quidproquo-deploy-awscdk 0.0.263 → 0.1.0

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.d.ts

@@ -0,0 +1,25 @@
+import { QPQConfig } from 'quidproquo-core';
+import { aws_cloudwatch } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+export interface DefaultResourceAlarmProps {
+    /** Construct id (also seeds the per-event-bus action ids). */
+    id: string;
+    alarmName: string;
+    metric: aws_cloudwatch.IMetric;
+    threshold: number;
+    comparisonOperator?: aws_cloudwatch.ComparisonOperator;
+    evaluationPeriods?: number;
+    datapointsToAlarm?: number;
+}
+/** Event buses that error/alarm notifications route to (from `defineNotifyError`). */
+export declare const getNotifyErrorEventBusNames: (qpqConfig: QPQConfig) => string[];
+/**
+ * Create a sensible default alarm for a resource and route it to the service's
+ * error-notification event bus(es).
+ *
+ * Opt-in: this is a no-op unless the service declares a `defineNotifyError`. We
+ * reuse that config's target bus so default alarms land wherever errors already
+ * do (no separate ops-routing concept). If a NotifyError exists but names no
+ * bus, the alarm is still created (visible in console / dashboards) but unrouted.
+ */
+export declare const createDefaultResourceAlarm: (scope: Construct, qpqConfig: QPQConfig, props: DefaultResourceAlarmProps) => void;

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultResourceAlarm = exports.getNotifyErrorEventBusNames = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+// Imported by direct path (not the ../feature/core barrel) to avoid an import
+// cycle: resource constructs import this helper, and the barrel re-exports those
+// same resource constructs.
+const QpqCoreEventBusConstruct_1 = require("../feature/core/eventBus/QpqCoreEventBusConstruct");
+/** Event buses that error/alarm notifications route to (from `defineNotifyError`). */
+const getNotifyErrorEventBusNames = (qpqConfig) => {
+    const names = quidproquo_core_1.qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).flatMap((config) => config.onAlarm.publishToEventBus || []);
+    return [...new Set(names)];
+};
+exports.getNotifyErrorEventBusNames = getNotifyErrorEventBusNames;
+/**
+ * Create a sensible default alarm for a resource and route it to the service's
+ * error-notification event bus(es).
+ *
+ * Opt-in: this is a no-op unless the service declares a `defineNotifyError`. We
+ * reuse that config's target bus so default alarms land wherever errors already
+ * do (no separate ops-routing concept). If a NotifyError exists but names no
+ * bus, the alarm is still created (visible in console / dashboards) but unrouted.
+ */
+const createDefaultResourceAlarm = (scope, qpqConfig, props) => {
+    var _a, _b;
+    if (quidproquo_core_1.qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).length === 0) {
+        return;
+    }
+    const alarm = new aws_cdk_lib_1.aws_cloudwatch.Alarm(scope, props.id, {
+        alarmName: props.alarmName,
+        metric: props.metric,
+        threshold: props.threshold,
+        comparisonOperator: (_a = props.comparisonOperator) !== null && _a !== void 0 ? _a : aws_cdk_lib_1.aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        evaluationPeriods: (_b = props.evaluationPeriods) !== null && _b !== void 0 ? _b : 1,
+        datapointsToAlarm: props.datapointsToAlarm,
+    });
+    (0, exports.getNotifyErrorEventBusNames)(qpqConfig).forEach((busName) => {
+        const eventBus = QpqCoreEventBusConstruct_1.QpqCoreEventBusConstruct.fromOtherStack(scope, `${props.id}-bus-${busName}`, qpqConfig, busName);
+        alarm.addAlarmAction(new aws_cdk_lib_1.aws_cloudwatch_actions.SnsAction(eventBus.topic));
+    });
+};
+exports.createDefaultResourceAlarm = createDefaultResourceAlarm;

package/lib/commonjs/constructs/basic/DomainCertificateLookup.d.ts

@@ -0,0 +1,16 @@
+import { aws_certificatemanager } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+/**
+ * Service-side helper to import an ACM certificate previously created by a DomainCertificateStack.
+ *
+ * The domain phase writes the cert ARN into an SSM parameter in the deploy region, keyed by region.
+ * This helper reads that parameter as a deploy-time CloudFormation token and imports the cert by ARN.
+ * Resolution is deferred to CloudFormation at deploy time (via valueForStringParameter), so synth does
+ * not require the domain stack to have been deployed yet.
+ *
+ * @param scope      CDK construct scope (typically the service stack/construct)
+ * @param certRegion 'us-east-1' for CloudFront, deploy region for regional resources
+ * @param rootDomain The same un-prefixed apex passed to the matching defineDomainCertificate entry
+ * @param idSuffix   Unique suffix for the CDK construct id (scope-local)
+ */
+export declare const lookupDomainCertificate: (scope: Construct, certRegion: string, rootDomain: string, idSuffix: string) => aws_certificatemanager.ICertificate;

package/lib/commonjs/constructs/basic/DomainCertificateLookup.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookupDomainCertificate = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+/**
+ * Service-side helper to import an ACM certificate previously created by a DomainCertificateStack.
+ *
+ * The domain phase writes the cert ARN into an SSM parameter in the deploy region, keyed by region.
+ * This helper reads that parameter as a deploy-time CloudFormation token and imports the cert by ARN.
+ * Resolution is deferred to CloudFormation at deploy time (via valueForStringParameter), so synth does
+ * not require the domain stack to have been deployed yet.
+ *
+ * @param scope      CDK construct scope (typically the service stack/construct)
+ * @param certRegion 'us-east-1' for CloudFront, deploy region for regional resources
+ * @param rootDomain The same un-prefixed apex passed to the matching defineDomainCertificate entry
+ * @param idSuffix   Unique suffix for the CDK construct id (scope-local)
+ */
+const lookupDomainCertificate = (scope, certRegion, rootDomain, idSuffix) => {
+    const paramName = quidproquo_config_aws_1.qpqConfigAwsUtils.getDomainCertificateArnSsmParameterName(certRegion, rootDomain);
+    const certArn = aws_cdk_lib_1.aws_ssm.StringParameter.valueForStringParameter(scope, paramName);
+    return aws_cdk_lib_1.aws_certificatemanager.Certificate.fromCertificateArn(scope, `domain-cert-${idSuffix}`, certArn);
+};
+exports.lookupDomainCertificate = lookupDomainCertificate;

package/lib/commonjs/constructs/basic/Function.js

@@ -53,7 +53,7 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
         this.lambdaFunction = new aws_cdk_lib_1.aws_lambda.Function(this, functionId, {
             functionName: props.functionName,
             timeout: cdk.Duration.seconds(props.timeoutInSeconds || 25),
-            runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_20_X,
+            runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X,
             memorySize: props.memoryInBytes || serviceInfo.lambdaMaxMemoryInMiB || 1024,
             layers: props.apiLayerVersions,
             code: aws_cdk_lib_1.aws_lambda.Code.fromAsset((0, upath_1.join)(utils_1.qpqAwsCdkPathUtils.getApiBuildPathFullPath(props.qpqConfig), props.functionType)),
@@ -62,10 +62,9 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
             reservedConcurrentExecutions: quidproquo_config_aws_2.qpqConfigAwsUtils.isReservedConcurrencyDisabled(props.qpqConfig)
                 ? undefined
                 : props.reservedConcurrentExecutions,
-            // TODO: Make this optional
-            tracing: aws_cdk_lib_1.aws_lambda.Tracing.DISABLED,
+            tracing: quidproquo_config_aws_2.qpqConfigAwsUtils.isTracingDisabled(props.qpqConfig) ? aws_cdk_lib_1.aws_lambda.Tracing.DISABLED : aws_cdk_lib_1.aws_lambda.Tracing.ACTIVE,
             logGroup: new aws_cdk_lib_1.aws_logs.LogGroup(this, 'LogGroup', {
-                retention: aws_cdk_lib_1.aws_logs.RetentionDays.ONE_WEEK,
+                retention: aws_cdk_lib_1.aws_logs.RetentionDays.ONE_YEAR,
                 removalPolicy: cdk.RemovalPolicy.DESTROY,
             }),
             role: props.role,

package/lib/commonjs/constructs/basic/LambdaLayers.js

@@ -23,15 +23,23 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         super(scope, id, props);
         const apiLayers = (0, exports.getLambdaLayersWithFullPaths)(props.qpqConfig);
-        this.layers = apiLayers.map((layer) => {
+        const userLayers = apiLayers.map((layer) => {
             return layer.buildPath
                 ? new aws_cdk_lib_1.aws_lambda.LayerVersion(this, `${layer.name}-layer`, {
                     layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),
                     code: new aws_cdk_lib_1.aws_lambda.AssetCode(layer.buildPath),
-                    compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_20_X],
+                    compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
                 })
                 : aws_cdk_lib_1.aws_lambda.LayerVersion.fromLayerVersionArn(this, `${layer.name}-layer-ref`, layer.layerArn);
         });
+        // Always-on: the qpq-log-extension ships story logs to S3 off the function's
+        // response path. Attached to every function via apiLayerVersions.
+        const logExtensionLayer = new aws_cdk_lib_1.aws_lambda.LayerVersion(this, 'qpq-log-extension-layer', {
+            layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig('qpq-log-extension', props.qpqConfig),
+            code: new aws_cdk_lib_1.aws_lambda.AssetCode((0, quidproquo_actionprocessor_awslambda_1.getLogExtensionLayerPath)()),
+            compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
+        });
+        this.layers = [...userLayers, logExtensionLayer];
     }
 }
 exports.LambdaLayers = LambdaLayers;

package/lib/commonjs/constructs/basic/SubdomainName.d.ts

@@ -4,10 +4,11 @@ import { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructB
 export interface SubdomainNameProps extends QpqConstructBlockProps {
     subdomain: string;
     apexDomain: string;
+    rootDomain: string;
 }
 export declare class SubdomainName extends QpqConstructBlock {
     readonly domainName: aws_apigateway.DomainName;
-    readonly certificate: aws_certificatemanager.Certificate;
+    readonly certificate: aws_certificatemanager.ICertificate;
     readonly targetARecord: aws_route53.RecordTarget;
     readonly deployDomain: string;
     constructor(scope: Construct, id: string, props: SubdomainNameProps);

package/lib/commonjs/constructs/basic/SubdomainName.js

@@ -1,20 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SubdomainName = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_webserver_1 = require("quidproquo-webserver");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
+const DomainCertificateLookup_1 = require("./DomainCertificateLookup");
 class SubdomainName extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         super(scope, id, props);
         this.deployDomain = `${props.subdomain}.${props.apexDomain}`;
+        // Always look up the root hosted zone (e.g. development.quidproquojs.com), not
+        // a per-service sub-zone. The FQDN may include the service name (e.g.
+        // ws.shell.development.quidproquojs.com) but the A record lives in the root zone.
+        const hostedZoneDomain = quidproquo_webserver_1.qpqWebServerUtils.resolveDomainRoot(props.rootDomain, props.qpqConfig);
         const apexHostedZone = aws_cdk_lib_1.aws_route53.HostedZone.fromLookup(this, 'hosted-zone', {
-            domainName: props.apexDomain,
-        });
-        this.certificate = new aws_cdk_lib_1.aws_certificatemanager.Certificate(this, 'certificate', {
-            domainName: this.deployDomain,
-            certificateName: `${this.deployDomain}-cert`,
-            validation: aws_cdk_lib_1.aws_certificatemanager.CertificateValidation.fromDns(apexHostedZone),
+            domainName: hostedZoneDomain,
         });
+        // Regional API Gateway custom domains need a cert in the deploy region.
+        // Look it up from SSM, written by the matching DomainCertificateStack during the domain phase.
+        const deployRegion = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
+        this.certificate = (0, DomainCertificateLookup_1.lookupDomainCertificate)(this, deployRegion, props.rootDomain, props.subdomain);
         this.domainName = new aws_cdk_lib_1.aws_apigateway.DomainName(this, 'domain-name', {
             domainName: this.deployDomain,
             certificate: this.certificate,

package/lib/commonjs/constructs/basic/WebserverRoll.js

@@ -11,51 +11,49 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
             assumedBy: new aws_cdk_lib_1.aws_iam.CompositePrincipal(new aws_cdk_lib_1.aws_iam.ServicePrincipal('lambda.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('transfer.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('edgelambda.amazonaws.com')),
         });
         const policies = [
+            // Resolve cross-stack resource names at runtime via CloudFormation exports.
             {
                 sid: 'CloudFormationListExports',
                 actions: ['cloudformation:ListExports'],
                 resources: ['*'],
             },
+            // Look up API Gateway metadata (stages, deployments) from within Lambdas.
             {
                 sid: 'APIGatewayGetOperations',
                 actions: ['apigateway:GET'],
                 resources: ['*'],
             },
+            // Invalidate CloudFront caches after web-entry static asset deploys.
             {
                 sid: 'CloudFrontCreateInvalidation',
                 actions: ['cloudfront:CreateInvalidation'],
                 resources: ['*'],
             },
+            // Publish to event-bus SNS topics (the framework's pub/sub layer).
             {
                 sid: 'SNSPublishMessages',
                 actions: ['sns:Publish'],
                 resources: ['*'],
             },
+            // Invoke QPQ service functions (`*sfunc*`) from other Lambdas.
             {
                 sid: 'LambdaInvokeFunction',
                 actions: ['lambda:InvokeFunction'],
                 resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
             },
-            {
-                sid: 'S3BucketOperations',
-                actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
-                resources: ['arn:aws:s3:::*'],
-            },
+            // Push messages to websocket clients via API Gateway Management API.
             {
                 sid: 'APIGatewayManageConnections',
                 actions: ['execute-api:ManageConnections'],
                 resources: ['*'],
             },
+            // Look up ACM certs when wiring up custom domains at runtime.
             {
                 sid: 'ACMCertificateOperations',
                 actions: ['acm:DescribeCertificate', 'acm:ListCertificates'],
                 resources: ['*'],
             },
-            {
-                sid: 'DynamoDBTableOperations',
-                actions: ['dynamodb:GetItem', 'dynamodb:Scan', 'dynamodb:Query', 'dynamodb:PutItem', 'dynamodb:UpdateItem', 'dynamodb:DeleteItem'],
-                resources: ['arn:aws:dynamodb:*:*:table/*'],
-            },
+            // Standard Lambda logging + log retrieval for the `askGetLogs` flow.
             {
                 sid: 'CloudWatchLogsManagement',
                 actions: [
@@ -69,6 +67,7 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 ],
                 resources: ['*'],
             },
+            // Required for VPC-attached Lambdas to manage their ENIs.
             {
                 sid: 'EC2NetworkInterfacePermissions',
                 actions: [
@@ -80,11 +79,6 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 ],
                 resources: ['*'],
             },
-            {
-                sid: 'TextractDocumentProcessing',
-                actions: ['textract:*'],
-                resources: ['*'],
-            },
         ];
         policies.forEach((policy) => {
             role.addToPolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement(policy));

package/lib/commonjs/constructs/basic/index.d.ts

@@ -1,5 +1,4 @@
+export * from './DomainCertificateLookup';
 export * from './Function';
-export * from './InfQpqWebserverServiceDomainsConstruct';
 export * from './LambdaLayers';
-export * from './ServiceDomain';
 export * from './SubdomainName';

package/lib/commonjs/constructs/basic/index.js

@@ -14,8 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./DomainCertificateLookup"), exports);
 __exportStar(require("./Function"), exports);
-__exportStar(require("./InfQpqWebserverServiceDomainsConstruct"), exports);
 __exportStar(require("./LambdaLayers"), exports);
-__exportStar(require("./ServiceDomain"), exports);
 __exportStar(require("./SubdomainName"), exports);

package/lib/commonjs/constructs/feature/config/alarm/QpqConfigAwsAlarm.js

@@ -57,32 +57,28 @@ class QpqConfigAwsAlarmConstruct extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         var _a;
         super(scope, id, props);
-        // Check if the namespace is Lambda
-        if (props.alarmConfig.alarmSettings.namespace === quidproquo_config_aws_1.AwsAlarmNamespace.Lambda) {
-            const lambdaAlarmSettings = props.alarmConfig.alarmSettings;
-            // Create CloudWatch alarm for Lambda
-            const alarm = new aws_cdk_lib_1.aws_cloudwatch.Alarm(this, props.alarmConfig.uniqueKey, {
-                alarmName: this.resourceName(props.alarmConfig.name),
-                metric: new aws_cdk_lib_1.aws_cloudwatch.Metric({
-                    namespace: lambdaAlarmSettings.namespace,
-                    metricName: lambdaAlarmSettings.metricName,
-                    statistic: lambdaAlarmSettings.statistic,
-                    period: cdk.Duration.seconds(lambdaAlarmSettings.period),
-                }),
-                threshold: lambdaAlarmSettings.threshold,
-                comparisonOperator: AwsAlarmOperatorToComparisonOperator(lambdaAlarmSettings.operator),
-                datapointsToAlarm: lambdaAlarmSettings.datapointsToAlarm,
-                evaluationPeriods: lambdaAlarmSettings.evaluationPeriodsToAlarm,
-            });
-            (_a = props.alarmConfig.alarmSettings.onAlarm.publishToEventBus) === null || _a === void 0 ? void 0 : _a.forEach((eventBusName) => {
-                const eventBus = core_1.QpqCoreEventBusConstruct.fromOtherStack(scope, 'eventBus', props.qpqConfig, eventBusName);
-                alarm.addAlarmAction(new aws_cdk_lib_1.aws_cloudwatch_actions.SnsAction(eventBus.topic));
-            });
-        }
-        else {
-            // Handle other namespaces or throw an error
-            throw new Error(`Invalid namespace ${props.alarmConfig.alarmSettings.namespace}`);
-        }
+        // The alarm is built entirely from the shared BaseAwsAlarmQPQConfigSetting
+        // fields, so it is namespace-agnostic — Lambda, ApiGateway, DynamoDb and Sqs
+        // (and any future namespace) are all supported via the config's namespace +
+        // metricName pair, no per-namespace branching required.
+        const alarmSettings = props.alarmConfig.alarmSettings;
+        const alarm = new aws_cdk_lib_1.aws_cloudwatch.Alarm(this, props.alarmConfig.uniqueKey, {
+            alarmName: this.resourceName(props.alarmConfig.name),
+            metric: new aws_cdk_lib_1.aws_cloudwatch.Metric({
+                namespace: alarmSettings.namespace,
+                metricName: alarmSettings.metricName,
+                statistic: alarmSettings.statistic,
+                period: cdk.Duration.seconds(alarmSettings.period),
+            }),
+            threshold: alarmSettings.threshold,
+            comparisonOperator: AwsAlarmOperatorToComparisonOperator(alarmSettings.operator),
+            datapointsToAlarm: alarmSettings.datapointsToAlarm,
+            evaluationPeriods: alarmSettings.evaluationPeriodsToAlarm,
+        });
+        (_a = alarmSettings.onAlarm.publishToEventBus) === null || _a === void 0 ? void 0 : _a.forEach((eventBusName) => {
+            const eventBus = core_1.QpqCoreEventBusConstruct.fromOtherStack(scope, 'eventBus', props.qpqConfig, eventBusName);
+            alarm.addAlarmAction(new aws_cdk_lib_1.aws_cloudwatch_actions.SnsAction(eventBus.topic));
+        });
     }
 }
 exports.QpqConfigAwsAlarmConstruct = QpqConfigAwsAlarmConstruct;

package/lib/commonjs/constructs/feature/config/cloudTrail/QpqBootstrapConfigCloudTrailConstruct.d.ts

@@ -0,0 +1,9 @@
+import { BootstrapCloudTrailQPQConfigSetting } from 'quidproquo-config-aws';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
+export interface QpqBootstrapConfigCloudTrailConstructProps extends QpqConstructBlockProps {
+    cloudTrailConfig: BootstrapCloudTrailQPQConfigSetting;
+}
+export declare class QpqBootstrapConfigCloudTrailConstruct extends QpqConstructBlock {
+    constructor(scope: Construct, id: string, props: QpqBootstrapConfigCloudTrailConstructProps);
+}

package/lib/commonjs/constructs/feature/config/cloudTrail/QpqBootstrapConfigCloudTrailConstruct.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqBootstrapConfigCloudTrailConstruct = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const cdk = __importStar(require("aws-cdk-lib"));
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const QpqConstructBlock_1 = require("../../../base/QpqConstructBlock");
+const SUPPORTED_RETENTION_DAYS = [
+    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_DAY,
+    aws_cdk_lib_1.aws_logs.RetentionDays.THREE_DAYS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_DAYS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_WEEK,
+    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_WEEKS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_MONTH,
+    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.THREE_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.FOUR_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.SIX_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_YEAR,
+    aws_cdk_lib_1.aws_logs.RetentionDays.THIRTEEN_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.EIGHTEEN_MONTHS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_YEARS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_YEARS,
+    aws_cdk_lib_1.aws_logs.RetentionDays.TEN_YEARS,
+];
+const resolveLogRetention = (days) => {
+    var _a;
+    if (!days)
+        return aws_cdk_lib_1.aws_logs.RetentionDays.ONE_MONTH;
+    return (_a = SUPPORTED_RETENTION_DAYS.find((v) => v >= days)) !== null && _a !== void 0 ? _a : aws_cdk_lib_1.aws_logs.RetentionDays.TEN_YEARS;
+};
+class QpqBootstrapConfigCloudTrailConstruct extends QpqConstructBlock_1.QpqConstructBlock {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { name, retentionDays = 365, enableLogFileValidation = true, multiRegion = true, includeGlobalServiceEvents = true, cloudWatchLogs, } = props.cloudTrailConfig;
+        const accountId = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
+        const bucket = new aws_cdk_lib_1.aws_s3.Bucket(this, 'logs', {
+            bucketName: `qpq-cloudtrail-${accountId}-${region}-${name}`,
+            blockPublicAccess: aws_cdk_lib_1.aws_s3.BlockPublicAccess.BLOCK_ALL,
+            encryption: aws_cdk_lib_1.aws_s3.BucketEncryption.S3_MANAGED,
+            enforceSSL: true,
+            removalPolicy: cdk.RemovalPolicy.RETAIN,
+            lifecycleRules: [{ expiration: cdk.Duration.days(retentionDays) }],
+        });
+        const logGroup = cloudWatchLogs
+            ? new aws_cdk_lib_1.aws_logs.LogGroup(this, 'log-group', {
+                logGroupName: `/qpq/cloudtrail/${name}`,
+                retention: resolveLogRetention(cloudWatchLogs.retentionDays),
+                removalPolicy: cdk.RemovalPolicy.DESTROY,
+            })
+            : undefined;
+        new aws_cdk_lib_1.aws_cloudtrail.Trail(this, 'trail', {
+            trailName: `${name}-trail`,
+            bucket,
+            enableFileValidation: enableLogFileValidation,
+            isMultiRegionTrail: multiRegion,
+            includeGlobalServiceEvents,
+            sendToCloudWatchLogs: !!logGroup,
+            cloudWatchLogGroup: logGroup,
+        });
+    }
+}
+exports.QpqBootstrapConfigCloudTrailConstruct = QpqBootstrapConfigCloudTrailConstruct;

package/lib/commonjs/constructs/feature/config/cloudTrail/index.d.ts

@@ -0,0 +1 @@
+export * from './QpqBootstrapConfigCloudTrailConstruct';

package/lib/commonjs/constructs/feature/config/cloudTrail/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./QpqBootstrapConfigCloudTrailConstruct"), exports);

package/lib/commonjs/constructs/feature/config/index.d.ts

@@ -1,2 +1,3 @@
 export * from './alarm';
+export * from './cloudTrail';
 export * from './organization';

package/lib/commonjs/constructs/feature/config/index.js

@@ -15,4 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./alarm"), exports);
+__exportStar(require("./cloudTrail"), exports);
 __exportStar(require("./organization"), exports);

package/lib/commonjs/constructs/feature/core/ai/QpqCoreAiConstruct.d.ts

@@ -0,0 +1,5 @@
+import { AiQPQConfigSetting } from 'quidproquo-core';
+import { aws_iam } from 'aws-cdk-lib';
+export declare class QpqCoreAiConstruct {
+    static authorizeActionsForRole(role: aws_iam.IRole, aiConfigs: AiQPQConfigSetting[]): void;
+}

package/lib/commonjs/constructs/feature/core/ai/QpqCoreAiConstruct.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqCoreAiConstruct = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+class QpqCoreAiConstruct {
+    static authorizeActionsForRole(role, aiConfigs) {
+        if (aiConfigs.length === 0) {
+            return;
+        }
+        role.addToPrincipalPolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
+            effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
+            actions: ['bedrock:InvokeModel', 'bedrock:InvokeModelWithResponseStream'],
+            resources: ['*'],
+        }));
+    }
+}
+exports.QpqCoreAiConstruct = QpqCoreAiConstruct;

package/lib/commonjs/constructs/feature/core/ai/index.d.ts

@@ -0,0 +1 @@
+export * from './QpqCoreAiConstruct';

package/lib/commonjs/constructs/feature/{webserver/domain → core/ai}/index.js

@@ -14,4 +14,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./QpqWebserverDomainConstruct"), exports);
+__exportStar(require("./QpqCoreAiConstruct"), exports);

package/lib/commonjs/constructs/feature/core/auth/QpqInfCoreUserDirectoryConstruct.d.ts

@@ -9,5 +9,5 @@ export declare class QpqInfCoreUserDirectoryConstruct extends QpqConstructBlock
     userPool: aws_cognito.IUserPool;
     static fromOtherStack(scope: Construct, id: string, qpqConfig: QPQConfig, userDirectoryName: string): QpqInfCoreUserDirectoryConstruct;
     constructor(scope: Construct, id: string, props: QpqInfCoreUserDirectoryConstructProps);
-    static authorizeActionsForRole(role: aws_iam.IRole, userDirectoryConfigs: UserDirectoryQPQConfigSetting[], userDirectoryConstructs: QpqInfCoreUserDirectoryConstruct[], qpqConfig: QPQConfig): void;
+    static authorizeAdminActionsForRole(role: aws_iam.IRole, userDirectoryConfigs: UserDirectoryQPQConfigSetting[], userDirectoryConstructs: QpqInfCoreUserDirectoryConstruct[], qpqConfig: QPQConfig): void;
 }