@ts-cloud/core 0.2.3 → 0.2.5

package/dist/modules/network.d.ts

@@ -0,0 +1,148 @@
+import type { EC2EIP, EC2FlowLog, EC2InternetGateway, EC2NatGateway, EC2Route, EC2RouteTable, EC2Subnet, EC2SubnetRouteTableAssociation, EC2VPC, EC2VPCGatewayAttachment } from '@ts-cloud/aws-types';
+import type { EnvironmentType } from '../types';
+export interface VpcOptions {
+    slug: string;
+    environment: EnvironmentType;
+    cidr?: string;
+    enableDnsHostnames?: boolean;
+    enableDnsSupport?: boolean;
+    zones?: number;
+}
+export interface SubnetOptions {
+    slug: string;
+    environment: EnvironmentType;
+    vpcId: string;
+    type: 'public' | 'private' | 'isolated';
+    cidr: string;
+    availabilityZone: string;
+    mapPublicIp?: boolean;
+}
+export interface NatGatewayOptions {
+    slug: string;
+    environment: EnvironmentType;
+    subnetId: string;
+}
+export interface FlowLogOptions {
+    slug: string;
+    environment: EnvironmentType;
+    resourceId: string;
+    resourceType: 'VPC' | 'Subnet';
+    trafficType?: 'ACCEPT' | 'REJECT' | 'ALL';
+    logGroupName?: string;
+}
+/**
+ * Network Module - VPC, Subnets, NAT, Internet Gateway
+ * Provides clean API for creating and configuring networking resources
+ */
+export declare class Network {
+    /**
+     * Create a VPC with optional multi-AZ configuration
+     */
+    static createVpc(options: VpcOptions): {
+        vpc: EC2VPC;
+        logicalId: string;
+    };
+    /**
+     * Create a subnet in a VPC
+     */
+    static createSubnet(options: SubnetOptions): {
+        subnet: EC2Subnet;
+        logicalId: string;
+    };
+    /**
+     * Create Internet Gateway
+     */
+    static createInternetGateway(slug: string, environment: EnvironmentType): {
+        internetGateway: EC2InternetGateway;
+        logicalId: string;
+    };
+    /**
+     * Attach Internet Gateway to VPC
+     */
+    static attachInternetGateway(vpcLogicalId: string, igwLogicalId: string): {
+        attachment: EC2VPCGatewayAttachment;
+        logicalId: string;
+    };
+    /**
+     * Create Elastic IP for NAT Gateway
+     */
+    static createEip(slug: string, environment: EnvironmentType): {
+        eip: EC2EIP;
+        logicalId: string;
+    };
+    /**
+     * Create NAT Gateway (with cost warning in comments)
+     */
+    static createNatGateway(options: NatGatewayOptions, eipLogicalId: string): {
+        natGateway: EC2NatGateway;
+        logicalId: string;
+    };
+    /**
+     * Create Route Table
+     */
+    static createRouteTable(slug: string, environment: EnvironmentType, vpcLogicalId: string, type: 'public' | 'private'): {
+        routeTable: EC2RouteTable;
+        logicalId: string;
+    };
+    /**
+     * Create Route (e.g., for Internet Gateway or NAT Gateway)
+     */
+    static createRoute(routeTableLogicalId: string, destination: string, target: {
+        type: 'igw' | 'nat' | 'instance';
+        logicalId: string;
+    }): {
+        route: EC2Route;
+        logicalId: string;
+    };
+    /**
+     * Associate Subnet with Route Table
+     */
+    static associateSubnetWithRouteTable(subnetLogicalId: string, routeTableLogicalId: string): {
+        association: EC2SubnetRouteTableAssociation;
+        logicalId: string;
+    };
+    /**
+     * Enable VPC Flow Logs
+     */
+    static enableFlowLogs(options: FlowLogOptions): {
+        flowLog: EC2FlowLog;
+        logicalId: string;
+    };
+    /**
+     * Calculate subnet CIDRs for a VPC
+     * Splits a VPC CIDR into smaller subnets
+     */
+    static calculateSubnetCidrs(vpcCidr: string, zones: number, subnetsPerZone?: number): string[];
+    /**
+     * Get available availability zones for a region
+     * Returns zone suffixes (a, b, c, etc.)
+     */
+    static getAvailabilityZones(region: string, count: number): string[];
+    /**
+     * Create a complete multi-AZ network setup with optional NAT Gateway
+     * This creates VPC, public/private subnets, IGW, and optionally NAT
+     */
+    static createMultiAzNetwork(options: {
+        slug: string;
+        environment: EnvironmentType;
+        region: string;
+        cidr?: string;
+        zones?: number;
+        enableNatGateway?: boolean;
+        singleNatGateway?: boolean;
+        enableFlowLogs?: boolean;
+    }): {
+        resources: Record<string, any>;
+        outputs: {
+            vpcId: string;
+            publicSubnetIds: string[];
+            privateSubnetIds: string[];
+            natGatewayIds?: string[];
+        };
+    };
+    /**
+     * NAT Gateway cost warning
+     * NAT Gateways cost ~$32/month plus data transfer charges
+     */
+    static readonly NatGatewayCostWarning = "\n\u26A0\uFE0F NAT Gateway Cost Warning:\n- Each NAT Gateway costs approximately $32-45/month (hourly charges)\n- Data processing charges: $0.045/GB processed\n- For development environments, consider:\n  - Using a single NAT Gateway (singleNatGateway: true)\n  - Using NAT Instances instead (cheaper but requires management)\n  - Disabling NAT entirely for isolated private subnets\n";
+}

package/dist/modules/parameter-store.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Systems Manager Parameter Store Module
+ * Clean API for AWS SSM Parameter Store
+ */
+import type { SSMParameter } from '@ts-cloud/aws-types';
+export interface ParameterOptions {
+    slug: string;
+    environment: string;
+    parameterName?: string;
+    value: string;
+    type?: 'String' | 'StringList' | 'SecureString';
+    description?: string;
+    tier?: 'Standard' | 'Advanced' | 'Intelligent-Tiering';
+    tags?: Record<string, string>;
+}
+/**
+ * Parameter Store Module
+ */
+export declare class ParameterStore {
+    /**
+     * Create a parameter
+     */
+    static createParameter(options: ParameterOptions): {
+        parameter: SSMParameter;
+        logicalId: string;
+    };
+    /**
+     * Create a string parameter
+     */
+    static createString(slug: string, environment: string, name: string, value: string, description?: string): {
+        parameter: SSMParameter;
+        logicalId: string;
+    };
+    /**
+     * Create a secure string parameter (encrypted)
+     */
+    static createSecureString(slug: string, environment: string, name: string, value: string, description?: string): {
+        parameter: SSMParameter;
+        logicalId: string;
+    };
+    /**
+     * Create a string list parameter (comma-separated)
+     */
+    static createStringList(slug: string, environment: string, name: string, values: string[], description?: string): {
+        parameter: SSMParameter;
+        logicalId: string;
+    };
+    /**
+     * Common parameter patterns
+     */
+    static readonly Parameters: {
+        /**
+         * Database connection string
+         */
+        databaseUrl: (slug: string, environment: string, url: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * API endpoint
+         */
+        apiEndpoint: (slug: string, environment: string, endpoint: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * Application version
+         */
+        appVersion: (slug: string, environment: string, version: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * Feature flags (comma-separated list)
+         */
+        featureFlags: (slug: string, environment: string, flags: string[]) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * Third-party API key (secure)
+         */
+        apiKey: (slug: string, environment: string, serviceName: string, key: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * OAuth credentials
+         */
+        oauthCredentials: (slug: string, environment: string, clientId: string, clientSecret: string) => {
+            clientId: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+            clientSecret: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+        };
+        /**
+         * SMTP credentials
+         */
+        smtpCredentials: (slug: string, environment: string, username: string, password: string, host: string, port: number) => {
+            username: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+            password: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+            host: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+            port: {
+                parameter: SSMParameter;
+                logicalId: string;
+            };
+        };
+        /**
+         * Redis connection
+         */
+        redisUrl: (slug: string, environment: string, url: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * S3 bucket name
+         */
+        s3Bucket: (slug: string, environment: string, bucketName: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+        /**
+         * CloudFront distribution ID
+         */
+        cloudFrontDistribution: (slug: string, environment: string, distributionId: string) => {
+            parameter: SSMParameter;
+            logicalId: string;
+        };
+    };
+}

package/dist/modules/permissions.d.ts

@@ -0,0 +1,245 @@
+import type { IAMAccessKey, IAMGroup, IAMInstanceProfile, IAMManagedPolicy, IAMRole, IAMUser } from '@ts-cloud/aws-types';
+import type { EnvironmentType } from '../types';
+export interface PolicyStatement {
+    sid?: string;
+    effect?: 'Allow' | 'Deny';
+    actions: string | string[];
+    resources: string | string[];
+    conditions?: Record<string, unknown>;
+}
+export interface UserOptions {
+    slug: string;
+    environment: EnvironmentType;
+    userName?: string;
+    groups?: string[];
+    managedPolicyArns?: string[];
+}
+export interface RoleOptions {
+    slug: string;
+    environment: EnvironmentType;
+    roleName?: string;
+    servicePrincipal?: string | string[];
+    awsPrincipal?: string | string[];
+    managedPolicyArns?: string[];
+}
+export interface GroupOptions {
+    slug: string;
+    environment: EnvironmentType;
+    groupName?: string;
+    managedPolicyArns?: string[];
+}
+export interface ManagedPolicyOptions {
+    slug: string;
+    environment: EnvironmentType;
+    policyName?: string;
+    description?: string;
+    statements: PolicyStatement[];
+}
+/**
+ * Permissions Module - IAM (Identity and Access Management)
+ * Provides clean API for creating users, roles, policies, and groups
+ */
+export declare class Permissions {
+    /**
+     * Create an IAM user
+     */
+    static createUser(options: UserOptions): {
+        user: IAMUser;
+        logicalId: string;
+    };
+    /**
+     * Create an IAM role
+     */
+    static createRole(options: RoleOptions): {
+        role: IAMRole;
+        logicalId: string;
+    };
+    /**
+     * Create an IAM group
+     */
+    static createGroup(options: GroupOptions): {
+        group: IAMGroup;
+        logicalId: string;
+    };
+    /**
+     * Create a managed policy
+     */
+    static createPolicy(options: ManagedPolicyOptions): {
+        policy: IAMManagedPolicy;
+        logicalId: string;
+    };
+    /**
+     * Attach a policy to a role
+     */
+    static attachPolicyToRole(role: IAMRole, policyArn: string): IAMRole;
+    /**
+     * Attach a policy to a user
+     */
+    static attachPolicyToUser(user: IAMUser, policyArn: string): IAMUser;
+    /**
+     * Attach a policy to a group
+     */
+    static attachPolicyToGroup(group: IAMGroup, policyArn: string): IAMGroup;
+    /**
+     * Add inline policy to a role
+     */
+    static addInlinePolicyToRole(role: IAMRole, policyName: string, statements: PolicyStatement[]): IAMRole;
+    /**
+     * Add inline policy to a user
+     */
+    static addInlinePolicyToUser(user: IAMUser, policyName: string, statements: PolicyStatement[]): IAMUser;
+    /**
+     * Create an access key for programmatic access
+     */
+    static createAccessKey(userLogicalId: string, options: {
+        slug: string;
+        environment: EnvironmentType;
+        status?: 'Active' | 'Inactive';
+    }): {
+        accessKey: IAMAccessKey;
+        logicalId: string;
+    };
+    /**
+     * Create an instance profile for EC2
+     */
+    static createInstanceProfile(roleLogicalId: string, options: {
+        slug: string;
+        environment: EnvironmentType;
+        profileName?: string;
+    }): {
+        instanceProfile: IAMInstanceProfile;
+        logicalId: string;
+    };
+    /**
+     * AWS Managed Policies (common)
+     */
+    static readonly ManagedPolicies: {
+        readonly AdministratorAccess: "arn:aws:iam::aws:policy/AdministratorAccess";
+        readonly PowerUserAccess: "arn:aws:iam::aws:policy/PowerUserAccess";
+        readonly ReadOnlyAccess: "arn:aws:iam::aws:policy/ReadOnlyAccess";
+        readonly S3FullAccess: "arn:aws:iam::aws:policy/AmazonS3FullAccess";
+        readonly S3ReadOnlyAccess: "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess";
+        readonly DynamoDBFullAccess: "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess";
+        readonly DynamoDBReadOnlyAccess: "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess";
+        readonly RDSFullAccess: "arn:aws:iam::aws:policy/AmazonRDSFullAccess";
+        readonly RDSReadOnlyAccess: "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess";
+        readonly LambdaFullAccess: "arn:aws:iam::aws:policy/AWSLambda_FullAccess";
+        readonly LambdaReadOnlyAccess: "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess";
+        readonly LambdaBasicExecutionRole: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole";
+        readonly LambdaVPCAccessExecutionRole: "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole";
+        readonly EC2FullAccess: "arn:aws:iam::aws:policy/AmazonEC2FullAccess";
+        readonly EC2ReadOnlyAccess: "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess";
+        readonly EC2ContainerRegistryReadOnly: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly";
+        readonly EC2ContainerRegistryPowerUser: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser";
+        readonly ECSTaskExecutionRole: "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy";
+        readonly ECSFullAccess: "arn:aws:iam::aws:policy/AmazonECS_FullAccess";
+        readonly CloudWatchFullAccess: "arn:aws:iam::aws:policy/CloudWatchFullAccess";
+        readonly CloudWatchLogsFullAccess: "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess";
+        readonly SESFullAccess: "arn:aws:iam::aws:policy/AmazonSESFullAccess";
+        readonly SNSFullAccess: "arn:aws:iam::aws:policy/AmazonSNSFullAccess";
+        readonly SQSFullAccess: "arn:aws:iam::aws:policy/AmazonSQSFullAccess";
+        readonly SecretsManagerReadWrite: "arn:aws:iam::aws:policy/SecretsManagerReadWrite";
+    };
+    /**
+     * Common service principals
+     */
+    static readonly ServicePrincipals: {
+        readonly Lambda: "lambda.amazonaws.com";
+        readonly EC2: "ec2.amazonaws.com";
+        readonly ECS: "ecs.amazonaws.com";
+        readonly ECSTaskExecution: "ecs-tasks.amazonaws.com";
+        readonly APIGateway: "apigateway.amazonaws.com";
+        readonly Events: "events.amazonaws.com";
+        readonly States: "states.amazonaws.com";
+        readonly CodeBuild: "codebuild.amazonaws.com";
+        readonly CodeDeploy: "codedeploy.amazonaws.com";
+        readonly CloudFormation: "cloudformation.amazonaws.com";
+    };
+    /**
+     * Create a CI/CD user with deployment permissions
+     */
+    static createCiCdUser(options: {
+        slug: string;
+        environment: EnvironmentType;
+        permissions: {
+            s3Buckets?: string[];
+            cloudFrontDistributions?: string[];
+            ecrRepositories?: string[];
+            ecsServices?: string[];
+            cloudFormationStacks?: string[];
+            lambdaFunctions?: string[];
+            secretsManagerSecrets?: string[];
+        };
+        createAccessKey?: boolean;
+    }): {
+        user: IAMUser;
+        accessKey?: IAMAccessKey;
+        policy: IAMManagedPolicy;
+        userLogicalId: string;
+        accessKeyLogicalId?: string;
+        policyLogicalId: string;
+        resources: Record<string, any>;
+    };
+    /**
+     * Create a cross-account access role
+     */
+    static createCrossAccountRole(options: {
+        slug: string;
+        environment: EnvironmentType;
+        trustedAccountIds: string[];
+        externalId?: string;
+        permissions: PolicyStatement[];
+        maxSessionDuration?: number;
+    }): {
+        role: IAMRole;
+        policy: IAMManagedPolicy;
+        roleLogicalId: string;
+        policyLogicalId: string;
+        resources: Record<string, any>;
+    };
+    /**
+     * Create a CLI access user with minimal permissions
+     */
+    static createCliUser(options: {
+        slug: string;
+        environment: EnvironmentType;
+        permissions?: 'readonly' | 'deploy' | 'admin';
+    }): {
+        user: IAMUser;
+        accessKey: IAMAccessKey;
+        policy?: IAMManagedPolicy;
+        userLogicalId: string;
+        accessKeyLogicalId: string;
+        policyLogicalId?: string;
+        resources: Record<string, any>;
+    };
+    /**
+     * Common CI/CD policy templates
+     */
+    static readonly CiCdPolicies: {
+        /**
+         * S3 static site deployment policy
+         */
+        s3Deployment: (bucketArns: string[]) => PolicyStatement[];
+        /**
+         * CloudFront invalidation policy
+         */
+        cloudFrontInvalidation: (distributionArns: string[]) => PolicyStatement[];
+        /**
+         * ECS deployment policy
+         */
+        ecsDeployment: () => PolicyStatement[];
+        /**
+         * ECR push policy
+         */
+        ecrPush: (repositoryArns: string[]) => PolicyStatement[];
+        /**
+         * Lambda deployment policy
+         */
+        lambdaDeployment: (functionArns: string[]) => PolicyStatement[];
+        /**
+         * CloudFormation deployment policy
+         */
+        cloudFormationDeployment: (stackArns: string[]) => PolicyStatement[];
+    };
+}

package/dist/modules/phone.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Phone/Voice Module for CloudFormation
+ *
+ * Provides CloudFormation resources for Amazon Connect phone infrastructure
+ */
+export interface PhoneConfig {
+    slug: string;
+    environment: string;
+    instanceAlias: string;
+    inboundCallsEnabled?: boolean;
+    outboundCallsEnabled?: boolean;
+    voicemailEnabled?: boolean;
+    transcriptionEnabled?: boolean;
+    notificationTopicArn?: string;
+    webhookUrl?: string;
+}
+export declare class Phone {
+    /**
+     * Lambda code for phone handlers
+     */
+    static LambdaCode: {
+        incomingCall: string;
+        voicemail: string;
+        missedCall: string;
+    };
+    /**
+     * Create Amazon Connect instance CloudFormation resource
+     */
+    static createConnectInstance(config: PhoneConfig): Record<string, any>;
+    /**
+     * Create hours of operation resource
+     */
+    static createHoursOfOperation(config: {
+        slug: string;
+        instanceArn: string;
+        name: string;
+        timezone: string;
+        schedule: Array<{
+            day: string;
+            startHour: number;
+            startMinute: number;
+            endHour: number;
+            endMinute: number;
+        }>;
+    }): Record<string, any>;
+    /**
+     * Create queue resource
+     */
+    static createQueue(config: {
+        slug: string;
+        instanceArn: string;
+        name: string;
+        hoursOfOperationArn: string;
+        maxContacts?: number;
+    }): Record<string, any>;
+    /**
+     * Create contact flow resource
+     */
+    static createContactFlow(config: {
+        slug: string;
+        instanceArn: string;
+        name: string;
+        type: 'CONTACT_FLOW' | 'CUSTOMER_QUEUE' | 'CUSTOMER_HOLD' | 'CUSTOMER_WHISPER' | 'AGENT_HOLD' | 'AGENT_WHISPER' | 'OUTBOUND_WHISPER' | 'AGENT_TRANSFER' | 'QUEUE_TRANSFER';
+        content: string;
+    }): Record<string, any>;
+    /**
+     * Create basic IVR contact flow content
+     */
+    static createBasicIvrFlow(config: {
+        greeting: string;
+        queueArn: string;
+        voicemailLambdaArn?: string;
+    }): string;
+    /**
+     * Create Lambda role for phone handlers
+     */
+    static createPhoneLambdaRole(config: {
+        slug: string;
+    }): Record<string, any>;
+    /**
+     * Create incoming call Lambda function
+     */
+    static createIncomingCallLambda(config: {
+        slug: string;
+        roleArn: string;
+        notificationTopicArn?: string;
+        callLogTable?: string;
+        webhookUrl?: string;
+    }): Record<string, any>;
+    /**
+     * Create voicemail Lambda function
+     */
+    static createVoicemailLambda(config: {
+        slug: string;
+        roleArn: string;
+        voicemailBucket: string;
+        notificationTopicArn?: string;
+        callLogTable?: string;
+        transcriptionEnabled?: boolean;
+    }): Record<string, any>;
+    /**
+     * Create missed call Lambda function
+     */
+    static createMissedCallLambda(config: {
+        slug: string;
+        roleArn: string;
+        notificationTopicArn?: string;
+        callLogTable?: string;
+        webhookUrl?: string;
+    }): Record<string, any>;
+    /**
+     * Create call log DynamoDB table
+     */
+    static createCallLogTable(config: {
+        slug: string;
+    }): Record<string, any>;
+    /**
+     * Create complete phone setup
+     */
+    static createCompleteSetup(config: PhoneConfig): {
+        resources: Record<string, any>;
+        outputs: Record<string, any>;
+    };
+}
+export default Phone;