quidproquo-deploy-awscdk 0.1.3 → 0.1.4

package/lib/commonjs/QPQApp.js

@@ -39,3 +39,4 @@ const createQPQApp = () => {
     return new cdk.App();
 };
 exports.createQPQApp = createQPQApp;
+//# sourceMappingURL=QPQApp.js.map

package/lib/commonjs/QPQApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QPQApp.js","sourceRoot":"","sources":["../../src/QPQApp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AAE5B,MAAM,YAAY,GAAG,GAAY,EAAE;IACxC,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB","sourcesContent":["import * as cdk from 'aws-cdk-lib';\n\nexport const createQPQApp = (): cdk.App => {\n  return new cdk.App();\n};\n"]}

package/lib/commonjs/constants/BootstrapResource.js

@@ -5,3 +5,4 @@ var BootstrapResource;
 (function (BootstrapResource) {
     BootstrapResource["WarmLambdas"] = "WarmLambdas";
 })(BootstrapResource || (exports.BootstrapResource = BootstrapResource = {}));
+//# sourceMappingURL=BootstrapResource.js.map

package/lib/commonjs/constants/BootstrapResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BootstrapResource.js","sourceRoot":"","sources":["../../../src/constants/BootstrapResource.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBAEX;AAFD,WAAY,iBAAiB;IAC3B,gDAA2B,CAAA;AAC7B,CAAC,EAFW,iBAAiB,iCAAjB,iBAAiB,QAE5B","sourcesContent":["export enum BootstrapResource {\n  WarmLambdas = 'WarmLambdas',\n}\n"]}

package/lib/commonjs/constants/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./BootstrapResource"), exports);
 __exportStar(require("./logging"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,4CAA0B","sourcesContent":["export * from './BootstrapResource';\nexport * from './logging';\n"]}

package/lib/commonjs/constants/logging.js

@@ -2,3 +2,4 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.QPQ_LOG_BUCKET_NAME = void 0;
 exports.QPQ_LOG_BUCKET_NAME = 'logs';
+//# sourceMappingURL=logging.js.map

package/lib/commonjs/constants/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/constants/logging.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG,MAAM,CAAC","sourcesContent":["export const QPQ_LOG_BUCKET_NAME = 'logs';\n"]}

package/lib/commonjs/constructs/base/QpqConstructBlock.js

@@ -37,3 +37,4 @@ class QpqConstructBlock extends constructs_1.Construct {
     }
 }
 exports.QpqConstructBlock = QpqConstructBlock;
+//# sourceMappingURL=QpqConstructBlock.js.map

package/lib/commonjs/constructs/base/QpqConstructBlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqConstructBlock.js","sourceRoot":"","sources":["../../../../src/constructs/base/QpqConstructBlock.ts"],"names":[],"mappings":";;;AAAA,+FAAsE;AAGtE,6CAAsC;AAEtC,2CAAuC;AAQvC,MAAa,iBAAkB,SAAQ,sBAAS;IAI9C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA6B;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,qDAAc,CAAC,sCAAsC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrF,CAAC;IAED,6BAA6B,CAAC,IAAY,EAAE,MAAe;QACzD,OAAO,qDAAc,CAAC,yDAAyD,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChH,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,YAAoB;QAChD,OAAO,qDAAc,CAAC,mCAAmC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IAED,wBAAwB,CAAC,IAAY;QACnC,OAAO,qDAAc,CAAC,+CAA+C,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAED,SAAS,CAAC,OAAmB,IAAS,CAAC;IAEvC,UAAU,CAAC,OAAmB,IAAS,CAAC;IAExC,QAAQ,CAAC,OAAmB;QAC1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,qBAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE;gBACpG,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AA5CD,8CA4CC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { QPQConfig } from 'quidproquo-core';\n\nimport { aws_iam } from 'aws-cdk-lib';\nimport { IGrantable, IRole } from 'aws-cdk-lib/aws-iam';\nimport { Construct } from 'constructs';\n\nimport { QpqResource } from './QpqResource';\n\nexport interface QpqConstructBlockProps {\n  qpqConfig: QPQConfig;\n}\n\nexport class QpqConstructBlock extends Construct implements QpqResource {\n  qpqConfig: QPQConfig;\n  serviceRole?: aws_iam.IRole;\n\n  constructor(scope: Construct, id: string, props: QpqConstructBlockProps) {\n    super(scope, id);\n\n    this.qpqConfig = props.qpqConfig;\n  }\n\n  resourceName(name: string) {\n    return awsNamingUtils.getConfigRuntimeResourceNameFromConfig(name, this.qpqConfig);\n  }\n\n  resourceNameWithModuleOveride(name: string, module?: string) {\n    return awsNamingUtils.getConfigRuntimeResourceNameFromConfigWithServiceOverride(name, this.qpqConfig, module);\n  }\n\n  qpqResourceName(name: string, resourceType: string) {\n    return awsNamingUtils.getQpqRuntimeResourceNameFromConfig(name, this.qpqConfig, resourceType);\n  }\n\n  qpqBootstrapResourceName(name: string) {\n    return awsNamingUtils.getConfigRuntimeBootstrapResourceNameFromConfig(name, this.qpqConfig);\n  }\n\n  grantRead(grantee: IGrantable): void {}\n\n  grantWrite(grantee: IGrantable): void {}\n\n  grantAll(grantee: IGrantable): void {\n    this.grantRead(grantee);\n    this.grantWrite(grantee);\n  }\n\n  getServiceRole(): aws_iam.IRole {\n    if (!this.serviceRole) {\n      this.serviceRole = aws_iam.Role.fromRoleName(this, 'service-role', this.resourceName('service-role'), {\n        mutable: true,\n      });\n    }\n\n    return this.serviceRole;\n  }\n}\n"]}

package/lib/commonjs/constructs/base/QpqResource.js

@@ -1,2 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=QpqResource.js.map

package/lib/commonjs/constructs/base/QpqResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqResource.js","sourceRoot":"","sources":["../../../../src/constructs/base/QpqResource.ts"],"names":[],"mappings":"","sourcesContent":["import { aws_iam } from 'aws-cdk-lib';\n\nexport interface QpqResource {\n  /**\n   * Grants read permissions on this resource.\n   *\n   * @param grantee the role to be granted read-only access to the resource.\n   */\n  grantRead(grantee: aws_iam.IGrantable): void;\n\n  /**\n   * Grants write permissions on the resource.\n   *\n   * @param grantee the role to be granted write access to the resource.\n   */\n  grantWrite(grantee: aws_iam.IGrantable): void;\n\n  /**\n   * Grants read/write permissions on the resource.\n   *\n   * @param grantee the role to be granted read/write access to the resource.\n   */\n  grantAll(grantee: aws_iam.IGrantable): void;\n}\n"]}

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.js

@@ -41,3 +41,4 @@ const createDefaultResourceAlarm = (scope, qpqConfig, props) => {
     });
 };
 exports.createDefaultResourceAlarm = createDefaultResourceAlarm;
+//# sourceMappingURL=createDefaultResourceAlarm.js.map

package/lib/commonjs/constructs/base/createDefaultResourceAlarm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDefaultResourceAlarm.js","sourceRoot":"","sources":["../../../../src/constructs/base/createDefaultResourceAlarm.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAE1D,6CAAqE;AAGrE,8EAA8E;AAC9E,iFAAiF;AACjF,4BAA4B;AAC5B,gGAA6F;AAa7F,sFAAsF;AAC/E,MAAM,2BAA2B,GAAG,CAAC,SAAoB,EAAY,EAAE;IAC5E,MAAM,KAAK,GAAG,8BAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACxH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC;AAHW,QAAA,2BAA2B,+BAGtC;AAEF;;;;;;;;GAQG;AACI,MAAM,0BAA0B,GAAG,CAAC,KAAgB,EAAE,SAAoB,EAAE,KAAgC,EAAQ,EAAE;;IAC3H,IAAI,8BAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,4BAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;QACtD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,MAAA,KAAK,CAAC,kBAAkB,mCAAI,4BAAc,CAAC,kBAAkB,CAAC,kCAAkC;QACpH,iBAAiB,EAAE,MAAA,KAAK,CAAC,iBAAiB,mCAAI,CAAC;QAC/C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,IAAA,mCAA2B,EAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,mDAAwB,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,QAAQ,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClH,KAAK,CAAC,cAAc,CAAC,IAAI,oCAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAlBW,QAAA,0BAA0B,8BAkBrC","sourcesContent":["import { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_cloudwatch, aws_cloudwatch_actions } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\n// Imported by direct path (not the ../feature/core barrel) to avoid an import\n// cycle: resource constructs import this helper, and the barrel re-exports those\n// same resource constructs.\nimport { QpqCoreEventBusConstruct } from '../feature/core/eventBus/QpqCoreEventBusConstruct';\n\nexport interface DefaultResourceAlarmProps {\n  /** Construct id (also seeds the per-event-bus action ids). */\n  id: string;\n  alarmName: string;\n  metric: aws_cloudwatch.IMetric;\n  threshold: number;\n  comparisonOperator?: aws_cloudwatch.ComparisonOperator;\n  evaluationPeriods?: number;\n  datapointsToAlarm?: number;\n}\n\n/** Event buses that error/alarm notifications route to (from `defineNotifyError`). */\nexport const getNotifyErrorEventBusNames = (qpqConfig: QPQConfig): string[] => {\n  const names = qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).flatMap((config) => config.onAlarm.publishToEventBus || []);\n  return [...new Set(names)];\n};\n\n/**\n * Create a sensible default alarm for a resource and route it to the service's\n * error-notification event bus(es).\n *\n * Opt-in: this is a no-op unless the service declares a `defineNotifyError`. We\n * reuse that config's target bus so default alarms land wherever errors already\n * do (no separate ops-routing concept). If a NotifyError exists but names no\n * bus, the alarm is still created (visible in console / dashboards) but unrouted.\n */\nexport const createDefaultResourceAlarm = (scope: Construct, qpqConfig: QPQConfig, props: DefaultResourceAlarmProps): void => {\n  if (qpqCoreUtils.getNotifyErrorConfigs(qpqConfig).length === 0) {\n    return;\n  }\n\n  const alarm = new aws_cloudwatch.Alarm(scope, props.id, {\n    alarmName: props.alarmName,\n    metric: props.metric,\n    threshold: props.threshold,\n    comparisonOperator: props.comparisonOperator ?? aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n    evaluationPeriods: props.evaluationPeriods ?? 1,\n    datapointsToAlarm: props.datapointsToAlarm,\n  });\n\n  getNotifyErrorEventBusNames(qpqConfig).forEach((busName) => {\n    const eventBus = QpqCoreEventBusConstruct.fromOtherStack(scope, `${props.id}-bus-${busName}`, qpqConfig, busName);\n    alarm.addAlarmAction(new aws_cloudwatch_actions.SnsAction(eventBus.topic));\n  });\n};\n"]}

package/lib/commonjs/constructs/base/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqConstructBlock"), exports);
 __exportStar(require("./QpqResource"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/base/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/base/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,gDAA8B","sourcesContent":["export * from './QpqConstructBlock';\nexport * from './QpqResource';\n"]}

package/lib/commonjs/constructs/basic/BSQpqLambdaWarmerEventConstruct.js

@@ -24,3 +24,4 @@ class BSQpqLambdaWarmerEventConstructConstruct extends QpqConstructBlock_1.QpqCo
     }
 }
 exports.BSQpqLambdaWarmerEventConstructConstruct = BSQpqLambdaWarmerEventConstructConstruct;
+//# sourceMappingURL=BSQpqLambdaWarmerEventConstruct.js.map

package/lib/commonjs/constructs/basic/BSQpqLambdaWarmerEventConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BSQpqLambdaWarmerEventConstruct.js","sourceRoot":"","sources":["../../../../src/constructs/basic/BSQpqLambdaWarmerEventConstruct.ts"],"names":[],"mappings":";;;AAAA,6CAAsE;AAGtE,+CAAoD;AACpD,iEAAsF;AAItF,MAAa,wCAAyC,SAAQ,qCAAiB;IAC7E,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAoD;QAC5F,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE;YACvD,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC;YACtE,mEAAmE;YACnE,QAAQ,EAAE,wBAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;SAC5D,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,qBAAO,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC;YACvE,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CACZ,IAAI,gCAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,wBAAU,CAAC,eAAe,CAAC,UAAU,CAAC;gBAC7C,IAAI,EAAE,sBAAsB;aAC7B,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAvBD,4FAuBC","sourcesContent":["import { aws_events, aws_events_targets, aws_sns } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { BootstrapResource } from '../../constants';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface BSQpqLambdaWarmerEventConstructConstructProps extends QpqConstructBlockProps {}\n\nexport class BSQpqLambdaWarmerEventConstructConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: BSQpqLambdaWarmerEventConstructConstructProps) {\n    super(scope, id, props);\n\n    const rule = new aws_events.Rule(this, 'WarmLambdaRule', {\n      ruleName: this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas),\n      // Create an EventBridge rule to trigger the Lambda every X minutes\n      schedule: aws_events.Schedule.expression('rate(5 minutes)'),\n    });\n\n    const topic = new aws_sns.Topic(this, 'MyTopic', {\n      topicName: this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas),\n      displayName: 'Warm Lambdas',\n    });\n\n    rule.addTarget(\n      new aws_events_targets.SnsTopic(topic, {\n        message: aws_events.RuleTargetInput.fromObject({\n          type: 'QpqLambdaWarmerEvent',\n        }),\n      }),\n    );\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/DomainCertificateLookup.js

@@ -22,3 +22,4 @@ const lookupDomainCertificate = (scope, certRegion, rootDomain, idSuffix) => {
     return aws_cdk_lib_1.aws_certificatemanager.Certificate.fromCertificateArn(scope, `domain-cert-${idSuffix}`, certArn);
 };
 exports.lookupDomainCertificate = lookupDomainCertificate;
+//# sourceMappingURL=DomainCertificateLookup.js.map

package/lib/commonjs/constructs/basic/DomainCertificateLookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DomainCertificateLookup.js","sourceRoot":"","sources":["../../../../src/constructs/basic/DomainCertificateLookup.ts"],"names":[],"mappings":";;;AAAA,iEAA0D;AAE1D,6CAA8D;AAG9D;;;;;;;;;;;;GAYG;AACI,MAAM,uBAAuB,GAAG,CACrC,KAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,QAAgB,EACqB,EAAE;IACvC,MAAM,SAAS,GAAG,yCAAiB,CAAC,uCAAuC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,qBAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClF,OAAO,oCAAsB,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,eAAe,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;AAC1G,CAAC,CAAC;AATW,QAAA,uBAAuB,2BASlC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { aws_certificatemanager, aws_ssm } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\n/**\n * Service-side helper to import an ACM certificate previously created by a DomainCertificateStack.\n *\n * The domain phase writes the cert ARN into an SSM parameter in the deploy region, keyed by region.\n * This helper reads that parameter as a deploy-time CloudFormation token and imports the cert by ARN.\n * Resolution is deferred to CloudFormation at deploy time (via valueForStringParameter), so synth does\n * not require the domain stack to have been deployed yet.\n *\n * @param scope      CDK construct scope (typically the service stack/construct)\n * @param certRegion 'us-east-1' for CloudFront, deploy region for regional resources\n * @param rootDomain The same un-prefixed apex passed to the matching defineDomainCertificate entry\n * @param idSuffix   Unique suffix for the CDK construct id (scope-local)\n */\nexport const lookupDomainCertificate = (\n  scope: Construct,\n  certRegion: string,\n  rootDomain: string,\n  idSuffix: string,\n): aws_certificatemanager.ICertificate => {\n  const paramName = qpqConfigAwsUtils.getDomainCertificateArnSsmParameterName(certRegion, rootDomain);\n  const certArn = aws_ssm.StringParameter.valueForStringParameter(scope, paramName);\n  return aws_certificatemanager.Certificate.fromCertificateArn(scope, `domain-cert-${idSuffix}`, certArn);\n};\n"]}

package/lib/commonjs/constructs/basic/Function.js

@@ -109,3 +109,4 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.Function = Function;
+//# sourceMappingURL=Function.js.map

package/lib/commonjs/constructs/basic/Function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Function.js","sourceRoot":"","sources":["../../../../src/constructs/basic/Function.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+FAAsE;AACtE,iEAAuE;AACvE,iEAA0D;AAC1D,qDAA0D;AAE1D,6CAAqG;AACrG,iDAAmC;AAEnC,iCAA6B;AAE7B,+CAAoD;AACpD,uCAA0F;AAC1F,uFAAyE;AACzE,iEAAsF;AA4BtF,kFAAkF;AAClF,kFAAkF;AAClF,sFAAsF;AACtF,qFAAqF;AACrF,yEAAyE;AACzE,MAAM,wBAAwB,GAAG,CAAC,SAAoB,EAA0B,EAAE;;IAChF,MAAM,cAAc,GAAG,8BAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,8BAAY,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wDAAwD,cAAc,CAAC,YAAY,4DAA4D,CAChJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,qDAAc,CAAC,0CAA0C,CAC1E,CAAA,MAAA,YAAY,CAAC,KAAK,0CAAE,oBAAoB,KAAI,YAAY,CAAC,YAAY,EACrE,SAAS,EACT,YAAY,CAAC,KAAK,CACnB,CAAC;IACF,MAAM,WAAW,GAAG,8BAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAErE,uBACE,qBAAqB,EAAE,QAAQ,UAAU,IAAI,WAAW,EAAE,IACvD,CAAC,cAAc,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACjH;AACJ,CAAC,CAAC;AAEF,MAAa,QAAS,SAAQ,qCAAiB;IAG7C,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAoB;;QAC5D,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,YAAY,IAAI,EAAE,MAAM,MAAA,KAAK,CAAC,YAAY,0CAAE,MAAM,EAAE,CAAC,CAAC;QAEtF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC;QAEjD,MAAM,WAAW,GAAG,IAAA,sDAA8B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpE,MAAM,UAAU,GAAG,KAAK,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;QAE/G,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;YAE3D,OAAO,EAAE,IAAA,wBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC;YAC1C,YAAY,EAAE,IAAA,6BAAqB,EAAC,KAAK,CAAC,SAAS,CAAC;YACpD,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,WAAW,CAAC,oBAAoB,IAAI,IAAI;YAC3E,MAAM,EAAE,KAAK,CAAC,gBAAgB;YAE9B,IAAI,EAAE,wBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,YAAI,EAAC,0BAAkB,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACtH,OAAO,EAAE,GAAG,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE;YAE/C,WAAW,gCACT,mCAAmC,EAAE,GAAG,IAIrC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,GACzC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAC7B;YAED,4BAA4B,EAAE,yCAAiB,CAAC,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B;YAE/I,OAAO,EAAE,yCAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAU,CAAC,OAAO,CAAC,MAAM;YAEvH,QAAQ,EAAE,IAAI,sBAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;gBAChD,SAAS,EAAE,sBAAQ,CAAC,aAAa,CAAC,QAAQ;gBAC1C,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;aACzC,CAAC;YAEF,IAAI,EAAE,KAAK,CAAC,IAAI;YAEhB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU,EAAE,KAAK,CAAC,GAAG;gBACnB,CAAC,CAAC;oBACE,UAAU,EAAE,qBAAO,CAAC,UAAU,CAAC,mBAAmB;iBACnD;gBACH,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QAEH,oBAAoB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEhF,IAAI,CAAC,yCAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnF,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAEzF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,6BAAiB,CAAC,WAAW,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,eAAe,MAAM,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,qBAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;YAE1E,KAAK,CAAC,eAAe,CAAC,IAAI,mCAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AApED,4BAoEC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { getAwsServiceAccountInfoConfig } from 'quidproquo-config-aws';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_ec2, aws_iam, aws_lambda, aws_logs, aws_sns, aws_sns_subscriptions } from 'aws-cdk-lib';\nimport * as cdk from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\nimport { join } from 'upath';\n\nimport { BootstrapResource } from '../../constants';\nimport { getLambdaArchitecture, getLambdaRuntime, qpqAwsCdkPathUtils } from '../../utils';\nimport * as qpqDeployAwsCdkUtils from '../../utils/qpqDeployAwsCdkUtils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface FunctionProps extends QpqConstructBlockProps {\n  functionName?: string;\n\n  srcFilename?: string;\n  functionType: string; // TODO: Rename this to subFolder / folder or something\n  executorName: string; // TODO: Rename this to handlerName or something maybe?\n\n  timeoutInSeconds?: number;\n  memoryInBytes?: number;\n\n  environment?: {\n    [key: string]: string;\n  };\n\n  apiLayerVersions?: aws_lambda.ILayerVersion[];\n\n  reservedConcurrentExecutions?: number;\n\n  role?: aws_iam.IRole;\n\n  reacreateOnFunctionNameChange?: boolean;\n\n  vpc?: aws_ec2.IVpc;\n  securityGroups?: aws_ec2.ISecurityGroup[];\n}\n\n// Resolves the federated code store location for this service, if it opted in via\n// defineFederatedModuleStore. Points the lambda at the referenced storage drive's\n// bucket, namespaced by service (s3://<bucket>/<service>), so many services can share\n// one bucket. Read access comes from the storage drive's own grants. Returns {} when\n// federation isn't configured, so the lambda runs only its bundled code.\nconst getFederatedCodeStoreEnv = (qpqConfig: QPQConfig): Record<string, string> => {\n  const federatedStore = qpqCoreUtils.getFederatedModuleStore(qpqConfig);\n  if (!federatedStore) {\n    return {};\n  }\n\n  const storageDrive = qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);\n  if (!storageDrive) {\n    throw new Error(\n      `defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which is not defined - add a matching defineStorageDrive`,\n    );\n  }\n\n  const bucketName = awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(\n    storageDrive.owner?.resourceNameOverride || storageDrive.storageDrive,\n    qpqConfig,\n    storageDrive.owner,\n  );\n  const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return {\n    federatedCodeStoreUrl: `s3://${bucketName}/${serviceName}`,\n    ...(federatedStore.recheckMs !== undefined ? { federatedCodeStoreRecheckMs: `${federatedStore.recheckMs}` } : {}),\n  };\n};\n\nexport class Function extends QpqConstructBlock {\n  public readonly lambdaFunction: aws_lambda.Function;\n\n  constructor(scope: Construct, id: string, props: FunctionProps) {\n    super(scope, id, props);\n\n    console.log(`Function: [${props.functionName || ''}]::${props.functionName?.length}`);\n\n    const handlerFile = props.srcFilename || 'index';\n\n    const serviceInfo = getAwsServiceAccountInfoConfig(props.qpqConfig);\n\n    const functionId = props.reacreateOnFunctionNameChange && props.functionName ? props.functionName : 'function';\n\n    this.lambdaFunction = new aws_lambda.Function(this, functionId, {\n      functionName: props.functionName,\n      timeout: cdk.Duration.seconds(props.timeoutInSeconds || 25),\n\n      runtime: getLambdaRuntime(props.qpqConfig),\n      architecture: getLambdaArchitecture(props.qpqConfig),\n      memorySize: props.memoryInBytes || serviceInfo.lambdaMaxMemoryInMiB || 1024,\n      layers: props.apiLayerVersions,\n\n      code: aws_lambda.Code.fromAsset(join(qpqAwsCdkPathUtils.getApiBuildPathFullPath(props.qpqConfig), props.functionType)),\n      handler: `${handlerFile}.${props.executorName}`,\n\n      environment: {\n        AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1',\n        // Federated code store (only when the service opted in via\n        // defineFederatedModuleStore); the loader falls back to bundled modules\n        // while the store has nothing published for this service\n        ...getFederatedCodeStoreEnv(props.qpqConfig),\n        ...(props.environment || {}),\n      },\n\n      reservedConcurrentExecutions: qpqConfigAwsUtils.isReservedConcurrencyDisabled(props.qpqConfig) ? undefined : props.reservedConcurrentExecutions,\n\n      tracing: qpqConfigAwsUtils.isTracingDisabled(props.qpqConfig) ? aws_lambda.Tracing.DISABLED : aws_lambda.Tracing.ACTIVE,\n\n      logGroup: new aws_logs.LogGroup(this, 'LogGroup', {\n        retention: aws_logs.RetentionDays.ONE_YEAR,\n        removalPolicy: cdk.RemovalPolicy.DESTROY,\n      }),\n\n      role: props.role,\n\n      vpc: props.vpc,\n      vpcSubnets: props.vpc\n        ? {\n            subnetType: aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,\n          }\n        : undefined,\n      securityGroups: props.securityGroups,\n    });\n\n    qpqDeployAwsCdkUtils.applyEnvironmentTags(this.lambdaFunction, props.qpqConfig);\n\n    if (!qpqConfigAwsUtils.isLambdaWarmingDisabled(props.qpqConfig)) {\n      const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n      const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n\n      const topicName = this.qpqBootstrapResourceName(BootstrapResource.WarmLambdas);\n      const topicArn = `arn:aws:sns:${region}:${accountId}:${topicName}`;\n      const topic = aws_sns.Topic.fromTopicArn(this, 'ImportedTopic', topicArn);\n\n      topic.addSubscription(new aws_sns_subscriptions.LambdaSubscription(this.lambdaFunction));\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/LambdaLayers.js

@@ -45,3 +45,4 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.LambdaLayers = LambdaLayers;
+//# sourceMappingURL=LambdaLayers.js.map

package/lib/commonjs/constructs/basic/LambdaLayers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LambdaLayers.js","sourceRoot":"","sources":["../../../../src/constructs/basic/LambdaLayers.ts"],"names":[],"mappings":";;;;;;AAAA,+FAAgG;AAChG,iEAAiF;AACjF,qDAA0D;AAE1D,6CAAyC;AAEzC,gDAAwB;AAExB,uCAA+C;AAC/C,iEAAsF;AAE/E,MAAM,4BAA4B,GAAG,CAAC,SAAoB,EAAc,EAAE;IAC/E,MAAM,2BAA2B,GAAG,IAAA,sDAA8B,EAAC,SAAS,CAAC,CAAC;IAE9E,OAAO,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,8BAAY,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1G,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AARW,QAAA,4BAA4B,gCAQvC;AAIF,MAAa,YAAa,SAAQ,qCAAiB;IAGjD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAwB;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,SAAS,GAAG,IAAA,oCAA4B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,IAAA,wBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,OAAO,KAAK,CAAC,SAAS;gBACpB,CAAC,CAAC,IAAI,wBAAU,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,QAAQ,EAAE;oBACvD,gBAAgB,EAAE,qDAAc,CAAC,mCAAmC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC;oBACjG,IAAI,EAAE,IAAI,wBAAU,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC/C,kBAAkB,EAAE,CAAC,aAAa,CAAC;iBACpC,CAAC;gBACJ,CAAC,CAAC,wBAAU,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,YAAY,EAAE,KAAK,CAAC,QAAS,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,IAAI,wBAAU,CAAC,YAAY,CAAC,IAAI,EAAE,yBAAyB,EAAE;YACrF,gBAAgB,EAAE,qDAAc,CAAC,mCAAmC,CAAC,mBAAmB,EAAE,KAAK,CAAC,SAAS,CAAC;YAC1G,IAAI,EAAE,IAAI,wBAAU,CAAC,SAAS,CAAC,IAAA,+DAAwB,GAAE,CAAC;YAC1D,kBAAkB,EAAE,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACnD,CAAC;CACF;AA7BD,oCA6BC","sourcesContent":["import { awsNamingUtils, getLogExtensionLayerPath } from 'quidproquo-actionprocessor-awslambda';\nimport { ApiLayer, getAwsServiceAccountInfoConfig } from 'quidproquo-config-aws';\nimport { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_lambda } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\nimport path from 'path';\n\nimport { getLambdaRuntime } from '../../utils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport const getLambdaLayersWithFullPaths = (qpqConfig: QPQConfig): ApiLayer[] => {\n  const awsServiceAccountInfoConfig = getAwsServiceAccountInfoConfig(qpqConfig);\n\n  return awsServiceAccountInfoConfig.apiLayers.map((layer: ApiLayer) => ({\n    name: layer.name,\n    buildPath: layer.buildPath ? path.join(qpqCoreUtils.getConfigRoot(qpqConfig), layer.buildPath) : undefined,\n    layerArn: layer.layerArn,\n  }));\n};\n\nexport interface LambdaLayersProps extends QpqConstructBlockProps {}\n\nexport class LambdaLayers extends QpqConstructBlock {\n  public readonly layers: aws_lambda.ILayerVersion[];\n\n  constructor(scope: Construct, id: string, props: LambdaLayersProps) {\n    super(scope, id, props);\n\n    const apiLayers = getLambdaLayersWithFullPaths(props.qpqConfig);\n    const lambdaRuntime = getLambdaRuntime(props.qpqConfig);\n\n    const userLayers = apiLayers.map((layer) => {\n      return layer.buildPath\n        ? new aws_lambda.LayerVersion(this, `${layer.name}-layer`, {\n            layerVersionName: awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),\n            code: new aws_lambda.AssetCode(layer.buildPath),\n            compatibleRuntimes: [lambdaRuntime],\n          })\n        : aws_lambda.LayerVersion.fromLayerVersionArn(this, `${layer.name}-layer-ref`, layer.layerArn!);\n    });\n\n    // Always-on: the qpq-log-extension ships story logs to S3 off the function's\n    // response path. Attached to every function via apiLayerVersions.\n    const logExtensionLayer = new aws_lambda.LayerVersion(this, 'qpq-log-extension-layer', {\n      layerVersionName: awsNamingUtils.getQpqRuntimeResourceNameFromConfig('qpq-log-extension', props.qpqConfig),\n      code: new aws_lambda.AssetCode(getLogExtensionLayerPath()),\n      compatibleRuntimes: [lambdaRuntime],\n    });\n\n    this.layers = [...userLayers, logExtensionLayer];\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/SubdomainName.js

@@ -41,3 +41,4 @@ class SubdomainName extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.SubdomainName = SubdomainName;
+//# sourceMappingURL=SubdomainName.js.map

package/lib/commonjs/constructs/basic/SubdomainName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubdomainName.js","sourceRoot":"","sources":["../../../../src/constructs/basic/SubdomainName.ts"],"names":[],"mappings":";;;AAAA,iEAA0D;AAC1D,+DAAyD;AAEzD,6CAAuG;AAGvG,iEAAsF;AACtF,uEAAoE;AAQpE,MAAa,aAAc,SAAQ,qCAAiB;IAMlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAyB;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,IAAI,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAE7D,+EAA+E;QAC/E,sEAAsE;QACtE,kFAAkF;QAClF,MAAM,gBAAgB,GAAG,wCAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChG,MAAM,cAAc,GAAG,yBAAW,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE;YAC5E,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QAEH,wEAAwE;QACxE,+FAA+F;QAC/F,MAAM,YAAY,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC,WAAW,GAAG,IAAA,iDAAuB,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElG,IAAI,CAAC,UAAU,GAAG,IAAI,4BAAc,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE;YACnE,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,4BAAc,CAAC,cAAc,CAAC,OAAO;YACrD,YAAY,EAAE,4BAAc,CAAC,YAAY,CAAC,QAAQ;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,yBAAW,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,iCAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnH,IAAI,yBAAW,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE;YACxC,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,MAAM,EAAE,IAAI,CAAC,aAAa;SAC3B,CAAC,CAAC;QAEH,kDAAkD;QAClD,4CAA4C;QAC5C,wCAAwC;QACxC,oDAAoD;QACpD,MAAM;IACR,CAAC;CACF;AA7CD,sCA6CC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { qpqWebServerUtils } from 'quidproquo-webserver';\n\nimport { aws_apigateway, aws_certificatemanager, aws_route53, aws_route53_targets } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\nimport { lookupDomainCertificate } from './DomainCertificateLookup';\n\nexport interface SubdomainNameProps extends QpqConstructBlockProps {\n  subdomain: string;\n  apexDomain: string;\n  rootDomain: string;\n}\n\nexport class SubdomainName extends QpqConstructBlock {\n  public readonly domainName: aws_apigateway.DomainName;\n  public readonly certificate: aws_certificatemanager.ICertificate;\n  public readonly targetARecord: aws_route53.RecordTarget;\n  public readonly deployDomain: string;\n\n  constructor(scope: Construct, id: string, props: SubdomainNameProps) {\n    super(scope, id, props);\n\n    this.deployDomain = `${props.subdomain}.${props.apexDomain}`;\n\n    // Always look up the root hosted zone (e.g. development.quidproquojs.com), not\n    // a per-service sub-zone. The FQDN may include the service name (e.g.\n    // ws.shell.development.quidproquojs.com) but the A record lives in the root zone.\n    const hostedZoneDomain = qpqWebServerUtils.resolveDomainRoot(props.rootDomain, props.qpqConfig);\n    const apexHostedZone = aws_route53.HostedZone.fromLookup(this, 'hosted-zone', {\n      domainName: hostedZoneDomain,\n    });\n\n    // Regional API Gateway custom domains need a cert in the deploy region.\n    // Look it up from SSM, written by the matching DomainCertificateStack during the domain phase.\n    const deployRegion = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n    this.certificate = lookupDomainCertificate(this, deployRegion, props.rootDomain, props.subdomain);\n\n    this.domainName = new aws_apigateway.DomainName(this, 'domain-name', {\n      domainName: this.deployDomain,\n      certificate: this.certificate,\n      securityPolicy: aws_apigateway.SecurityPolicy.TLS_1_2,\n      endpointType: aws_apigateway.EndpointType.REGIONAL,\n    });\n\n    this.targetARecord = aws_route53.RecordTarget.fromAlias(new aws_route53_targets.ApiGatewayDomain(this.domainName));\n\n    new aws_route53.ARecord(this, 'a-record', {\n      zone: apexHostedZone,\n      recordName: this.deployDomain,\n      target: this.targetARecord,\n    });\n\n    // // Export the names so we can import them later\n    // new cdk.CfnOutput(this, 'HostedZoneID', {\n    //   value: apexHostedZone.hostedZoneId,\n    //   exportName: `${apexHostedZone}-hosted-zone-id`,\n    // });\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/WebserverRoll.js

@@ -61,7 +61,7 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
         // the same owner-fallback derivation the runtime send processor uses to build the ARN.
         const eventBusTopicArns = quidproquo_core_1.qpqCoreUtils.getAllEventBusConfigs(props.qpqConfig).map((eventBusConfig) => {
             var _a, _b, _c, _d, _e;
-            return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getEventBusSnsTopicArn(((_a = eventBusConfig.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || eventBusConfig.name, props.qpqConfig, ((_b = eventBusConfig.owner) === null || _b === void 0 ? void 0 : _b.module) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(props.qpqConfig), ((_c = eventBusConfig.owner) === null || _c === void 0 ? void 0 : _c.environment) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig), ((_d = eventBusConfig.owner) === null || _d === void 0 ? void 0 : _d.application) || quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), ((_e = eventBusConfig.owner) === null || _e === void 0 ? void 0 : _e.feature) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig));
+            return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getEventBusSnsTopicArn(((_a = eventBusConfig.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || eventBusConfig.name, props.qpqConfig, ((_b = eventBusConfig.owner) === null || _b === void 0 ? void 0 : _b.module) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(props.qpqConfig), ((_c = eventBusConfig.owner) === null || _c === void 0 ? void 0 : _c.environment) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig), ((_d = eventBusConfig.owner) === null || _d === void 0 ? void 0 : _d.application) || quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), ((_e = eventBusConfig.owner) === null || _e === void 0 ? void 0 : _e.feature) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig), eventBusConfig.isFifo);
         });
         const policies = [
             // Resolve cross-stack resource names at runtime via CloudFormation exports.
@@ -145,3 +145,4 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.WebserverRoll = WebserverRoll;
+//# sourceMappingURL=WebserverRoll.js.map

package/lib/commonjs/constructs/basic/WebserverRoll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebserverRoll.js","sourceRoot":"","sources":["../../../../src/constructs/basic/WebserverRoll.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+FAAsE;AACtE,iEAA0D;AAC1D,qDAA+C;AAE/C,6CAAsC;AAGtC,uFAAyE;AACzE,iEAAsF;AAItF,MAAa,aAAc,SAAQ,qCAAiB;IAGlD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAyB;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,IAAI,qBAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YAC1C,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;YAC3C,SAAS,EAAE,IAAI,qBAAO,CAAC,kBAAkB,CACvC,IAAI,qBAAO,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EACpD,IAAI,qBAAO,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EACtD,IAAI,qBAAO,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAEzD;SACF,CAAC,CAAC;QAEH,oBAAoB,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,eAAe,GAAG,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,8BAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE1E,6FAA6F;QAC7F,sFAAsF;QACtF,2FAA2F;QAC3F,MAAM,gCAAgC,mBACpC,6BAA6B,EAAE,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAC/E,6BAA6B,EAAE,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,IACzF,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3D,CAAC;QAEF,wFAAwF;QACxF,uFAAuF;QACvF,MAAM,iBAAiB,GAAG,8BAAY,CAAC,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE;;YACnG,OAAA,qDAAc,CAAC,sBAAsB,CACnC,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,oBAAoB,KAAI,cAAc,CAAC,IAAI,EACjE,KAAK,CAAC,SAAS,EAEf,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,MAAM,KAAI,8BAAY,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,EACtF,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,WAAW,KAAI,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,EAClG,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,WAAW,KAAI,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EACrF,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,OAAO,KAAI,8BAAY,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,EAC1F,cAAc,CAAC,MAAM,CACtB,CAAA;SAAA,CACF,CAAC;QAEF,MAAM,QAAQ,GAAmC;YAC/C,4EAA4E;YAC5E;gBACE,GAAG,EAAE,2BAA2B;gBAChC,OAAO,EAAE,CAAC,4BAA4B,CAAC;gBACvC,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;YAED,wFAAwF;YACxF,oFAAoF;YACpF,gFAAgF;YAChF,2EAA2E;YAC3E;gBACE,GAAG,EAAE,yBAAyB;gBAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;gBAC3B,SAAS,EAAE,CAAC,sBAAsB,MAAM,cAAc,CAAC;gBACvD,UAAU,EAAE;oBACV,YAAY,EAAE,gCAAgC;iBAC/C;aACF;YAED,iFAAiF;YACjF,oFAAoF;YACpF,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC;oBACE;wBACE,GAAG,EAAE,oBAAoB;wBACzB,OAAO,EAAE,CAAC,aAAa,CAAC;wBACxB,SAAS,EAAE,iBAAiB;qBAC7B;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,oFAAoF;YACpF,kFAAkF;YAClF,gFAAgF;YAChF,0EAA0E;YAC1E;gBACE,GAAG,EAAE,sBAAsB;gBAC3B,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE;oBACT,kBAAkB,MAAM,IAAI,SAAS,aAAa,qDAAc,CAAC,4BAA4B,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE;iBACvJ;aACF;YAED,8DAA8D;YAC9D;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,OAAO,EAAE,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;gBAC5D,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;YAED,qFAAqF;YACrF,iFAAiF;YACjF;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,OAAO,EAAE;oBACP,qBAAqB;oBACrB,sBAAsB;oBACtB,wBAAwB;oBACxB,yBAAyB;oBACzB,mBAAmB;oBACnB,mBAAmB;oBACnB,sBAAsB;iBACvB;gBACD,SAAS,EAAE,CAAC,kBAAkB,SAAS,cAAc,CAAC;aACvD;YAED,0DAA0D;YAC1D;gBACE,GAAG,EAAE,gCAAgC;gBACrC,OAAO,EAAE;oBACP,4BAA4B;oBAC5B,+BAA+B;oBAC/B,4BAA4B;oBAC5B,8BAA8B;oBAC9B,gCAAgC;iBACjC;gBACD,SAAS,EAAE,CAAC,GAAG,CAAC;aACjB;SACF,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,qBAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAxID,sCAwIC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_iam } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport * as qpqDeployAwsCdkUtils from '../../utils/qpqDeployAwsCdkUtils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../base/QpqConstructBlock';\n\nexport interface WebserverRollProps extends QpqConstructBlockProps {}\n\nexport class WebserverRoll extends QpqConstructBlock {\n  role: aws_iam.IRole;\n\n  constructor(scope: Construct, id: string, props: WebserverRollProps) {\n    super(scope, id, props);\n\n    const role = new aws_iam.Role(this, 'role', {\n      roleName: this.resourceName('service-role'),\n      assumedBy: new aws_iam.CompositePrincipal(\n        new aws_iam.ServicePrincipal('lambda.amazonaws.com'),\n        new aws_iam.ServicePrincipal('transfer.amazonaws.com'),\n        new aws_iam.ServicePrincipal('edgelambda.amazonaws.com'),\n        // new aws_iam.ServicePrincipal('neptune.amazonaws.com'),\n      ),\n    });\n\n    qpqDeployAwsCdkUtils.applyEnvironmentTags(role, props.qpqConfig);\n\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n    const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n    const applicationName = qpqCoreUtils.getApplicationName(props.qpqConfig);\n    const environment = qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig);\n    const feature = qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig);\n\n    // This deployment's identity tags, as applied to every qpq resource by applyEnvironmentTags.\n    // Used for tag-based conditions where the target resource's id is unknowable at synth\n    // (later deploy phase / AWS-generated) but the resource is still owned by this deployment.\n    const applicationResourceTagConditions = {\n      'aws:ResourceTag/application': qpqCoreUtils.getApplicationName(props.qpqConfig),\n      'aws:ResourceTag/environment': qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig),\n      ...(feature ? { 'aws:ResourceTag/feature': feature } : {}),\n    };\n\n    // Every event-bus topic this service can publish to (owned + referenced cross-module) -\n    // the same owner-fallback derivation the runtime send processor uses to build the ARN.\n    const eventBusTopicArns = qpqCoreUtils.getAllEventBusConfigs(props.qpqConfig).map((eventBusConfig) =>\n      awsNamingUtils.getEventBusSnsTopicArn(\n        eventBusConfig.owner?.resourceNameOverride || eventBusConfig.name,\n        props.qpqConfig,\n\n        eventBusConfig.owner?.module || qpqCoreUtils.getApplicationModuleName(props.qpqConfig),\n        eventBusConfig.owner?.environment || qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig),\n        eventBusConfig.owner?.application || qpqCoreUtils.getApplicationName(props.qpqConfig),\n        eventBusConfig.owner?.feature || qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig),\n        eventBusConfig.isFifo,\n      ),\n    );\n\n    const policies: aws_iam.PolicyStatementProps[] = [\n      // Resolve cross-stack resource names at runtime via CloudFormation exports.\n      {\n        sid: 'CloudFormationListExports',\n        actions: ['cloudformation:ListExports'],\n        resources: ['*'],\n      },\n\n      // Read api-key values at runtime for api-key validation - keys are fetched individually\n      // by id (never listed), so the grant is per-key, pinned to this application's tags.\n      // Module is deliberately NOT pinned: routes may reference another service's key\n      // (ApiKeyReference.serviceName) within the same application + environment.\n      {\n        sid: 'APIGatewayGetOperations',\n        actions: ['apigateway:GET'],\n        resources: [`arn:aws:apigateway:${region}::/apikeys/*`],\n        conditions: {\n          StringEquals: applicationResourceTagConditions,\n        },\n      },\n\n      // Publish to event-bus SNS topics (the framework's pub/sub layer), scoped to the\n      // buses this service declares. Omitted entirely when no event buses are configured.\n      ...(eventBusTopicArns.length > 0\n        ? [\n            {\n              sid: 'SNSPublishMessages',\n              actions: ['sns:Publish'],\n              resources: eventBusTopicArns,\n            },\n          ]\n        : []),\n\n      // Invoke QPQ service functions from other lambdas. The runtime derives target names\n      // with getConfigRuntimeResourceName from its own app/env/feature (only the target\n      // service varies), so the same helper builds this pattern with the function and\n      // service segments wildcarded - cross-app/env invocation is not possible.\n      {\n        sid: 'LambdaInvokeFunction',\n        actions: ['lambda:InvokeFunction'],\n        resources: [\n          `arn:aws:lambda:${region}:${accountId}:function:${awsNamingUtils.getConfigRuntimeResourceName('*-sfunc', applicationName, '*', environment, feature)}`,\n        ],\n      },\n\n      // Look up ACM certs when wiring up custom domains at runtime.\n      {\n        sid: 'ACMCertificateOperations',\n        actions: ['acm:DescribeCertificate', 'acm:ListCertificates'],\n        resources: ['*'],\n      },\n\n      // Standard Lambda logging + log retrieval for the `askGetLogs` flow. Account-pinned;\n      // region is left open because edge lambdas write logs in their execution region.\n      {\n        sid: 'CloudWatchLogsManagement',\n        actions: [\n          'logs:CreateLogGroup',\n          'logs:CreateLogStream',\n          'logs:DescribeLogGroups',\n          'logs:DescribeLogStreams',\n          'logs:PutLogEvents',\n          'logs:GetLogEvents',\n          'logs:FilterLogEvents',\n        ],\n        resources: [`arn:aws:logs:*:${accountId}:log-group:*`],\n      },\n\n      // Required for VPC-attached Lambdas to manage their ENIs.\n      {\n        sid: 'EC2NetworkInterfacePermissions',\n        actions: [\n          'ec2:CreateNetworkInterface',\n          'ec2:DescribeNetworkInterfaces',\n          'ec2:DeleteNetworkInterface',\n          'ec2:AssignPrivateIpAddresses',\n          'ec2:UnassignPrivateIpAddresses',\n        ],\n        resources: ['*'],\n      },\n    ];\n\n    policies.forEach((policy) => {\n      role.addToPolicy(new aws_iam.PolicyStatement(policy));\n    });\n\n    this.role = role;\n  }\n}\n"]}

package/lib/commonjs/constructs/basic/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./DomainCertificateLookup"), exports);
 __exportStar(require("./Function"), exports);
 __exportStar(require("./LambdaLayers"), exports);
 __exportStar(require("./SubdomainName"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/basic/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/basic/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAC1C,6CAA2B;AAC3B,iDAA+B;AAC/B,kDAAgC","sourcesContent":["export * from './DomainCertificateLookup';\nexport * from './Function';\nexport * from './LambdaLayers';\nexport * from './SubdomainName';\n"]}

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.js

@@ -69,3 +69,4 @@ class QpqAccountBudgetConstruct extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.QpqAccountBudgetConstruct = QpqAccountBudgetConstruct;
+//# sourceMappingURL=QpqAccountBudgetConstruct.js.map

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqAccountBudgetConstruct.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/account/QpqAccountBudgetConstruct.ts"],"names":[],"mappings":";;;AAAA,iEAA+H;AAE/H,6CAAkD;AAGlD,oEAAyF;AAMzF,MAAM,iBAAiB,GAAsB;IAC3C,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;IAC1D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,UAAU,EAAE;IAC/D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;IAC3D,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,2CAAmB,CAAC,MAAM,EAAE;CAC5D,CAAC;AAEF,MAAa,yBAA0B,SAAQ,qCAAiB;IAC9D,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAqC;;QAC7E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC;QAEzH,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxD,gBAAgB,EAAE,OAAO;YACzB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,CAAC;QAEJ,IAAI,yBAAW,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE;YACxC,MAAM,EAAE;gBACN,UAAU,EAAE,cAAc,SAAS,IAAI,IAAI,EAAE;gBAC7C,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE;oBACX,MAAM,EAAE,eAAe;oBACvB,IAAI,EAAE,KAAK;iBACZ;aACF;YACD,4BAA4B,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC3D,YAAY,EAAE;oBACZ,gBAAgB,EAAE,SAAS,CAAC,IAAI,KAAK,2CAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;oBAC7F,kBAAkB,EAAE,cAAc;oBAClC,SAAS,EAAE,SAAS,CAAC,gBAAgB;oBACrC,aAAa,EAAE,YAAY;iBAC5B;gBACD,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;YAChC,mFAAmF;YACnF,iFAAiF;YACjF,MAAM,cAAc,GAAG,IAAI,oBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE;gBAC3E,WAAW,EAAE,uBAAuB,SAAS,IAAI,IAAI,EAAE;gBACvD,WAAW,EAAE,aAAa;gBAC1B,gBAAgB,EAAE,SAAS;aAC5B,CAAC,CAAC;YAEH,IAAI,oBAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,EAAE;gBAC9D,gBAAgB,EAAE,4BAA4B,SAAS,IAAI,IAAI,EAAE;gBACjE,cAAc,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC;gBAC/C,kEAAkE;gBAClE,SAAS,EAAE,OAAO;gBAClB,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC5C,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC;oBAClC,UAAU,EAAE;wBACV,GAAG,EAAE,+BAA+B;wBACpC,YAAY,EAAE,CAAC,uBAAuB,CAAC;wBACvC,MAAM,EAAE,CAAC,GAAG,MAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,gBAAgB,mCAAI,EAAE,EAAE,CAAC;qBACxD;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA9DD,8DA8DC","sourcesContent":["import { AccountBudgetQPQConfigSetting, BudgetThreshold, BudgetThresholdType, qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport { aws_budgets, aws_ce } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';\n\nexport interface QpqAccountBudgetConstructProps extends QpqConstructBlockProps {\n  budgetConfig: AccountBudgetQPQConfigSetting;\n}\n\nconst defaultThresholds: BudgetThreshold[] = [\n  { thresholdPercent: 80, type: BudgetThresholdType.actual },\n  { thresholdPercent: 100, type: BudgetThresholdType.forecasted },\n  { thresholdPercent: 100, type: BudgetThresholdType.actual },\n  { thresholdPercent: 150, type: BudgetThresholdType.actual },\n];\n\nexport class QpqAccountBudgetConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqAccountBudgetConstructProps) {\n    super(scope, id, props);\n\n    const { name, monthlyLimitUsd, subscriberEmails, thresholds = defaultThresholds, anomalyDetection } = props.budgetConfig;\n\n    const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n\n    const emailSubscribers = subscriberEmails.map((email) => ({\n      subscriptionType: 'EMAIL',\n      address: email,\n    }));\n\n    new aws_budgets.CfnBudget(this, 'budget', {\n      budget: {\n        budgetName: `qpq-budget-${accountId}-${name}`,\n        budgetType: 'COST',\n        timeUnit: 'MONTHLY',\n        budgetLimit: {\n          amount: monthlyLimitUsd,\n          unit: 'USD',\n        },\n      },\n      notificationsWithSubscribers: thresholds.map((threshold) => ({\n        notification: {\n          notificationType: threshold.type === BudgetThresholdType.forecasted ? 'FORECASTED' : 'ACTUAL',\n          comparisonOperator: 'GREATER_THAN',\n          threshold: threshold.thresholdPercent,\n          thresholdType: 'PERCENTAGE',\n        },\n        subscribers: emailSubscribers,\n      })),\n    });\n\n    if (!anomalyDetection?.disabled) {\n      // AWS allows only one DIMENSIONAL(SERVICE) anomaly monitor per account - declare a\n      // single defineAccountBudget per account (or disable anomalyDetection on extras)\n      const anomalyMonitor = new aws_ce.CfnAnomalyMonitor(this, 'anomaly-monitor', {\n        monitorName: `qpq-anomaly-monitor-${accountId}-${name}`,\n        monitorType: 'DIMENSIONAL',\n        monitorDimension: 'SERVICE',\n      });\n\n      new aws_ce.CfnAnomalySubscription(this, 'anomaly-subscription', {\n        subscriptionName: `qpq-anomaly-subscription-${accountId}-${name}`,\n        monitorArnList: [anomalyMonitor.attrMonitorArn],\n        // DAILY is required for EMAIL subscribers (IMMEDIATE is SNS-only)\n        frequency: 'DAILY',\n        subscribers: subscriberEmails.map((email) => ({\n          type: 'EMAIL',\n          address: email,\n        })),\n        thresholdExpression: JSON.stringify({\n          Dimensions: {\n            Key: 'ANOMALY_TOTAL_IMPACT_ABSOLUTE',\n            MatchOptions: ['GREATER_THAN_OR_EQUAL'],\n            Values: [`${anomalyDetection?.minimumImpactUsd ?? 10}`],\n          },\n        }),\n      });\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/account/QpqAccountCloudTrailConstruct.js

@@ -72,3 +72,4 @@ class QpqAccountCloudTrailConstruct extends QpqConstructBlock_1.QpqConstructBloc
     }
 }
 exports.QpqAccountCloudTrailConstruct = QpqAccountCloudTrailConstruct;
+//# sourceMappingURL=QpqAccountCloudTrailConstruct.js.map

package/lib/commonjs/constructs/feature/account/QpqAccountCloudTrailConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqAccountCloudTrailConstruct.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/account/QpqAccountCloudTrailConstruct.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAA6F;AAE7F,iDAAmC;AACnC,6CAA+D;AAG/D,0CAAqD;AACrD,oEAAyF;AAMzF,MAAa,6BAA8B,SAAQ,qCAAiB;IAKlE,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAyC;QACjF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EACJ,IAAI,EACJ,aAAa,GAAG,GAAG,EACnB,uBAAuB,GAAG,IAAI,EAC9B,WAAW,GAAG,IAAI,EAClB,0BAA0B,GAAG,IAAI,EACjC,cAAc,GACf,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAE3B,MAAM,SAAS,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,IAAI,oBAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;YAC7C,UAAU,EAAE,kBAAkB,SAAS,IAAI,MAAM,IAAI,IAAI,EAAE;YAC3D,iBAAiB,EAAE,oBAAM,CAAC,iBAAiB,CAAC,SAAS;YACrD,UAAU,EAAE,oBAAM,CAAC,gBAAgB,CAAC,UAAU;YAC9C,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,MAAM;YACvC,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,GAAG,cAAc;YAC5B,CAAC,CAAC,IAAI,sBAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBACvC,YAAY,EAAE,mBAAmB,IAAI,EAAE;gBACvC,SAAS,EAAE,IAAA,2BAAmB,EAAC,cAAc,CAAC,aAAa,CAAC;gBAC5D,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;aACzC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,4BAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE;YACtC,SAAS,EAAE,GAAG,IAAI,QAAQ;YAC1B,MAAM;YACN,oBAAoB,EAAE,uBAAuB;YAC7C,kBAAkB,EAAE,WAAW;YAC/B,0BAA0B;YAC1B,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;YACrC,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC,CAAC;IACL,CAAC;CACF;AA/CD,sEA+CC","sourcesContent":["import { AccountCloudTrailQPQConfigSetting, qpqConfigAwsUtils } from 'quidproquo-config-aws';\n\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_cloudtrail, aws_logs, aws_s3 } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { resolveLogRetention } from '../../../utils';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';\n\nexport interface QpqAccountCloudTrailConstructProps extends QpqConstructBlockProps {\n  cloudTrailConfig: AccountCloudTrailQPQConfigSetting;\n}\n\nexport class QpqAccountCloudTrailConstruct extends QpqConstructBlock {\n  // Only set when the config enables cloudWatchLogs - consumed by the security services\n  // construct for the cognito auth-failure metric filter\n  public readonly logGroup?: aws_logs.LogGroup;\n\n  constructor(scope: Construct, id: string, props: QpqAccountCloudTrailConstructProps) {\n    super(scope, id, props);\n\n    const {\n      name,\n      retentionDays = 365,\n      enableLogFileValidation = true,\n      multiRegion = true,\n      includeGlobalServiceEvents = true,\n      cloudWatchLogs,\n    } = props.cloudTrailConfig;\n\n    const accountId = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);\n\n    const bucket = new aws_s3.Bucket(this, 'logs', {\n      bucketName: `qpq-cloudtrail-${accountId}-${region}-${name}`,\n      blockPublicAccess: aws_s3.BlockPublicAccess.BLOCK_ALL,\n      encryption: aws_s3.BucketEncryption.S3_MANAGED,\n      enforceSSL: true,\n      removalPolicy: cdk.RemovalPolicy.RETAIN,\n      lifecycleRules: [{ expiration: cdk.Duration.days(retentionDays) }],\n    });\n\n    this.logGroup = cloudWatchLogs\n      ? new aws_logs.LogGroup(this, 'log-group', {\n          logGroupName: `/qpq/cloudtrail/${name}`,\n          retention: resolveLogRetention(cloudWatchLogs.retentionDays),\n          removalPolicy: cdk.RemovalPolicy.DESTROY,\n        })\n      : undefined;\n\n    new aws_cloudtrail.Trail(this, 'trail', {\n      trailName: `${name}-trail`,\n      bucket,\n      enableFileValidation: enableLogFileValidation,\n      isMultiRegionTrail: multiRegion,\n      includeGlobalServiceEvents,\n      sendToCloudWatchLogs: !!this.logGroup,\n      cloudWatchLogGroup: this.logGroup,\n    });\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/account/QpqAccountSecurityServicesConstruct.js

@@ -59,3 +59,4 @@ class QpqAccountSecurityServicesConstruct extends QpqConstructBlock_1.QpqConstru
     }
 }
 exports.QpqAccountSecurityServicesConstruct = QpqAccountSecurityServicesConstruct;
+//# sourceMappingURL=QpqAccountSecurityServicesConstruct.js.map

package/lib/commonjs/constructs/feature/account/QpqAccountSecurityServicesConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqAccountSecurityServicesConstruct.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/account/QpqAccountSecurityServicesConstruct.ts"],"names":[],"mappings":";;;AAEA,6CASqB;AAGrB,oEAAyF;AASzF,yFAAyF;AACzF,uFAAuF;AACvF,wDAAwD;AACxD,MAAa,mCAAoC,SAAQ,qCAAiB;IACxE,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA+C;;QACvF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,IAAI,KAAK,CAAC,sBAAsB,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,2BAAa,CAAC,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE;gBACxD,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,CAAC;YACnD,oFAAoF;YACpF,4EAA4E;YAC5E,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,gFAAgF;QAChF,oFAAoF;QACpF,mFAAmF;QACnF,gCAAgC;QAChC,MAAM,uBAAuB,GAAG,KAAK,CAAC,sBAAsB,CAAC,uBAAuB,CAAC;QACrF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,sBAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,6BAA6B,EAAE;gBAClF,QAAQ,EAAE,KAAK,CAAC,kBAAkB;gBAClC,aAAa,EAAE,sBAAQ,CAAC,aAAa,CAAC,GAAG,CACvC,sBAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,eAAe,EAAE,GAAG,EAAE,2BAA2B,CAAC,EACrF,sBAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,wBAAwB,CAAC,CACjF;gBACD,eAAe,EAAE,cAAc;gBAC/B,UAAU,EAAE,uBAAuB;gBACnC,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,qBAAO,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBAClE,SAAS,EAAE,6BAA6B;aACzC,CAAC,CAAC;YACH,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/C,UAAU,CAAC,eAAe,CAAC,IAAI,mCAAqB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,IAAI,4BAAc,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,EAAE;gBACzE,SAAS,EAAE,mCAAmC;gBAC9C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;oBAC1B,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC5B,CAAC;gBACF,SAAS,EAAE,MAAA,uBAAuB,CAAC,oBAAoB,mCAAI,EAAE;gBAC7D,kBAAkB,EAAE,4BAAc,CAAC,kBAAkB,CAAC,kCAAkC;gBACxF,iBAAiB,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,gBAAgB,EAAE,4BAAc,CAAC,gBAAgB,CAAC,aAAa;aAChE,CAAC,CAAC;YACH,KAAK,CAAC,cAAc,CAAC,IAAI,oCAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AA3DD,kFA2DC","sourcesContent":["import { AccountSecurityServicesQPQConfigSetting } from 'quidproquo-config-aws';\n\nimport {\n  aws_cloudwatch,\n  aws_cloudwatch_actions,\n  aws_guardduty,\n  aws_logs,\n  aws_securityhub,\n  aws_sns,\n  aws_sns_subscriptions,\n  Duration,\n} from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';\n\nexport interface QpqAccountSecurityServicesConstructProps extends QpqConstructBlockProps {\n  securityServicesConfig: AccountSecurityServicesQPQConfigSetting;\n\n  /** The account CloudTrail's CloudWatch log group - required for cognitoAuthFailureAlert. */\n  cloudTrailLogGroup?: aws_logs.ILogGroup;\n}\n\n// GuardDuty detectors and Security Hub hubs are one-per-account+region, which is exactly\n// why they live in the account stack rather than any app's bootstrap - an app teardown\n// must not take the account's threat detection with it.\nexport class QpqAccountSecurityServicesConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqAccountSecurityServicesConstructProps) {\n    super(scope, id, props);\n\n    if (props.securityServicesConfig.enableGuardDuty) {\n      new aws_guardduty.CfnDetector(this, 'guardduty-detector', {\n        enable: true,\n      });\n    }\n\n    if (props.securityServicesConfig.enableSecurityHub) {\n      // Security Hub's compliance standards require AWS Config recording, which bills per\n      // configuration item recorded - enabling this is a deliberate cost decision\n      new aws_securityhub.CfnHub(this, 'security-hub');\n    }\n\n    // Credential stuffing hitting Cognito directly (bypassing the apis) shows up as\n    // cognito-idp NotAuthorizedException events in CloudTrail - alert by email when the\n    // failure rate spikes. (Failed logins through qpq routes are covered separately by\n    // the per-api 401-rate alarms.)\n    const cognitoAuthFailureAlert = props.securityServicesConfig.cognitoAuthFailureAlert;\n    if (cognitoAuthFailureAlert) {\n      if (!props.cloudTrailLogGroup) {\n        throw new Error('cognitoAuthFailureAlert requires a defineAccountCloudTrail with cloudWatchLogs enabled');\n      }\n\n      const metricFilter = new aws_logs.MetricFilter(this, 'cognito-auth-failure-filter', {\n        logGroup: props.cloudTrailLogGroup,\n        filterPattern: aws_logs.FilterPattern.all(\n          aws_logs.FilterPattern.stringValue('$.eventSource', '=', 'cognito-idp.amazonaws.com'),\n          aws_logs.FilterPattern.stringValue('$.errorCode', '=', 'NotAuthorizedException'),\n        ),\n        metricNamespace: 'qpq/security',\n        metricName: 'cognito-auth-failures',\n        metricValue: '1',\n      });\n\n      const alertTopic = new aws_sns.Topic(this, 'security-alerts-topic', {\n        topicName: 'qpq-account-security-alerts',\n      });\n      cognitoAuthFailureAlert.emails.forEach((email) => {\n        alertTopic.addSubscription(new aws_sns_subscriptions.EmailSubscription(email));\n      });\n\n      const alarm = new aws_cloudwatch.Alarm(this, 'cognito-auth-failure-alarm', {\n        alarmName: 'qpq-account-cognito-auth-failures',\n        metric: metricFilter.metric({\n          statistic: 'Sum',\n          period: Duration.minutes(5),\n        }),\n        threshold: cognitoAuthFailureAlert.thresholdPer5Minutes ?? 10,\n        comparisonOperator: aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n        evaluationPeriods: 1,\n        // No sign-in attempts = no datapoints - that is not an alarm state\n        treatMissingData: aws_cloudwatch.TreatMissingData.NOT_BREACHING,\n      });\n      alarm.addAlarmAction(new aws_cloudwatch_actions.SnsAction(alertTopic));\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/account/index.js

@@ -17,3 +17,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqAccountBudgetConstruct"), exports);
 __exportStar(require("./QpqAccountCloudTrailConstruct"), exports);
 __exportStar(require("./QpqAccountSecurityServicesConstruct"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/account/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/account/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,kEAAgD;AAChD,wEAAsD","sourcesContent":["export * from './QpqAccountBudgetConstruct';\nexport * from './QpqAccountCloudTrailConstruct';\nexport * from './QpqAccountSecurityServicesConstruct';\n"]}

package/lib/commonjs/constructs/feature/config/alarm/QpqConfigAwsAlarm.js

@@ -82,3 +82,4 @@ class QpqConfigAwsAlarmConstruct extends QpqConstructBlock_1.QpqConstructBlock {
     }
 }
 exports.QpqConfigAwsAlarmConstruct = QpqConfigAwsAlarmConstruct;
+//# sourceMappingURL=QpqConfigAwsAlarm.js.map

package/lib/commonjs/constructs/feature/config/alarm/QpqConfigAwsAlarm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqConfigAwsAlarm.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/alarm/QpqConfigAwsAlarm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAAmF;AAEnF,6CAAqE;AACrE,iDAAmC;AAGnC,uEAA4F;AAC5F,qCAAsD;AAMtD,SAAS,oCAAoC,CAAC,QAA0B;IACtE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,wCAAgB,CAAC,oBAAoB;YACxC,OAAO,4BAAc,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;QAClE,KAAK,wCAAgB,CAAC,6BAA6B;YACjD,OAAO,4BAAc,CAAC,kBAAkB,CAAC,kCAAkC,CAAC;QAC9E,KAAK,wCAAgB,CAAC,iBAAiB;YACrC,OAAO,4BAAc,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;QAC/D,KAAK,wCAAgB,CAAC,0BAA0B;YAC9C,OAAO,4BAAc,CAAC,kBAAkB,CAAC,+BAA+B,CAAC;QAC3E;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAa,0BAA2B,SAAQ,qCAAiB;IAC/D,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAsC;;QAC9E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,wDAAwD;QACxD,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC;QAEtD,MAAM,KAAK,GAAG,IAAI,4BAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE;YACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACpD,MAAM,EAAE,IAAI,4BAAc,CAAC,MAAM,CAAC;gBAChC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,UAAU,EAAE,aAAa,CAAC,UAAU;gBACpC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC;aACnD,CAAC;YACF,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,kBAAkB,EAAE,oCAAoC,CAAC,aAAa,CAAC,QAAQ,CAAC;YAChF,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,iBAAiB,EAAE,aAAa,CAAC,wBAAwB;SAC1D,CAAC,CAAC;QAEH,MAAA,aAAa,CAAC,OAAO,CAAC,iBAAiB,0CAAE,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,+BAAwB,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAE3G,KAAK,CAAC,cAAc,CAAC,IAAI,oCAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA9BD,gEA8BC","sourcesContent":["import { AwsAlarmOperator, AwsAlarmQPQConfigSetting } from 'quidproquo-config-aws';\n\nimport { aws_cloudwatch, aws_cloudwatch_actions } from 'aws-cdk-lib';\nimport * as cdk from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';\nimport { QpqCoreEventBusConstruct } from '../../core';\n\nexport interface QpqConfigAwsAlarmConstructProps extends QpqConstructBlockProps {\n  alarmConfig: AwsAlarmQPQConfigSetting;\n}\n\nfunction AwsAlarmOperatorToComparisonOperator(operator: AwsAlarmOperator): aws_cloudwatch.ComparisonOperator {\n  switch (operator) {\n    case AwsAlarmOperator.GreaterThanThreshold:\n      return aws_cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD;\n    case AwsAlarmOperator.GreaterThanOrEqualToThreshold:\n      return aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD;\n    case AwsAlarmOperator.LessThanThreshold:\n      return aws_cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD;\n    case AwsAlarmOperator.LessThanOrEqualToThreshold:\n      return aws_cloudwatch.ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD;\n    default:\n      throw new Error('Invalid AwsAlarmOperator value');\n  }\n}\n\nexport class QpqConfigAwsAlarmConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqConfigAwsAlarmConstructProps) {\n    super(scope, id, props);\n\n    // The alarm is built entirely from the shared BaseAwsAlarmQPQConfigSetting\n    // fields, so it is namespace-agnostic — Lambda, ApiGateway, DynamoDb and Sqs\n    // (and any future namespace) are all supported via the config's namespace +\n    // metricName pair, no per-namespace branching required.\n    const alarmSettings = props.alarmConfig.alarmSettings;\n\n    const alarm = new aws_cloudwatch.Alarm(this, props.alarmConfig.uniqueKey, {\n      alarmName: this.resourceName(props.alarmConfig.name),\n      metric: new aws_cloudwatch.Metric({\n        namespace: alarmSettings.namespace,\n        metricName: alarmSettings.metricName,\n        statistic: alarmSettings.statistic,\n        period: cdk.Duration.seconds(alarmSettings.period),\n      }),\n      threshold: alarmSettings.threshold,\n      comparisonOperator: AwsAlarmOperatorToComparisonOperator(alarmSettings.operator),\n      datapointsToAlarm: alarmSettings.datapointsToAlarm,\n      evaluationPeriods: alarmSettings.evaluationPeriodsToAlarm,\n    });\n\n    alarmSettings.onAlarm.publishToEventBus?.forEach((eventBusName) => {\n      const eventBus = QpqCoreEventBusConstruct.fromOtherStack(scope, 'eventBus', props.qpqConfig, eventBusName);\n\n      alarm.addAlarmAction(new aws_cloudwatch_actions.SnsAction(eventBus.topic));\n    });\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/config/alarm/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqConfigAwsAlarm"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/config/alarm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/alarm/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC","sourcesContent":["export * from './QpqConfigAwsAlarm';\n"]}

package/lib/commonjs/constructs/feature/config/dashboard/QpqConfigAwsDashboardConstruct.js

@@ -216,3 +216,4 @@ class QpqConfigAwsDashboardConstruct extends QpqConstructBlock_1.QpqConstructBlo
     }
 }
 exports.QpqConfigAwsDashboardConstruct = QpqConfigAwsDashboardConstruct;
+//# sourceMappingURL=QpqConfigAwsDashboardConstruct.js.map

package/lib/commonjs/constructs/feature/config/dashboard/QpqConfigAwsDashboardConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqConfigAwsDashboardConstruct.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/dashboard/QpqConfigAwsDashboardConstruct.ts"],"names":[],"mappings":";;;AAAA,+FAAsE;AACtE,iEAA+F;AAC/F,qDAA0D;AAC1D,+DAAyD;AAEzD,6CAAuD;AAGvD,+EAA+E;AAC/E,6BAA6B;AAC7B,yFAAuF;AACvF,uEAA4F;AAC5F,2FAAwF;AAMxF,MAAM,YAAY,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEzC,yFAAyF;AACzF,yFAAyF;AACzF,qFAAqF;AACrF,iFAAiF;AACjF,MAAM,6BAA6B,GAAG,CAAC,SAAoB,EAAY,EAAE;IACvE,MAAM,SAAS,GAAG;QAChB,GAAG,wCAAiB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,QAAQ,CAAC;QAClF,GAAG,wCAAiB,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,YAAY,QAAQ,CAAC;QAC1H,GAAG,8BAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,QAAQ,CAAC;QAC/E,GAAG,8BAAY,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,KAAK,CAAC;QAC/F,GAAG,wCAAiB,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,KAAK,CAAC;KACxG,CAAC;IAEF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qDAAc,CAAC,sCAAsC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,YAAoB,EAAE,SAAiB,EAAyB,EAAE,CAC1G,IAAI,4BAAc,CAAC,MAAM,CAAC;IACxB,SAAS,EAAE,YAAY;IACvB,UAAU;IACV,aAAa,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;IAC7C,SAAS;IACT,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;CACpB,CAAC,CAAC;AAEL,uFAAuF;AACvF,0FAA0F;AAC1F,qFAAqF;AACrF,qFAAqF;AACrF,iFAAiF;AACjF,MAAa,8BAA+B,SAAQ,qCAAiB;IACnE,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA0C;QAClF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,uBAAuB,CAAC;QAE/E,MAAM,SAAS,GAAG,IAAI,4BAAc,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE;YAChE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QAEH,UAAU;QACV,wCAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,WAAW,CAAC,CAAC;YAEnE,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,SAAiB,EAAE,KAAc,EAAyB,EAAE,CACjG,IAAI,4BAAc,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,gBAAgB;gBAC3B,UAAU;gBACV,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;gBACnC,SAAS;gBACT,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,KAAK,IAAI,UAAU;aAC3B,CAAC,CAAC;YAEL,MAAM,cAAc,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;YAExE,SAAS,CAAC,UAAU,CAClB,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,4BAA4B;gBACvD,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;aAC9F,CAAC,EACF,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,gBAAgB;gBAC3C,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE;oBACJ,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC;oBAC1C,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC;oBAC1C,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC;oBAC1C,GAAG,CAAC,uBAAuB;wBACzB,CAAC,CAAC;4BACE,IAAI,4BAAc,CAAC,cAAc,CAAC;gCAChC,UAAU,EAAE,uCAAuC;gCACnD,YAAY,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;gCAC5C,KAAK,EAAE,uBAAuB;gCAC9B,MAAM,EAAE,YAAY;6BACrB,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,CAAC,CACH,CAAC;YAEF,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,IAAI,4BAAc,CAAC,kBAAkB,CAAC,IAAI,EAAE,4BAA4B,SAAS,CAAC,OAAO,EAAE,EAAE;oBAC3F,SAAS,EAAE,gBAAgB;oBAC3B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;iBAClD,CAAC,CAAC;gBAEH,gFAAgF;gBAChF,6EAA6E;gBAC7E,IAAI,8BAAY,CAAC,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnE,MAAM,oBAAoB,GAAG,IAAA,wDAA2B,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAC3E,CAAC,OAAO,EAAE,EAAE,CACV,mDAAwB,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,SAAS,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK;yBACjI,QAAQ,CACd,CAAC;oBAEF,IAAI,4BAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,SAAS,CAAC,OAAO,EAAE,EAAE;wBAC9E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,kBAAkB,CAAC;wBACpE,kBAAkB,EAAE,2BAA2B;wBAC/C,iBAAiB,EAAE,KAAK;wBACxB,iBAAiB,EAAE,CAAC;wBACpB,iBAAiB,EAAE,CAAC;wBACpB,OAAO,EAAE;4BACP;gCACE,EAAE,EAAE,IAAI;gCACR,UAAU,EAAE;oCACV,MAAM,EAAE;wCACN,SAAS,EAAE,gBAAgB;wCAC3B,UAAU,EAAE,SAAS;wCACrB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;qCAClD;oCACD,MAAM,EAAE,GAAG;oCACX,IAAI,EAAE,SAAS;iCAChB;gCACD,UAAU,EAAE,IAAI;6BACjB;4BACD;gCACE,EAAE,EAAE,KAAK;gCACT,UAAU,EAAE,+BAA+B;gCAC3C,UAAU,EAAE,IAAI;6BACjB;yBACF;wBACD,YAAY,EAAE,oBAAoB;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,aAAa;QACb,MAAM,aAAa,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,UAAU,CAClB,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,sBAAsB;gBAC7B,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;aAC5E,CAAC,EACF,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;aACvE,CAAC,EACF,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,yBAAyB;gBAChC,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;aAC7E,CAAC,EACF,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,gCAAgC;gBACvC,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;aACzF,CAAC,CACH,CAAC;YAEF,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,qFAAqF;gBACrF,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE;oBAC5C,IAAI,4BAAc,CAAC,kBAAkB,CAAC,IAAI,EAAE,6BAA6B,KAAK,EAAE,EAAE;wBAChF,SAAS,EAAE,YAAY;wBACvB,UAAU,EAAE,UAAU;wBACtB,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;qBAC5D,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,WAAW;QACX,MAAM,YAAY,GAAG,8BAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAE3E,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,KAAa,EAAyB,EAAE,CAC/E,IAAI,4BAAc,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,cAAc;gBACzB,UAAU;gBACV,aAAa,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;gBACvC,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,YAAY;gBACpB,KAAK;aACN,CAAC,CAAC;YAEL,OAAO,IAAI,4BAAc,CAAC,WAAW,CAAC;gBACpC,KAAK,EAAE,GAAG,SAAS,CAAC,iBAAiB,QAAQ;gBAC7C,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;gBAClH,KAAK,EAAE,CAAC,WAAW,CAAC,2BAA2B,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC;aAChI,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,8BAAY,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;YAC/E,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAE,KAAa,EAAyB,EAAE,CAClG,IAAI,4BAAc,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,SAAS;gBACpB,UAAU;gBACV,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE;gBAC1D,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,YAAY;gBACpB,KAAK;aACN,CAAC,CAAC;YAEL,OAAO,IAAI,4BAAc,CAAC,WAAW,CAAC;gBACpC,KAAK,EAAE,GAAG,WAAW,CAAC,IAAI,QAAQ;gBAClC,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE,wBAAwB,CAAC,CAAC;gBAChG,KAAK,EAAE,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,IAAI,OAAO,EAAE,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;aAC/G,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,SAAS,CAAC,UAAU,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,0EAA0E;QAC1E,IAAI,yCAAiB,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAyB,EAAE,CAC9D,IAAI,4BAAc,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,WAAW;gBACtB,UAAU;gBACV,aAAa,EAAE;oBACb,MAAM,EAAE,oBAAoB,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;oBAC/I,MAAM,EAAE,yCAAiB,CAAC,gCAAgC,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC3E,IAAI,EAAE,KAAK;iBACZ;gBACD,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;YAEL,SAAS,CAAC,UAAU,CAClB,IAAI,4BAAc,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,0BAA0B;gBACjC,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAnND,wEAmNC","sourcesContent":["import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';\nimport { AwsServiceDashboardQPQConfigSetting, qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\nimport { qpqWebServerUtils } from 'quidproquo-webserver';\n\nimport { aws_cloudwatch, Duration } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\n// Imported by direct path (not the barrel) for the same import-cycle reason as\n// createDefaultResourceAlarm\nimport { getNotifyErrorEventBusNames } from '../../../base/createDefaultResourceAlarm';\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';\nimport { QpqCoreEventBusConstruct } from '../../core/eventBus/QpqCoreEventBusConstruct';\n\nexport interface QpqConfigAwsDashboardConstructProps extends QpqConstructBlockProps {\n  dashboardConfig: AwsServiceDashboardQPQConfigSetting;\n}\n\nconst FIVE_MINUTES = Duration.minutes(5);\n\n// The service lambdas worth watching operationally (api routes, service functions, queue\n// consumers, schedules, websocket handlers). Infra lambdas (deploy events, storage-drive\n// triggers, user-directory triggers, SEO/edge) are deliberately excluded to keep the\n// dashboard focused. All names are config-derived - no construct handles needed.\nconst getServiceLambdaFunctionNames = (qpqConfig: QPQConfig): string[] => {\n  const baseNames = [\n    ...qpqWebServerUtils.getApiConfigs(qpqConfig).map((api) => `${api.apiName}-route`),\n    ...qpqWebServerUtils.getOwnedServiceFunctions(qpqConfig).map((serviceFunction) => `${serviceFunction.functionName}-sfunc`),\n    ...qpqCoreUtils.getQueues(qpqConfig).map((queue) => `${queue.uniqueKey}-queue`),\n    ...qpqCoreUtils.getOwnedScheduleEvents(qpqConfig).map((schedule) => `${schedule.uniqueKey}-SE`),\n    ...qpqWebServerUtils.getOwnedWebsocketSettings(qpqConfig).map((websocket) => `${websocket.apiName}-ws`),\n  ];\n\n  return baseNames.map((name) => awsNamingUtils.getConfigRuntimeResourceNameFromConfig(name, qpqConfig));\n};\n\nconst lambdaMetric = (metricName: string, functionName: string, statistic: string): aws_cloudwatch.Metric =>\n  new aws_cloudwatch.Metric({\n    namespace: 'AWS/Lambda',\n    metricName,\n    dimensionsMap: { FunctionName: functionName },\n    statistic,\n    period: FIVE_MINUTES,\n    label: functionName,\n  });\n\n// A per-service operational dashboard built purely from config-derived resource names,\n// plus anomaly detection: detector models (free) on api latency and lambda duration power\n// the band widgets, and api latency anomaly alarms route via defineNotifyError (same\n// opt-in + targets as createDefaultResourceAlarm). Websocket apis are absent - their\n// metrics dimension on the AWS-generated ApiId, which is unknowable from config.\nexport class QpqConfigAwsDashboardConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqConfigAwsDashboardConstructProps) {\n    super(scope, id, props);\n\n    const anomalyDetectionEnabled = !props.dashboardConfig.disableAnomalyDetection;\n\n    const dashboard = new aws_cloudwatch.Dashboard(this, 'dashboard', {\n      dashboardName: this.resourceName('dashboard'),\n    });\n\n    // Api row\n    qpqWebServerUtils.getApiConfigs(props.qpqConfig).forEach((apiConfig) => {\n      const apiName = this.resourceName(`${apiConfig.apiName}-rest-api`);\n\n      const apiMetric = (metricName: string, statistic: string, label?: string): aws_cloudwatch.Metric =>\n        new aws_cloudwatch.Metric({\n          namespace: 'AWS/ApiGateway',\n          metricName,\n          dimensionsMap: { ApiName: apiName },\n          statistic,\n          period: FIVE_MINUTES,\n          label: label || metricName,\n        });\n\n      const averageLatency = apiMetric('Latency', 'Average', 'Latency (avg)');\n\n      dashboard.addWidgets(\n        new aws_cloudwatch.GraphWidget({\n          title: `${apiConfig.apiName} api - requests and errors`,\n          width: 12,\n          left: [apiMetric('Count', 'Sum'), apiMetric('4XXError', 'Sum'), apiMetric('5XXError', 'Sum')],\n        }),\n        new aws_cloudwatch.GraphWidget({\n          title: `${apiConfig.apiName} api - latency`,\n          width: 12,\n          left: [\n            apiMetric('Latency', 'p50', 'Latency p50'),\n            apiMetric('Latency', 'p95', 'Latency p95'),\n            apiMetric('Latency', 'p99', 'Latency p99'),\n            ...(anomalyDetectionEnabled\n              ? [\n                  new aws_cloudwatch.MathExpression({\n                    expression: 'ANOMALY_DETECTION_BAND(latencyAvg, 2)',\n                    usingMetrics: { latencyAvg: averageLatency },\n                    label: 'Latency expected band',\n                    period: FIVE_MINUTES,\n                  }),\n                ]\n              : []),\n          ],\n        }),\n      );\n\n      if (anomalyDetectionEnabled) {\n        new aws_cloudwatch.CfnAnomalyDetector(this, `latency-anomaly-detector-${apiConfig.apiName}`, {\n          namespace: 'AWS/ApiGateway',\n          metricName: 'Latency',\n          stat: 'Average',\n          dimensions: [{ name: 'ApiName', value: apiName }],\n        });\n\n        // Anomaly alarm needs the L1 (the L2 Alarm has no thresholdMetricId). Gated and\n        // routed like createDefaultResourceAlarm: no-op without a defineNotifyError.\n        if (qpqCoreUtils.getNotifyErrorConfigs(props.qpqConfig).length > 0) {\n          const alarmActionTopicArns = getNotifyErrorEventBusNames(props.qpqConfig).map(\n            (busName) =>\n              QpqCoreEventBusConstruct.fromOtherStack(this, `latency-anomaly-bus-${apiConfig.apiName}-${busName}`, props.qpqConfig, busName).topic\n                .topicArn,\n          );\n\n          new aws_cloudwatch.CfnAlarm(this, `latency-anomaly-alarm-${apiConfig.apiName}`, {\n            alarmName: this.resourceName(`${apiConfig.apiName}-latency-anomaly`),\n            comparisonOperator: 'GreaterThanUpperThreshold',\n            thresholdMetricId: 'ad1',\n            evaluationPeriods: 3,\n            datapointsToAlarm: 3,\n            metrics: [\n              {\n                id: 'm1',\n                metricStat: {\n                  metric: {\n                    namespace: 'AWS/ApiGateway',\n                    metricName: 'Latency',\n                    dimensions: [{ name: 'ApiName', value: apiName }],\n                  },\n                  period: 300,\n                  stat: 'Average',\n                },\n                returnData: true,\n              },\n              {\n                id: 'ad1',\n                expression: 'ANOMALY_DETECTION_BAND(m1, 2)',\n                returnData: true,\n              },\n            ],\n            alarmActions: alarmActionTopicArns,\n          });\n        }\n      }\n    });\n\n    // Lambda row\n    const functionNames = getServiceLambdaFunctionNames(props.qpqConfig);\n    if (functionNames.length > 0) {\n      dashboard.addWidgets(\n        new aws_cloudwatch.GraphWidget({\n          title: 'lambda - invocations',\n          width: 6,\n          left: functionNames.map((name) => lambdaMetric('Invocations', name, 'Sum')),\n        }),\n        new aws_cloudwatch.GraphWidget({\n          title: 'lambda - errors',\n          width: 6,\n          left: functionNames.map((name) => lambdaMetric('Errors', name, 'Sum')),\n        }),\n        new aws_cloudwatch.GraphWidget({\n          title: 'lambda - duration (avg)',\n          width: 6,\n          left: functionNames.map((name) => lambdaMetric('Duration', name, 'Average')),\n        }),\n        new aws_cloudwatch.GraphWidget({\n          title: 'lambda - concurrent executions',\n          width: 6,\n          left: functionNames.map((name) => lambdaMetric('ConcurrentExecutions', name, 'Maximum')),\n        }),\n      );\n\n      if (anomalyDetectionEnabled) {\n        // Detector models are free - they power expected-value bands on the duration metrics\n        functionNames.forEach((functionName, index) => {\n          new aws_cloudwatch.CfnAnomalyDetector(this, `duration-anomaly-detector-${index}`, {\n            namespace: 'AWS/Lambda',\n            metricName: 'Duration',\n            stat: 'Average',\n            dimensions: [{ name: 'FunctionName', value: functionName }],\n          });\n        });\n      }\n    }\n\n    // Data row\n    const tableWidgets = qpqCoreUtils.getOwnedKeyValueStores(props.qpqConfig).map((kvsConfig) => {\n      const tableName = this.qpqResourceName(kvsConfig.keyValueStoreName, 'kvs');\n\n      const tableMetric = (metricName: string, label: string): aws_cloudwatch.Metric =>\n        new aws_cloudwatch.Metric({\n          namespace: 'AWS/DynamoDB',\n          metricName,\n          dimensionsMap: { TableName: tableName },\n          statistic: 'Sum',\n          period: FIVE_MINUTES,\n          label,\n        });\n\n      return new aws_cloudwatch.GraphWidget({\n        title: `${kvsConfig.keyValueStoreName} table`,\n        width: 6,\n        left: [tableMetric('ReadThrottleEvents', 'read throttles'), tableMetric('WriteThrottleEvents', 'write throttles')],\n        right: [tableMetric('ConsumedReadCapacityUnits', 'read capacity'), tableMetric('ConsumedWriteCapacityUnits', 'write capacity')],\n      });\n    });\n\n    const queueWidgets = qpqCoreUtils.getQueues(props.qpqConfig).map((queueConfig) => {\n      const queueMetric = (queueName: string, metricName: string, label: string): aws_cloudwatch.Metric =>\n        new aws_cloudwatch.Metric({\n          namespace: 'AWS/SQS',\n          metricName,\n          dimensionsMap: { QueueName: this.resourceName(queueName) },\n          statistic: 'Maximum',\n          period: FIVE_MINUTES,\n          label,\n        });\n\n      return new aws_cloudwatch.GraphWidget({\n        title: `${queueConfig.name} queue`,\n        width: 6,\n        left: [queueMetric(queueConfig.name, 'ApproximateAgeOfOldestMessage', 'oldest message age (s)')],\n        right: [queueMetric(`${queueConfig.name}-dead`, 'ApproximateNumberOfMessagesVisible', 'dead letter messages')],\n      });\n    });\n\n    if (tableWidgets.length > 0 || queueWidgets.length > 0) {\n      dashboard.addWidgets(...tableWidgets, ...queueWidgets);\n    }\n\n    // Waf row (regional acl protecting the apis - shared per app+environment)\n    if (qpqConfigAwsUtils.isWafProtectionEnabled(props.qpqConfig)) {\n      const wafMetric = (metricName: string): aws_cloudwatch.Metric =>\n        new aws_cloudwatch.Metric({\n          namespace: 'AWS/WAFV2',\n          metricName,\n          dimensionsMap: {\n            WebACL: `qpq-waf-regional-${qpqCoreUtils.getApplicationName(props.qpqConfig)}-${qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig)}`,\n            Region: qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig),\n            Rule: 'ALL',\n          },\n          statistic: 'Sum',\n          period: FIVE_MINUTES,\n          label: metricName,\n        });\n\n      dashboard.addWidgets(\n        new aws_cloudwatch.GraphWidget({\n          title: 'waf - allowed vs blocked',\n          width: 12,\n          left: [wafMetric('AllowedRequests'), wafMetric('BlockedRequests')],\n        }),\n      );\n    }\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/config/dashboard/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqConfigAwsDashboardConstruct"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/config/dashboard/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/dashboard/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mEAAiD","sourcesContent":["export * from './QpqConfigAwsDashboardConstruct';\n"]}

package/lib/commonjs/constructs/feature/config/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./alarm"), exports);
 __exportStar(require("./dashboard"), exports);
 __exportStar(require("./organization"), exports);
 __exportStar(require("./waf"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/constructs/feature/config/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8CAA4B;AAC5B,iDAA+B;AAC/B,wCAAsB","sourcesContent":["export * from './alarm';\nexport * from './dashboard';\nexport * from './organization';\nexport * from './waf';\n"]}

package/lib/commonjs/constructs/feature/config/organization/QpqBootstrapConfigAwsOrganization.js

@@ -38,3 +38,4 @@ class QpqBootstrapConfigAwsOrganizationConstruct extends QpqConstructBlock_1.Qpq
     }
 }
 exports.QpqBootstrapConfigAwsOrganizationConstruct = QpqBootstrapConfigAwsOrganizationConstruct;
+//# sourceMappingURL=QpqBootstrapConfigAwsOrganization.js.map

package/lib/commonjs/constructs/feature/config/organization/QpqBootstrapConfigAwsOrganization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqBootstrapConfigAwsOrganization.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/organization/QpqBootstrapConfigAwsOrganization.ts"],"names":[],"mappings":";;;AAGA,6CAAkE;AAGlE,uEAA4F;AAM5F,SAAS,kBAAkB,CAAC,gBAAwB,EAAE,OAAe,EAAE,WAAmB;IACxF,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/C,OAAO,GAAG,eAAe,IAAI,OAAO,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,MAAa,0CAA2C,SAAQ,qCAAiB;IAC/E,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAsD;QAC9F,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,qBAAqB,CAAC;QAEzF,4DAA4D;QAC5D,MAAM,kBAAkB,GAAG,IAAI,+BAAiB,CAAC,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,EAAE;YACjG,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,2BAA2B;SAClE,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,QAAQ,GAAqD,EAAE,CAAC;QACtE,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;YACnC,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,+BAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC1E,WAAW,EAAE,GAAG,gBAAgB,IAAI,WAAW,EAAE;gBACjD,KAAK,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,CAAC;gBAC1E,QAAQ,EAAE,WAAW,WAAW,aAAa;gBAC7C,SAAS,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;aACvC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,0FAA0F;QAC1F,yBAAyB;QACzB,gDAAgD;QAChD,mGAAmG;QACnG,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM;IACR,CAAC;CACF;AAhCD,gGAgCC","sourcesContent":["import { AwsOrganizationQPQConfigSetting } from 'quidproquo-config-aws';\n\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam, aws_organizations, aws_sso } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';\n\nexport interface QpqBootstrapConfigAwsOrganizationConstructProps extends QpqConstructBlockProps {\n  awsOrganizationConfig: AwsOrganizationQPQConfigSetting;\n}\n\nfunction getEmailForAccount(baseEmailAddress: string, orgName: string, accountName: string): string {\n  const [mainEmail, domainEmail] = baseEmailAddress.split('@');\n  const [mainEmailNoPlus] = mainEmail.split('@');\n\n  return `${mainEmailNoPlus}+${orgName}-${accountName}@${domainEmail}`;\n}\n\nexport class QpqBootstrapConfigAwsOrganizationConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqBootstrapConfigAwsOrganizationConstructProps) {\n    super(scope, id, props);\n\n    const { organizationName, accountNames, baseEmailAddress } = props.awsOrganizationConfig;\n\n    // Create an Organizational Unit (OU) under the Organization\n    const organizationalUnit = new aws_organizations.CfnOrganizationalUnit(this, 'OrganizationalUnit', {\n      name: organizationName,\n      parentId: props.awsOrganizationConfig.rootAwsOrganizationalUnitId,\n    });\n\n    // Create AWS accounts and place them in the Organizational Unit (OU)\n    const accounts: { [name: string]: aws_organizations.CfnAccount } = {};\n    accountNames.forEach((accountName) => {\n      accounts[accountName] = new aws_organizations.CfnAccount(this, accountName, {\n        accountName: `${organizationName}-${accountName}`,\n        email: getEmailForAccount(baseEmailAddress, organizationName, accountName),\n        roleName: `account-${accountName}-AccessRole`,\n        parentIds: [organizationalUnit.attrId],\n      });\n    });\n\n    // // Create the admin permissions\n    // const adminPermissionSet = new aws_sso.CfnPermissionSet(this, 'admin-permission-set', {\n    //   name: 'AdminAccess',\n    //   description: 'Admin access permission set',\n    //   instanceArn: `arn:aws:sso:::instance/${props.awsOrganizationConfig.identityCenterInstanceId}`,\n    //   managedPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],\n    //   sessionDuration: 'PT12H',\n    // });\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/config/organization/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqBootstrapConfigAwsOrganization"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/config/organization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/organization/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD","sourcesContent":["export * from './QpqBootstrapConfigAwsOrganization';\n"]}

package/lib/commonjs/constructs/feature/config/waf/QpqBootstrapConfigWafConstruct.js

@@ -33,3 +33,4 @@ class QpqBootstrapConfigWafConstruct extends QpqConstructBlock_1.QpqConstructBlo
     }
 }
 exports.QpqBootstrapConfigWafConstruct = QpqBootstrapConfigWafConstruct;
+//# sourceMappingURL=QpqBootstrapConfigWafConstruct.js.map

package/lib/commonjs/constructs/feature/config/waf/QpqBootstrapConfigWafConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqBootstrapConfigWafConstruct.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/waf/QpqBootstrapConfigWafConstruct.ts"],"names":[],"mappings":";;;AAAA,iEAAwF;AACxF,qDAA+C;AAE/C,6CAAiD;AAGjD,uEAA4F;AAC5F,yCAA8C;AAM9C,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,wCAAwC;AACxC,MAAa,8BAA+B,SAAQ,qCAAiB;IACnE,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA0C;QAClF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,WAAW,GAAG,8BAAY,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,8BAAY,CAAC,+BAA+B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,IAAI,uBAAS,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE;YACtD,IAAI,EAAE,oBAAoB,WAAW,IAAI,WAAW,EAAE;YACtD,KAAK,EAAE,UAAU;YACjB,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5B,KAAK,EAAE,IAAA,2BAAgB,EAAC,KAAK,CAAC,SAAS,CAAC;YACxC,gBAAgB,EAAE;gBAChB,wBAAwB,EAAE,IAAI;gBAC9B,UAAU,EAAE,oBAAoB,WAAW,IAAI,WAAW,EAAE;gBAC5D,sBAAsB,EAAE,IAAI;aAC7B;SACF,CAAC,CAAC;QAEH,IAAI,qBAAO,CAAC,eAAe,CAAC,IAAI,EAAE,mBAAmB,EAAE;YACrD,aAAa,EAAE,yCAAiB,CAAC,+BAA+B,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;YAC7F,WAAW,EAAE,MAAM,CAAC,OAAO;SAC5B,CAAC,CAAC;IACL,CAAC;CACF;AAxBD,wEAwBC","sourcesContent":["import { BootstrapWafQPQConfigSetting, qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { qpqCoreUtils } from 'quidproquo-core';\n\nimport { aws_ssm, aws_wafv2 } from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nimport { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';\nimport { buildWebAclRules } from './wafRules';\n\nexport interface QpqBootstrapConfigWafConstructProps extends QpqConstructBlockProps {\n  wafConfig: BootstrapWafQPQConfigSetting;\n}\n\n// The REGIONAL web acl protecting api gateway stages. Each service's api stack attaches\n// itself via a WebACLAssociation, resolving the arn from the SSM parameter published here\n// (bootstrap always deploys before the api phase). The CLOUDFRONT-scope twin lives in\n// WafCloudFrontWebAclStack (us-east-1).\nexport class QpqBootstrapConfigWafConstruct extends QpqConstructBlock {\n  constructor(scope: Construct, id: string, props: QpqBootstrapConfigWafConstructProps) {\n    super(scope, id, props);\n\n    const application = qpqCoreUtils.getApplicationName(props.qpqConfig);\n    const environment = qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig);\n\n    const webAcl = new aws_wafv2.CfnWebACL(this, 'web-acl', {\n      name: `qpq-waf-regional-${application}-${environment}`,\n      scope: 'REGIONAL',\n      defaultAction: { allow: {} },\n      rules: buildWebAclRules(props.wafConfig),\n      visibilityConfig: {\n        cloudWatchMetricsEnabled: true,\n        metricName: `qpq-waf-regional-${application}-${environment}`,\n        sampledRequestsEnabled: true,\n      },\n    });\n\n    new aws_ssm.StringParameter(this, 'web-acl-arn-param', {\n      parameterName: qpqConfigAwsUtils.getWafWebAclArnSsmParameterName('regional', props.qpqConfig),\n      stringValue: webAcl.attrArn,\n    });\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/config/waf/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqBootstrapConfigWafConstruct"), exports);
 __exportStar(require("./wafRules"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/config/waf/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/waf/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mEAAiD;AACjD,6CAA2B","sourcesContent":["export * from './QpqBootstrapConfigWafConstruct';\nexport * from './wafRules';\n"]}

package/lib/commonjs/constructs/feature/config/waf/wafRules.js

@@ -62,3 +62,4 @@ const buildWebAclRules = (wafConfig) => {
     return [...rateLimitRules, ...managedRules];
 };
 exports.buildWebAclRules = buildWebAclRules;
+//# sourceMappingURL=wafRules.js.map

package/lib/commonjs/constructs/feature/config/waf/wafRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wafRules.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/config/waf/wafRules.ts"],"names":[],"mappings":";;;AAAA,iEAAwG;AAIxG,MAAM,2BAA2B,GAAwC;IACvE,CAAC,2CAAmB,CAAC,MAAM,CAAC,EAAE,8BAA8B;IAC5D,CAAC,2CAAmB,CAAC,cAAc,CAAC,EAAE,sCAAsC;IAC5E,CAAC,2CAAmB,CAAC,IAAI,CAAC,EAAE,4BAA4B;IACxD,CAAC,2CAAmB,CAAC,YAAY,CAAC,EAAE,uCAAuC;CAC5E,CAAC;AAEF,MAAM,wBAAwB,GAA0B,CAAC,2CAAmB,CAAC,MAAM,EAAE,2CAAmB,CAAC,cAAc,EAAE,2CAAmB,CAAC,IAAI,CAAC,CAAC;AAEnJ,MAAM,yBAAyB,GAAG,CAAC,SAA8B,EAAE,QAAgB,EAAoC,EAAE;IACvH,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5B,SAAS,EAAE;YACT,yBAAyB,EAAE;gBACzB,UAAU,EAAE,KAAK;gBACjB,IAAI,EAAE,UAAU;aACjB;SACF;QACD,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;YAC9B,UAAU,EAAE,UAAU;YACtB,sBAAsB,EAAE,IAAI;SAC7B;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAuB,EAAE,QAAgB,EAAoC,EAAE,CAAC,CAAC;IAC3G,IAAI,EAAE,cAAc,SAAS,CAAC,IAAI,EAAE;IACpC,QAAQ;IACR,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACrB,SAAS,EAAE;QACT,kBAAkB,EAAE;YAClB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,SAAS,CAAC,iBAAiB;gBAC7C,CAAC,CAAC;oBACE,kBAAkB,EAAE;wBAClB,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;wBAC7B,oBAAoB,EAAE,aAAa;wBACnC,YAAY,EAAE,SAAS,CAAC,iBAAiB;wBACzC,mBAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;qBACrD;iBACF;gBACH,CAAC,CAAC,SAAS;SACd;KACF;IACD,gBAAgB,EAAE;QAChB,wBAAwB,EAAE,IAAI;QAC9B,UAAU,EAAE,cAAc,SAAS,CAAC,IAAI,EAAE;QAC1C,sBAAsB,EAAE,IAAI;KAC7B;CACF,CAAC,CAAC;AAEH,mFAAmF;AACnF,wEAAwE;AACjE,MAAM,gBAAgB,GAAG,CAAC,SAAuC,EAAsC,EAAE;IAC9G,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpH,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACtG,yBAAyB,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,GAAG,KAAK,CAAC,CACpE,CAAC;IAEF,OAAO,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC,CAAC;AAC9C,CAAC,CAAC;AARW,QAAA,gBAAgB,oBAQ3B","sourcesContent":["import { BootstrapWafQPQConfigSetting, WafManagedRuleGroup, WafRateLimit } from 'quidproquo-config-aws';\n\nimport { aws_wafv2 } from 'aws-cdk-lib';\n\nconst managedRuleGroupVendorNames: Record<WafManagedRuleGroup, string> = {\n  [WafManagedRuleGroup.common]: 'AWSManagedRulesCommonRuleSet',\n  [WafManagedRuleGroup.knownBadInputs]: 'AWSManagedRulesKnownBadInputsRuleSet',\n  [WafManagedRuleGroup.sqli]: 'AWSManagedRulesSQLiRuleSet',\n  [WafManagedRuleGroup.ipReputation]: 'AWSManagedRulesAmazonIpReputationList',\n};\n\nconst defaultManagedRuleGroups: WafManagedRuleGroup[] = [WafManagedRuleGroup.common, WafManagedRuleGroup.knownBadInputs, WafManagedRuleGroup.sqli];\n\nconst buildManagedRuleGroupRule = (ruleGroup: WafManagedRuleGroup, priority: number): aws_wafv2.CfnWebACL.RuleProperty => {\n  const vendorName = managedRuleGroupVendorNames[ruleGroup];\n\n  return {\n    name: vendorName,\n    priority,\n    overrideAction: { none: {} },\n    statement: {\n      managedRuleGroupStatement: {\n        vendorName: 'AWS',\n        name: vendorName,\n      },\n    },\n    visibilityConfig: {\n      cloudWatchMetricsEnabled: true,\n      metricName: vendorName,\n      sampledRequestsEnabled: true,\n    },\n  };\n};\n\nconst buildRateLimitRule = (rateLimit: WafRateLimit, priority: number): aws_wafv2.CfnWebACL.RuleProperty => ({\n  name: `rate-limit-${rateLimit.name}`,\n  priority,\n  action: { block: {} },\n  statement: {\n    rateBasedStatement: {\n      limit: rateLimit.limit,\n      aggregateKeyType: 'IP',\n      scopeDownStatement: rateLimit.uriPathStartsWith\n        ? {\n            byteMatchStatement: {\n              fieldToMatch: { uriPath: {} },\n              positionalConstraint: 'STARTS_WITH',\n              searchString: rateLimit.uriPathStartsWith,\n              textTransformations: [{ priority: 0, type: 'NONE' }],\n            },\n          }\n        : undefined,\n    },\n  },\n  visibilityConfig: {\n    cloudWatchMetricsEnabled: true,\n    metricName: `rate-limit-${rateLimit.name}`,\n    sampledRequestsEnabled: true,\n  },\n});\n\n// Shared by the REGIONAL and CLOUDFRONT web acls so both evaluate identical rules.\n// Rate limits run first (cheap counters), then the managed rule groups.\nexport const buildWebAclRules = (wafConfig: BootstrapWafQPQConfigSetting): aws_wafv2.CfnWebACL.RuleProperty[] => {\n  const rateLimitRules = (wafConfig.rateLimits || []).map((rateLimit, index) => buildRateLimitRule(rateLimit, index));\n\n  const managedRules = (wafConfig.managedRuleGroups || defaultManagedRuleGroups).map((ruleGroup, index) =>\n    buildManagedRuleGroupRule(ruleGroup, rateLimitRules.length + index),\n  );\n\n  return [...rateLimitRules, ...managedRules];\n};\n"]}

package/lib/commonjs/constructs/feature/core/ai/QpqCoreAiConstruct.js

@@ -15,3 +15,4 @@ class QpqCoreAiConstruct {
     }
 }
 exports.QpqCoreAiConstruct = QpqCoreAiConstruct;
+//# sourceMappingURL=QpqCoreAiConstruct.js.map

package/lib/commonjs/constructs/feature/core/ai/QpqCoreAiConstruct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QpqCoreAiConstruct.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/core/ai/QpqCoreAiConstruct.ts"],"names":[],"mappings":";;;AAEA,6CAAsC;AAEtC,MAAa,kBAAkB;IACtB,MAAM,CAAC,uBAAuB,CAAC,IAAmB,EAAE,SAA+B;QACxF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,oBAAoB,CACvB,IAAI,qBAAO,CAAC,eAAe,CAAC;YAC1B,MAAM,EAAE,qBAAO,CAAC,MAAM,CAAC,KAAK;YAC5B,OAAO,EAAE,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;YACzE,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAdD,gDAcC","sourcesContent":["import { AiQPQConfigSetting } from 'quidproquo-core';\n\nimport { aws_iam } from 'aws-cdk-lib';\n\nexport class QpqCoreAiConstruct {\n  public static authorizeActionsForRole(role: aws_iam.IRole, aiConfigs: AiQPQConfigSetting[]) {\n    if (aiConfigs.length === 0) {\n      return;\n    }\n\n    role.addToPrincipalPolicy(\n      new aws_iam.PolicyStatement({\n        effect: aws_iam.Effect.ALLOW,\n        actions: ['bedrock:InvokeModel', 'bedrock:InvokeModelWithResponseStream'],\n        resources: ['*'],\n      }),\n    );\n  }\n}\n"]}

package/lib/commonjs/constructs/feature/core/ai/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./QpqCoreAiConstruct"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/constructs/feature/core/ai/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/constructs/feature/core/ai/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC","sourcesContent":["export * from './QpqCoreAiConstruct';\n"]}

package/lib/commonjs/constructs/feature/core/auth/QpqInfCoreUserDirectoryConstruct.js

@@ -239,3 +239,4 @@ class QpqInfCoreUserDirectoryConstruct extends QpqConstructBlock_1.QpqConstructB
     }
 }
 exports.QpqInfCoreUserDirectoryConstruct = QpqInfCoreUserDirectoryConstruct;
+//# sourceMappingURL=QpqInfCoreUserDirectoryConstruct.js.map