@openhi/constructs 0.0.69 → 0.0.71

package/lib/firehose-archive-transform.handler.d.mts

@@ -0,0 +1,42 @@
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+import { FirehoseTransformationEvent, FirehoseTransformationResult } from 'aws-lambda';
+
+interface DynamoDbStreamKinesisRecord {
+    eventName?: string;
+    userIdentity?: unknown;
+    dynamodb?: {
+        Keys?: Record<string, AttributeValue>;
+        NewImage?: Record<string, AttributeValue>;
+        OldImage?: Record<string, AttributeValue>;
+    };
+}
+/**
+ * Returns true when this stream/Kinesis record should not be archived because it
+ * represents a **replica-side application** of a global-table change (the logical
+ * write originated in another Region).
+ *
+ * - If `aws:rep:updateregion` is present on the item image and differs from
+ *   `archiveLambdaRegion`, the change was replicated into this Region (archive
+ *   only in the Region that matches `aws:rep:updateregion`).
+ * - Otherwise, if `userIdentity` matches the DynamoDB replication service SLR,
+ *   treat as replication. **Excluded:** TTL deletes (`type` Service and
+ *   `principalId` `dynamodb.amazonaws.com`) per AWS stream Identity docs.
+ *
+ * For MREC global tables version 2019.11.21, AWS documents that stream records
+ * may not carry distinguishable metadata; the recommended approach is a custom
+ * “write region” attribute on items. If neither that attribute nor
+ * `aws:rep:updateregion` nor replication `userIdentity` applies, this function
+ * returns false (no drop)—duplicate archives are possible if identical pipelines
+ * run in every Region without those signals.
+ */
+declare function shouldDropAsGlobalTableReplicationRecord(record: DynamoDbStreamKinesisRecord, archiveLambdaRegion: string): boolean;
+declare function parseCurrentResourceKeys(record: DynamoDbStreamKinesisRecord): {
+    tenantId: string;
+    workspaceId: string;
+    resourceType: string;
+    resourceId: string;
+    version: string;
+} | null;
+declare function handler(event: FirehoseTransformationEvent): Promise<FirehoseTransformationResult>;
+
+export { type DynamoDbStreamKinesisRecord, handler, parseCurrentResourceKeys, shouldDropAsGlobalTableReplicationRecord };

package/lib/firehose-archive-transform.handler.d.ts

@@ -0,0 +1,42 @@
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+import { FirehoseTransformationEvent, FirehoseTransformationResult } from 'aws-lambda';
+
+interface DynamoDbStreamKinesisRecord {
+    eventName?: string;
+    userIdentity?: unknown;
+    dynamodb?: {
+        Keys?: Record<string, AttributeValue>;
+        NewImage?: Record<string, AttributeValue>;
+        OldImage?: Record<string, AttributeValue>;
+    };
+}
+/**
+ * Returns true when this stream/Kinesis record should not be archived because it
+ * represents a **replica-side application** of a global-table change (the logical
+ * write originated in another Region).
+ *
+ * - If `aws:rep:updateregion` is present on the item image and differs from
+ *   `archiveLambdaRegion`, the change was replicated into this Region (archive
+ *   only in the Region that matches `aws:rep:updateregion`).
+ * - Otherwise, if `userIdentity` matches the DynamoDB replication service SLR,
+ *   treat as replication. **Excluded:** TTL deletes (`type` Service and
+ *   `principalId` `dynamodb.amazonaws.com`) per AWS stream Identity docs.
+ *
+ * For MREC global tables version 2019.11.21, AWS documents that stream records
+ * may not carry distinguishable metadata; the recommended approach is a custom
+ * “write region” attribute on items. If neither that attribute nor
+ * `aws:rep:updateregion` nor replication `userIdentity` applies, this function
+ * returns false (no drop)—duplicate archives are possible if identical pipelines
+ * run in every Region without those signals.
+ */
+declare function shouldDropAsGlobalTableReplicationRecord(record: DynamoDbStreamKinesisRecord, archiveLambdaRegion: string): boolean;
+declare function parseCurrentResourceKeys(record: DynamoDbStreamKinesisRecord): {
+    tenantId: string;
+    workspaceId: string;
+    resourceType: string;
+    resourceId: string;
+    version: string;
+} | null;
+declare function handler(event: FirehoseTransformationEvent): Promise<FirehoseTransformationResult>;
+
+export { type DynamoDbStreamKinesisRecord, handler, parseCurrentResourceKeys, shouldDropAsGlobalTableReplicationRecord };

package/lib/firehose-archive-transform.handler.js

@@ -0,0 +1,222 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/components/dynamodb/firehose-archive-transform.handler.ts
+var firehose_archive_transform_handler_exports = {};
+__export(firehose_archive_transform_handler_exports, {
+  handler: () => handler,
+  parseCurrentResourceKeys: () => parseCurrentResourceKeys,
+  shouldDropAsGlobalTableReplicationRecord: () => shouldDropAsGlobalTableReplicationRecord
+});
+module.exports = __toCommonJS(firehose_archive_transform_handler_exports);
+function dynamodbValueToJs(av) {
+  if (av.S !== void 0) {
+    return av.S;
+  }
+  if (av.N !== void 0) {
+    return av.N.includes(".") ? Number.parseFloat(av.N) : Number.parseInt(av.N, 10);
+  }
+  if (av.BOOL !== void 0) {
+    return av.BOOL;
+  }
+  if (av.NULL !== void 0) {
+    return null;
+  }
+  if (av.M !== void 0) {
+    return dynamodbImageToPlain(av.M);
+  }
+  if (av.L !== void 0) {
+    return av.L.map((x) => dynamodbValueToJs(x));
+  }
+  if (av.SS !== void 0) {
+    return av.SS;
+  }
+  if (av.NS !== void 0) {
+    return av.NS.map(
+      (n) => n.includes(".") ? Number.parseFloat(n) : Number.parseInt(n, 10)
+    );
+  }
+  return void 0;
+}
+function dynamodbImageToPlain(image) {
+  const out = {};
+  for (const [k, v] of Object.entries(image)) {
+    out[k] = dynamodbValueToJs(v);
+  }
+  return out;
+}
+var CURRENT_SK = "CURRENT";
+var PK_PATTERN = /^TID#(?<tenantId>[^#]+)#WID#(?<workspaceId>[^#]+)#RT#(?<resourceType>[^#]+)#ID#(?<resourceId>.+)$/;
+var AWS_REP_UPDATE_REGION = "aws:rep:updateregion";
+function getDynamoDbStringAttr(image, name) {
+  if (!image) {
+    return void 0;
+  }
+  const av = image[name];
+  if (typeof av?.S === "string" && av.S.trim() !== "") {
+    return av.S.trim();
+  }
+  return void 0;
+}
+function primaryImageForReplicationCheck(record) {
+  if (record.eventName === "REMOVE") {
+    return record.dynamodb?.OldImage;
+  }
+  return record.dynamodb?.NewImage;
+}
+function shouldDropAsGlobalTableReplicationRecord(record, archiveLambdaRegion) {
+  const image = primaryImageForReplicationCheck(record);
+  const updateRegion = getDynamoDbStringAttr(image, AWS_REP_UPDATE_REGION);
+  if (updateRegion && archiveLambdaRegion && updateRegion !== archiveLambdaRegion) {
+    return true;
+  }
+  return isDynamoDbReplicationUserIdentity(record.userIdentity);
+}
+function isDynamoDbReplicationUserIdentity(userIdentity) {
+  if (!userIdentity || typeof userIdentity !== "object") {
+    return false;
+  }
+  const ui = userIdentity;
+  const principalRaw = ui.principalId ?? ui.PrincipalId;
+  const typeRaw = ui.type ?? ui.Type;
+  const principal = typeof principalRaw === "string" ? principalRaw.toLowerCase() : "";
+  const type = typeof typeRaw === "string" ? typeRaw.toLowerCase() : "";
+  if (type === "service" && principal === "dynamodb.amazonaws.com") {
+    return false;
+  }
+  const replicationMarkers = [
+    "awsservicerolefordynamodbreplication",
+    "replication.dynamodb.amazonaws.com"
+  ];
+  return replicationMarkers.some((m) => principal.includes(m));
+}
+function parseCurrentResourceKeys(record) {
+  const keys = record.dynamodb?.Keys;
+  if (!keys) {
+    return null;
+  }
+  const pkAttr = keys.PK?.S;
+  const skAttr = keys.SK?.S;
+  if (!pkAttr || skAttr !== CURRENT_SK) {
+    return null;
+  }
+  const m = PK_PATTERN.exec(pkAttr);
+  if (!m?.groups) {
+    return null;
+  }
+  const { tenantId, workspaceId, resourceType, resourceId } = m.groups;
+  const image = record.eventName === "REMOVE" ? record.dynamodb?.OldImage : record.dynamodb?.NewImage;
+  if (!image) {
+    return null;
+  }
+  const plain = dynamodbImageToPlain(image);
+  const version = typeof plain.vid === "string" ? plain.vid : null;
+  if (!version) {
+    return null;
+  }
+  return { tenantId, workspaceId, resourceType, resourceId, version };
+}
+function partitionToken(value) {
+  if (!value || value.trim() === "") {
+    return "-";
+  }
+  return value.replace(/[/\\]/g, "_");
+}
+function buildArchivePayload(record, keys) {
+  const newImage = record.dynamodb?.NewImage;
+  const oldImage = record.dynamodb?.OldImage;
+  const resourceImage = record.eventName === "REMOVE" ? oldImage : newImage;
+  const resourcePlain = resourceImage ? dynamodbImageToPlain(resourceImage) : {};
+  if (typeof resourcePlain.resource === "string") {
+    try {
+      resourcePlain.resource = JSON.parse(resourcePlain.resource);
+    } catch {
+    }
+  }
+  return {
+    eventName: record.eventName,
+    archivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: keys.tenantId,
+    workspaceId: keys.workspaceId,
+    resourceType: keys.resourceType,
+    resourceId: keys.resourceId,
+    version: keys.version,
+    resource: resourcePlain
+  };
+}
+function handler(event) {
+  const records = [];
+  const archiveLambdaRegion = process.env.AWS_REGION ?? "";
+  for (const rec of event.records) {
+    try {
+      const payload = Buffer.from(rec.data, "base64").toString("utf8");
+      const change = JSON.parse(payload);
+      if (shouldDropAsGlobalTableReplicationRecord(change, archiveLambdaRegion)) {
+        records.push({
+          recordId: rec.recordId,
+          result: "Dropped",
+          data: rec.data
+        });
+        continue;
+      }
+      const keys = parseCurrentResourceKeys(change);
+      if (!keys) {
+        records.push({
+          recordId: rec.recordId,
+          result: "Dropped",
+          data: rec.data
+        });
+        continue;
+      }
+      const archive = buildArchivePayload(change, keys);
+      const out = Buffer.from(`${JSON.stringify(archive)}
+`).toString(
+        "base64"
+      );
+      records.push({
+        recordId: rec.recordId,
+        result: "Ok",
+        data: out,
+        metadata: {
+          partitionKeys: {
+            tenantId: partitionToken(keys.tenantId),
+            workspaceId: partitionToken(keys.workspaceId),
+            resourceType: partitionToken(keys.resourceType),
+            resourceId: partitionToken(keys.resourceId),
+            version: partitionToken(keys.version)
+          }
+        }
+      });
+    } catch {
+      records.push({
+        recordId: rec.recordId,
+        result: "ProcessingFailed",
+        data: rec.data
+      });
+    }
+  }
+  return Promise.resolve({ records });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler,
+  parseCurrentResourceKeys,
+  shouldDropAsGlobalTableReplicationRecord
+});
+//# sourceMappingURL=firehose-archive-transform.handler.js.map

package/lib/firehose-archive-transform.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/dynamodb/firehose-archive-transform.handler.ts"],"sourcesContent":["import type { AttributeValue } from \"@aws-sdk/client-dynamodb\";\nimport type {\n  FirehoseTransformationEvent,\n  FirehoseTransformationResult,\n  FirehoseTransformationResultRecord,\n} from \"aws-lambda\";\n\nfunction dynamodbValueToJs(av: AttributeValue): unknown {\n  if (av.S !== undefined) {\n    return av.S;\n  }\n  if (av.N !== undefined) {\n    return av.N.includes(\".\")\n      ? Number.parseFloat(av.N)\n      : Number.parseInt(av.N, 10);\n  }\n  if (av.BOOL !== undefined) {\n    return av.BOOL;\n  }\n  if (av.NULL !== undefined) {\n    return null;\n  }\n  if (av.M !== undefined) {\n    return dynamodbImageToPlain(av.M);\n  }\n  if (av.L !== undefined) {\n    return av.L.map((x) => dynamodbValueToJs(x));\n  }\n  if (av.SS !== undefined) {\n    return av.SS;\n  }\n  if (av.NS !== undefined) {\n    return av.NS.map((n) =>\n      n.includes(\".\") ? Number.parseFloat(n) : Number.parseInt(n, 10),\n    );\n  }\n  return undefined;\n}\n\nfunction dynamodbImageToPlain(\n  image: Record<string, AttributeValue>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(image)) {\n    out[k] = dynamodbValueToJs(v);\n  }\n  return out;\n}\n\n/**\n * Firehose data-transformation handler: filters DynamoDB change records to\n * current FHIR resource items (SK = CURRENT, TID#…#WID#…#RT#…#ID#… PK),\n * writes archive JSON to S3 via Firehose, and sets dynamic partition keys\n * tenantId/workspaceId/resourceType/resourceId/version per ADR 2026-03-11-02.\n */\n\nconst CURRENT_SK = \"CURRENT\";\nconst PK_PATTERN =\n  /^TID#(?<tenantId>[^#]+)#WID#(?<workspaceId>[^#]+)#RT#(?<resourceType>[^#]+)#ID#(?<resourceId>.+)$/;\n\nexport interface DynamoDbStreamKinesisRecord {\n  eventName?: string;\n  userIdentity?: unknown;\n  dynamodb?: {\n    Keys?: Record<string, AttributeValue>;\n    NewImage?: Record<string, AttributeValue>;\n    OldImage?: Record<string, AttributeValue>;\n  };\n}\n\n/** DynamoDB-managed attribute on global table items (see AWS Global Tables legacy / replication docs). */\nconst AWS_REP_UPDATE_REGION = \"aws:rep:updateregion\";\n\nfunction getDynamoDbStringAttr(\n  image: Record<string, AttributeValue> | undefined,\n  name: string,\n): string | undefined {\n  if (!image) {\n    return undefined;\n  }\n  const av = image[name];\n  if (typeof av?.S === \"string\" && av.S.trim() !== \"\") {\n    return av.S.trim();\n  }\n  return undefined;\n}\n\nfunction primaryImageForReplicationCheck(\n  record: DynamoDbStreamKinesisRecord,\n): Record<string, AttributeValue> | undefined {\n  if (record.eventName === \"REMOVE\") {\n    return record.dynamodb?.OldImage;\n  }\n  return record.dynamodb?.NewImage;\n}\n\n/**\n * Returns true when this stream/Kinesis record should not be archived because it\n * represents a **replica-side application** of a global-table change (the logical\n * write originated in another Region).\n *\n * - If `aws:rep:updateregion` is present on the item image and differs from\n *   `archiveLambdaRegion`, the change was replicated into this Region (archive\n *   only in the Region that matches `aws:rep:updateregion`).\n * - Otherwise, if `userIdentity` matches the DynamoDB replication service SLR,\n *   treat as replication. **Excluded:** TTL deletes (`type` Service and\n *   `principalId` `dynamodb.amazonaws.com`) per AWS stream Identity docs.\n *\n * For MREC global tables version 2019.11.21, AWS documents that stream records\n * may not carry distinguishable metadata; the recommended approach is a custom\n * “write region” attribute on items. If neither that attribute nor\n * `aws:rep:updateregion` nor replication `userIdentity` applies, this function\n * returns false (no drop)—duplicate archives are possible if identical pipelines\n * run in every Region without those signals.\n */\nexport function shouldDropAsGlobalTableReplicationRecord(\n  record: DynamoDbStreamKinesisRecord,\n  archiveLambdaRegion: string,\n): boolean {\n  const image = primaryImageForReplicationCheck(record);\n  const updateRegion = getDynamoDbStringAttr(image, AWS_REP_UPDATE_REGION);\n  if (\n    updateRegion &&\n    archiveLambdaRegion &&\n    updateRegion !== archiveLambdaRegion\n  ) {\n    return true;\n  }\n\n  return isDynamoDbReplicationUserIdentity(record.userIdentity);\n}\n\nfunction isDynamoDbReplicationUserIdentity(userIdentity: unknown): boolean {\n  if (!userIdentity || typeof userIdentity !== \"object\") {\n    return false;\n  }\n  const ui = userIdentity as Record<string, unknown>;\n  const principalRaw = ui.principalId ?? ui.PrincipalId;\n  const typeRaw = ui.type ?? ui.Type;\n  const principal =\n    typeof principalRaw === \"string\" ? principalRaw.toLowerCase() : \"\";\n  const type = typeof typeRaw === \"string\" ? typeRaw.toLowerCase() : \"\";\n\n  if (type === \"service\" && principal === \"dynamodb.amazonaws.com\") {\n    return false;\n  }\n\n  const replicationMarkers = [\n    \"awsservicerolefordynamodbreplication\",\n    \"replication.dynamodb.amazonaws.com\",\n  ];\n  return replicationMarkers.some((m) => principal.includes(m));\n}\n\nexport function parseCurrentResourceKeys(record: DynamoDbStreamKinesisRecord): {\n  tenantId: string;\n  workspaceId: string;\n  resourceType: string;\n  resourceId: string;\n  version: string;\n} | null {\n  const keys = record.dynamodb?.Keys;\n  if (!keys) {\n    return null;\n  }\n  const pkAttr = keys.PK?.S;\n  const skAttr = keys.SK?.S;\n  if (!pkAttr || skAttr !== CURRENT_SK) {\n    return null;\n  }\n  const m = PK_PATTERN.exec(pkAttr);\n  if (!m?.groups) {\n    return null;\n  }\n  const { tenantId, workspaceId, resourceType, resourceId } = m.groups;\n  const image =\n    record.eventName === \"REMOVE\"\n      ? record.dynamodb?.OldImage\n      : record.dynamodb?.NewImage;\n  if (!image) {\n    return null;\n  }\n  const plain = dynamodbImageToPlain(image as Record<string, AttributeValue>);\n  const version = typeof plain.vid === \"string\" ? plain.vid : null;\n  if (!version) {\n    return null;\n  }\n  return { tenantId, workspaceId, resourceType, resourceId, version };\n}\n\nfunction partitionToken(value: string): string {\n  if (!value || value.trim() === \"\") {\n    return \"-\";\n  }\n  return value.replace(/[/\\\\]/g, \"_\");\n}\n\nfunction buildArchivePayload(\n  record: DynamoDbStreamKinesisRecord,\n  keys: ReturnType<typeof parseCurrentResourceKeys>,\n): Record<string, unknown> {\n  const newImage = record.dynamodb?.NewImage;\n  const oldImage = record.dynamodb?.OldImage;\n  const resourceImage = record.eventName === \"REMOVE\" ? oldImage : newImage;\n  const resourcePlain = resourceImage\n    ? dynamodbImageToPlain(resourceImage as Record<string, AttributeValue>)\n    : {};\n\n  if (typeof resourcePlain.resource === \"string\") {\n    try {\n      resourcePlain.resource = JSON.parse(resourcePlain.resource) as unknown;\n    } catch {\n      /* keep raw string if not valid JSON */\n    }\n  }\n\n  return {\n    eventName: record.eventName,\n    archivedAt: new Date().toISOString(),\n    tenantId: keys!.tenantId,\n    workspaceId: keys!.workspaceId,\n    resourceType: keys!.resourceType,\n    resourceId: keys!.resourceId,\n    version: keys!.version,\n    resource: resourcePlain,\n  };\n}\n\nexport function handler(\n  event: FirehoseTransformationEvent,\n): Promise<FirehoseTransformationResult> {\n  const records: FirehoseTransformationResultRecord[] = [];\n  const archiveLambdaRegion = process.env.AWS_REGION ?? \"\";\n\n  for (const rec of event.records) {\n    try {\n      const payload = Buffer.from(rec.data, \"base64\").toString(\"utf8\");\n      const change = JSON.parse(payload) as DynamoDbStreamKinesisRecord;\n\n      if (\n        shouldDropAsGlobalTableReplicationRecord(change, archiveLambdaRegion)\n      ) {\n        records.push({\n          recordId: rec.recordId,\n          result: \"Dropped\",\n          data: rec.data,\n        });\n        continue;\n      }\n\n      const keys = parseCurrentResourceKeys(change);\n\n      if (!keys) {\n        records.push({\n          recordId: rec.recordId,\n          result: \"Dropped\",\n          data: rec.data,\n        });\n        continue;\n      }\n\n      const archive = buildArchivePayload(change, keys);\n      const out = Buffer.from(`${JSON.stringify(archive)}\\n`).toString(\n        \"base64\",\n      );\n\n      records.push({\n        recordId: rec.recordId,\n        result: \"Ok\",\n        data: out,\n        metadata: {\n          partitionKeys: {\n            tenantId: partitionToken(keys.tenantId),\n            workspaceId: partitionToken(keys.workspaceId),\n            resourceType: partitionToken(keys.resourceType),\n            resourceId: partitionToken(keys.resourceId),\n            version: partitionToken(keys.version),\n          },\n        },\n      });\n    } catch {\n      records.push({\n        recordId: rec.recordId,\n        result: \"ProcessingFailed\",\n        data: rec.data,\n      });\n    }\n  }\n\n  return Promise.resolve({ records });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,SAAS,kBAAkB,IAA6B;AACtD,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG,EAAE,SAAS,GAAG,IACpB,OAAO,WAAW,GAAG,CAAC,IACtB,OAAO,SAAS,GAAG,GAAG,EAAE;AAAA,EAC9B;AACA,MAAI,GAAG,SAAS,QAAW;AACzB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,SAAS,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,qBAAqB,GAAG,CAAC;AAAA,EAClC;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG,EAAE,IAAI,CAAC,MAAM,kBAAkB,CAAC,CAAC;AAAA,EAC7C;AACA,MAAI,GAAG,OAAO,QAAW;AACvB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,OAAO,QAAW;AACvB,WAAO,GAAG,GAAG;AAAA,MAAI,CAAC,MAChB,EAAE,SAAS,GAAG,IAAI,OAAO,WAAW,CAAC,IAAI,OAAO,SAAS,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,CAAC,IAAI,kBAAkB,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AASA,IAAM,aAAa;AACnB,IAAM,aACJ;AAaF,IAAM,wBAAwB;AAE9B,SAAS,sBACP,OACA,MACoB;AACpB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,KAAK,MAAM,IAAI;AACrB,MAAI,OAAO,IAAI,MAAM,YAAY,GAAG,EAAE,KAAK,MAAM,IAAI;AACnD,WAAO,GAAG,EAAE,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,gCACP,QAC4C;AAC5C,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,OAAO,UAAU;AAAA,EAC1B;AACA,SAAO,OAAO,UAAU;AAC1B;AAqBO,SAAS,yCACd,QACA,qBACS;AACT,QAAM,QAAQ,gCAAgC,MAAM;AACpD,QAAM,eAAe,sBAAsB,OAAO,qBAAqB;AACvE,MACE,gBACA,uBACA,iBAAiB,qBACjB;AACA,WAAO;AAAA,EACT;AAEA,SAAO,kCAAkC,OAAO,YAAY;AAC9D;AAEA,SAAS,kCAAkC,cAAgC;AACzE,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;AACrD,WAAO;AAAA,EACT;AACA,QAAM,KAAK;AACX,QAAM,eAAe,GAAG,eAAe,GAAG;AAC1C,QAAM,UAAU,GAAG,QAAQ,GAAG;AAC9B,QAAM,YACJ,OAAO,iBAAiB,WAAW,aAAa,YAAY,IAAI;AAClE,QAAM,OAAO,OAAO,YAAY,WAAW,QAAQ,YAAY,IAAI;AAEnE,MAAI,SAAS,aAAa,cAAc,0BAA0B;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACA,SAAO,mBAAmB,KAAK,CAAC,MAAM,UAAU,SAAS,CAAC,CAAC;AAC7D;AAEO,SAAS,yBAAyB,QAMhC;AACP,QAAM,OAAO,OAAO,UAAU;AAC9B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,IAAI;AACxB,QAAM,SAAS,KAAK,IAAI;AACxB,MAAI,CAAC,UAAU,WAAW,YAAY;AACpC,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,KAAK,MAAM;AAChC,MAAI,CAAC,GAAG,QAAQ;AACd,WAAO;AAAA,EACT;AACA,QAAM,EAAE,UAAU,aAAa,cAAc,WAAW,IAAI,EAAE;AAC9D,QAAM,QACJ,OAAO,cAAc,WACjB,OAAO,UAAU,WACjB,OAAO,UAAU;AACvB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,qBAAqB,KAAuC;AAC1E,QAAM,UAAU,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAC5D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,aAAa,cAAc,YAAY,QAAQ;AACpE;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,UAAU,GAAG;AACpC;AAEA,SAAS,oBACP,QACA,MACyB;AACzB,QAAM,WAAW,OAAO,UAAU;AAClC,QAAM,WAAW,OAAO,UAAU;AAClC,QAAM,gBAAgB,OAAO,cAAc,WAAW,WAAW;AACjE,QAAM,gBAAgB,gBAClB,qBAAqB,aAA+C,IACpE,CAAC;AAEL,MAAI,OAAO,cAAc,aAAa,UAAU;AAC9C,QAAI;AACF,oBAAc,WAAW,KAAK,MAAM,cAAc,QAAQ;AAAA,IAC5D,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,UAAU,KAAM;AAAA,IAChB,aAAa,KAAM;AAAA,IACnB,cAAc,KAAM;AAAA,IACpB,YAAY,KAAM;AAAA,IAClB,SAAS,KAAM;AAAA,IACf,UAAU;AAAA,EACZ;AACF;AAEO,SAAS,QACd,OACuC;AACvC,QAAM,UAAgD,CAAC;AACvD,QAAM,sBAAsB,QAAQ,IAAI,cAAc;AAEtD,aAAW,OAAO,MAAM,SAAS;AAC/B,QAAI;AACF,YAAM,UAAU,OAAO,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM;AAC/D,YAAM,SAAS,KAAK,MAAM,OAAO;AAEjC,UACE,yCAAyC,QAAQ,mBAAmB,GACpE;AACA,gBAAQ,KAAK;AAAA,UACX,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,UACR,MAAM,IAAI;AAAA,QACZ,CAAC;AACD;AAAA,MACF;AAEA,YAAM,OAAO,yBAAyB,MAAM;AAE5C,UAAI,CAAC,MAAM;AACT,gBAAQ,KAAK;AAAA,UACX,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,UACR,MAAM,IAAI;AAAA,QACZ,CAAC;AACD;AAAA,MACF;AAEA,YAAM,UAAU,oBAAoB,QAAQ,IAAI;AAChD,YAAM,MAAM,OAAO,KAAK,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,CAAI,EAAE;AAAA,QACtD;AAAA,MACF;AAEA,cAAQ,KAAK;AAAA,QACX,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,UAAU;AAAA,UACR,eAAe;AAAA,YACb,UAAU,eAAe,KAAK,QAAQ;AAAA,YACtC,aAAa,eAAe,KAAK,WAAW;AAAA,YAC5C,cAAc,eAAe,KAAK,YAAY;AAAA,YAC9C,YAAY,eAAe,KAAK,UAAU;AAAA,YAC1C,SAAS,eAAe,KAAK,OAAO;AAAA,UACtC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,cAAQ,KAAK;AAAA,QACX,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,QACR,MAAM,IAAI;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC;AACpC;","names":[]}

package/lib/firehose-archive-transform.handler.mjs

@@ -0,0 +1,197 @@
+import "./chunk-LZOMFHX3.mjs";
+
+// src/components/dynamodb/firehose-archive-transform.handler.ts
+function dynamodbValueToJs(av) {
+  if (av.S !== void 0) {
+    return av.S;
+  }
+  if (av.N !== void 0) {
+    return av.N.includes(".") ? Number.parseFloat(av.N) : Number.parseInt(av.N, 10);
+  }
+  if (av.BOOL !== void 0) {
+    return av.BOOL;
+  }
+  if (av.NULL !== void 0) {
+    return null;
+  }
+  if (av.M !== void 0) {
+    return dynamodbImageToPlain(av.M);
+  }
+  if (av.L !== void 0) {
+    return av.L.map((x) => dynamodbValueToJs(x));
+  }
+  if (av.SS !== void 0) {
+    return av.SS;
+  }
+  if (av.NS !== void 0) {
+    return av.NS.map(
+      (n) => n.includes(".") ? Number.parseFloat(n) : Number.parseInt(n, 10)
+    );
+  }
+  return void 0;
+}
+function dynamodbImageToPlain(image) {
+  const out = {};
+  for (const [k, v] of Object.entries(image)) {
+    out[k] = dynamodbValueToJs(v);
+  }
+  return out;
+}
+var CURRENT_SK = "CURRENT";
+var PK_PATTERN = /^TID#(?<tenantId>[^#]+)#WID#(?<workspaceId>[^#]+)#RT#(?<resourceType>[^#]+)#ID#(?<resourceId>.+)$/;
+var AWS_REP_UPDATE_REGION = "aws:rep:updateregion";
+function getDynamoDbStringAttr(image, name) {
+  if (!image) {
+    return void 0;
+  }
+  const av = image[name];
+  if (typeof av?.S === "string" && av.S.trim() !== "") {
+    return av.S.trim();
+  }
+  return void 0;
+}
+function primaryImageForReplicationCheck(record) {
+  if (record.eventName === "REMOVE") {
+    return record.dynamodb?.OldImage;
+  }
+  return record.dynamodb?.NewImage;
+}
+function shouldDropAsGlobalTableReplicationRecord(record, archiveLambdaRegion) {
+  const image = primaryImageForReplicationCheck(record);
+  const updateRegion = getDynamoDbStringAttr(image, AWS_REP_UPDATE_REGION);
+  if (updateRegion && archiveLambdaRegion && updateRegion !== archiveLambdaRegion) {
+    return true;
+  }
+  return isDynamoDbReplicationUserIdentity(record.userIdentity);
+}
+function isDynamoDbReplicationUserIdentity(userIdentity) {
+  if (!userIdentity || typeof userIdentity !== "object") {
+    return false;
+  }
+  const ui = userIdentity;
+  const principalRaw = ui.principalId ?? ui.PrincipalId;
+  const typeRaw = ui.type ?? ui.Type;
+  const principal = typeof principalRaw === "string" ? principalRaw.toLowerCase() : "";
+  const type = typeof typeRaw === "string" ? typeRaw.toLowerCase() : "";
+  if (type === "service" && principal === "dynamodb.amazonaws.com") {
+    return false;
+  }
+  const replicationMarkers = [
+    "awsservicerolefordynamodbreplication",
+    "replication.dynamodb.amazonaws.com"
+  ];
+  return replicationMarkers.some((m) => principal.includes(m));
+}
+function parseCurrentResourceKeys(record) {
+  const keys = record.dynamodb?.Keys;
+  if (!keys) {
+    return null;
+  }
+  const pkAttr = keys.PK?.S;
+  const skAttr = keys.SK?.S;
+  if (!pkAttr || skAttr !== CURRENT_SK) {
+    return null;
+  }
+  const m = PK_PATTERN.exec(pkAttr);
+  if (!m?.groups) {
+    return null;
+  }
+  const { tenantId, workspaceId, resourceType, resourceId } = m.groups;
+  const image = record.eventName === "REMOVE" ? record.dynamodb?.OldImage : record.dynamodb?.NewImage;
+  if (!image) {
+    return null;
+  }
+  const plain = dynamodbImageToPlain(image);
+  const version = typeof plain.vid === "string" ? plain.vid : null;
+  if (!version) {
+    return null;
+  }
+  return { tenantId, workspaceId, resourceType, resourceId, version };
+}
+function partitionToken(value) {
+  if (!value || value.trim() === "") {
+    return "-";
+  }
+  return value.replace(/[/\\]/g, "_");
+}
+function buildArchivePayload(record, keys) {
+  const newImage = record.dynamodb?.NewImage;
+  const oldImage = record.dynamodb?.OldImage;
+  const resourceImage = record.eventName === "REMOVE" ? oldImage : newImage;
+  const resourcePlain = resourceImage ? dynamodbImageToPlain(resourceImage) : {};
+  if (typeof resourcePlain.resource === "string") {
+    try {
+      resourcePlain.resource = JSON.parse(resourcePlain.resource);
+    } catch {
+    }
+  }
+  return {
+    eventName: record.eventName,
+    archivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tenantId: keys.tenantId,
+    workspaceId: keys.workspaceId,
+    resourceType: keys.resourceType,
+    resourceId: keys.resourceId,
+    version: keys.version,
+    resource: resourcePlain
+  };
+}
+function handler(event) {
+  const records = [];
+  const archiveLambdaRegion = process.env.AWS_REGION ?? "";
+  for (const rec of event.records) {
+    try {
+      const payload = Buffer.from(rec.data, "base64").toString("utf8");
+      const change = JSON.parse(payload);
+      if (shouldDropAsGlobalTableReplicationRecord(change, archiveLambdaRegion)) {
+        records.push({
+          recordId: rec.recordId,
+          result: "Dropped",
+          data: rec.data
+        });
+        continue;
+      }
+      const keys = parseCurrentResourceKeys(change);
+      if (!keys) {
+        records.push({
+          recordId: rec.recordId,
+          result: "Dropped",
+          data: rec.data
+        });
+        continue;
+      }
+      const archive = buildArchivePayload(change, keys);
+      const out = Buffer.from(`${JSON.stringify(archive)}
+`).toString(
+        "base64"
+      );
+      records.push({
+        recordId: rec.recordId,
+        result: "Ok",
+        data: out,
+        metadata: {
+          partitionKeys: {
+            tenantId: partitionToken(keys.tenantId),
+            workspaceId: partitionToken(keys.workspaceId),
+            resourceType: partitionToken(keys.resourceType),
+            resourceId: partitionToken(keys.resourceId),
+            version: partitionToken(keys.version)
+          }
+        }
+      });
+    } catch {
+      records.push({
+        recordId: rec.recordId,
+        result: "ProcessingFailed",
+        data: rec.data
+      });
+    }
+  }
+  return Promise.resolve({ records });
+}
+export {
+  handler,
+  parseCurrentResourceKeys,
+  shouldDropAsGlobalTableReplicationRecord
+};
+//# sourceMappingURL=firehose-archive-transform.handler.mjs.map

package/lib/firehose-archive-transform.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/dynamodb/firehose-archive-transform.handler.ts"],"sourcesContent":["import type { AttributeValue } from \"@aws-sdk/client-dynamodb\";\nimport type {\n  FirehoseTransformationEvent,\n  FirehoseTransformationResult,\n  FirehoseTransformationResultRecord,\n} from \"aws-lambda\";\n\nfunction dynamodbValueToJs(av: AttributeValue): unknown {\n  if (av.S !== undefined) {\n    return av.S;\n  }\n  if (av.N !== undefined) {\n    return av.N.includes(\".\")\n      ? Number.parseFloat(av.N)\n      : Number.parseInt(av.N, 10);\n  }\n  if (av.BOOL !== undefined) {\n    return av.BOOL;\n  }\n  if (av.NULL !== undefined) {\n    return null;\n  }\n  if (av.M !== undefined) {\n    return dynamodbImageToPlain(av.M);\n  }\n  if (av.L !== undefined) {\n    return av.L.map((x) => dynamodbValueToJs(x));\n  }\n  if (av.SS !== undefined) {\n    return av.SS;\n  }\n  if (av.NS !== undefined) {\n    return av.NS.map((n) =>\n      n.includes(\".\") ? Number.parseFloat(n) : Number.parseInt(n, 10),\n    );\n  }\n  return undefined;\n}\n\nfunction dynamodbImageToPlain(\n  image: Record<string, AttributeValue>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(image)) {\n    out[k] = dynamodbValueToJs(v);\n  }\n  return out;\n}\n\n/**\n * Firehose data-transformation handler: filters DynamoDB change records to\n * current FHIR resource items (SK = CURRENT, TID#…#WID#…#RT#…#ID#… PK),\n * writes archive JSON to S3 via Firehose, and sets dynamic partition keys\n * tenantId/workspaceId/resourceType/resourceId/version per ADR 2026-03-11-02.\n */\n\nconst CURRENT_SK = \"CURRENT\";\nconst PK_PATTERN =\n  /^TID#(?<tenantId>[^#]+)#WID#(?<workspaceId>[^#]+)#RT#(?<resourceType>[^#]+)#ID#(?<resourceId>.+)$/;\n\nexport interface DynamoDbStreamKinesisRecord {\n  eventName?: string;\n  userIdentity?: unknown;\n  dynamodb?: {\n    Keys?: Record<string, AttributeValue>;\n    NewImage?: Record<string, AttributeValue>;\n    OldImage?: Record<string, AttributeValue>;\n  };\n}\n\n/** DynamoDB-managed attribute on global table items (see AWS Global Tables legacy / replication docs). */\nconst AWS_REP_UPDATE_REGION = \"aws:rep:updateregion\";\n\nfunction getDynamoDbStringAttr(\n  image: Record<string, AttributeValue> | undefined,\n  name: string,\n): string | undefined {\n  if (!image) {\n    return undefined;\n  }\n  const av = image[name];\n  if (typeof av?.S === \"string\" && av.S.trim() !== \"\") {\n    return av.S.trim();\n  }\n  return undefined;\n}\n\nfunction primaryImageForReplicationCheck(\n  record: DynamoDbStreamKinesisRecord,\n): Record<string, AttributeValue> | undefined {\n  if (record.eventName === \"REMOVE\") {\n    return record.dynamodb?.OldImage;\n  }\n  return record.dynamodb?.NewImage;\n}\n\n/**\n * Returns true when this stream/Kinesis record should not be archived because it\n * represents a **replica-side application** of a global-table change (the logical\n * write originated in another Region).\n *\n * - If `aws:rep:updateregion` is present on the item image and differs from\n *   `archiveLambdaRegion`, the change was replicated into this Region (archive\n *   only in the Region that matches `aws:rep:updateregion`).\n * - Otherwise, if `userIdentity` matches the DynamoDB replication service SLR,\n *   treat as replication. **Excluded:** TTL deletes (`type` Service and\n *   `principalId` `dynamodb.amazonaws.com`) per AWS stream Identity docs.\n *\n * For MREC global tables version 2019.11.21, AWS documents that stream records\n * may not carry distinguishable metadata; the recommended approach is a custom\n * “write region” attribute on items. If neither that attribute nor\n * `aws:rep:updateregion` nor replication `userIdentity` applies, this function\n * returns false (no drop)—duplicate archives are possible if identical pipelines\n * run in every Region without those signals.\n */\nexport function shouldDropAsGlobalTableReplicationRecord(\n  record: DynamoDbStreamKinesisRecord,\n  archiveLambdaRegion: string,\n): boolean {\n  const image = primaryImageForReplicationCheck(record);\n  const updateRegion = getDynamoDbStringAttr(image, AWS_REP_UPDATE_REGION);\n  if (\n    updateRegion &&\n    archiveLambdaRegion &&\n    updateRegion !== archiveLambdaRegion\n  ) {\n    return true;\n  }\n\n  return isDynamoDbReplicationUserIdentity(record.userIdentity);\n}\n\nfunction isDynamoDbReplicationUserIdentity(userIdentity: unknown): boolean {\n  if (!userIdentity || typeof userIdentity !== \"object\") {\n    return false;\n  }\n  const ui = userIdentity as Record<string, unknown>;\n  const principalRaw = ui.principalId ?? ui.PrincipalId;\n  const typeRaw = ui.type ?? ui.Type;\n  const principal =\n    typeof principalRaw === \"string\" ? principalRaw.toLowerCase() : \"\";\n  const type = typeof typeRaw === \"string\" ? typeRaw.toLowerCase() : \"\";\n\n  if (type === \"service\" && principal === \"dynamodb.amazonaws.com\") {\n    return false;\n  }\n\n  const replicationMarkers = [\n    \"awsservicerolefordynamodbreplication\",\n    \"replication.dynamodb.amazonaws.com\",\n  ];\n  return replicationMarkers.some((m) => principal.includes(m));\n}\n\nexport function parseCurrentResourceKeys(record: DynamoDbStreamKinesisRecord): {\n  tenantId: string;\n  workspaceId: string;\n  resourceType: string;\n  resourceId: string;\n  version: string;\n} | null {\n  const keys = record.dynamodb?.Keys;\n  if (!keys) {\n    return null;\n  }\n  const pkAttr = keys.PK?.S;\n  const skAttr = keys.SK?.S;\n  if (!pkAttr || skAttr !== CURRENT_SK) {\n    return null;\n  }\n  const m = PK_PATTERN.exec(pkAttr);\n  if (!m?.groups) {\n    return null;\n  }\n  const { tenantId, workspaceId, resourceType, resourceId } = m.groups;\n  const image =\n    record.eventName === \"REMOVE\"\n      ? record.dynamodb?.OldImage\n      : record.dynamodb?.NewImage;\n  if (!image) {\n    return null;\n  }\n  const plain = dynamodbImageToPlain(image as Record<string, AttributeValue>);\n  const version = typeof plain.vid === \"string\" ? plain.vid : null;\n  if (!version) {\n    return null;\n  }\n  return { tenantId, workspaceId, resourceType, resourceId, version };\n}\n\nfunction partitionToken(value: string): string {\n  if (!value || value.trim() === \"\") {\n    return \"-\";\n  }\n  return value.replace(/[/\\\\]/g, \"_\");\n}\n\nfunction buildArchivePayload(\n  record: DynamoDbStreamKinesisRecord,\n  keys: ReturnType<typeof parseCurrentResourceKeys>,\n): Record<string, unknown> {\n  const newImage = record.dynamodb?.NewImage;\n  const oldImage = record.dynamodb?.OldImage;\n  const resourceImage = record.eventName === \"REMOVE\" ? oldImage : newImage;\n  const resourcePlain = resourceImage\n    ? dynamodbImageToPlain(resourceImage as Record<string, AttributeValue>)\n    : {};\n\n  if (typeof resourcePlain.resource === \"string\") {\n    try {\n      resourcePlain.resource = JSON.parse(resourcePlain.resource) as unknown;\n    } catch {\n      /* keep raw string if not valid JSON */\n    }\n  }\n\n  return {\n    eventName: record.eventName,\n    archivedAt: new Date().toISOString(),\n    tenantId: keys!.tenantId,\n    workspaceId: keys!.workspaceId,\n    resourceType: keys!.resourceType,\n    resourceId: keys!.resourceId,\n    version: keys!.version,\n    resource: resourcePlain,\n  };\n}\n\nexport function handler(\n  event: FirehoseTransformationEvent,\n): Promise<FirehoseTransformationResult> {\n  const records: FirehoseTransformationResultRecord[] = [];\n  const archiveLambdaRegion = process.env.AWS_REGION ?? \"\";\n\n  for (const rec of event.records) {\n    try {\n      const payload = Buffer.from(rec.data, \"base64\").toString(\"utf8\");\n      const change = JSON.parse(payload) as DynamoDbStreamKinesisRecord;\n\n      if (\n        shouldDropAsGlobalTableReplicationRecord(change, archiveLambdaRegion)\n      ) {\n        records.push({\n          recordId: rec.recordId,\n          result: \"Dropped\",\n          data: rec.data,\n        });\n        continue;\n      }\n\n      const keys = parseCurrentResourceKeys(change);\n\n      if (!keys) {\n        records.push({\n          recordId: rec.recordId,\n          result: \"Dropped\",\n          data: rec.data,\n        });\n        continue;\n      }\n\n      const archive = buildArchivePayload(change, keys);\n      const out = Buffer.from(`${JSON.stringify(archive)}\\n`).toString(\n        \"base64\",\n      );\n\n      records.push({\n        recordId: rec.recordId,\n        result: \"Ok\",\n        data: out,\n        metadata: {\n          partitionKeys: {\n            tenantId: partitionToken(keys.tenantId),\n            workspaceId: partitionToken(keys.workspaceId),\n            resourceType: partitionToken(keys.resourceType),\n            resourceId: partitionToken(keys.resourceId),\n            version: partitionToken(keys.version),\n          },\n        },\n      });\n    } catch {\n      records.push({\n        recordId: rec.recordId,\n        result: \"ProcessingFailed\",\n        data: rec.data,\n      });\n    }\n  }\n\n  return Promise.resolve({ records });\n}\n"],"mappings":";;;AAOA,SAAS,kBAAkB,IAA6B;AACtD,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG,EAAE,SAAS,GAAG,IACpB,OAAO,WAAW,GAAG,CAAC,IACtB,OAAO,SAAS,GAAG,GAAG,EAAE;AAAA,EAC9B;AACA,MAAI,GAAG,SAAS,QAAW;AACzB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,SAAS,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,qBAAqB,GAAG,CAAC;AAAA,EAClC;AACA,MAAI,GAAG,MAAM,QAAW;AACtB,WAAO,GAAG,EAAE,IAAI,CAAC,MAAM,kBAAkB,CAAC,CAAC;AAAA,EAC7C;AACA,MAAI,GAAG,OAAO,QAAW;AACvB,WAAO,GAAG;AAAA,EACZ;AACA,MAAI,GAAG,OAAO,QAAW;AACvB,WAAO,GAAG,GAAG;AAAA,MAAI,CAAC,MAChB,EAAE,SAAS,GAAG,IAAI,OAAO,WAAW,CAAC,IAAI,OAAO,SAAS,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,CAAC,IAAI,kBAAkB,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AASA,IAAM,aAAa;AACnB,IAAM,aACJ;AAaF,IAAM,wBAAwB;AAE9B,SAAS,sBACP,OACA,MACoB;AACpB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,KAAK,MAAM,IAAI;AACrB,MAAI,OAAO,IAAI,MAAM,YAAY,GAAG,EAAE,KAAK,MAAM,IAAI;AACnD,WAAO,GAAG,EAAE,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,gCACP,QAC4C;AAC5C,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,OAAO,UAAU;AAAA,EAC1B;AACA,SAAO,OAAO,UAAU;AAC1B;AAqBO,SAAS,yCACd,QACA,qBACS;AACT,QAAM,QAAQ,gCAAgC,MAAM;AACpD,QAAM,eAAe,sBAAsB,OAAO,qBAAqB;AACvE,MACE,gBACA,uBACA,iBAAiB,qBACjB;AACA,WAAO;AAAA,EACT;AAEA,SAAO,kCAAkC,OAAO,YAAY;AAC9D;AAEA,SAAS,kCAAkC,cAAgC;AACzE,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;AACrD,WAAO;AAAA,EACT;AACA,QAAM,KAAK;AACX,QAAM,eAAe,GAAG,eAAe,GAAG;AAC1C,QAAM,UAAU,GAAG,QAAQ,GAAG;AAC9B,QAAM,YACJ,OAAO,iBAAiB,WAAW,aAAa,YAAY,IAAI;AAClE,QAAM,OAAO,OAAO,YAAY,WAAW,QAAQ,YAAY,IAAI;AAEnE,MAAI,SAAS,aAAa,cAAc,0BAA0B;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACA,SAAO,mBAAmB,KAAK,CAAC,MAAM,UAAU,SAAS,CAAC,CAAC;AAC7D;AAEO,SAAS,yBAAyB,QAMhC;AACP,QAAM,OAAO,OAAO,UAAU;AAC9B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,IAAI;AACxB,QAAM,SAAS,KAAK,IAAI;AACxB,MAAI,CAAC,UAAU,WAAW,YAAY;AACpC,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,KAAK,MAAM;AAChC,MAAI,CAAC,GAAG,QAAQ;AACd,WAAO;AAAA,EACT;AACA,QAAM,EAAE,UAAU,aAAa,cAAc,WAAW,IAAI,EAAE;AAC9D,QAAM,QACJ,OAAO,cAAc,WACjB,OAAO,UAAU,WACjB,OAAO,UAAU;AACvB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,qBAAqB,KAAuC;AAC1E,QAAM,UAAU,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAC5D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,aAAa,cAAc,YAAY,QAAQ;AACpE;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,SAAS,MAAM,KAAK,MAAM,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,UAAU,GAAG;AACpC;AAEA,SAAS,oBACP,QACA,MACyB;AACzB,QAAM,WAAW,OAAO,UAAU;AAClC,QAAM,WAAW,OAAO,UAAU;AAClC,QAAM,gBAAgB,OAAO,cAAc,WAAW,WAAW;AACjE,QAAM,gBAAgB,gBAClB,qBAAqB,aAA+C,IACpE,CAAC;AAEL,MAAI,OAAO,cAAc,aAAa,UAAU;AAC9C,QAAI;AACF,oBAAc,WAAW,KAAK,MAAM,cAAc,QAAQ;AAAA,IAC5D,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,UAAU,KAAM;AAAA,IAChB,aAAa,KAAM;AAAA,IACnB,cAAc,KAAM;AAAA,IACpB,YAAY,KAAM;AAAA,IAClB,SAAS,KAAM;AAAA,IACf,UAAU;AAAA,EACZ;AACF;AAEO,SAAS,QACd,OACuC;AACvC,QAAM,UAAgD,CAAC;AACvD,QAAM,sBAAsB,QAAQ,IAAI,cAAc;AAEtD,aAAW,OAAO,MAAM,SAAS;AAC/B,QAAI;AACF,YAAM,UAAU,OAAO,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM;AAC/D,YAAM,SAAS,KAAK,MAAM,OAAO;AAEjC,UACE,yCAAyC,QAAQ,mBAAmB,GACpE;AACA,gBAAQ,KAAK;AAAA,UACX,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,UACR,MAAM,IAAI;AAAA,QACZ,CAAC;AACD;AAAA,MACF;AAEA,YAAM,OAAO,yBAAyB,MAAM;AAE5C,UAAI,CAAC,MAAM;AACT,gBAAQ,KAAK;AAAA,UACX,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,UACR,MAAM,IAAI;AAAA,QACZ,CAAC;AACD;AAAA,MACF;AAEA,YAAM,UAAU,oBAAoB,QAAQ,IAAI;AAChD,YAAM,MAAM,OAAO,KAAK,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,CAAI,EAAE;AAAA,QACtD;AAAA,MACF;AAEA,cAAQ,KAAK;AAAA,QACX,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,UAAU;AAAA,UACR,eAAe;AAAA,YACb,UAAU,eAAe,KAAK,QAAQ;AAAA,YACtC,aAAa,eAAe,KAAK,WAAW;AAAA,YAC5C,cAAc,eAAe,KAAK,YAAY;AAAA,YAC9C,YAAY,eAAe,KAAK,UAAU;AAAA,YAC1C,SAAS,eAAe,KAAK,OAAO;AAAA,UACtC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,cAAQ,KAAK;AAAA,QACX,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,QACR,MAAM,IAAI;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,QAAQ,QAAQ,EAAE,QAAQ,CAAC;AACpC;","names":[]}

package/lib/index.d.mts

@@ -7,12 +7,15 @@ import { GraphqlApi, IGraphqlApi, GraphqlApiProps } from 'aws-cdk-lib/aws-appsyn
 import { UserPool, UserPoolProps, UserPoolClient, UserPoolClientProps, UserPoolDomain, UserPoolDomainProps, IUserPool, IUserPoolClient, IUserPoolDomain } from 'aws-cdk-lib/aws-cognito';
 import { Key, KeyProps, IKey } from 'aws-cdk-lib/aws-kms';
 import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as kinesis from 'aws-cdk-lib/aws-kinesis';
+import * as kinesisfirehose from 'aws-cdk-lib/aws-kinesisfirehose';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { IBucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { Table, TableProps, ITable } from 'aws-cdk-lib/aws-dynamodb';
 import { EventBus, EventBusProps, IEventBus } from 'aws-cdk-lib/aws-events';
 import { HostedZone, HostedZoneProps, IHostedZone, HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
 import { StringParameterProps, StringParameter } from 'aws-cdk-lib/aws-ssm';
 import { Distribution, DistributionProps } from 'aws-cdk-lib/aws-cloudfront';
-import { IBucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { IFunction } from 'aws-cdk-lib/aws-lambda';
 
 /**
@@ -433,6 +436,31 @@ declare class PreTokenGenerationLambda extends Construct {
     constructor(scope: Construct);
 }
 
+interface DataStoreHistoricalArchiveProps {
+    /**
+     * Kinesis stream that receives DynamoDB item-level changes (table Kinesis destination).
+     */
+    readonly kinesisStream: kinesis.IStream;
+    /**
+     * Removal policy for the archive bucket and related resources.
+     */
+    readonly removalPolicy: RemovalPolicy;
+    /**
+     * Short hash for unique stream/bucket naming within the deployment.
+     */
+    readonly stackHash: string;
+}
+/**
+ * DynamoDB change stream → Kinesis → Firehose → S3 with a transform Lambda for
+ * scope filtering and dynamic partitioning (ADR 2026-03-11-02).
+ */
+declare class DataStoreHistoricalArchive extends Construct {
+    readonly archiveBucket: s3.Bucket;
+    readonly deliveryStream: kinesisfirehose.IDeliveryStream;
+    readonly transformFunction: NodejsFunction;
+    constructor(scope: Construct, id: string, props: DataStoreHistoricalArchiveProps);
+}
+
 /**
  * @see sites/www-docs/content/packages/@openhi/constructs/components/dynamodb/dynamo-db-data-store.md
  */
@@ -456,6 +484,9 @@ interface DynamoDbDataStoreProps extends Omit<TableProps, "tableName" | "removal
  *
  * Primary key: PK (String), SK (String).
  * GSIs: GSI1 (reverse reference), GSI2 (identifier lookup), GSI3 (facility ops), GSI4 (resource type list).
+ *
+ * For historical archive to S3, pass `kinesisStream` and `stream` (e.g.
+ * `StreamViewType.NEW_AND_OLD_IMAGES`) on the table props per ADR 2026-03-11-02.
  */
 declare class DynamoDbDataStore extends Table {
     constructor(scope: Construct, id: string, props?: DynamoDbDataStoreProps);
@@ -896,6 +927,14 @@ declare class OpenHiDataService extends OpenHiService {
      * from other stacks to obtain an ITable reference by name.
      */
     readonly dataStore: ITable;
+    /**
+     * Kinesis stream receiving DynamoDB item-level changes for the data store table.
+     */
+    readonly dataStoreChangeStream: kinesis.IStream;
+    /**
+     * S3 historical archive pipeline (Kinesis → Firehose → S3) per ADR 2026-03-11-02.
+     */
+    readonly dataStoreHistoricalArchive: DataStoreHistoricalArchive;
     constructor(ohEnv: OpenHiEnvironment, props?: OpenHiDataServiceProps);
     /**
      * Creates the data event bus.
@@ -936,4 +975,4 @@ declare class OpenHiGraphqlService extends OpenHiService {
     protected createRootGraphqlApi(): RootGraphqlApi;
 }
 
-export { type BuildParameterNameProps, ChildHostedZone, type ChildHostedZoneProps, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, DataEventBus, DiscoverableStringParameter, type DiscoverableStringParameterProps, DynamoDbDataStore, type DynamoDbDataStoreProps, OpenHiApp, type OpenHiAppProps, OpenHiAuthService, type OpenHiAuthServiceProps, OpenHiDataService, type OpenHiDataServiceProps, OpenHiEnvironment, type OpenHiEnvironmentProps, OpenHiGlobalService, type OpenHiGlobalServiceProps, OpenHiGraphqlService, type OpenHiGraphqlServiceProps, OpenHiRestApiService, type OpenHiRestApiServiceProps, OpenHiService, type OpenHiServiceProps, type OpenHiServiceType, OpenHiStage, type OpenHiStageProps, OpsEventBus, PreTokenGenerationLambda, REST_API_BASE_URL_SSM_NAME, RootGraphqlApi, type RootGraphqlApiProps, RootHostedZone, RootHttpApi, type RootHttpApiProps, RootWildcardCertificate, STATIC_HOSTING_SERVICE_TYPE, StaticHosting, type StaticHostingProps, getDynamoDbDataStoreTableName };
+export { type BuildParameterNameProps, ChildHostedZone, type ChildHostedZoneProps, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, DataEventBus, DataStoreHistoricalArchive, type DataStoreHistoricalArchiveProps, DiscoverableStringParameter, type DiscoverableStringParameterProps, DynamoDbDataStore, type DynamoDbDataStoreProps, OpenHiApp, type OpenHiAppProps, OpenHiAuthService, type OpenHiAuthServiceProps, OpenHiDataService, type OpenHiDataServiceProps, OpenHiEnvironment, type OpenHiEnvironmentProps, OpenHiGlobalService, type OpenHiGlobalServiceProps, OpenHiGraphqlService, type OpenHiGraphqlServiceProps, OpenHiRestApiService, type OpenHiRestApiServiceProps, OpenHiService, type OpenHiServiceProps, type OpenHiServiceType, OpenHiStage, type OpenHiStageProps, OpsEventBus, PreTokenGenerationLambda, REST_API_BASE_URL_SSM_NAME, RootGraphqlApi, type RootGraphqlApiProps, RootHostedZone, RootHttpApi, type RootHttpApiProps, RootWildcardCertificate, STATIC_HOSTING_SERVICE_TYPE, StaticHosting, type StaticHostingProps, getDynamoDbDataStoreTableName };