quidproquo-deploy-awscdk 0.1.2 → 0.1.4

package/lib/commonjs/QPQApp.js

@@ -39,3 +39,4 @@ const createQPQApp = () => {
     return new cdk.App();
 };
 exports.createQPQApp = createQPQApp;
+//# sourceMappingURL=QPQApp.js.map

package/lib/commonjs/QPQApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QPQApp.js","sourceRoot":"","sources":["../../src/QPQApp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AAE5B,MAAM,YAAY,GAAG,GAAY,EAAE;IACxC,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB","sourcesContent":["import * as cdk from 'aws-cdk-lib';\n\nexport const createQPQApp = (): cdk.App => {\n  return new cdk.App();\n};\n"]}

package/lib/commonjs/constants/BootstrapResource.js

@@ -5,3 +5,4 @@ var BootstrapResource;
 (function (BootstrapResource) {
     BootstrapResource["WarmLambdas"] = "WarmLambdas";
 })(BootstrapResource || (exports.BootstrapResource = BootstrapResource = {}));
+//# sourceMappingURL=BootstrapResource.js.map

package/lib/commonjs/constants/BootstrapResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BootstrapResource.js","sourceRoot":"","sources":["../../../src/constants/BootstrapResource.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBAEX;AAFD,WAAY,iBAAiB;IAC3B,gDAA2B,CAAA;AAC7B,CAAC,EAFW,iBAAiB,iCAAjB,iBAAiB,QAE5B","sourcesContent":["export enum BootstrapResource {\n  WarmLambdas = 'WarmLambdas',\n}\n"]}

package/lib/commonjs/constants/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./BootstrapResource"), exports);
 __exportStar(require("./logging"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,4CAA0B","sourcesContent":["export * from './BootstrapResource';\nexport * from './logging';\n"]}

package/lib/commonjs/constants/logging.js

@@ -2,3 +2,4 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.QPQ_LOG_BUCKET_NAME = void 0;
 exports.QPQ_LOG_BUCKET_NAME = 'logs';
+//# sourceMappingURL=logging.js.map

package/lib/commonjs/constants/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/constants/logging.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG,MAAM,CAAC","sourcesContent":["export const QPQ_LOG_BUCKET_NAME = 'logs';\n"]}

package/lib/commonjs/constructs/base/QpqConstructBlock.js

@@ -37,3 +37,4 @@ class QpqConstructBlock extends constructs_1.Construct {
     }
 }
 exports.QpqConstructBlock = QpqConstructBlock;
+//# sourceMappingURL=QpqConstructBlock.js.map

package/lib/commonjs/constructs/base/QpqConstructBlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqConstructBlock.js","sourceRoot":"","sources":["../../../../src/constructs/base/QpqConstructBlock.ts"],"names":[],"mappings":";;;AAAA,+FAAsE;AAGtE,6CAAsC;AAEtC,2CAAuC;AAQvC,MAAa,iBAAkB,SAAQ,sBAAS;IAI9C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA6B;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,qDAAc,CAAC,sCAAsC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrF,CAAC;IAED,6BAA6B,CAAC,IAAY,EAAE,MAAe;QACzD,OAAO,qDAAc,CAAC,yDAAyD,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChH,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,YAAoB;QAChD,OAAO,qDAAc,CAAC,mCAAmC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IAED,wBAAwB,CAAC,IAAY;QACnC,OAAO,qDAAc,CAAC,+CAA+C,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAED,SAAS,CAAC,OAAmB,IAAS,CAAC;IAEvC,UAAU,CAAC,OAAmB,IAAS,CAAC;IAExC,QAAQ,CAAC,OAAmB;QAC1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,qBAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE;gBACpG,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AA5CD,8CA4CC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { QPQConfig } from 'quidproquo-core';\n\nimport { aws_iam } from 'aws-cdk-lib';\nimport { IGrantable, IRole } from 'aws-cdk-lib/aws-iam';\nimport { Construct } from 'constructs';\n\nimport { QpqResource } from './QpqResource';\n\nexport interface QpqConstructBlockProps {\n  qpqConfig: QPQConfig;\n}\n\nexport class QpqConstructBlock extends Construct implements QpqResource {\n  qpqConfig: QPQConfig;\n  serviceRole?: aws_iam.IRole;\n\n  constructor(scope: Construct, id: string, props: QpqConstructBlockProps) {\n    super(scope, id);\n\n    this.qpqConfig = props.qpqConfig;\n  }\n\n  resourceName(name: string) {\n    return awsNamingUtils.getConfigRuntimeResourceNameFromConfig(name, this.qpqConfig);\n  }\n\n  resourceNameWithModuleOveride(name: string, module?: string) {\n    return awsNamingUtils.getConfigRuntimeResourceNameFromConfigWithServiceOverride(name, this.qpqConfig, module);\n  }\n\n  qpqResourceName(name: string, resourceType: string) {\n    return awsNamingUtils.getQpqRuntimeResourceNameFromConfig(name, this.qpqConfig, resourceType);\n  }\n\n  qpqBootstrapResourceName(name: string) {\n    return awsNamingUtils.getConfigRuntimeBootstrapResourceNameFromConfig(name, this.qpqConfig);\n  }\n\n  grantRead(grantee: IGrantable): void {}\n\n  grantWrite(grantee: IGrantable): void {}\n\n  grantAll(grantee: IGrantable): void {\n    this.grantRead(grantee);\n    this.grantWrite(grantee);\n  }\n\n  getServiceRole(): aws_iam.IRole {\n    if (!this.serviceRole) {\n      this.serviceRole = aws_iam.Role.fromRoleName(this, 'service-role', this.resourceName('service-role'), {\n        mutable: true,\n      });\n    }\n\n    return this.serviceRole;\n  }\n}\n"]}

package/lib/commonjs/constructs/base/QpqResource.js

@@ -1,2 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=QpqResource.js.map

package/lib/commonjs/constructs/base/QpqResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqResource.js","sourceRoot":"","sources":["../../../../src/constructs/base/QpqResource.ts"],"names":[],"mappings":"","sourcesContent":["import { aws_iam } from 'aws-cdk-lib';\n\nexport interface QpqResource {\n  /**\n   * Grants read permissions on this resource.\n   *\n   * @param grantee the role to be granted read-only access to the resource.\n   */\n  grantRead(grantee: aws_iam.IGrantable): void;\n\n  /**\n   * Grants write permissions on the resource.\n   *\n   * @param grantee the role to be granted write access to the resource.\n   */\n  grantWrite(grantee: aws_iam.IGrantable): void;\n\n  /**\n   * Grants read/write permissions on the resource.\n   *\n   * @param grantee the role to be granted read/write access to the resource.\n   */\n  grantAll(grantee: aws_iam.IGrantable): void;\n}\n"]}

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.js

@@ -41,3 +41,4 @@ const createDefaultResourceAlarm = (scope, qpqConfig, props) => {
     });
 };
 exports.createDefaultResourceAlarm = createDefaultResourceAlarm;
+//# sourceMappingURL=createDefaultResourceAlarm.js.map

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDefaultResourceAlarm.js","sourceRoot":"","sources":["../../../../src/constructs/base/createDefaultResourceAlarm.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAE1D,6CAAqE;AAGrE,8EAA8E;AAC9E,iFAAiF;AACjF,4BAA4B;AAC5B,gGAA6F;AAa7F,sFAAsF;AAC/E,MAAM,2BAA2B,GAAG,CAAC,SAAoB,EAAY,EAAE;IAC5E,MAAM,KAAK,GAAG,8BAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACxH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC;AAHW,QAAA,2BAA2B,+BAGtC;AAEF;;;;;;;;GAQG;AACI,MAAM,0BAA0B,GAAG,CAAC,KAAgB,EAAE,SAAoB,EAAE,KAAgC,EAAQ,EAAE;;IAC3H,IAAI,8BAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,4BAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;QACtD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,MAAA,KAAK,CAAC,kBAAkB,mCAAI,4BAAc,CAAC,kBAAkB,CAAC,kCAAkC;QACpH,iBAAiB,EAAE,MAAA,KAAK,CAAC,iBAAiB,mCAAI,CAAC;QAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,IAAA,mCAA2B,EAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,mDAAwB,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,QAAQ,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClH,KAAK,CAAC,cAAc,CAAC,IAAI,oCAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAlBW,QAAA,0BAA0B,8BAkBrC","sourcesContent":["import { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_cloudwatch, aws_cloudwatch_actions } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\n// Imported by direct path (not the ../feature/core barrel) to avoid an import\n// cycle: resource constructs import this helper, and the barrel re-exports those\n// same resource constructs.\nimport { QpqCoreEventBusConstruct } from '../feature/core/eventBus/QpqCoreEventBusConstruct';\n\nexport interface DefaultResourceAlarmProps {\n  /** Construct id (also seeds the per-event-bus action ids). */\n  id: string;\n  alarmName: string;\n  metric: aws_cloudwatch.IMetric;\n  threshold: number;\n  comparisonOperator?: aws_cloudwatch.ComparisonOperator;\n  evaluationPeriods?: number;\n  datapointsToAlarm?: number;\n}\n\n/** Event buses that error/alarm notifications route to (from `defineNotifyError`). */\nexport const getNotifyErrorEventBusNames = (qpqConfig: QPQConfig): string[] => {\n  const names = qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).flatMap((config) => config.onAlarm.publishToEventBus || []);\n  return [...new Set(names)];\n};\n\n/**\n * Create a sensible default alarm for a resource and route it to the service's\n * error-notification event bus(es).\n *\n * Opt-in: this is a no-op unless the service declares a `defineNotifyError`. We\n * reuse that config's target bus so default alarms land wherever errors already\n * do (no separate ops-routing concept). If a NotifyError exists but names no\n * bus, the alarm is still created (visible in console / dashboards) but unrouted.\n */\nexport const createDefaultResourceAlarm = (scope: Construct, qpqConfig: QPQConfig, props: DefaultResourceAlarmProps): void => {\n  if (qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).length === 0) {\n    return;\n  }\n\n  const alarm = new aws_cloudwatch.Alarm(scope, props.id, {\n    alarmName: props.alarmName,\n    metric: props.metric,\n    threshold: props.threshold,\n    comparisonOperator: props.comparisonOperator ?? aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n    evaluationPeriods: props.evaluationPeriods ?? 1,\n    datapointsToAlarm: props.datapointsToAlarm,\n  });\n\n  getNotifyErrorEventBusNames(qpqConfig).forEach((busName) => {\n    const eventBus = QpqCoreEventBusConstruct.fromOtherStack(scope, `${props.id}-bus-${busName}`, qpqConfig, busName);\n    alarm.addAlarmAction(new aws_cloudwatch_actions.SnsAction(eventBus.topic));\n  });\n};\n"]}

package/lib/commonjs/constructs/base/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqConstructBlock"), exports);
 __exportStar(require("./QpqResource"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/base/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/base/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,gDAA8B","sourcesContent":["export * from './QpqConstructBlock';\nexport * from './QpqResource';\n"]}

package/lib/commonjs/constructs/basic/BSQpqLambdaWarmerEventConstruct.js

@@ -24,3 +24,4 @@ class BSQpqLambdaWarmerEventConstructConstruct extends QpqConstructBlock_1.QpqCo
     }
 }
 exports.BSQpqLambdaWarmerEventConstructConstruct = BSQpqLambdaWarmerEventConstructConstruct;
+//# sourceMappingURL=BSQpqLambdaWarmerEventConstruct.js.map

package/lib/commonjs/constructs/basic/BSQpqLambdaWarmerEventConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BSQpqLambdaWarmerEventConstruct.js","sourceRoot":"","sources":["../../../../src/constructs/basic/BSQpqLambdaWarmerEventConstruct.ts"],"names":[],"mappings":";;;AAAA,6CAAsE;AAGtE,+CAAoD;AACpD,iEAAsF;AAItF,MAAa,wCAAyC,SAAQ,qCAAiB;IAC7E,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAoD;QAC5F,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE;YACvD,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC;YACtE,mEAAmE;YACnE,QAAQ,EAAE,wBAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;SAC5D,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,qBAAO,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC;YACvE,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CACZ,IAAI,gCAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,wBAAU,CAAC,eAAe,CAAC,UAAU,CAAC;gBAC7C,IAAI,EAAE,sBAAsB;aAC7B,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAvBD,4FAuBC","sourcesContent":["import { aws_events, aws_events_targets, aws_sns } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { BootstrapResource } from '../../constants';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface BSQpqLambdaWarmerEventConstructConstructProps extends QpqConstructBlockProps {}\n\nexport class BSQpqLambdaWarmerEventConstructConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: BSQpqLambdaWarmerEventConstructConstructProps) {\n    super(scope, id, props);\n\n    const rule = new aws_events.Rule(this, 'WarmLambdaRule', {\n      ruleName: this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas),\n      // Create an EventBridge rule to trigger the Lambda every X minutes\n      schedule: aws_events.Schedule.expression('rate(5 minutes)'),\n    });\n\n    const topic = new aws_sns.Topic(this, 'MyTopic', {\n      topicName: this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas),\n      displayName: 'Warm Lambdas',\n    });\n\n    rule.addTarget(\n      new aws_events_targets.SnsTopic(topic, {\n        message: aws_events.RuleTargetInput.fromObject({\n          type: 'QpqLambdaWarmerEvent',\n        }),\n      }),\n    );\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/DomainCertificateLookup.js

@@ -22,3 +22,4 @@ const lookupDomainCertificate = (scope, certRegion, rootDomain, idSuffix) => {
     return aws_cdk_lib_1.aws_certificatemanager.Certificate.fromCertificateArn(scope, `domain-cert-${idSuffix}`, certArn);
 };
 exports.lookupDomainCertificate = lookupDomainCertificate;
+//# sourceMappingURL=DomainCertificateLookup.js.map

package/lib/commonjs/constructs/basic/DomainCertificateLookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DomainCertificateLookup.js","sourceRoot":"","sources":["../../../../src/constructs/basic/DomainCertificateLookup.ts"],"names":[],"mappings":";;;AAAA,iEAA0D;AAE1D,6CAA8D;AAG9D;;;;;;;;;;;;GAYG;AACI,MAAM,uBAAuB,GAAG,CACrC,KAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,QAAgB,EACqB,EAAE;IACvC,MAAM,SAAS,GAAG,yCAAiB,CAAC,uCAAuC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,qBAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClF,OAAO,oCAAsB,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,eAAe,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;AAC1G,CAAC,CAAC;AATW,QAAA,uBAAuB,2BASlC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { aws_certificatemanager, aws_ssm } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\n/**\n * Service-side helper to import an ACM certificate previously created by a DomainCertificateStack.\n *\n * The domain phase writes the cert ARN into an SSM parameter in the deploy region, keyed by region.\n * This helper reads that parameter as a deploy-time CloudFormation token and imports the cert by ARN.\n * Resolution is deferred to CloudFormation at deploy time (via valueForStringParameter), so synth does\n * not require the domain stack to have been deployed yet.\n *\n * @param scope      CDK construct scope (typically the service stack/construct)\n * @param certRegion 'us-east-1' for CloudFront, deploy region for regional resources\n * @param rootDomain The same un-prefixed apex passed to the matching defineDomainCertificate entry\n * @param idSuffix   Unique suffix for the CDK construct id (scope-local)\n */\nexport const lookupDomainCertificate = (\n  scope: Construct,\n  certRegion: string,\n  rootDomain: string,\n  idSuffix: string,\n): aws_certificatemanager.ICertificate => {\n  const paramName = qpqConfigAwsUtils.getDomainCertificateArnSsmParameterName(certRegion, rootDomain);\n  const certArn = aws_ssm.StringParameter.valueForStringParameter(scope, paramName);\n  return aws_certificatemanager.Certificate.fromCertificateArn(scope, `domain-cert-${idSuffix}`, certArn);\n};\n"]}

package/lib/commonjs/constructs/basic/Function.d.ts

@@ -16,6 +16,7 @@ export interface FunctionProps extends QpqConstructBlockProps {
     role?: aws_iam.IRole;
     reacreateOnFunctionNameChange?: boolean;
     vpc?: aws_ec2.IVpc;
+    securityGroups?: aws_ec2.ISecurityGroup[];
 }
 export declare class Function extends QpqConstructBlock {
     readonly lambdaFunction: aws_lambda.Function;

package/lib/commonjs/constructs/basic/Function.js

@@ -34,14 +34,36 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Function = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_config_aws_2 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const cdk = __importStar(require("aws-cdk-lib"));
 const upath_1 = require("upath");
 const constants_1 = require("../../constants");
 const utils_1 = require("../../utils");
+const qpqDeployAwsCdkUtils = __importStar(require("../../utils/qpqDeployAwsCdkUtils"));
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
+// Resolves the federated code store location for this service, if it opted in via
+// defineFederatedModuleStore. Points the lambda at the referenced storage drive's
+// bucket, namespaced by service (s3://<bucket>/<service>), so many services can share
+// one bucket. Read access comes from the storage drive's own grants. Returns {} when
+// federation isn't configured, so the lambda runs only its bundled code.
+const getFederatedCodeStoreEnv = (qpqConfig) => {
+    var _a;
+    const federatedStore = quidproquo_core_1.qpqCoreUtils.getFederatedModuleStore(qpqConfig);
+    if (!federatedStore) {
+        return {};
+    }
+    const storageDrive = quidproquo_core_1.qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);
+    if (!storageDrive) {
+        throw new Error(`defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which is not defined - add a matching defineStorageDrive`);
+    }
+    const bucketName = quidproquo_actionprocessor_awslambda_1.awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(((_a = storageDrive.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || storageDrive.storageDrive, qpqConfig, storageDrive.owner);
+    const serviceName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return Object.assign({ federatedCodeStoreUrl: `s3://${bucketName}/${serviceName}` }, (federatedStore.recheckMs !== undefined ? { federatedCodeStoreRecheckMs: `${federatedStore.recheckMs}` } : {}));
+};
 class Function extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         var _a;
@@ -53,12 +75,13 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
         this.lambdaFunction = new aws_cdk_lib_1.aws_lambda.Function(this, functionId, {
             functionName: props.functionName,
             timeout: cdk.Duration.seconds(props.timeoutInSeconds || 25),
-            runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X,
+            runtime: (0, utils_1.getLambdaRuntime)(props.qpqConfig),
+            architecture: (0, utils_1.getLambdaArchitecture)(props.qpqConfig),
             memorySize: props.memoryInBytes || serviceInfo.lambdaMaxMemoryInMiB || 1024,
             layers: props.apiLayerVersions,
             code: aws_cdk_lib_1.aws_lambda.Code.fromAsset((0, upath_1.join)(utils_1.qpqAwsCdkPathUtils.getApiBuildPathFullPath(props.qpqConfig), props.functionType)),
             handler: `${handlerFile}.${props.executorName}`,
-            environment: Object.assign({ AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1' }, (props.environment || {})),
+            environment: Object.assign(Object.assign({ AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1' }, getFederatedCodeStoreEnv(props.qpqConfig)), (props.environment || {})),
             reservedConcurrentExecutions: quidproquo_config_aws_2.qpqConfigAwsUtils.isReservedConcurrencyDisabled(props.qpqConfig) ? undefined : props.reservedConcurrentExecutions,
             tracing: quidproquo_config_aws_2.qpqConfigAwsUtils.isTracingDisabled(props.qpqConfig) ? aws_cdk_lib_1.aws_lambda.Tracing.DISABLED : aws_cdk_lib_1.aws_lambda.Tracing.ACTIVE,
             logGroup: new aws_cdk_lib_1.aws_logs.LogGroup(this, 'LogGroup', {
@@ -72,7 +95,9 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
                     subnetType: aws_cdk_lib_1.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
                 }
                 : undefined,
+            securityGroups: props.securityGroups,
         });
+        qpqDeployAwsCdkUtils.applyEnvironmentTags(this.lambdaFunction, props.qpqConfig);
         if (!quidproquo_config_aws_2.qpqConfigAwsUtils.isLambdaWarmingDisabled(props.qpqConfig)) {
             const region = quidproquo_config_aws_2.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
             const accountId = quidproquo_config_aws_2.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
@@ -84,3 +109,4 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.Function = Function;
+//# sourceMappingURL=Function.js.map

package/lib/commonjs/constructs/basic/Function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Function.js","sourceRoot":"","sources":["../../../../src/constructs/basic/Function.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+FAAsE;AACtE,iEAAuE;AACvE,iEAA0D;AAC1D,qDAA0D;AAE1D,6CAAqG;AACrG,iDAAmC;AAEnC,iCAA6B;AAE7B,+CAAoD;AACpD,uCAA0F;AAC1F,uFAAyE;AACzE,iEAAsF;AA4BtF,kFAAkF;AAClF,kFAAkF;AAClF,sFAAsF;AACtF,qFAAqF;AACrF,yEAAyE;AACzE,MAAM,wBAAwB,GAAG,CAAC,SAAoB,EAA0B,EAAE;;IAChF,MAAM,cAAc,GAAG,8BAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,8BAAY,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wDAAwD,cAAc,CAAC,YAAY,4DAA4D,CAChJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,qDAAc,CAAC,0CAA0C,CAC1E,CAAA,MAAA,YAAY,CAAC,KAAK,0CAAE,oBAAoB,KAAI,YAAY,CAAC,YAAY,EACrE,SAAS,EACT,YAAY,CAAC,KAAK,CACnB,CAAC;IACF,MAAM,WAAW,GAAG,8BAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAErE,uBACE,qBAAqB,EAAE,QAAQ,UAAU,IAAI,WAAW,EAAE,IACvD,CAAC,cAAc,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACjH;AACJ,CAAC,CAAC;AAEF,MAAa,QAAS,SAAQ,qCAAiB;IAG7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAoB;;QAC5D,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,YAAY,IAAI,EAAE,MAAM,MAAA,KAAK,CAAC,YAAY,0CAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC;QAEjD,MAAM,WAAW,GAAG,IAAA,sDAA8B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpE,MAAM,UAAU,GAAG,KAAK,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;QAE/G,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;YAE3D,OAAO,EAAE,IAAA,wBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC;YAC1C,YAAY,EAAE,IAAA,6BAAqB,EAAC,KAAK,CAAC,SAAS,CAAC;YACpD,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,WAAW,CAAC,oBAAoB,IAAI,IAAI;YAC3E,MAAM,EAAE,KAAK,CAAC,gBAAgB;YAE9B,IAAI,EAAE,wBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,YAAI,EAAC,0BAAkB,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACtH,OAAO,EAAE,GAAG,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE;YAE/C,WAAW,gCACT,mCAAmC,EAAE,GAAG,IAIrC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,GACzC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAC7B;YAED,4BAA4B,EAAE,yCAAiB,CAAC,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B;YAE/I,OAAO,EAAE,yCAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAU,CAAC,OAAO,CAAC,MAAM;YAEvH,QAAQ,EAAE,IAAI,sBAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;gBAChD,SAAS,EAAE,sBAAQ,CAAC,aAAa,CAAC,QAAQ;gBAC1C,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;aACzC,CAAC;YAEF,IAAI,EAAE,KAAK,CAAC,IAAI;YAEhB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU,EAAE,KAAK,CAAC,GAAG;gBACnB,CAAC,CAAC;oBACE,UAAU,EAAE,qBAAO,CAAC,UAAU,CAAC,mBAAmB;iBACnD;gBACH,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QAEH,oBAAoB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEhF,IAAI,CAAC,yCAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnF,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAEzF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,eAAe,MAAM,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,qBAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;YAE1E,KAAK,CAAC,eAAe,CAAC,IAAI,mCAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AApED,4BAoEC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { getAwsServiceAccountInfoConfig } from 'quidproquo-config-aws';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_ec2, aws_iam, aws_lambda, aws_logs, aws_sns, aws_sns_subscriptions } from 'aws-cdk-lib';\nimport * as cdk from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\nimport { join } from 'upath';\n\nimport { BootstrapResource } from '../../constants';\nimport { getLambdaArchitecture, getLambdaRuntime, qpqAwsCdkPathUtils } from '../../utils';\nimport * as qpqDeployAwsCdkUtils from '../../utils/qpqDeployAwsCdkUtils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface FunctionProps extends QpqConstructBlockProps {\n  functionName?: string;\n\n  srcFilename?: string;\n  functionType: string; // TODO: Rename this to subFolder / folder or something\n  executorName: string; // TODO: Rename this to handlerName or something maybe?\n\n  timeoutInSeconds?: number;\n  memoryInBytes?: number;\n\n  environment?: {\n    [key: string]: string;\n  };\n\n  apiLayerVersions?: aws_lambda.ILayerVersion[];\n\n  reservedConcurrentExecutions?: number;\n\n  role?: aws_iam.IRole;\n\n  reacreateOnFunctionNameChange?: boolean;\n\n  vpc?: aws_ec2.IVpc;\n  securityGroups?: aws_ec2.ISecurityGroup[];\n}\n\n// Resolves the federated code store location for this service, if it opted in via\n// defineFederatedModuleStore. Points the lambda at the referenced storage drive's\n// bucket, namespaced by service (s3://<bucket>/<service>), so many services can share\n// one bucket. Read access comes from the storage drive's own grants. Returns {} when\n// federation isn't configured, so the lambda runs only its bundled code.\nconst getFederatedCodeStoreEnv = (qpqConfig: QPQConfig): Record<string, string> => {\n  const federatedStore = qpqCoreUtils.getFederatedModuleStore(qpqConfig);\n  if (!federatedStore) {\n    return {};\n  }\n\n  const storageDrive = qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);\n  if (!storageDrive) {\n    throw new Error(\n      `defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which is not defined - add a matching defineStorageDrive`,\n    );\n  }\n\n  const bucketName = awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(\n    storageDrive.owner?.resourceNameOverride || storageDrive.storageDrive,\n    qpqConfig,\n    storageDrive.owner,\n  );\n  const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return {\n    federatedCodeStoreUrl: `s3://${bucketName}/${serviceName}`,\n    ...(federatedStore.recheckMs !== undefined ? { federatedCodeStoreRecheckMs: `${federatedStore.recheckMs}` } : {}),\n  };\n};\n\nexport class Function extends QpqConstructBlock {\n  public readonly lambdaFunction: aws_lambda.Function;\n\n  constructor(scope: Construct, id: string, props: FunctionProps) {\n    super(scope, id, props);\n\n    console.log(`Function: [${props.functionName || ''}]::${props.functionName?.length}`);\n\n    const handlerFile = props.srcFilename || 'index';\n\n    const serviceInfo = getAwsServiceAccountInfoConfig(props.qpqConfig);\n\n    const functionId = props.reacreateOnFunctionNameChange && props.functionName ? props.functionName : 'function';\n\n    this.lambdaFunction = new aws_lambda.Function(this, functionId, {\n      functionName: props.functionName,\n      timeout: cdk.Duration.seconds(props.timeoutInSeconds || 25),\n\n      runtime: getLambdaRuntime(props.qpqConfig),\n      architecture: getLambdaArchitecture(props.qpqConfig),\n      memorySize: props.memoryInBytes || serviceInfo.lambdaMaxMemoryInMiB || 1024,\n      layers: props.apiLayerVersions,\n\n      code: aws_lambda.Code.fromAsset(join(qpqAwsCdkPathUtils.getApiBuildPathFullPath(props.qpqConfig), props.functionType)),\n      handler: `${handlerFile}.${props.executorName}`,\n\n      environment: {\n        AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1',\n        // Federated code store (only when the service opted in via\n        // defineFederatedModuleStore); the loader falls back to bundled modules\n        // while the store has nothing published for this service\n        ...getFederatedCodeStoreEnv(props.qpqConfig),\n        ...(props.environment || {}),\n      },\n\n      reservedConcurrentExecutions: qpqConfigAwsUtils.isReservedConcurrencyDisabled(props.qpqConfig) ? undefined : props.reservedConcurrentExecutions,\n\n      tracing: qpqConfigAwsUtils.isTracingDisabled(props.qpqConfig) ? aws_lambda.Tracing.DISABLED : aws_lambda.Tracing.ACTIVE,\n\n      logGroup: new aws_logs.LogGroup(this, 'LogGroup', {\n        retention: aws_logs.RetentionDays.ONE_YEAR,\n        removalPolicy: cdk.RemovalPolicy.DESTROY,\n      }),\n\n      role: props.role,\n\n      vpc: props.vpc,\n      vpcSubnets: props.vpc\n        ? {\n            subnetType: aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,\n          }\n        : undefined,\n      securityGroups: props.securityGroups,\n    });\n\n    qpqDeployAwsCdkUtils.applyEnvironmentTags(this.lambdaFunction, props.qpqConfig);\n\n    if (!qpqConfigAwsUtils.isLambdaWarmingDisabled(props.qpqConfig)) {\n      const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n      const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n\n      const topicName = this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas);\n      const topicArn = `arn:aws:sns:${region}:${accountId}:${topicName}`;\n      const topic = aws_sns.Topic.fromTopicArn(this, 'ImportedTopic', topicArn);\n\n      topic.addSubscription(new aws_sns_subscriptions.LambdaSubscription(this.lambdaFunction));\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/LambdaLayers.js

@@ -9,6 +9,7 @@ const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const path_1 = __importDefault(require("path"));
+const utils_1 = require("../../utils");
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
 const getLambdaLayersWithFullPaths = (qpqConfig) => {
     const awsServiceAccountInfoConfig = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
@@ -23,12 +24,13 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         super(scope, id, props);
         const apiLayers = (0, exports.getLambdaLayersWithFullPaths)(props.qpqConfig);
+        const lambdaRuntime = (0, utils_1.getLambdaRuntime)(props.qpqConfig);
         const userLayers = apiLayers.map((layer) => {
             return layer.buildPath
                 ? new aws_cdk_lib_1.aws_lambda.LayerVersion(this, `${layer.name}-layer`, {
                     layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),
                     code: new aws_cdk_lib_1.aws_lambda.AssetCode(layer.buildPath),
-                    compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
+                    compatibleRuntimes: [lambdaRuntime],
                 })
                 : aws_cdk_lib_1.aws_lambda.LayerVersion.fromLayerVersionArn(this, `${layer.name}-layer-ref`, layer.layerArn);
         });
@@ -37,9 +39,10 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
         const logExtensionLayer = new aws_cdk_lib_1.aws_lambda.LayerVersion(this, 'qpq-log-extension-layer', {
             layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig('qpq-log-extension', props.qpqConfig),
             code: new aws_cdk_lib_1.aws_lambda.AssetCode((0, quidproquo_actionprocessor_awslambda_1.getLogExtensionLayerPath)()),
-            compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
+            compatibleRuntimes: [lambdaRuntime],
         });
         this.layers = [...userLayers, logExtensionLayer];
     }
 }
 exports.LambdaLayers = LambdaLayers;
+//# sourceMappingURL=LambdaLayers.js.map

package/lib/commonjs/constructs/basic/LambdaLayers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LambdaLayers.js","sourceRoot":"","sources":["../../../../src/constructs/basic/LambdaLayers.ts"],"names":[],"mappings":";;;;;;AAAA,+FAAgG;AAChG,iEAAiF;AACjF,qDAA0D;AAE1D,6CAAyC;AAEzC,gDAAwB;AAExB,uCAA+C;AAC/C,iEAAsF;AAE/E,MAAM,4BAA4B,GAAG,CAAC,SAAoB,EAAc,EAAE;IAC/E,MAAM,2BAA2B,GAAG,IAAA,sDAA8B,EAAC,SAAS,CAAC,CAAC;IAE9E,OAAO,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,8BAAY,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1G,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AARW,QAAA,4BAA4B,gCAQvC;AAIF,MAAa,YAAa,SAAQ,qCAAiB;IAGjD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,SAAS,GAAG,IAAA,oCAA4B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,IAAA,wBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,OAAO,KAAK,CAAC,SAAS;gBACpB,CAAC,CAAC,IAAI,wBAAU,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,QAAQ,EAAE;oBACvD,gBAAgB,EAAE,qDAAc,CAAC,mCAAmC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC;oBACjG,IAAI,EAAE,IAAI,wBAAU,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC/C,kBAAkB,EAAE,CAAC,aAAa,CAAC;iBACpC,CAAC;gBACJ,CAAC,CAAC,wBAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,YAAY,EAAE,KAAK,CAAC,QAAS,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,IAAI,wBAAU,CAAC,YAAY,CAAC,IAAI,EAAE,yBAAyB,EAAE;YACrF,gBAAgB,EAAE,qDAAc,CAAC,mCAAmC,CAAC,mBAAmB,EAAE,KAAK,CAAC,SAAS,CAAC;YAC1G,IAAI,EAAE,IAAI,wBAAU,CAAC,SAAS,CAAC,IAAA,+DAAwB,GAAE,CAAC;YAC1D,kBAAkB,EAAE,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACnD,CAAC;CACF;AA7BD,oCA6BC","sourcesContent":["import { awsNamingUtils, getLogExtensionLayerPath } from 'quidproquo-actionprocessor-awslambda';\nimport { ApiLayer, getAwsServiceAccountInfoConfig } from 'quidproquo-config-aws';\nimport { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_lambda } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\nimport path from 'path';\n\nimport { getLambdaRuntime } from '../../utils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport const getLambdaLayersWithFullPaths = (qpqConfig: QPQConfig): ApiLayer[] => {\n  const awsServiceAccountInfoConfig = getAwsServiceAccountInfoConfig(qpqConfig);\n\n  return awsServiceAccountInfoConfig.apiLayers.map((layer: ApiLayer) => ({\n    name: layer.name,\n    buildPath: layer.buildPath ? path.join(qpqCoreUtils.getConfigRoot(qpqConfig), layer.buildPath) : undefined,\n    layerArn: layer.layerArn,\n  }));\n};\n\nexport interface LambdaLayersProps extends QpqConstructBlockProps {}\n\nexport class LambdaLayers extends QpqConstructBlock {\n  public readonly layers: aws_lambda.ILayerVersion[];\n\n  constructor(scope: Construct, id: string, props: LambdaLayersProps) {\n    super(scope, id, props);\n\n    const apiLayers = getLambdaLayersWithFullPaths(props.qpqConfig);\n    const lambdaRuntime = getLambdaRuntime(props.qpqConfig);\n\n    const userLayers = apiLayers.map((layer) => {\n      return layer.buildPath\n        ? new aws_lambda.LayerVersion(this, `${layer.name}-layer`, {\n            layerVersionName: awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),\n            code: new aws_lambda.AssetCode(layer.buildPath),\n            compatibleRuntimes: [lambdaRuntime],\n          })\n        : aws_lambda.LayerVersion.fromLayerVersionArn(this, `${layer.name}-layer-ref`, layer.layerArn!);\n    });\n\n    // Always-on: the qpq-log-extension ships story logs to S3 off the function's\n    // response path. Attached to every function via apiLayerVersions.\n    const logExtensionLayer = new aws_lambda.LayerVersion(this, 'qpq-log-extension-layer', {\n      layerVersionName: awsNamingUtils.getQpqRuntimeResourceNameFromConfig('qpq-log-extension', props.qpqConfig),\n      code: new aws_lambda.AssetCode(getLogExtensionLayerPath()),\n      compatibleRuntimes: [lambdaRuntime],\n    });\n\n    this.layers = [...userLayers, logExtensionLayer];\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/SubdomainName.js

@@ -41,3 +41,4 @@ class SubdomainName extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.SubdomainName = SubdomainName;
+//# sourceMappingURL=SubdomainName.js.map

package/lib/commonjs/constructs/basic/SubdomainName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubdomainName.js","sourceRoot":"","sources":["../../../../src/constructs/basic/SubdomainName.ts"],"names":[],"mappings":";;;AAAA,iEAA0D;AAC1D,+DAAyD;AAEzD,6CAAuG;AAGvG,iEAAsF;AACtF,uEAAoE;AAQpE,MAAa,aAAc,SAAQ,qCAAiB;IAMlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAyB;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,IAAI,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAE7D,+EAA+E;QAC/E,sEAAsE;QACtE,kFAAkF;QAClF,MAAM,gBAAgB,GAAG,wCAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChG,MAAM,cAAc,GAAG,yBAAW,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE;YAC5E,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QAEH,wEAAwE;QACxE,+FAA+F;QAC/F,MAAM,YAAY,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC,WAAW,GAAG,IAAA,iDAAuB,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElG,IAAI,CAAC,UAAU,GAAG,IAAI,4BAAc,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE;YACnE,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,4BAAc,CAAC,cAAc,CAAC,OAAO;YACrD,YAAY,EAAE,4BAAc,CAAC,YAAY,CAAC,QAAQ;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,yBAAW,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,iCAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnH,IAAI,yBAAW,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE;YACxC,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;QAEH,kDAAkD;QAClD,4CAA4C;QAC5C,wCAAwC;QACxC,oDAAoD;QACpD,MAAM;IACR,CAAC;CACF;AA7CD,sCA6CC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { qpqWebServerUtils } from 'quidproquo-webserver';\n\nimport { aws_apigateway, aws_certificatemanager, aws_route53, aws_route53_targets } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\nimport { lookupDomainCertificate } from './DomainCertificateLookup';\n\nexport interface SubdomainNameProps extends QpqConstructBlockProps {\n  subdomain: string;\n  apexDomain: string;\n  rootDomain: string;\n}\n\nexport class SubdomainName extends QpqConstructBlock {\n  public readonly domainName: aws_apigateway.DomainName;\n  public readonly certificate: aws_certificatemanager.ICertificate;\n  public readonly targetARecord: aws_route53.RecordTarget;\n  public readonly deployDomain: string;\n\n  constructor(scope: Construct, id: string, props: SubdomainNameProps) {\n    super(scope, id, props);\n\n    this.deployDomain = `${props.subdomain}.${props.apexDomain}`;\n\n    // Always look up the root hosted zone (e.g. development.quidproquojs.com), not\n    // a per-service sub-zone. The FQDN may include the service name (e.g.\n    // ws.shell.development.quidproquojs.com) but the A record lives in the root zone.\n    const hostedZoneDomain = qpqWebServerUtils.resolveDomainRoot(props.rootDomain, props.qpqConfig);\n    const apexHostedZone = aws_route53.HostedZone.fromLookup(this, 'hosted-zone', {\n      domainName: hostedZoneDomain,\n    });\n\n    // Regional API Gateway custom domains need a cert in the deploy region.\n    // Look it up from SSM, written by the matching DomainCertificateStack during the domain phase.\n    const deployRegion = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n    this.certificate = lookupDomainCertificate(this, deployRegion, props.rootDomain, props.subdomain);\n\n    this.domainName = new aws_apigateway.DomainName(this, 'domain-name', {\n      domainName: this.deployDomain,\n      certificate: this.certificate,\n      securityPolicy: aws_apigateway.SecurityPolicy.TLS_1_2,\n      endpointType: aws_apigateway.EndpointType.REGIONAL,\n    });\n\n    this.targetARecord = aws_route53.RecordTarget.fromAlias(new aws_route53_targets.ApiGatewayDomain(this.domainName));\n\n    new aws_route53.ARecord(this, 'a-record', {\n      zone: apexHostedZone,\n      recordName: this.deployDomain,\n      target: this.targetARecord,\n    });\n\n    // // Export the names so we can import them later\n    // new cdk.CfnOutput(this, 'HostedZoneID', {\n    //   value: apexHostedZone.hostedZoneId,\n    //   exportName: `${apexHostedZone}-hosted-zone-id`,\n    // });\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/WebserverRoll.js

@@ -1,7 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebserverRoll = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
+const qpqDeployAwsCdkUtils = __importStar(require("../../utils/qpqDeployAwsCdkUtils"));
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
 class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
@@ -10,6 +47,22 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
             roleName: this.resourceName('service-role'),
             assumedBy: new aws_cdk_lib_1.aws_iam.CompositePrincipal(new aws_cdk_lib_1.aws_iam.ServicePrincipal('lambda.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('transfer.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('edgelambda.amazonaws.com')),
         });
+        qpqDeployAwsCdkUtils.applyEnvironmentTags(role, props.qpqConfig);
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
+        const accountId = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
+        const applicationName = quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig);
+        const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig);
+        const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig);
+        // This deployment's identity tags, as applied to every qpq resource by applyEnvironmentTags.
+        // Used for tag-based conditions where the target resource's id is unknowable at synth
+        // (later deploy phase / AWS-generated) but the resource is still owned by this deployment.
+        const applicationResourceTagConditions = Object.assign({ 'aws:ResourceTag/application': quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), 'aws:ResourceTag/environment': quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig) }, (feature ? { 'aws:ResourceTag/feature': feature } : {}));
+        // Every event-bus topic this service can publish to (owned + referenced cross-module) -
+        // the same owner-fallback derivation the runtime send processor uses to build the ARN.
+        const eventBusTopicArns = quidproquo_core_1.qpqCoreUtils.getAllEventBusConfigs(props.qpqConfig).map((eventBusConfig) => {
+            var _a, _b, _c, _d, _e;
+            return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getEventBusSnsTopicArn(((_a = eventBusConfig.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || eventBusConfig.name, props.qpqConfig, ((_b = eventBusConfig.owner) === null || _b === void 0 ? void 0 : _b.module) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(props.qpqConfig), ((_c = eventBusConfig.owner) === null || _c === void 0 ? void 0 : _c.environment) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig), ((_d = eventBusConfig.owner) === null || _d === void 0 ? void 0 : _d.application) || quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), ((_e = eventBusConfig.owner) === null || _e === void 0 ? void 0 : _e.feature) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig), eventBusConfig.isFifo);
+        });
         const policies = [
             // Resolve cross-stack resource names at runtime via CloudFormation exports.
             {
@@ -17,35 +70,39 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 actions: ['cloudformation:ListExports'],
                 resources: ['*'],
             },
-            // Look up API Gateway metadata (stages, deployments) from within Lambdas.
+            // Read api-key values at runtime for api-key validation - keys are fetched individually
+            // by id (never listed), so the grant is per-key, pinned to this application's tags.
+            // Module is deliberately NOT pinned: routes may reference another service's key
+            // (ApiKeyReference.serviceName) within the same application + environment.
             {
                 sid: 'APIGatewayGetOperations',
                 actions: ['apigateway:GET'],
-                resources: ['*'],
-            },
-            // Invalidate CloudFront caches after web-entry static asset deploys.
-            {
-                sid: 'CloudFrontCreateInvalidation',
-                actions: ['cloudfront:CreateInvalidation'],
-                resources: ['*'],
-            },
-            // Publish to event-bus SNS topics (the framework's pub/sub layer).
-            {
-                sid: 'SNSPublishMessages',
-                actions: ['sns:Publish'],
-                resources: ['*'],
+                resources: [`arn:aws:apigateway:${region}::/apikeys/*`],
+                conditions: {
+                    StringEquals: applicationResourceTagConditions,
+                },
             },
-            // Invoke QPQ service functions (`*sfunc*`) from other Lambdas.
+            // Publish to event-bus SNS topics (the framework's pub/sub layer), scoped to the
+            // buses this service declares. Omitted entirely when no event buses are configured.
+            ...(eventBusTopicArns.length > 0
+                ? [
+                    {
+                        sid: 'SNSPublishMessages',
+                        actions: ['sns:Publish'],
+                        resources: eventBusTopicArns,
+                    },
+                ]
+                : []),
+            // Invoke QPQ service functions from other lambdas. The runtime derives target names
+            // with getConfigRuntimeResourceName from its own app/env/feature (only the target
+            // service varies), so the same helper builds this pattern with the function and
+            // service segments wildcarded - cross-app/env invocation is not possible.
             {
                 sid: 'LambdaInvokeFunction',
                 actions: ['lambda:InvokeFunction'],
-                resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
-            },
-            // Push messages to websocket clients via API Gateway Management API.
-            {
-                sid: 'APIGatewayManageConnections',
-                actions: ['execute-api:ManageConnections'],
-                resources: ['*'],
+                resources: [
+                    `arn:aws:lambda:${region}:${accountId}:function:${quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getConfigRuntimeResourceName('*-sfunc', applicationName, '*', environment, feature)}`,
+                ],
             },
             // Look up ACM certs when wiring up custom domains at runtime.
             {
@@ -53,7 +110,8 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 actions: ['acm:DescribeCertificate', 'acm:ListCertificates'],
                 resources: ['*'],
             },
-            // Standard Lambda logging + log retrieval for the `askGetLogs` flow.
+            // Standard Lambda logging + log retrieval for the `askGetLogs` flow. Account-pinned;
+            // region is left open because edge lambdas write logs in their execution region.
             {
                 sid: 'CloudWatchLogsManagement',
                 actions: [
@@ -65,7 +123,7 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                     'logs:GetLogEvents',
                     'logs:FilterLogEvents',
                 ],
-                resources: ['*'],
+                resources: [`arn:aws:logs:*:${accountId}:log-group:*`],
             },
             // Required for VPC-attached Lambdas to manage their ENIs.
             {
@@ -87,3 +145,4 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.WebserverRoll = WebserverRoll;
+//# sourceMappingURL=WebserverRoll.js.map

package/lib/commonjs/constructs/basic/WebserverRoll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebserverRoll.js","sourceRoot":"","sources":["../../../../src/constructs/basic/WebserverRoll.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+FAAsE;AACtE,iEAA0D;AAC1D,qDAA+C;AAE/C,6CAAsC;AAGtC,uFAAyE;AACzE,iEAAsF;AAItF,MAAa,aAAc,SAAQ,qCAAiB;IAGlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAyB;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,IAAI,qBAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YAC1C,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;YAC3C,SAAS,EAAE,IAAI,qBAAO,CAAC,kBAAkB,CACvC,IAAI,qBAAO,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EACpD,IAAI,qBAAO,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EACtD,IAAI,qBAAO,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAEzD;SACF,CAAC,CAAC;QAEH,oBAAoB,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,eAAe,GAAG,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,8BAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE1E,6FAA6F;QAC7F,sFAAsF;QACtF,2FAA2F;QAC3F,MAAM,gCAAgC,mBACpC,6BAA6B,EAAE,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAC/E,6BAA6B,EAAE,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,IACzF,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3D,CAAC;QAEF,wFAAwF;QACxF,uFAAuF;QACvF,MAAM,iBAAiB,GAAG,8BAAY,CAAC,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE;;YACnG,OAAA,qDAAc,CAAC,sBAAsB,CACnC,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,oBAAoB,KAAI,cAAc,CAAC,IAAI,EACjE,KAAK,CAAC,SAAS,EAEf,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,MAAM,KAAI,8BAAY,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,EACtF,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,WAAW,KAAI,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,EAClG,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,WAAW,KAAI,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EACrF,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,OAAO,KAAI,8BAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,EAC1F,cAAc,CAAC,MAAM,CACtB,CAAA;SAAA,CACF,CAAC;QAEF,MAAM,QAAQ,GAAmC;YAC/C,4EAA4E;YAC5E;gBACE,GAAG,EAAE,2BAA2B;gBAChC,OAAO,EAAE,CAAC,4BAA4B,CAAC;gBACvC,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;YAED,wFAAwF;YACxF,oFAAoF;YACpF,gFAAgF;YAChF,2EAA2E;YAC3E;gBACE,GAAG,EAAE,yBAAyB;gBAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;gBAC3B,SAAS,EAAE,CAAC,sBAAsB,MAAM,cAAc,CAAC;gBACvD,UAAU,EAAE;oBACV,YAAY,EAAE,gCAAgC;iBAC/C;aACF;YAED,iFAAiF;YACjF,oFAAoF;YACpF,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC;oBACE;wBACE,GAAG,EAAE,oBAAoB;wBACzB,OAAO,EAAE,CAAC,aAAa,CAAC;wBACxB,SAAS,EAAE,iBAAiB;qBAC7B;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,oFAAoF;YACpF,kFAAkF;YAClF,gFAAgF;YAChF,0EAA0E;YAC1E;gBACE,GAAG,EAAE,sBAAsB;gBAC3B,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE;oBACT,kBAAkB,MAAM,IAAI,SAAS,aAAa,qDAAc,CAAC,4BAA4B,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE;iBACvJ;aACF;YAED,8DAA8D;YAC9D;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,OAAO,EAAE,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;gBAC5D,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;YAED,qFAAqF;YACrF,iFAAiF;YACjF;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,OAAO,EAAE;oBACP,qBAAqB;oBACrB,sBAAsB;oBACtB,wBAAwB;oBACxB,yBAAyB;oBACzB,mBAAmB;oBACnB,mBAAmB;oBACnB,sBAAsB;iBACvB;gBACD,SAAS,EAAE,CAAC,kBAAkB,SAAS,cAAc,CAAC;aACvD;YAED,0DAA0D;YAC1D;gBACE,GAAG,EAAE,gCAAgC;gBACrC,OAAO,EAAE;oBACP,4BAA4B;oBAC5B,+BAA+B;oBAC/B,4BAA4B;oBAC5B,8BAA8B;oBAC9B,gCAAgC;iBACjC;gBACD,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;SACF,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,qBAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAxID,sCAwIC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_iam } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport * as qpqDeployAwsCdkUtils from '../../utils/qpqDeployAwsCdkUtils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface WebserverRollProps extends QpqConstructBlockProps {}\n\nexport class WebserverRoll extends QpqConstructBlock {\n  role: aws_iam.IRole;\n\n  constructor(scope: Construct, id: string, props: WebserverRollProps) {\n    super(scope, id, props);\n\n    const role = new aws_iam.Role(this, 'role', {\n      roleName: this.resourceName('service-role'),\n      assumedBy: new aws_iam.CompositePrincipal(\n        new aws_iam.ServicePrincipal('lambda.amazonaws.com'),\n        new aws_iam.ServicePrincipal('transfer.amazonaws.com'),\n        new aws_iam.ServicePrincipal('edgelambda.amazonaws.com'),\n        // new aws_iam.ServicePrincipal('neptune.amazonaws.com'),\n      ),\n    });\n\n    qpqDeployAwsCdkUtils.applyEnvironmentTags(role, props.qpqConfig);\n\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n    const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n    const applicationName = qpqCoreUtils.getApplicationName(props.qpqConfig);\n    const environment = qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig);\n    const feature = qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig);\n\n    // This deployment's identity tags, as applied to every qpq resource by applyEnvironmentTags.\n    // Used for tag-based conditions where the target resource's id is unknowable at synth\n    // (later deploy phase / AWS-generated) but the resource is still owned by this deployment.\n    const applicationResourceTagConditions = {\n      'aws:ResourceTag/application': qpqCoreUtils.getApplicationName(props.qpqConfig),\n      'aws:ResourceTag/environment': qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig),\n      ...(feature ? { 'aws:ResourceTag/feature': feature } : {}),\n    };\n\n    // Every event-bus topic this service can publish to (owned + referenced cross-module) -\n    // the same owner-fallback derivation the runtime send processor uses to build the ARN.\n    const eventBusTopicArns = qpqCoreUtils.getAllEventBusConfigs(props.qpqConfig).map((eventBusConfig) =>\n      awsNamingUtils.getEventBusSnsTopicArn(\n        eventBusConfig.owner?.resourceNameOverride || eventBusConfig.name,\n        props.qpqConfig,\n\n        eventBusConfig.owner?.module || qpqCoreUtils.getApplicationModuleName(props.qpqConfig),\n        eventBusConfig.owner?.environment || qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig),\n        eventBusConfig.owner?.application || qpqCoreUtils.getApplicationName(props.qpqConfig),\n        eventBusConfig.owner?.feature || qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig),\n        eventBusConfig.isFifo,\n      ),\n    );\n\n    const policies: aws_iam.PolicyStatementProps[] = [\n      // Resolve cross-stack resource names at runtime via CloudFormation exports.\n      {\n        sid: 'CloudFormationListExports',\n        actions: ['cloudformation:ListExports'],\n        resources: ['*'],\n      },\n\n      // Read api-key values at runtime for api-key validation - keys are fetched individually\n      // by id (never listed), so the grant is per-key, pinned to this application's tags.\n      // Module is deliberately NOT pinned: routes may reference another service's key\n      // (ApiKeyReference.serviceName) within the same application + environment.\n      {\n        sid: 'APIGatewayGetOperations',\n        actions: ['apigateway:GET'],\n        resources: [`arn:aws:apigateway:${region}::/apikeys/*`],\n        conditions: {\n          StringEquals: applicationResourceTagConditions,\n        },\n      },\n\n      // Publish to event-bus SNS topics (the framework's pub/sub layer), scoped to the\n      // buses this service declares. Omitted entirely when no event buses are configured.\n      ...(eventBusTopicArns.length > 0\n        ? [\n            {\n              sid: 'SNSPublishMessages',\n              actions: ['sns:Publish'],\n              resources: eventBusTopicArns,\n            },\n          ]\n        : []),\n\n      // Invoke QPQ service functions from other lambdas. The runtime derives target names\n      // with getConfigRuntimeResourceName from its own app/env/feature (only the target\n      // service varies), so the same helper builds this pattern with the function and\n      // service segments wildcarded - cross-app/env invocation is not possible.\n      {\n        sid: 'LambdaInvokeFunction',\n        actions: ['lambda:InvokeFunction'],\n        resources: [\n          `arn:aws:lambda:${region}:${accountId}:function:${awsNamingUtils.getConfigRuntimeResourceName('*-sfunc', applicationName, '*', environment, feature)}`,\n        ],\n      },\n\n      // Look up ACM certs when wiring up custom domains at runtime.\n      {\n        sid: 'ACMCertificateOperations',\n        actions: ['acm:DescribeCertificate', 'acm:ListCertificates'],\n        resources: ['*'],\n      },\n\n      // Standard Lambda logging + log retrieval for the `askGetLogs` flow. Account-pinned;\n      // region is left open because edge lambdas write logs in their execution region.\n      {\n        sid: 'CloudWatchLogsManagement',\n        actions: [\n          'logs:CreateLogGroup',\n          'logs:CreateLogStream',\n          'logs:DescribeLogGroups',\n          'logs:DescribeLogStreams',\n          'logs:PutLogEvents',\n          'logs:GetLogEvents',\n          'logs:FilterLogEvents',\n        ],\n        resources: [`arn:aws:logs:*:${accountId}:log-group:*`],\n      },\n\n      // Required for VPC-attached Lambdas to manage their ENIs.\n      {\n        sid: 'EC2NetworkInterfacePermissions',\n        actions: [\n          'ec2:CreateNetworkInterface',\n          'ec2:DescribeNetworkInterfaces',\n          'ec2:DeleteNetworkInterface',\n          'ec2:AssignPrivateIpAddresses',\n          'ec2:UnassignPrivateIpAddresses',\n        ],\n        resources: ['*'],\n      },\n    ];\n\n    policies.forEach((policy) => {\n      role.addToPolicy(new aws_iam.PolicyStatement(policy));\n    });\n\n    this.role = role;\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./DomainCertificateLookup"), exports);
 __exportStar(require("./Function"), exports);
 __exportStar(require("./LambdaLayers"), exports);
 __exportStar(require("./SubdomainName"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/basic/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/basic/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAC1C,6CAA2B;AAC3B,iDAA+B;AAC/B,kDAAgC","sourcesContent":["export * from './DomainCertificateLookup';\nexport * from './Function';\nexport * from './LambdaLayers';\nexport * from './SubdomainName';\n"]}

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.d.ts

@@ -0,0 +1,9 @@
+import { AccountBudgetQPQConfigSetting } from 'quidproquo-config-aws';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';
+export interface QpqAccountBudgetConstructProps extends QpqConstructBlockProps {
+    budgetConfig: AccountBudgetQPQConfigSetting;
+}
+export declare class QpqAccountBudgetConstruct extends QpqConstructBlock {
+    constructor(scope: Construct, id: string, props: QpqAccountBudgetConstructProps);
+}

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqAccountBudgetConstruct = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const QpqConstructBlock_1 = require("../../base/QpqConstructBlock");
+const defaultThresholds = [
+    { thresholdPercent: 80, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+    { thresholdPercent: 100, type: quidproquo_config_aws_1.BudgetThresholdType.forecasted },
+    { thresholdPercent: 100, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+    { thresholdPercent: 150, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+];
+class QpqAccountBudgetConstruct extends QpqConstructBlock_1.QpqConstructBlock {
+    constructor(scope, id, props) {
+        var _a;
+        super(scope, id, props);
+        const { name, monthlyLimitUsd, subscriberEmails, thresholds = defaultThresholds, anomalyDetection } = props.budgetConfig;
+        const accountId = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
+        const emailSubscribers = subscriberEmails.map((email) => ({
+            subscriptionType: 'EMAIL',
+            address: email,
+        }));
+        new aws_cdk_lib_1.aws_budgets.CfnBudget(this, 'budget', {
+            budget: {
+                budgetName: `qpq-budget-${accountId}-${name}`,
+                budgetType: 'COST',
+                timeUnit: 'MONTHLY',
+                budgetLimit: {
+                    amount: monthlyLimitUsd,
+                    unit: 'USD',
+                },
+            },
+            notificationsWithSubscribers: thresholds.map((threshold) => ({
+                notification: {
+                    notificationType: threshold.type === quidproquo_config_aws_1.BudgetThresholdType.forecasted ? 'FORECASTED' : 'ACTUAL',
+                    comparisonOperator: 'GREATER_THAN',
+                    threshold: threshold.thresholdPercent,
+                    thresholdType: 'PERCENTAGE',
+                },
+                subscribers: emailSubscribers,
+            })),
+        });
+        if (!(anomalyDetection === null || anomalyDetection === void 0 ? void 0 : anomalyDetection.disabled)) {
+            // AWS allows only one DIMENSIONAL(SERVICE) anomaly monitor per account - declare a
+            // single defineAccountBudget per account (or disable anomalyDetection on extras)
+            const anomalyMonitor = new aws_cdk_lib_1.aws_ce.CfnAnomalyMonitor(this, 'anomaly-monitor', {
+                monitorName: `qpq-anomaly-monitor-${accountId}-${name}`,
+                monitorType: 'DIMENSIONAL',
+                monitorDimension: 'SERVICE',
+            });
+            new aws_cdk_lib_1.aws_ce.CfnAnomalySubscription(this, 'anomaly-subscription', {
+                subscriptionName: `qpq-anomaly-subscription-${accountId}-${name}`,
+                monitorArnList: [anomalyMonitor.attrMonitorArn],
+                // DAILY is required for EMAIL subscribers (IMMEDIATE is SNS-only)
+                frequency: 'DAILY',
+                subscribers: subscriberEmails.map((email) => ({
+                    type: 'EMAIL',
+                    address: email,
+                })),
+                thresholdExpression: JSON.stringify({
+                    Dimensions: {
+                        Key: 'ANOMALY_TOTAL_IMPACT_ABSOLUTE',
+                        MatchOptions: ['GREATER_THAN_OR_EQUAL'],
+                        Values: [`${(_a = anomalyDetection === null || anomalyDetection === void 0 ? void 0 : anomalyDetection.minimumImpactUsd) !== null && _a !== void 0 ? _a : 10}`],
+                    },
+                }),
+            });
+        }
+    }
+}
+exports.QpqAccountBudgetConstruct = QpqAccountBudgetConstruct;
+//# sourceMappingURL=QpqAccountBudgetConstruct.js.map

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqAccountBudgetConstruct.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/account/QpqAccountBudgetConstruct.ts"],"names":[],"mappings":";;;AAAA,iEAA+H;AAE/H,6CAAkD;AAGlD,oEAAyF;AAMzF,MAAM,iBAAiB,GAAsB;IAC3C,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;IAC1D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,UAAU,EAAE;IAC/D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;IAC3D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;CAC5D,CAAC;AAEF,MAAa,yBAA0B,SAAQ,qCAAiB;IAC9D,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAqC;;QAC7E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC;QAEzH,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxD,gBAAgB,EAAE,OAAO;YACzB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAC;QAEJ,IAAI,yBAAW,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE;YACxC,MAAM,EAAE;gBACN,UAAU,EAAE,cAAc,SAAS,IAAI,IAAI,EAAE;gBAC7C,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE;oBACX,MAAM,EAAE,eAAe;oBACvB,IAAI,EAAE,KAAK;iBACZ;aACF;YACD,4BAA4B,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC3D,YAAY,EAAE;oBACZ,gBAAgB,EAAE,SAAS,CAAC,IAAI,KAAK,2CAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;oBAC7F,kBAAkB,EAAE,cAAc;oBAClC,SAAS,EAAE,SAAS,CAAC,gBAAgB;oBACrC,aAAa,EAAE,YAAY;iBAC5B;gBACD,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;YAChC,mFAAmF;YACnF,iFAAiF;YACjF,MAAM,cAAc,GAAG,IAAI,oBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE;gBAC3E,WAAW,EAAE,uBAAuB,SAAS,IAAI,IAAI,EAAE;gBACvD,WAAW,EAAE,aAAa;gBAC1B,gBAAgB,EAAE,SAAS;aAC5B,CAAC,CAAC;YAEH,IAAI,oBAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,EAAE;gBAC9D,gBAAgB,EAAE,4BAA4B,SAAS,IAAI,IAAI,EAAE;gBACjE,cAAc,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC;gBAC/C,kEAAkE;gBAClE,SAAS,EAAE,OAAO;gBAClB,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC5C,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC;oBAClC,UAAU,EAAE;wBACV,GAAG,EAAE,+BAA+B;wBACpC,YAAY,EAAE,CAAC,uBAAuB,CAAC;wBACvC,MAAM,EAAE,CAAC,GAAG,MAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,gBAAgB,mCAAI,EAAE,EAAE,CAAC;qBACxD;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA9DD,8DA8DC","sourcesContent":["import { AccountBudgetQPQConfigSetting, BudgetThreshold, BudgetThresholdType, qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { aws_budgets, aws_ce } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';\n\nexport interface QpqAccountBudgetConstructProps extends QpqConstructBlockProps {\n  budgetConfig: AccountBudgetQPQConfigSetting;\n}\n\nconst defaultThresholds: BudgetThreshold[] = [\n  { thresholdPercent: 80, type: BudgetThresholdType.actual },\n  { thresholdPercent: 100, type: BudgetThresholdType.forecasted },\n  { thresholdPercent: 100, type: BudgetThresholdType.actual },\n  { thresholdPercent: 150, type: BudgetThresholdType.actual },\n];\n\nexport class QpqAccountBudgetConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqAccountBudgetConstructProps) {\n    super(scope, id, props);\n\n    const { name, monthlyLimitUsd, subscriberEmails, thresholds = defaultThresholds, anomalyDetection } = props.budgetConfig;\n\n    const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n\n    const emailSubscribers = subscriberEmails.map((email) => ({\n      subscriptionType: 'EMAIL',\n      address: email,\n    }));\n\n    new aws_budgets.CfnBudget(this, 'budget', {\n      budget: {\n        budgetName: `qpq-budget-${accountId}-${name}`,\n        budgetType: 'COST',\n        timeUnit: 'MONTHLY',\n        budgetLimit: {\n          amount: monthlyLimitUsd,\n          unit: 'USD',\n        },\n      },\n      notificationsWithSubscribers: thresholds.map((threshold) => ({\n        notification: {\n          notificationType: threshold.type === BudgetThresholdType.forecasted ? 'FORECASTED' : 'ACTUAL',\n          comparisonOperator: 'GREATER_THAN',\n          threshold: threshold.thresholdPercent,\n          thresholdType: 'PERCENTAGE',\n        },\n        subscribers: emailSubscribers,\n      })),\n    });\n\n    if (!anomalyDetection?.disabled) {\n      // AWS allows only one DIMENSIONAL(SERVICE) anomaly monitor per account - declare a\n      // single defineAccountBudget per account (or disable anomalyDetection on extras)\n      const anomalyMonitor = new aws_ce.CfnAnomalyMonitor(this, 'anomaly-monitor', {\n        monitorName: `qpq-anomaly-monitor-${accountId}-${name}`,\n        monitorType: 'DIMENSIONAL',\n        monitorDimension: 'SERVICE',\n      });\n\n      new aws_ce.CfnAnomalySubscription(this, 'anomaly-subscription', {\n        subscriptionName: `qpq-anomaly-subscription-${accountId}-${name}`,\n        monitorArnList: [anomalyMonitor.attrMonitorArn],\n        // DAILY is required for EMAIL subscribers (IMMEDIATE is SNS-only)\n        frequency: 'DAILY',\n        subscribers: subscriberEmails.map((email) => ({\n          type: 'EMAIL',\n          address: email,\n        })),\n        thresholdExpression: JSON.stringify({\n          Dimensions: {\n            Key: 'ANOMALY_TOTAL_IMPACT_ABSOLUTE',\n            MatchOptions: ['GREATER_THAN_OR_EQUAL'],\n            Values: [`${anomalyDetection?.minimumImpactUsd ?? 10}`],\n          },\n        }),\n      });\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/account/QpqAccountCloudTrailConstruct.d.ts

@@ -0,0 +1,11 @@
+import { AccountCloudTrailQPQConfigSetting } from 'quidproquo-config-aws';
+import { aws_logs } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';
+export interface QpqAccountCloudTrailConstructProps extends QpqConstructBlockProps {
+    cloudTrailConfig: AccountCloudTrailQPQConfigSetting;
+}
+export declare class QpqAccountCloudTrailConstruct extends QpqConstructBlock {
+    readonly logGroup?: aws_logs.LogGroup;
+    constructor(scope: Construct, id: string, props: QpqAccountCloudTrailConstructProps);
+}