@openhi/constructs 0.0.69 → 0.0.71

package/lib/index.d.ts

@@ -6,12 +6,15 @@ import { IGraphqlApi, GraphqlApi, GraphqlApiProps } from 'aws-cdk-lib/aws-appsyn
 import { UserPool, UserPoolProps, UserPoolClient, UserPoolClientProps, UserPoolDomain, UserPoolDomainProps, IUserPool, IUserPoolClient, IUserPoolDomain } from 'aws-cdk-lib/aws-cognito';
 import { Key, KeyProps, IKey } from 'aws-cdk-lib/aws-kms';
 import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as kinesis from 'aws-cdk-lib/aws-kinesis';
+import * as kinesisfirehose from 'aws-cdk-lib/aws-kinesisfirehose';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { IBucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { Table, TableProps, ITable } from 'aws-cdk-lib/aws-dynamodb';
 import { EventBus, EventBusProps, IEventBus } from 'aws-cdk-lib/aws-events';
 import { HostedZone, HostedZoneProps, IHostedZone, HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
 import { StringParameterProps, StringParameter } from 'aws-cdk-lib/aws-ssm';
 import { Distribution, DistributionProps } from 'aws-cdk-lib/aws-cloudfront';
-import { IBucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { IFunction } from 'aws-cdk-lib/aws-lambda';
 
 /*******************************************************************************
@@ -513,6 +516,31 @@ declare class PreTokenGenerationLambda extends Construct {
     constructor(scope: Construct);
 }
 
+interface DataStoreHistoricalArchiveProps {
+    /**
+     * Kinesis stream that receives DynamoDB item-level changes (table Kinesis destination).
+     */
+    readonly kinesisStream: kinesis.IStream;
+    /**
+     * Removal policy for the archive bucket and related resources.
+     */
+    readonly removalPolicy: RemovalPolicy;
+    /**
+     * Short hash for unique stream/bucket naming within the deployment.
+     */
+    readonly stackHash: string;
+}
+/**
+ * DynamoDB change stream → Kinesis → Firehose → S3 with a transform Lambda for
+ * scope filtering and dynamic partitioning (ADR 2026-03-11-02).
+ */
+declare class DataStoreHistoricalArchive extends Construct {
+    readonly archiveBucket: s3.Bucket;
+    readonly deliveryStream: kinesisfirehose.IDeliveryStream;
+    readonly transformFunction: NodejsFunction;
+    constructor(scope: Construct, id: string, props: DataStoreHistoricalArchiveProps);
+}
+
 /**
  * @see sites/www-docs/content/packages/@openhi/constructs/components/dynamodb/dynamo-db-data-store.md
  */
@@ -536,6 +564,9 @@ interface DynamoDbDataStoreProps extends Omit<TableProps, "tableName" | "removal
  *
  * Primary key: PK (String), SK (String).
  * GSIs: GSI1 (reverse reference), GSI2 (identifier lookup), GSI3 (facility ops), GSI4 (resource type list).
+ *
+ * For historical archive to S3, pass `kinesisStream` and `stream` (e.g.
+ * `StreamViewType.NEW_AND_OLD_IMAGES`) on the table props per ADR 2026-03-11-02.
  */
 declare class DynamoDbDataStore extends Table {
     constructor(scope: Construct, id: string, props?: DynamoDbDataStoreProps);
@@ -976,6 +1007,14 @@ declare class OpenHiDataService extends OpenHiService {
      * from other stacks to obtain an ITable reference by name.
      */
     readonly dataStore: ITable;
+    /**
+     * Kinesis stream receiving DynamoDB item-level changes for the data store table.
+     */
+    readonly dataStoreChangeStream: kinesis.IStream;
+    /**
+     * S3 historical archive pipeline (Kinesis → Firehose → S3) per ADR 2026-03-11-02.
+     */
+    readonly dataStoreHistoricalArchive: DataStoreHistoricalArchive;
     constructor(ohEnv: OpenHiEnvironment, props?: OpenHiDataServiceProps);
     /**
      * Creates the data event bus.
@@ -1016,5 +1055,5 @@ declare class OpenHiGraphqlService extends OpenHiService {
     protected createRootGraphqlApi(): RootGraphqlApi;
 }
 
-export { ChildHostedZone, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, DataEventBus, DiscoverableStringParameter, DynamoDbDataStore, OpenHiApp, OpenHiAuthService, OpenHiDataService, OpenHiEnvironment, OpenHiGlobalService, OpenHiGraphqlService, OpenHiRestApiService, OpenHiService, OpenHiStage, OpsEventBus, PreTokenGenerationLambda, REST_API_BASE_URL_SSM_NAME, RootGraphqlApi, RootHostedZone, RootHttpApi, RootWildcardCertificate, STATIC_HOSTING_SERVICE_TYPE, StaticHosting, getDynamoDbDataStoreTableName };
-export type { BuildParameterNameProps, ChildHostedZoneProps, DiscoverableStringParameterProps, DynamoDbDataStoreProps, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiGraphqlServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps, RootGraphqlApiProps, RootHttpApiProps, StaticHostingProps };
+export { ChildHostedZone, CognitoUserPool, CognitoUserPoolClient, CognitoUserPoolDomain, CognitoUserPoolKmsKey, DataEventBus, DataStoreHistoricalArchive, DiscoverableStringParameter, DynamoDbDataStore, OpenHiApp, OpenHiAuthService, OpenHiDataService, OpenHiEnvironment, OpenHiGlobalService, OpenHiGraphqlService, OpenHiRestApiService, OpenHiService, OpenHiStage, OpsEventBus, PreTokenGenerationLambda, REST_API_BASE_URL_SSM_NAME, RootGraphqlApi, RootHostedZone, RootHttpApi, RootWildcardCertificate, STATIC_HOSTING_SERVICE_TYPE, StaticHosting, getDynamoDbDataStoreTableName };
+export type { BuildParameterNameProps, ChildHostedZoneProps, DataStoreHistoricalArchiveProps, DiscoverableStringParameterProps, DynamoDbDataStoreProps, OpenHiAppProps, OpenHiAuthServiceProps, OpenHiDataServiceProps, OpenHiEnvironmentProps, OpenHiGlobalServiceProps, OpenHiGraphqlServiceProps, OpenHiRestApiServiceProps, OpenHiServiceProps, OpenHiServiceType, OpenHiStageProps, RootGraphqlApiProps, RootHttpApiProps, StaticHostingProps };

package/lib/index.js

@@ -99,6 +99,7 @@ __export(src_exports, {
   CognitoUserPoolDomain: () => CognitoUserPoolDomain,
   CognitoUserPoolKmsKey: () => CognitoUserPoolKmsKey,
   DataEventBus: () => DataEventBus,
+  DataStoreHistoricalArchive: () => DataStoreHistoricalArchive,
   DiscoverableStringParameter: () => DiscoverableStringParameter,
   DynamoDbDataStore: () => DynamoDbDataStore,
   OpenHiApp: () => OpenHiApp,
@@ -695,6 +696,86 @@ var PreTokenGenerationLambda = class extends import_constructs.Construct {
   }
 };
 
+// src/components/dynamodb/data-store-historical-archive.ts
+var import_node_fs2 = __toESM(require("fs"));
+var import_node_path2 = __toESM(require("path"));
+var import_aws_cdk_lib6 = require("aws-cdk-lib");
+var kinesisfirehose = __toESM(require("aws-cdk-lib/aws-kinesisfirehose"));
+var import_aws_lambda2 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs2 = require("aws-cdk-lib/aws-lambda-nodejs");
+var s3 = __toESM(require("aws-cdk-lib/aws-s3"));
+var import_constructs2 = require("constructs");
+var HANDLER_NAME2 = "firehose-archive-transform.handler.js";
+function resolveHandlerEntry2(dirname) {
+  const sameDir = import_node_path2.default.join(dirname, HANDLER_NAME2);
+  if (import_node_fs2.default.existsSync(sameDir)) {
+    return sameDir;
+  }
+  return import_node_path2.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME2);
+}
+var DataStoreHistoricalArchive = class extends import_constructs2.Construct {
+  constructor(scope, id, props) {
+    super(scope, id);
+    this.archiveBucket = new s3.Bucket(this, "ArchiveBucket", {
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      removalPolicy: props.removalPolicy,
+      autoDeleteObjects: props.removalPolicy === import_aws_cdk_lib6.RemovalPolicy.DESTROY,
+      versioned: true
+    });
+    this.transformFunction = new import_aws_lambda_nodejs2.NodejsFunction(this, "FirehoseTransform", {
+      entry: resolveHandlerEntry2(__dirname),
+      runtime: import_aws_lambda2.Runtime.NODEJS_LATEST,
+      memorySize: 512,
+      timeout: import_aws_cdk_lib6.Duration.minutes(1),
+      description: "Firehose transform: filter CURRENT resource rows, S3 dynamic partition keys",
+      bundling: {
+        minify: true,
+        sourceMap: false
+      }
+    });
+    const processor = new kinesisfirehose.LambdaFunctionProcessor(
+      this.transformFunction,
+      {
+        bufferInterval: import_aws_cdk_lib6.Duration.seconds(60),
+        bufferSize: import_aws_cdk_lib6.Size.mebibytes(3),
+        retries: 3
+      }
+    );
+    const destination = new kinesisfirehose.S3Bucket(this.archiveBucket, {
+      compression: kinesisfirehose.Compression.GZIP,
+      bufferingInterval: import_aws_cdk_lib6.Duration.seconds(300),
+      // Firehose requires SizeInMBs ≥ 64 when dynamic partitioning is enabled.
+      bufferingSize: import_aws_cdk_lib6.Size.mebibytes(64),
+      processors: [processor],
+      errorOutputPrefix: "errors/!{firehose:error-output-type}/!{timestamp:yyyy/MM/dd/HH}/",
+      loggingConfig: new kinesisfirehose.EnableLogging()
+    });
+    this.deliveryStream = new kinesisfirehose.DeliveryStream(
+      this,
+      "ArchiveDeliveryStream",
+      {
+        deliveryStreamName: `openhi-dstore-arch-${props.stackHash}`,
+        source: new kinesisfirehose.KinesisStreamSource(props.kinesisStream),
+        destination
+      }
+    );
+    const cfn = this.deliveryStream.node.defaultChild;
+    cfn.addPropertyOverride(
+      "ExtendedS3DestinationConfiguration.DynamicPartitioningConfiguration",
+      {
+        Enabled: true,
+        RetryOptions: { DurationInSeconds: 300 }
+      }
+    );
+    cfn.addPropertyOverride(
+      "ExtendedS3DestinationConfiguration.Prefix",
+      "!{partitionKeyFromLambda:tenantId}/!{partitionKeyFromLambda:workspaceId}/!{partitionKeyFromLambda:resourceType}/!{partitionKeyFromLambda:resourceId}/!{partitionKeyFromLambda:version}/"
+    );
+  }
+};
+
 // src/components/dynamodb/dynamo-db-data-store.ts
 var import_aws_dynamodb = require("aws-cdk-lib/aws-dynamodb");
 function getDynamoDbDataStoreTableName(scope) {
@@ -817,7 +898,7 @@ var OpsEventBus = class _OpsEventBus extends import_aws_events2.EventBus {
 };
 
 // src/components/route-53/child-hosted-zone.ts
-var import_aws_cdk_lib6 = require("aws-cdk-lib");
+var import_aws_cdk_lib7 = require("aws-cdk-lib");
 var import_aws_route53 = require("aws-cdk-lib/aws-route53");
 var ChildHostedZone = class extends import_aws_route53.HostedZone {
   constructor(scope, id, props) {
@@ -826,7 +907,7 @@ var ChildHostedZone = class extends import_aws_route53.HostedZone {
       zone: props.parentHostedZone,
       recordName: this.zoneName,
       values: this.hostedZoneNameServers || [],
-      ttl: import_aws_cdk_lib6.Duration.minutes(5)
+      ttl: import_aws_cdk_lib7.Duration.minutes(5)
     });
   }
 };
@@ -836,8 +917,8 @@ var ChildHostedZone = class extends import_aws_route53.HostedZone {
 ChildHostedZone.SSM_PARAM_NAME = "CHILDHOSTEDZONE";
 
 // src/components/route-53/root-hosted-zone.ts
-var import_constructs2 = require("constructs");
-var RootHostedZone = class extends import_constructs2.Construct {
+var import_constructs3 = require("constructs");
+var RootHostedZone = class extends import_constructs3.Construct {
 };
 
 // src/components/static-hosting/static-hosting.ts
@@ -845,9 +926,9 @@ var import_aws_cloudfront = require("aws-cdk-lib/aws-cloudfront");
 var import_aws_cloudfront_origins = require("aws-cdk-lib/aws-cloudfront-origins");
 var import_aws_s3 = require("aws-cdk-lib/aws-s3");
 var import_core = require("aws-cdk-lib/core");
-var import_constructs3 = require("constructs");
+var import_constructs4 = require("constructs");
 var STATIC_HOSTING_SERVICE_TYPE = "website";
-var _StaticHosting = class _StaticHosting extends import_constructs3.Construct {
+var _StaticHosting = class _StaticHosting extends import_constructs4.Construct {
   constructor(scope, id, props = {}) {
     super(scope, id);
     const stack = OpenHiService.of(scope);
@@ -1158,6 +1239,7 @@ var import_core2 = require("aws-cdk-lib/core");
 // src/services/open-hi-data-service.ts
 var import_aws_dynamodb2 = require("aws-cdk-lib/aws-dynamodb");
 var import_aws_events3 = require("aws-cdk-lib/aws-events");
+var kinesis = __toESM(require("aws-cdk-lib/aws-kinesis"));
 var _OpenHiDataService = class _OpenHiDataService extends OpenHiService {
   /**
    * Returns the data event bus by name (deterministic per branch). Use from other stacks to obtain an IEventBus reference.
@@ -1193,7 +1275,24 @@ var _OpenHiDataService = class _OpenHiDataService extends OpenHiService {
     this.props = props;
     this.dataEventBus = this.createDataEventBus();
     this.opsEventBus = this.createOpsEventBus();
+    this.dataStoreChangeStream = new kinesis.Stream(
+      this,
+      "data-store-change-stream",
+      {
+        streamName: `openhi-dstore-cdc-${this.branchHash}`,
+        streamMode: kinesis.StreamMode.ON_DEMAND
+      }
+    );
     this.dataStore = this.createDataStore();
+    this.dataStoreHistoricalArchive = new DataStoreHistoricalArchive(
+      this,
+      "data-store-historical-archive",
+      {
+        kinesisStream: this.dataStoreChangeStream,
+        removalPolicy: this.removalPolicy,
+        stackHash: this.stackHash
+      }
+    );
   }
   /**
    * Creates the data event bus.
@@ -1214,59 +1313,62 @@ var _OpenHiDataService = class _OpenHiDataService extends OpenHiService {
    * Override to customize.
    */
   createDataStore() {
-    return new DynamoDbDataStore(this, "dynamo-db-data-store");
+    return new DynamoDbDataStore(this, "dynamo-db-data-store", {
+      kinesisStream: this.dataStoreChangeStream,
+      stream: import_aws_dynamodb2.StreamViewType.NEW_AND_OLD_IMAGES
+    });
   }
 };
 _OpenHiDataService.SERVICE_TYPE = "data";
 var OpenHiDataService = _OpenHiDataService;
 
 // src/data/lambda/cors-options-lambda.ts
-var import_node_fs2 = __toESM(require("fs"));
-var import_node_path2 = __toESM(require("path"));
-var import_aws_lambda2 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs2 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs4 = require("constructs");
-var HANDLER_NAME2 = "cors-options-lambda.handler.js";
-function resolveHandlerEntry2(dirname) {
-  const sameDir = import_node_path2.default.join(dirname, HANDLER_NAME2);
-  if (import_node_fs2.default.existsSync(sameDir)) {
+var import_node_fs3 = __toESM(require("fs"));
+var import_node_path3 = __toESM(require("path"));
+var import_aws_lambda3 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs3 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs5 = require("constructs");
+var HANDLER_NAME3 = "cors-options-lambda.handler.js";
+function resolveHandlerEntry3(dirname) {
+  const sameDir = import_node_path3.default.join(dirname, HANDLER_NAME3);
+  if (import_node_fs3.default.existsSync(sameDir)) {
     return sameDir;
   }
-  const fromLib = import_node_path2.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME2);
+  const fromLib = import_node_path3.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME3);
   return fromLib;
 }
-var CorsOptionsLambda = class extends import_constructs4.Construct {
+var CorsOptionsLambda = class extends import_constructs5.Construct {
   constructor(scope, id = "cors-options-lambda") {
     super(scope, id);
-    this.lambda = new import_aws_lambda_nodejs2.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry2(__dirname),
-      runtime: import_aws_lambda2.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs3.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry3(__dirname),
+      runtime: import_aws_lambda3.Runtime.NODEJS_LATEST,
       memorySize: 128
     });
   }
 };
 
 // src/data/lambda/rest-api-lambda.ts
-var import_node_fs3 = __toESM(require("fs"));
-var import_node_path3 = __toESM(require("path"));
-var import_aws_lambda3 = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs3 = require("aws-cdk-lib/aws-lambda-nodejs");
-var import_constructs5 = require("constructs");
-var HANDLER_NAME3 = "rest-api-lambda.handler.js";
-function resolveHandlerEntry3(dirname) {
-  const sameDir = import_node_path3.default.join(dirname, HANDLER_NAME3);
-  if (import_node_fs3.default.existsSync(sameDir)) {
+var import_node_fs4 = __toESM(require("fs"));
+var import_node_path4 = __toESM(require("path"));
+var import_aws_lambda4 = require("aws-cdk-lib/aws-lambda");
+var import_aws_lambda_nodejs4 = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_constructs6 = require("constructs");
+var HANDLER_NAME4 = "rest-api-lambda.handler.js";
+function resolveHandlerEntry4(dirname) {
+  const sameDir = import_node_path4.default.join(dirname, HANDLER_NAME4);
+  if (import_node_fs4.default.existsSync(sameDir)) {
     return sameDir;
   }
-  const fromLib = import_node_path3.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME3);
+  const fromLib = import_node_path4.default.join(dirname, "..", "..", "..", "lib", HANDLER_NAME4);
   return fromLib;
 }
-var RestApiLambda = class extends import_constructs5.Construct {
+var RestApiLambda = class extends import_constructs6.Construct {
   constructor(scope, props) {
     super(scope, "rest-api-lambda");
-    this.lambda = new import_aws_lambda_nodejs3.NodejsFunction(this, "handler", {
-      entry: resolveHandlerEntry3(__dirname),
-      runtime: import_aws_lambda3.Runtime.NODEJS_LATEST,
+    this.lambda = new import_aws_lambda_nodejs4.NodejsFunction(this, "handler", {
+      entry: resolveHandlerEntry4(__dirname),
+      runtime: import_aws_lambda4.Runtime.NODEJS_LATEST,
       memorySize: 1024,
       environment: {
         DYNAMO_TABLE_NAME: props.dynamoTableName,
@@ -1565,6 +1667,7 @@ var OpenHiGraphqlService = _OpenHiGraphqlService;
   CognitoUserPoolDomain,
   CognitoUserPoolKmsKey,
   DataEventBus,
+  DataStoreHistoricalArchive,
   DiscoverableStringParameter,
   DynamoDbDataStore,
   OpenHiApp,