTokenGenerationLambda,
   ProvisionDefaultWorkspaceLambda: () => ProvisionDefaultWorkspaceLambda,
   QMB_EFFECTIVE_DATE_SUB_EXTENSION_URL: () => QMB_EFFECTIVE_DATE_SUB_EXTENSION_URL,
   QMB_STATUS_VALUE_SUB_EXTENSION_URL: () => QMB_STATUS_VALUE_SUB_EXTENSION_URL,
-  RENAMABLE_ENTITY_TYPE: () => import_workflows6.RENAMABLE_ENTITY_TYPE,
+  RENAMABLE_ENTITY_TYPE: () => import_workflows8.RENAMABLE_ENTITY_TYPE,
   RENAME_CASCADE_CONSUMER_NAME: () => RENAME_CASCADE_CONSUMER_NAME,
   RENAME_CASCADE_DEFAULT_CONCURRENCY: () => RENAME_CASCADE_DEFAULT_CONCURRENCY,
   RENAME_CASCADE_FAILED_THRESHOLD: () => RENAME_CASCADE_FAILED_THRESHOLD,
@@ -3218,9 +3278,129 @@ var _OpenHiGlobalService = class _OpenHiGlobalService extends OpenHiService {
 _OpenHiGlobalService.SERVICE_TYPE = "global";
 var OpenHiGlobalService = _OpenHiGlobalService;
 
+// src/workflows/control-plane/counter-maintenance/events.ts
+var import_workflows2 = __toESM(require_lib2());
+var COUNTER_MAINTENANCE_CONSUMER_NAME = "counter-maintenance";
+var COUNTER_MAINTENANCE_DETAIL_TYPES = [
+  import_workflows2.ControlPlaneMembershipCreatedV1.detailType,
+  import_workflows2.ControlPlaneMembershipDeletedV1.detailType,
+  import_workflows2.ControlPlaneRoleAssignmentCreatedV1.detailType,
+  import_workflows2.ControlPlaneRoleAssignmentDeletedV1.detailType,
+  import_workflows2.ControlPlaneWorkspaceCreatedV1.detailType,
+  import_workflows2.ControlPlaneWorkspaceDeletedV1.detailType
+];
+
+// src/workflows/control-plane/counter-maintenance/counter-maintenance-lambda.ts
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_path7 = __toESM(require("path"));
+var import_aws_cdk_lib13 = require("aws-cdk-lib");
+var import_aws_events6 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets2 = require("aws-cdk-lib/aws-events-targets");
+var import_aws_lambda8 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs8 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs13 = require("constructs");
+var HANDLER_NAME7 = "counter-maintenance.handler.js";
+function resolveHandlerEntry7(dirname) {
+  const sameDir = import_node_path7.default.join(dirname, HANDLER_NAME7);
+  if (import_node_fs7.default.existsSync(sameDir)) {
+    return sameDir;
+  }
+  return import_node_path7.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME7);
+}
+var CounterMaintenanceLambda = class extends import_constructs13.Construct {
+  constructor(scope, props) {
+    super(scope, "counter-maintenance-lambda");
+    this.lambda = new import_aws_lambda_nodejs8.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry7(__dirname),
+      runtime: import_aws_lambda8.Runtime.NODEJS_LATEST,
+      memorySize: 256,
+      timeout: import_aws_cdk_lib13.Duration.minutes(1),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grant(this.lambda, "dynamodb:UpdateItem");
+    this.rule = new import_aws_events6.Rule(this, "rule", {
+      eventBus: props.controlEventBus,
+      eventPattern: {
+        source: [import_workflows2.ControlPlaneMembershipCreatedV1.source],
+        detailType: [...COUNTER_MAINTENANCE_DETAIL_TYPES]
+      },
+      targets: [
+        new import_aws_events_targets2.LambdaFunction(this.lambda, {
+          retryAttempts: 2,
+          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
+        })
+      ]
+    });
+  }
+};
+
+// src/workflows/control-plane/counter-maintenance/counter-maintenance-workflow.ts
+var import_constructs14 = require("constructs");
+var CounterMaintenanceWorkflow = class extends import_constructs14.Construct {
+  constructor(scope, props) {
+    super(scope, "counter-maintenance-workflow");
+    this.counterMaintenance = new CounterMaintenanceLambda(this, {
+      controlEventBus: props.controlEventBus,
+      dataStoreTable: props.dataStoreTable
+    });
+    WorkflowDedupTable.grantConsumerFromLookup(
+      this,
+      this.counterMaintenance.lambda,
+      COUNTER_MAINTENANCE_CONSUMER_NAME
+    );
+  }
+};
+
+// src/workflows/control-plane/counter-reconciliation/counter-reconciliation-lambda.ts
+var import_node_fs8 = __toESM(require("fs"));
+var import_node_path8 = __toESM(require("path"));
+var import_aws_cdk_lib14 = require("aws-cdk-lib");
+var import_aws_lambda9 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs9 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs15 = require("constructs");
+var HANDLER_NAME8 = "counter-reconciliation.handler.js";
+function resolveHandlerEntry8(dirname) {
+  const sameDir = import_node_path8.default.join(dirname, HANDLER_NAME8);
+  if (import_node_fs8.default.existsSync(sameDir)) {
+    return sameDir;
+  }
+  return import_node_path8.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME8);
+}
+var CounterReconciliationLambda = class extends import_constructs15.Construct {
+  constructor(scope, props) {
+    super(scope, "counter-reconciliation-lambda");
+    this.lambda = new import_aws_lambda_nodejs9.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry8(__dirname),
+      runtime: import_aws_lambda9.Runtime.NODEJS_LATEST,
+      memorySize: 512,
+      // A full-table sweep over every Tenant / Workspace / User is
+      // heavier than the single-event counter-maintenance consumer, so
+      // the on-demand job gets a longer ceiling.
+      timeout: import_aws_cdk_lib14.Duration.minutes(15),
+      environment: {
+        DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
+      }
+    });
+    props.dataStoreTable.grantReadWriteData(this.lambda);
+  }
+};
+
+// src/workflows/control-plane/counter-reconciliation/counter-reconciliation-workflow.ts
+var import_constructs16 = require("constructs");
+var CounterReconciliationWorkflow = class extends import_constructs16.Construct {
+  constructor(scope, props) {
+    super(scope, "counter-reconciliation-workflow");
+    this.counterReconciliation = new CounterReconciliationLambda(this, {
+      dataStoreTable: props.dataStoreTable
+    });
+  }
+};
+
 // src/workflows/control-plane/seed-demo-data/events.ts
 var import_types = require("@openhi/types");
-var import_workflows2 = __toESM(require_lib2());
+var import_workflows3 = __toESM(require_lib2());
 
 // src/data/operations/control/membership-constraints/platform-scope-tenant-id.ts
 var PLATFORM_SCOPE_TENANT_ID = "platform";
@@ -6975,22 +7155,22 @@ var _validateFixturesAgainstTenantSpecs = () => {
 _validateFixturesAgainstTenantSpecs();
 
 // src/workflows/control-plane/seed-demo-data/seed-demo-data-lambda.ts
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_path7 = __toESM(require("path"));
-var import_aws_cdk_lib13 = require("aws-cdk-lib");
-var import_aws_events6 = require("aws-cdk-lib/aws-events");
-var import_aws_events_targets2 = require("aws-cdk-lib/aws-events-targets");
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_path9 = __toESM(require("path"));
+var import_aws_cdk_lib15 = require("aws-cdk-lib");
+var import_aws_events7 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets3 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam3 = require("aws-cdk-lib/aws-iam");
-var import_aws_lambda8 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs8 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs13 = require("constructs");
+var import_aws_lambda10 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs10 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs17 = require("constructs");
 
 // src/workflows/control-plane/seed-demo-data/seed-demo-data.handler.ts
 var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
 var import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
 var import_client_ssm = require("@aws-sdk/client-ssm");
 var import_types12 = require("@openhi/types");
-var import_workflows3 = __toESM(require_lib2());
+var import_workflows5 = __toESM(require_lib2());
 
 // src/data/dynamo/dynamo-control-service.ts
 var import_electrodb14 = require("electrodb");
@@ -8436,6 +8616,24 @@ var TenantEntity = new import_electrodb11.Entity({
       type: "string",
       required: true
     },
+    /**
+     * ADR-028 denormalized counter — number of tenant-scoped Memberships
+     * (users) in this tenant. Maintained by the counter-maintenance
+     * consumer via atomic ADD; absent/0 until first event or reconciliation.
+     */
+    usersInTenant: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of Workspaces in this tenant.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    workspacesInTenant: {
+      type: "number",
+      required: false
+    },
     gsi1Shard: gsi1ShardAttribute,
     /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
     gsi1sk: gsi1skAttribute,
@@ -8540,6 +8738,26 @@ var UserEntity = new import_electrodb12.Entity({
       type: "string",
       required: true
     },
+    /**
+     * ADR-028 denormalized counter — number of tenant-scoped Memberships
+     * (tenants) this user belongs to. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    tenantsForUser: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * Memberships (workspaces) this user belongs to. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    workspacesForUser: {
+      type: "number",
+      required: false
+    },
     gsi1Shard: gsi1ShardAttribute,
     /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
     gsi1sk: gsi1skAttribute,
@@ -8684,6 +8902,36 @@ var WorkspaceEntity = new import_electrodb13.Entity({
       type: "string",
       required: true
     },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * Memberships (users) in this workspace. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    usersInWorkspace: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * RoleAssignments classified as admin-tier in this workspace.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    adminUsersInWorkspace: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * RoleAssignments classified as non-admin in this workspace.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    normalUsersInWorkspace: {
+      type: "number",
+      required: false
+    },
     gsi1Shard: gsi1ShardAttribute,
     /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
     gsi1sk: gsi1skAttribute,
@@ -8794,6 +9042,10 @@ var import_types3 = require("@openhi/types");
 // src/data/operations/control/membership/membership-workspace-projection.ts
 var import_types4 = require("@openhi/types");
 
+// src/data/operations/control/control-event-publisher.ts
+var import_client_eventbridge = require("@aws-sdk/client-eventbridge");
+var import_workflows4 = __toESM(require_lib2());
+
 // src/data/operations/control/roleassignment/roleassignment-create-operation.ts
 var import_types8 = require("@openhi/types");
 
@@ -9881,22 +10133,22 @@ var import_ulid13 = require("ulid");
 var SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR = "SEED_DEMO_DATA_USER_POOL_ID";
 
 // src/workflows/control-plane/seed-demo-data/seed-demo-data-lambda.ts
-var HANDLER_NAME7 = "seed-demo-data.handler.js";
-function resolveHandlerEntry7(dirname) {
-  const sameDir = import_node_path7.default.join(dirname, HANDLER_NAME7);
-  if (import_node_fs7.default.existsSync(sameDir)) {
+var HANDLER_NAME9 = "seed-demo-data.handler.js";
+function resolveHandlerEntry9(dirname) {
+  const sameDir = import_node_path9.default.join(dirname, HANDLER_NAME9);
+  if (import_node_fs9.default.existsSync(sameDir)) {
     return sameDir;
   }
-  return import_node_path7.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME7);
+  return import_node_path9.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME9);
 }
-var SeedDemoDataLambda = class extends import_constructs13.Construct {
+var SeedDemoDataLambda = class extends import_constructs17.Construct {
   constructor(scope, props) {
     super(scope, "seed-demo-data-lambda");
-    this.lambda = new import_aws_lambda_nodejs8.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry7(__dirname),
-      runtime: import_aws_lambda8.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs10.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry9(__dirname),
+      runtime: import_aws_lambda10.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib13.Duration.minutes(2),
+      timeout: import_aws_cdk_lib15.Duration.minutes(2),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_DEMO_DATA_USER_POOL_ID_ENV_VAR]: props.userPool.userPoolId
@@ -9925,7 +10177,7 @@ var SeedDemoDataLambda = class extends import_constructs13.Construct {
           "cognito-idp:AdminSetUserPassword"
         ],
         resources: [
-          import_aws_cdk_lib13.Stack.of(this).formatArn({
+          import_aws_cdk_lib15.Stack.of(this).formatArn({
             service: "cognito-idp",
             resource: "userpool",
             resourceName: props.userPool.userPoolId
@@ -9938,7 +10190,7 @@ var SeedDemoDataLambda = class extends import_constructs13.Construct {
         effect: import_aws_iam3.Effect.ALLOW,
         actions: ["ssm:GetParameter"],
         resources: [
-          import_aws_cdk_lib13.Stack.of(this).formatArn({
+          import_aws_cdk_lib15.Stack.of(this).formatArn({
             service: "ssm",
             resource: "parameter",
             resourceName: "openhi/seed/users/*/password"
@@ -9951,7 +10203,7 @@ var SeedDemoDataLambda = class extends import_constructs13.Construct {
         effect: import_aws_iam3.Effect.ALLOW,
         actions: ["kms:Decrypt"],
         resources: [
-          import_aws_cdk_lib13.Stack.of(this).formatArn({
+          import_aws_cdk_lib15.Stack.of(this).formatArn({
             service: "kms",
             resource: "alias",
             resourceName: "aws/ssm"
@@ -9959,16 +10211,16 @@ var SeedDemoDataLambda = class extends import_constructs13.Construct {
         ]
       })
     );
-    this.rule = new import_aws_events6.Rule(this, "rule", {
+    this.rule = new import_aws_events7.Rule(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
-        source: [import_workflows2.PlatformSystemDataSeededV1.source],
-        detailType: [import_workflows2.PlatformSystemDataSeededV1.detailType]
+        source: [import_workflows3.PlatformSystemDataSeededV1.source],
+        detailType: [import_workflows3.PlatformSystemDataSeededV1.detailType]
       },
       targets: [
-        new import_aws_events_targets2.LambdaFunction(this.lambda, {
+        new import_aws_events_targets3.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib13.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib15.Duration.hours(2)
         })
       ]
     });
@@ -9976,8 +10228,8 @@ var SeedDemoDataLambda = class extends import_constructs13.Construct {
 };
 
 // src/workflows/control-plane/seed-demo-data/seed-demo-data-workflow.ts
-var import_constructs14 = require("constructs");
-var SeedDemoDataWorkflow = class extends import_constructs14.Construct {
+var import_constructs18 = require("constructs");
+var SeedDemoDataWorkflow = class extends import_constructs18.Construct {
   constructor(scope, props) {
     super(scope, "seed-demo-data-workflow");
     this.seedDemoData = new SeedDemoDataLambda(this, {
@@ -9994,38 +10246,38 @@ var SeedDemoDataWorkflow = class extends import_constructs14.Construct {
 };
 
 // src/workflows/control-plane/seed-system-data/events.ts
-var import_workflows4 = __toESM(require_lib2());
+var import_workflows6 = __toESM(require_lib2());
 var SEED_SYSTEM_DATA_CONSUMER_NAME = "seed-system-data";
 var SEED_SYSTEM_DATA_ACTOR_SYSTEM = "seed-system-data";
 var SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR = "CONTROL_EVENT_BUS_NAME";
 
 // src/workflows/control-plane/seed-system-data/seed-system-data-lambda.ts
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_path8 = __toESM(require("path"));
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path10 = __toESM(require("path"));
 var import_types13 = require("@openhi/types");
-var import_aws_cdk_lib14 = require("aws-cdk-lib");
-var import_aws_events7 = require("aws-cdk-lib/aws-events");
-var import_aws_events_targets3 = require("aws-cdk-lib/aws-events-targets");
+var import_aws_cdk_lib16 = require("aws-cdk-lib");
+var import_aws_events8 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets4 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam4 = require("aws-cdk-lib/aws-iam");
-var import_aws_lambda9 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs9 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs15 = require("constructs");
-var HANDLER_NAME8 = "seed-system-data.handler.js";
-function resolveHandlerEntry8(dirname) {
-  const sameDir = import_node_path8.default.join(dirname, HANDLER_NAME8);
-  if (import_node_fs8.default.existsSync(sameDir)) {
+var import_aws_lambda11 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs11 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs19 = require("constructs");
+var HANDLER_NAME10 = "seed-system-data.handler.js";
+function resolveHandlerEntry10(dirname) {
+  const sameDir = import_node_path10.default.join(dirname, HANDLER_NAME10);
+  if (import_node_fs10.default.existsSync(sameDir)) {
     return sameDir;
   }
-  return import_node_path8.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME8);
+  return import_node_path10.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME10);
 }
-var SeedSystemDataLambda = class extends import_constructs15.Construct {
+var SeedSystemDataLambda = class extends import_constructs19.Construct {
   constructor(scope, props) {
     super(scope, "seed-system-data-lambda");
-    this.lambda = new import_aws_lambda_nodejs9.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry8(__dirname),
-      runtime: import_aws_lambda9.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs11.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry10(__dirname),
+      runtime: import_aws_lambda11.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib14.Duration.minutes(1),
+      timeout: import_aws_cdk_lib16.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR]: props.controlEventBus.eventBusName
@@ -10047,12 +10299,12 @@ var SeedSystemDataLambda = class extends import_constructs15.Construct {
       })
     );
     props.controlEventBus.grantPutEventsTo(this.lambda);
-    const hostStackName = import_aws_cdk_lib14.Stack.of(this).stackName;
-    this.rule = new import_aws_events7.Rule(this, "rule", {
+    const hostStackName = import_aws_cdk_lib16.Stack.of(this).stackName;
+    this.rule = new import_aws_events8.Rule(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
-        source: [import_workflows4.PlatformDeploymentCompletedV1.source],
-        detailType: [import_workflows4.PlatformDeploymentCompletedV1.detailType],
+        source: [import_workflows6.PlatformDeploymentCompletedV1.source],
+        detailType: [import_workflows6.PlatformDeploymentCompletedV1.detailType],
         detail: {
           payload: {
             stackName: [hostStackName]
@@ -10060,9 +10312,9 @@ var SeedSystemDataLambda = class extends import_constructs15.Construct {
         }
       },
       targets: [
-        new import_aws_events_targets3.LambdaFunction(this.lambda, {
+        new import_aws_events_targets4.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib14.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib16.Duration.hours(2)
         })
       ]
     });
@@ -10070,8 +10322,8 @@ var SeedSystemDataLambda = class extends import_constructs15.Construct {
 };
 
 // src/workflows/control-plane/seed-system-data/seed-system-data-workflow.ts
-var import_constructs16 = require("constructs");
-var SeedSystemDataWorkflow = class extends import_constructs16.Construct {
+var import_constructs20 = require("constructs");
+var SeedSystemDataWorkflow = class extends import_constructs20.Construct {
   constructor(scope, props) {
     super(scope, "seed-system-data-workflow");
     this.seedSystemData = new SeedSystemDataLambda(this, {
@@ -10138,6 +10390,8 @@ var _OpenHiDataService = class _OpenHiDataService extends OpenHiService {
     );
     this.seedSystemDataWorkflow = this.createSeedSystemDataWorkflow();
     this.seedDemoDataWorkflow = this.createSeedDemoDataWorkflow();
+    this.counterMaintenanceWorkflow = this.createCounterMaintenanceWorkflow();
+    this.counterReconciliationWorkflow = this.createCounterReconciliationWorkflow();
   }
   /**
    * Returns the data store table by name. Use from other stacks (e.g. REST API Lambda) to obtain an ITable reference.
@@ -10184,6 +10438,28 @@ var _OpenHiDataService = class _OpenHiDataService extends OpenHiService {
       userPool: OpenHiAuthService.userPoolFromConstruct(this)
     });
   }
+  /**
+   * Creates the ADR-028 counter-maintenance workflow. Override to
+   * customize. Mounted on every stage — the denormalized counters back
+   * the admin console list columns in prod and non-prod alike.
+   */
+  createCounterMaintenanceWorkflow() {
+    return new CounterMaintenanceWorkflow(this, {
+      controlEventBus: this.controlEventBus(),
+      dataStoreTable: this.dataStore
+    });
+  }
+  /**
+   * Creates the ADR-028 counter-reconciliation job (#1319). Override to
+   * customize. Mounted on every stage — the recompute-and-repair backstop
+   * is the correctness authority for the denormalized counters in prod
+   * and non-prod alike. On-demand only (no EventBridge trigger).
+   */
+  createCounterReconciliationWorkflow() {
+    return new CounterReconciliationWorkflow(this, {
+      dataStoreTable: this.dataStore
+    });
+  }
   /**
    * Creates the single-table DynamoDB data store.
    * Override to customize.
@@ -10200,7 +10476,7 @@ var OpenHiDataService = _OpenHiDataService;
 
 // src/services/open-hi-website-service.ts
 var import_config6 = __toESM(require_lib());
-var import_aws_cdk_lib15 = require("aws-cdk-lib");
+var import_aws_cdk_lib17 = require("aws-cdk-lib");
 var import_aws_s32 = require("aws-cdk-lib/aws-s3");
 
 // src/services/open-hi-rest-api-service.ts
@@ -10208,59 +10484,60 @@ var import_config5 = __toESM(require_lib());
 var import_aws_apigatewayv22 = require("aws-cdk-lib/aws-apigatewayv2");
 var import_aws_apigatewayv2_authorizers = require("aws-cdk-lib/aws-apigatewayv2-authorizers");
 var import_aws_apigatewayv2_integrations = require("aws-cdk-lib/aws-apigatewayv2-integrations");
+var import_aws_events9 = require("aws-cdk-lib/aws-events");
 var import_aws_iam5 = require("aws-cdk-lib/aws-iam");
 var import_aws_route535 = require("aws-cdk-lib/aws-route53");
 var import_aws_route53_targets3 = require("aws-cdk-lib/aws-route53-targets");
 var import_core = require("aws-cdk-lib/core");
-var import_constructs19 = require("constructs");
+var import_constructs23 = require("constructs");
 
 // src/data/lambda/cors-options-lambda.ts
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_path9 = __toESM(require("path"));
-var import_aws_lambda10 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs10 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs17 = require("constructs");
-var HANDLER_NAME9 = "cors-options-lambda.handler.js";
-function resolveHandlerEntry9(dirname) {
-  const sameDir = import_node_path9.default.join(dirname, HANDLER_NAME9);
-  if (import_node_fs9.default.existsSync(sameDir)) {
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
+var import_aws_lambda12 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs12 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs21 = require("constructs");
+var HANDLER_NAME11 = "cors-options-lambda.handler.js";
+function resolveHandlerEntry11(dirname) {
+  const sameDir = import_node_path11.default.join(dirname, HANDLER_NAME11);
+  if (import_node_fs11.default.existsSync(sameDir)) {
     return sameDir;
   }
-  const fromLib = import_node_path9.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME9);
+  const fromLib = import_node_path11.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME11);
   return fromLib;
 }
-var CorsOptionsLambda = class extends import_constructs17.Construct {
+var CorsOptionsLambda = class extends import_constructs21.Construct {
   constructor(scope, id = "cors-options-lambda") {
     super(scope, id);
-    this.lambda = new import_aws_lambda_nodejs10.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry9(__dirname),
-      runtime: import_aws_lambda10.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs12.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry11(__dirname),
+      runtime: import_aws_lambda12.Runtime.NODEJS_LATEST,
       memorySize: 128
     });
   }
 };
 
 // src/data/lambda/rest-api-lambda.ts
-var import_node_fs10 = __toESM(require("fs"));
-var import_node_path10 = __toESM(require("path"));
-var import_aws_lambda11 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs11 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs18 = require("constructs");
-var HANDLER_NAME10 = "rest-api-lambda.handler.js";
-function resolveHandlerEntry10(dirname) {
-  const sameDir = import_node_path10.default.join(dirname, HANDLER_NAME10);
-  if (import_node_fs10.default.existsSync(sameDir)) {
+var import_node_fs12 = __toESM(require("fs"));
+var import_node_path12 = __toESM(require("path"));
+var import_aws_lambda13 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs13 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs22 = require("constructs");
+var HANDLER_NAME12 = "rest-api-lambda.handler.js";
+function resolveHandlerEntry12(dirname) {
+  const sameDir = import_node_path12.default.join(dirname, HANDLER_NAME12);
+  if (import_node_fs12.default.existsSync(sameDir)) {
     return sameDir;
   }
-  const fromLib = import_node_path10.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME10);
+  const fromLib = import_node_path12.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME12);
   return fromLib;
 }
-var RestApiLambda = class extends import_constructs18.Construct {
+var RestApiLambda = class extends import_constructs22.Construct {
   constructor(scope, props) {
     super(scope, "rest-api-lambda");
-    this.lambda = new import_aws_lambda_nodejs11.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry10(__dirname),
-      runtime: import_aws_lambda11.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs13.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry12(__dirname),
+      runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
       memorySize: 1024,
       environment: {
         DYNAMO_TABLE_NAME: props.dynamoTableName,
@@ -10270,6 +10547,7 @@ var RestApiLambda = class extends import_constructs18.Construct {
         OPENHI_PG_SECRET_ARN: props.postgresSecretArn,
         OPENHI_PG_DATABASE: props.postgresDatabase,
         OPENHI_PG_SCHEMA: props.postgresSchema,
+        CONTROL_EVENT_BUS_NAME: props.controlEventBusName,
         ...props.extraEnvironment
       },
       bundling: {
@@ -10453,6 +10731,7 @@ var _OpenHiRestApiService = class _OpenHiRestApiService extends OpenHiService {
     const postgresDatabase = DataStorePostgresReplica.databaseNameFromConstruct(this);
     const postgresSchema = getPostgresReplicaSchemaName(this.branchHash);
     const extraEnvironment = this.resolveRuntimeConfigEnvVars();
+    const controlEventBusName = ControlEventBus.getEventBusName(this);
     const { lambda } = new RestApiLambda(this, {
       dynamoTableName: dataStoreTable.tableName,
       branchTagValue: this.branchName,
@@ -10461,8 +10740,14 @@ var _OpenHiRestApiService = class _OpenHiRestApiService extends OpenHiService {
       postgresSecretArn,
       postgresDatabase,
       postgresSchema,
+      controlEventBusName,
       extraEnvironment
     });
+    import_aws_events9.EventBus.fromEventBusName(
+      this,
+      "control-event-bus-ref",
+      controlEventBusName
+    ).grantPutEventsTo(lambda);
     lambda.addToRolePolicy(
       new import_aws_iam5.PolicyStatement({
         effect: import_aws_iam5.Effect.ALLOW,
@@ -10678,7 +10963,7 @@ var _OpenHiRestApiService = class _OpenHiRestApiService extends OpenHiService {
    * client-side from `window.location.origin`.
    */
   resolveRuntimeConfigEnvVars() {
-    const cognitoScope = new import_constructs19.Construct(this, "runtime-config");
+    const cognitoScope = new import_constructs23.Construct(this, "runtime-config");
     const userPool = OpenHiAuthService.userPoolFromConstruct(cognitoScope);
     const userPoolClient = OpenHiAuthService.userPoolClientFromConstruct(cognitoScope);
     const cognitoDomainUrl = OpenHiAuthService.userPoolDomainBaseUrlFromConstruct(cognitoScope);
@@ -10928,7 +11213,7 @@ var _OpenHiWebsiteService = class _OpenHiWebsiteService extends OpenHiService {
    * literal key stable across synths.
    */
   createAdminConsoleEndpointOutput() {
-    const output = new import_aws_cdk_lib15.CfnOutput(this, "admin-console-endpoint-output", {
+    const output = new import_aws_cdk_lib17.CfnOutput(this, "admin-console-endpoint-output", {
       value: `https://${this.fullDomain}`,
       description: "Admin console endpoint for this deploy (https://<fullDomain>). Surfaced by the deploy workflow's sticky PR comment and job summary."
     });
@@ -11039,29 +11324,29 @@ var buildProvisionDefaultWorkspaceRequestedDetail = (event) => {
 };
 
 // src/workflows/control-plane/user-onboarding/provision-default-workspace-lambda.ts
-var import_node_fs11 = __toESM(require("fs"));
-var import_node_path11 = __toESM(require("path"));
-var import_aws_cdk_lib16 = require("aws-cdk-lib");
-var import_aws_events8 = require("aws-cdk-lib/aws-events");
-var import_aws_events_targets4 = require("aws-cdk-lib/aws-events-targets");
+var import_node_fs13 = __toESM(require("fs"));
+var import_node_path13 = __toESM(require("path"));
+var import_aws_cdk_lib18 = require("aws-cdk-lib");
+var import_aws_events10 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets5 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_iam6 = require("aws-cdk-lib/aws-iam");
-var import_aws_lambda12 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs12 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs20 = require("constructs");
-var HANDLER_NAME11 = "provision-default-workspace.handler.js";
-function resolveHandlerEntry11(dirname) {
-  const sameDir = import_node_path11.default.join(dirname, HANDLER_NAME11);
-  if (import_node_fs11.default.existsSync(sameDir)) {
+var import_aws_lambda14 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs14 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs24 = require("constructs");
+var HANDLER_NAME13 = "provision-default-workspace.handler.js";
+function resolveHandlerEntry13(dirname) {
+  const sameDir = import_node_path13.default.join(dirname, HANDLER_NAME13);
+  if (import_node_fs13.default.existsSync(sameDir)) {
     return sameDir;
   }
-  return import_node_path11.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME11);
+  return import_node_path13.default.join(dirname, "..", "..", "..", "..", "lib", HANDLER_NAME13);
 }
-var ProvisionDefaultWorkspaceLambda = class extends import_constructs20.Construct {
+var ProvisionDefaultWorkspaceLambda = class extends import_constructs24.Construct {
   constructor(scope, props) {
     super(scope, "provision-default-workspace-lambda");
-    this.lambda = new import_aws_lambda_nodejs12.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry11(__dirname),
-      runtime: import_aws_lambda12.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs14.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry13(__dirname),
+      runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
       memorySize: 1024,
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
@@ -11079,16 +11364,16 @@ var ProvisionDefaultWorkspaceLambda = class extends import_constructs20.Construc
         resources: [`${props.dataStoreTable.tableArn}/index/*`]
       })
     );
-    this.rule = new import_aws_events8.Rule(this, "rule", {
+    this.rule = new import_aws_events10.Rule(this, "rule", {
       eventBus: props.controlEventBus,
       eventPattern: {
         source: [USER_ONBOARDING_EVENT_SOURCE],
         detailType: [PROVISION_DEFAULT_WORKSPACE_DETAIL_TYPE]
       },
       targets: [
-        new import_aws_events_targets4.LambdaFunction(this.lambda, {
+        new import_aws_events_targets5.LambdaFunction(this.lambda, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib16.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib18.Duration.hours(2)
         })
       ]
     });
@@ -11096,8 +11381,8 @@ var ProvisionDefaultWorkspaceLambda = class extends import_constructs20.Construc
 };
 
 // src/workflows/control-plane/user-onboarding/user-onboarding-workflow.ts
-var import_constructs21 = require("constructs");
-var UserOnboardingWorkflow = class extends import_constructs21.Construct {
+var import_constructs25 = require("constructs");
+var UserOnboardingWorkflow = class extends import_constructs25.Construct {
   constructor(scope, props) {
     super(scope, "user-onboarding-workflow");
     this.provisionDefaultWorkspace = new ProvisionDefaultWorkspaceLambda(this, {
@@ -11518,54 +11803,54 @@ _OpenHiGraphqlService.SERVICE_TYPE = "graphql-api";
 var OpenHiGraphqlService = _OpenHiGraphqlService;
 
 // src/workflows/control-plane/owning-delete-cascade/events.ts
-var import_workflows5 = __toESM(require_lib2());
+var import_workflows7 = __toESM(require_lib2());
 var OWNING_DELETE_CASCADE_CONSUMER_NAME = "owning-delete-cascade";
 var OWNING_DELETE_CASCADE_DEFAULT_CONCURRENCY = 8;
 var OWNING_DELETE_CASCADE_STUCK_THRESHOLD_MINUTES = 15;
 var OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR = "OWNING_DELETE_OPS_EVENT_BUS_NAME";
 
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-lambdas.ts
-var import_node_fs12 = __toESM(require("fs"));
-var import_node_path12 = __toESM(require("path"));
-var import_aws_cdk_lib17 = require("aws-cdk-lib");
+var import_node_fs14 = __toESM(require("fs"));
+var import_node_path14 = __toESM(require("path"));
+var import_aws_cdk_lib19 = require("aws-cdk-lib");
 var import_aws_iam8 = require("aws-cdk-lib/aws-iam");
-var import_aws_lambda13 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs13 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs22 = require("constructs");
-function resolveHandlerEntry12(dirname, handlerName) {
-  const sameDir = import_node_path12.default.join(dirname, handlerName);
-  if (import_node_fs12.default.existsSync(sameDir)) {
+var import_aws_lambda15 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs15 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs26 = require("constructs");
+function resolveHandlerEntry14(dirname, handlerName) {
+  const sameDir = import_node_path14.default.join(dirname, handlerName);
+  if (import_node_fs14.default.existsSync(sameDir)) {
     return { entry: sameDir, handler: "handler" };
   }
-  const libDir = import_node_path12.default.join(dirname, "..", "..", "..", "..", "lib", handlerName);
+  const libDir = import_node_path14.default.join(dirname, "..", "..", "..", "..", "lib", handlerName);
   return { entry: libDir, handler: "handler" };
 }
-var OwningDeleteCascadeLambdas = class extends import_constructs22.Construct {
+var OwningDeleteCascadeLambdas = class extends import_constructs26.Construct {
   constructor(scope, props) {
     super(scope, "owning-delete-cascade-lambdas");
-    const listResolved = resolveHandlerEntry12(
+    const listResolved = resolveHandlerEntry14(
       __dirname,
       "list-chunks.handler.js"
     );
-    this.listChunks = new import_aws_lambda_nodejs13.NodejsFunction(this, "list-chunks-handler", {
+    this.listChunks = new import_aws_lambda_nodejs15.NodejsFunction(this, "list-chunks-handler", {
       entry: listResolved.entry,
-      runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda15.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib19.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
     });
     props.dataStoreTable.grant(this.listChunks, "dynamodb:Query");
-    const deleteResolved = resolveHandlerEntry12(
+    const deleteResolved = resolveHandlerEntry14(
       __dirname,
       "delete-chunk.handler.js"
     );
-    this.deleteChunk = new import_aws_lambda_nodejs13.NodejsFunction(this, "delete-chunk-handler", {
+    this.deleteChunk = new import_aws_lambda_nodejs15.NodejsFunction(this, "delete-chunk-handler", {
       entry: deleteResolved.entry,
-      runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda15.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib19.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -11576,15 +11861,15 @@ var OwningDeleteCascadeLambdas = class extends import_constructs22.Construct {
       "dynamodb:UpdateItem",
       "dynamodb:PutItem"
     );
-    const finalizeResolved = resolveHandlerEntry12(
+    const finalizeResolved = resolveHandlerEntry14(
       __dirname,
       "finalize.handler.js"
     );
-    this.finalize = new import_aws_lambda_nodejs13.NodejsFunction(this, "finalize-handler", {
+    this.finalize = new import_aws_lambda_nodejs15.NodejsFunction(this, "finalize-handler", {
       entry: finalizeResolved.entry,
-      runtime: import_aws_lambda13.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda15.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib17.Duration.minutes(1),
+      timeout: import_aws_cdk_lib19.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName,
         [OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
@@ -11602,13 +11887,13 @@ var OwningDeleteCascadeLambdas = class extends import_constructs22.Construct {
 };
 
 // src/workflows/control-plane/owning-delete-cascade/owning-delete-cascade-workflow.ts
-var import_aws_cdk_lib18 = require("aws-cdk-lib");
-var import_aws_events9 = require("aws-cdk-lib/aws-events");
-var import_aws_events_targets5 = require("aws-cdk-lib/aws-events-targets");
+var import_aws_cdk_lib20 = require("aws-cdk-lib");
+var import_aws_events11 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets6 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions = require("aws-cdk-lib/aws-stepfunctions");
 var import_aws_stepfunctions_tasks = require("aws-cdk-lib/aws-stepfunctions-tasks");
-var import_constructs23 = require("constructs");
-var OwningDeleteCascadeWorkflow = class extends import_constructs23.Construct {
+var import_constructs27 = require("constructs");
+var OwningDeleteCascadeWorkflow = class extends import_constructs27.Construct {
   constructor(scope, props) {
     super(scope, "owning-delete-cascade-workflow");
     this.lambdas = new OwningDeleteCascadeLambdas(this, {
@@ -11717,7 +12002,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs23.Construct {
       }
     });
     const interPageWait = new import_aws_stepfunctions.Wait(this, "inter-page-wait", {
-      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib18.Duration.seconds(0))
+      time: import_aws_stepfunctions.WaitTime.duration(import_aws_cdk_lib20.Duration.seconds(0))
     });
     const isExhausted = new import_aws_stepfunctions.Choice(this, "is-exhausted");
     const finalize = new import_aws_stepfunctions_tasks.LambdaInvoke(this, "finalize", {
@@ -11748,18 +12033,18 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs23.Construct {
       // Long timeout because real-world cascades can run minutes when
       // a workspace has thousands of members. The stuck-cascade alarm
       // fires at 15 minutes; the state machine itself does not abort.
-      timeout: import_aws_cdk_lib18.Duration.hours(2)
+      timeout: import_aws_cdk_lib20.Duration.hours(2)
     });
-    this.rule = new import_aws_events9.Rule(this, "rule", {
+    this.rule = new import_aws_events11.Rule(this, "rule", {
       eventBus: props.dataEventBus,
       eventPattern: {
-        source: [import_workflows5.OPENHI_DATA_SOURCE],
-        detailType: [import_workflows5.ControlPlaneOwningDeleteV1.detailType]
+        source: [import_workflows7.OPENHI_DATA_SOURCE],
+        detailType: [import_workflows7.ControlPlaneOwningDeleteV1.detailType]
       },
       targets: [
-        new import_aws_events_targets5.SfnStateMachine(this.stateMachine, {
+        new import_aws_events_targets6.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib18.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib20.Duration.hours(2)
         })
       ]
     });
@@ -11767,7 +12052,7 @@ var OwningDeleteCascadeWorkflow = class extends import_constructs23.Construct {
 };
 
 // src/workflows/control-plane/rename-cascade/events.ts
-var import_workflows6 = __toESM(require_lib2());
+var import_workflows8 = __toESM(require_lib2());
 var RENAME_CASCADE_CONSUMER_NAME = "rename-cascade";
 var RENAME_CASCADE_DEFAULT_CONCURRENCY = 10;
 var RENAME_CASCADE_FAILED_THRESHOLD = 0;
@@ -11775,47 +12060,47 @@ var RENAME_CASCADE_SLOW_THRESHOLD_SECONDS = 300;
 var RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR = "RENAME_CASCADE_OPS_EVENT_BUS_NAME";
 
 // src/workflows/control-plane/rename-cascade/rename-cascade-lambdas.ts
-var import_node_fs13 = __toESM(require("fs"));
-var import_node_path13 = __toESM(require("path"));
-var import_aws_cdk_lib19 = require("aws-cdk-lib");
+var import_node_fs15 = __toESM(require("fs"));
+var import_node_path15 = __toESM(require("path"));
+var import_aws_cdk_lib21 = require("aws-cdk-lib");
 var import_aws_iam9 = require("aws-cdk-lib/aws-iam");
-var import_aws_lambda14 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs14 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs24 = require("constructs");
-function resolveHandlerEntry13(dirname, handlerName) {
-  const sameDir = import_node_path13.default.join(dirname, handlerName);
-  if (import_node_fs13.default.existsSync(sameDir)) {
+var import_aws_lambda16 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs16 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs28 = require("constructs");
+function resolveHandlerEntry15(dirname, handlerName) {
+  const sameDir = import_node_path15.default.join(dirname, handlerName);
+  if (import_node_fs15.default.existsSync(sameDir)) {
     return { entry: sameDir, handler: "handler" };
   }
-  const libDir = import_node_path13.default.join(dirname, "..", "..", "..", "..", "lib", handlerName);
+  const libDir = import_node_path15.default.join(dirname, "..", "..", "..", "..", "lib", handlerName);
   return { entry: libDir, handler: "handler" };
 }
-var RenameCascadeLambdas = class extends import_constructs24.Construct {
+var RenameCascadeLambdas = class extends import_constructs28.Construct {
   constructor(scope, props) {
     super(scope, "rename-cascade-lambdas");
-    const listResolved = resolveHandlerEntry13(
+    const listResolved = resolveHandlerEntry15(
       __dirname,
       "rename-list-targets.handler.js"
     );
-    this.listTargets = new import_aws_lambda_nodejs14.NodejsFunction(this, "list-targets-handler", {
+    this.listTargets = new import_aws_lambda_nodejs16.NodejsFunction(this, "list-targets-handler", {
       entry: listResolved.entry,
-      runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda16.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib19.Duration.minutes(1),
+      timeout: import_aws_cdk_lib21.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
     });
     props.dataStoreTable.grant(this.listTargets, "dynamodb:Query");
-    const rewriteResolved = resolveHandlerEntry13(
+    const rewriteResolved = resolveHandlerEntry15(
       __dirname,
       "rename-rewrite-chunk.handler.js"
     );
-    this.rewriteChunk = new import_aws_lambda_nodejs14.NodejsFunction(this, "rewrite-chunk-handler", {
+    this.rewriteChunk = new import_aws_lambda_nodejs16.NodejsFunction(this, "rewrite-chunk-handler", {
       entry: rewriteResolved.entry,
-      runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda16.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib19.Duration.minutes(1),
+      timeout: import_aws_cdk_lib21.Duration.minutes(1),
       environment: {
         DYNAMO_TABLE_NAME: props.dataStoreTable.tableName
       }
@@ -11826,15 +12111,15 @@ var RenameCascadeLambdas = class extends import_constructs24.Construct {
       "dynamodb:PutItem",
       "dynamodb:UpdateItem"
     );
-    const finalizeResolved = resolveHandlerEntry13(
+    const finalizeResolved = resolveHandlerEntry15(
       __dirname,
       "rename-finalize.handler.js"
     );
-    this.finalize = new import_aws_lambda_nodejs14.NodejsFunction(this, "finalize-handler", {
+    this.finalize = new import_aws_lambda_nodejs16.NodejsFunction(this, "finalize-handler", {
       entry: finalizeResolved.entry,
-      runtime: import_aws_lambda14.Runtime.NODEJS_LATEST,
+      runtime: import_aws_lambda16.Runtime.NODEJS_LATEST,
       memorySize: 512,
-      timeout: import_aws_cdk_lib19.Duration.minutes(1),
+      timeout: import_aws_cdk_lib21.Duration.minutes(1),
       environment: {
         [RENAME_CASCADE_OPS_EVENT_BUS_ENV_VAR]: props.opsEventBus.eventBusName
       }
@@ -11850,13 +12135,13 @@ var RenameCascadeLambdas = class extends import_constructs24.Construct {
 };
 
 // src/workflows/control-plane/rename-cascade/rename-cascade-workflow.ts
-var import_aws_cdk_lib20 = require("aws-cdk-lib");
-var import_aws_events10 = require("aws-cdk-lib/aws-events");
-var import_aws_events_targets6 = require("aws-cdk-lib/aws-events-targets");
+var import_aws_cdk_lib22 = require("aws-cdk-lib");
+var import_aws_events12 = require("aws-cdk-lib/aws-events");
+var import_aws_events_targets7 = require("aws-cdk-lib/aws-events-targets");
 var import_aws_stepfunctions2 = require("aws-cdk-lib/aws-stepfunctions");
 var import_aws_stepfunctions_tasks2 = require("aws-cdk-lib/aws-stepfunctions-tasks");
-var import_constructs25 = require("constructs");
-var RenameCascadeWorkflow = class extends import_constructs25.Construct {
+var import_constructs29 = require("constructs");
+var RenameCascadeWorkflow = class extends import_constructs29.Construct {
   constructor(scope, props) {
     super(scope, "rename-cascade-workflow");
     this.lambdas = new RenameCascadeLambdas(this, {
@@ -12000,18 +12285,18 @@ var RenameCascadeWorkflow = class extends import_constructs25.Construct {
       // Long timeout — large renames may rewrite thousands of rows;
       // the `CascadeSlow` alarm fires at 300s p99 but the state
       // machine itself does not abort.
-      timeout: import_aws_cdk_lib20.Duration.hours(2)
+      timeout: import_aws_cdk_lib22.Duration.hours(2)
     });
-    this.rule = new import_aws_events10.Rule(this, "rule", {
+    this.rule = new import_aws_events12.Rule(this, "rule", {
       eventBus: props.dataEventBus,
       eventPattern: {
-        source: [import_workflows6.OPENHI_DATA_SOURCE],
-        detailType: [import_workflows6.ControlPlaneRenameV1.detailType]
+        source: [import_workflows8.OPENHI_DATA_SOURCE],
+        detailType: [import_workflows8.ControlPlaneRenameV1.detailType]
       },
       targets: [
-        new import_aws_events_targets6.SfnStateMachine(this.stateMachine, {
+        new import_aws_events_targets7.SfnStateMachine(this.stateMachine, {
           retryAttempts: 2,
-          maxEventAge: import_aws_cdk_lib20.Duration.hours(2)
+          maxEventAge: import_aws_cdk_lib22.Duration.hours(2)
         })
       ]
     });
@@ -12032,6 +12317,8 @@ var RenameCascadeWorkflow = class extends import_constructs25.Construct {
   CLOUDFORMATION_STACK_STATUS_CHANGE_DETAIL_TYPE,
   CONDITION_CLINICAL_STATUS_SYSTEM,
   CONTROL_EVENT_BUS_NAME_ENV_VAR,
+  COUNTER_MAINTENANCE_CONSUMER_NAME,
+  COUNTER_MAINTENANCE_DETAIL_TYPES,
   COVERAGE_PAYOR_TYPE_SYSTEM,
   COVERAGE_QMB_STATUS_EXTENSION_URL,
   COVERAGE_VERIFICATION_DATE_EXTENSION_URL,
@@ -12043,12 +12330,22 @@ var RenameCascadeWorkflow = class extends import_constructs25.Construct {
   CognitoUserPoolDomain,
   CognitoUserPoolKmsKey,
   ControlEventBus,
+  ControlPlaneMembershipCreatedV1,
+  ControlPlaneMembershipDeletedV1,
   ControlPlaneOwningDeleteCompleteV1,
   ControlPlaneOwningDeleteFailedV1,
   ControlPlaneOwningDeleteV1,
   ControlPlaneRenameCompleteV1,
   ControlPlaneRenameFailedV1,
   ControlPlaneRenameV1,
+  ControlPlaneRoleAssignmentCreatedV1,
+  ControlPlaneRoleAssignmentDeletedV1,
+  ControlPlaneWorkspaceCreatedV1,
+  ControlPlaneWorkspaceDeletedV1,
+  CounterMaintenanceLambda,
+  CounterMaintenanceWorkflow,
+  CounterReconciliationLambda,
+  CounterReconciliationWorkflow,
   DATA_STORE_CHANGE_DETAIL_MAX_UTF8_BYTES,
   DATA_STORE_CHANGE_DETAIL_TYPE,
   DEFAULT_PREVIEW_EXPIRATION_DAYS,