@aws-blocks/bb-distributed-table 0.1.4 → 0.1.6

package/dist/index.cdk.test.js

@@ -12,8 +12,8 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
-import { Template } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Template, Match, Annotations } from 'aws-cdk-lib/assertions';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets } from '@aws-blocks/core/cdk';
 import { z } from 'zod';
 import { DistributedTable } from './index.cdk.js';
 const userSchema = z.object({
@@ -23,21 +23,28 @@ const userSchema = z.object({
 });
 class StubBlocksStack extends cdk.Stack {
     handler;
+    executionRole;
     id;
+    defaults = BlocksPresets.production;
     constructor(scope, id) {
         super(scope, id);
         this.id = id;
         globalThis.CURRENT_BLOCKS_STACK = this;
+        this.executionRole = new cdk.aws_iam.Role(this, 'BlocksRole', {
+            assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
         this.handler = new cdk.aws_lambda.Function(this, 'StubHandler', {
             runtime: DEFAULT_NODE_RUNTIME,
             handler: 'index.handler',
             code: cdk.aws_lambda.Code.fromInline('exports.handler = async () => {};'),
+            role: this.executionRole,
         });
     }
 }
-function setup() {
+function setup(defaults = BlocksPresets.production) {
     const app = new cdk.App();
     const stack = new StubBlocksStack(app, 'TestStack');
+    stack.defaults = defaults;
     const parent = new Scope('app');
     return { stack, parent };
 }
@@ -50,6 +57,281 @@ test('CDK: default DistributedTable provisions a DynamoDB table', () => {
     const template = Template.fromStack(stack);
     template.resourceCountIs('AWS::DynamoDB::Table', 1);
 });
+// ── Secure-by-default durability & encryption (prod) ────────────────────────
+// Regression for the bug bash finding: prod DDB tables shipped with
+// DeletionProtection off, PITR disabled, and SSE (KMS) unset.
+test('CDK: prod DistributedTable enables PITR by default', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+    });
+});
+test('CDK: default PITR does not pin a recovery window (DynamoDB 35-day default)', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: {
+            PointInTimeRecoveryEnabled: true,
+            RecoveryPeriodInDays: Match.absent(),
+        },
+    });
+});
+test('CDK: pointInTimeRecovery { retentionDays } enables PITR and pins the window', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: { retentionDays: 7 },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: {
+            PointInTimeRecoveryEnabled: true,
+            RecoveryPeriodInDays: 7,
+        },
+    });
+});
+test('CDK: an out-of-range retentionDays falls back to the default window (still enabled)', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: { retentionDays: 60 },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: {
+            PointInTimeRecoveryEnabled: true,
+            RecoveryPeriodInDays: Match.absent(),
+        },
+    });
+});
+test('CDK: pointInTimeRecovery: false disables PITR', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: false,
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: Match.absent(),
+    });
+});
+test('CDK: prod DistributedTable enables DeletionProtection by default', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        DeletionProtectionEnabled: true,
+    });
+});
+test('CDK: prod DistributedTable enables SSE (KMS-managed) by default', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    // AWS_MANAGED emits SSEEnabled:true with no SSEType (the aws/dynamodb key).
+    // Contrast with the AWS-owned default, which emits no SSESpecification at all,
+    // and customer-managed, which adds SSEType:'KMS' + a KMSMasterKeyId.
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        SSESpecification: { SSEEnabled: true, SSEType: Match.absent() },
+    });
+});
+test('CDK: prod DistributedTable table is RETAINed on stack delete by default', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::DynamoDB::Table', {
+        DeletionPolicy: 'Retain',
+    });
+});
+// (Sandbox-default behavior — DESTROY, deletion protection off, PITR off — is
+// covered by the "adopts sandbox defaults" / "PITR follows the stack defaults"
+// tests above, which drive it through the stack `defaults` rather than the
+// `sandboxMode` context.)
+// ── Customer overrides win over the secure defaults ─────────────────────────
+test('CDK: customer can opt OUT of PITR + protection in prod', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: false,
+        protection: 'disposable',
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: Match.absent(),
+        DeletionProtectionEnabled: false,
+    });
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Delete' });
+});
+test('CDK: customer can opt INTO durable/protected tables even under the sandbox preset', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: true,
+        protection: 'locked',
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+        DeletionProtectionEnabled: true,
+    });
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Retain' });
+});
+test("CDK: protection 'retained' orphans the table without locking deletes", () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        protection: 'retained',
+    });
+    const template = Template.fromStack(stack);
+    // RETAIN on stack delete, but deletion protection OFF (a direct delete works).
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Retain' });
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        DeletionProtectionEnabled: false,
+    });
+});
+test('CDK: customer-managed encryption provisions a KMS key', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        encryption: 'customer-managed',
+    });
+    const template = Template.fromStack(stack);
+    template.resourceCountIs('AWS::KMS::Key', 1);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        SSESpecification: { SSEEnabled: true, SSEType: 'KMS' },
+    });
+});
+test('CDK: fromKmsKey encrypts with an existing key and provisions no new KMS key', () => {
+    const { stack, parent } = setup();
+    const keyArn = 'arn:aws:kms:us-east-1:111122223333:key/abcd-1234-ef56';
+    new DistributedTable(parent, 'orders', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        encryption: DistributedTable.fromKmsKey(keyArn),
+    });
+    const template = Template.fromStack(stack);
+    // Bringing an existing key must NOT mint a new one (the whole point — a
+    // shared key across tables instead of one dedicated key each).
+    template.resourceCountIs('AWS::KMS::Key', 0);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        SSESpecification: { SSEEnabled: true, SSEType: 'KMS', KMSMasterKeyId: keyArn },
+    });
+});
+test('CDK: two tables sharing one fromKmsKey ref provision zero KMS keys', () => {
+    const { stack, parent } = setup();
+    const sharedKey = DistributedTable.fromKmsKey('arn:aws:kms:us-east-1:111122223333:key/shared-1');
+    new DistributedTable(parent, 'orders', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        encryption: sharedKey,
+    });
+    new DistributedTable(parent, 'events', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        encryption: sharedKey,
+    });
+    const template = Template.fromStack(stack);
+    template.resourceCountIs('AWS::KMS::Key', 0);
+    template.resourceCountIs('AWS::DynamoDB::Table', 2);
+});
+test('CDK: fromExisting ignores durability props (customer owns the table)', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        table: DistributedTable.fromExisting('preexisting-users-table'),
+        // These must be inert when wrapping an existing table.
+        pointInTimeRecovery: true,
+        protection: 'locked',
+        encryption: 'customer-managed',
+    });
+    const template = Template.fromStack(stack);
+    // No table is provisioned, and customer-managed encryption does NOT
+    // provision a CMK — proving the durability options are ignored.
+    template.resourceCountIs('AWS::DynamoDB::Table', 0);
+    template.resourceCountIs('AWS::KMS::Key', 0);
+});
+// ── Durability follows the stack `defaults` when no per-block override (#302) ──
+test('CDK: table adopts sandbox defaults (DESTROY, deletion protection off)', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Delete' });
+    template.hasResourceProperties('AWS::DynamoDB::Table', { DeletionProtectionEnabled: false });
+});
+test('CDK: table adopts production defaults (RETAIN, deletion protection on)', () => {
+    const { stack, parent } = setup(BlocksPresets.production);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Retain' });
+    template.hasResourceProperties('AWS::DynamoDB::Table', { DeletionProtectionEnabled: true });
+});
+test('CDK: PITR follows the stack defaults — off under the sandbox preset', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: Match.absent(),
+    });
+});
+test('CDK: options.pointInTimeRecovery overrides the stack defaults (on under sandbox)', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: true,
+    });
+    const template = Template.fromStack(stack);
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+        PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+    });
+});
+test('CDK: a per-block protection option overrides the stack defaults', () => {
+    // Sandbox preset would give DESTROY + no protection; `protection: 'locked'`
+    // must win, proving the per-block override sits on top of the #302 defaults.
+    const { stack, parent } = setup(BlocksPresets.sandbox);
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        protection: 'locked',
+    });
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::DynamoDB::Table', { DeletionPolicy: 'Retain' });
+    template.hasResourceProperties('AWS::DynamoDB::Table', { DeletionProtectionEnabled: true });
+});
 test('CDK: DistributedTable.fromExisting does NOT provision a table (regression)', () => {
     const { stack, parent } = setup();
     new DistributedTable(parent, 'users', {
@@ -91,3 +373,42 @@ test('CDK: calling a runtime data method throws an actionable error (not a crypt
         assert.throws(() => table[method]('k'), /cannot be called during CDK synth/, `${method}() should throw the actionable synth-time error`);
     }
 });
+// ── Synth-time warnings actually fire (not just the fallback values) ─────────
+test('CDK: an unrecognized protection value warns at synth', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        protection: 'retian', // intentional typo — exercise the synth guard
+    });
+    Annotations.fromStack(stack).hasWarning('*', Match.stringLikeRegexp('Unrecognized protection'));
+});
+test('CDK: an unrecognized encryption value warns at synth', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        encryption: 'kms', // intentional typo — exercise the synth guard
+    });
+    Annotations.fromStack(stack).hasWarning('*', Match.stringLikeRegexp('Unrecognized encryption'));
+});
+test('CDK: an out-of-range retentionDays warns at synth', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        pointInTimeRecovery: { retentionDays: 60 },
+    });
+    Annotations.fromStack(stack).hasWarning('*', Match.stringLikeRegexp('retentionDays must be an integer'));
+});
+test('CDK: durability options passed alongside fromExisting warn at synth', () => {
+    const { stack, parent } = setup();
+    new DistributedTable(parent, 'users', {
+        schema: userSchema,
+        key: { partitionKey: 'userId', sortKey: 'createdAt' },
+        table: DistributedTable.fromExisting('preexisting-users-table'),
+        protection: 'locked',
+        pointInTimeRecovery: { retentionDays: 14 },
+    });
+    Annotations.fromStack(stack).hasWarning('*', Match.stringLikeRegexp('wrapped via fromExisting'));
+});

package/dist/index.mock.d.ts

@@ -1,8 +1,8 @@
 import { Scope } from '@aws-blocks/core';
 import type { ScopeParent } from '@aws-blocks/core';
 export { DistributedTableErrors } from './errors.js';
-export type { TableKeyConfig, DistributedTableOptions, ReadValidationMode, ExternalTableRef, TableKey, PartitionKeyCondition, SortKeyCondition, KeyCondition, QueryOptions, ScanOptions, PutOptions, DeleteOptions, } from './types.js';
-import type { TableKeyConfig, DistributedTableOptions, ExternalTableRef, ScanOptions, PutOptions, DeleteOptions, TableKey } from './types.js';
+export type { TableKeyConfig, DistributedTableOptions, ReadValidationMode, ExternalTableRef, ExternalKmsKeyRef, TableKey, PartitionKeyCondition, SortKeyCondition, KeyCondition, QueryOptions, ScanOptions, PutOptions, DeleteOptions, } from './types.js';
+import type { TableKeyConfig, DistributedTableOptions, ExternalTableRef, ExternalKmsKeyRef, ScanOptions, PutOptions, DeleteOptions, TableKey } from './types.js';
 /**
  * Structured data storage backed by DynamoDB with secondary indexes and
  * rich query capabilities.
@@ -99,6 +99,7 @@ export declare class DistributedTable<T, K extends TableKeyConfig<T> = TableKeyC
      */
     deleteBatch(keys: TableKey<T, K>[]): Promise<void>;
     static fromExisting(tableName: string): ExternalTableRef;
+    static fromKmsKey(keyArn: string): ExternalKmsKeyRef;
     private checkFieldEquals;
     private serializeKey;
     private loadFromDisk;

package/dist/index.mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,YAAY,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,aAAa,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EACX,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAEhB,WAAW,EACX,UAAU,EACV,aAAa,EACb,QAAQ,EAER,MAAM,YAAY,CAAC;AA4DpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,gBAAgB,CAC5B,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,EAC/C,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CACpF,SAAQ,KAAK;IAWqC,OAAO,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IAVlG,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,IAAI,CAAiB;IAC7B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,cAAc,CAAqB;IAE3C,0FAA0F;IAC1F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAS,OAAO,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IAe5F,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAIjD;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAIf,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpD,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,KAAK,CACX,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,GAClC,aAAa,CAAC,CAAC,CAAC;IAoDZ,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC;IAQpD;;;;;;;OAOG;IACG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAM7D;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC;;;;;;OAMG;IACG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB;IAMxD,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;CAGnB;AAOD,OAAO,KAAK,EAAgE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE7G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,YAAY,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,aAAa,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EACX,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EAEjB,WAAW,EACX,UAAU,EACV,aAAa,EACb,QAAQ,EAER,MAAM,YAAY,CAAC;AA4DpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,gBAAgB,CAC5B,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,EAC/C,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CACpF,SAAQ,KAAK;IAWqC,OAAO,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IAVlG,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,IAAI,CAAiB;IAC7B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,cAAc,CAAqB;IAE3C,0FAA0F;IAC1F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAS,OAAO,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IAe5F,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAIjD;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAIf,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpD,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,KAAK,CACX,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,GAClC,aAAa,CAAC,CAAC,CAAC;IAoDZ,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC;IAQpD;;;;;;;OAOG;IACG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAM7D;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC;;;;;;OAMG;IACG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB;IAIxD,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAMpD,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;CAGnB;AAOD,OAAO,KAAK,EAAgE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE7G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.mock.js

@@ -276,6 +276,9 @@ export class DistributedTable extends Scope {
     static fromExisting(tableName) {
         return { __brand: 'ExternalTableRef', tableName };
     }
+    static fromKmsKey(keyArn) {
+        return { __brand: 'ExternalKmsKeyRef', keyArn };
+    }
     // ── Internal ────────────────────────────────────────────────────────────
     checkFieldEquals(keyStr, fields) {
         const entries = Object.entries(fields).filter(([, v]) => v !== undefined);

package/dist/types.d.ts

@@ -43,6 +43,82 @@ export interface DistributedTableOptions<T, K extends TableKeyConfig<T> = TableK
      * ```
      */
     ttl?: keyof T & string;
+    /**
+     * DynamoDB Point-in-Time Recovery (continuous backups) — restore the table
+     * to any second within a retention window, protecting against accidental
+     * writes/deletes and logical corruption.
+     *
+     * A single knob, since the recovery window only means anything when PITR is
+     * on:
+     * - `true` — enable PITR with the default 35-day window.
+     * - `false` — disable PITR.
+     * - `{ retentionDays: n }` — enable PITR and keep `n` days of continuous
+     *   backups (**1–35**). A shorter window reduces backup-storage cost at the
+     *   expense of how far back you can restore.
+     *
+     * When omitted, the stack-wide default applies (`defaults.pointInTimeRecovery`
+     * from `BlocksPresets` — on under `production`, off under `sandbox`). A
+     * per-block value always wins.
+     *
+     * Note: PITR bills for continuous-backup storage (per GB-month of table
+     * size), so it is not free on large tables.
+     */
+    pointInTimeRecovery?: boolean | {
+        retentionDays: number;
+    };
+    /**
+     * How hard the table is to destroy — a single knob spanning DynamoDB
+     * deletion protection and the CloudFormation removal policy, which together
+     * answer one question: "can this table be destroyed?"
+     *
+     * - `'disposable'`: `RemovalPolicy.DESTROY`, deletion protection **off**.
+     *   Deleting the stack deletes the table. The **sandbox default** — keeps
+     *   `sandbox:destroy` a one-command teardown.
+     * - `'retained'`: `RemovalPolicy.RETAIN`, deletion protection **off**.
+     *   Deleting the stack orphans (keeps) the table, but a direct
+     *   `DeleteTable`/console delete still works. Use when you want the data to
+     *   survive stack teardown without blocking intentional deletes.
+     * - `'locked'`: `RemovalPolicy.RETAIN` **and** deletion protection **on**.
+     *   The table survives stack deletion and DynamoDB refuses a direct delete
+     *   until protection is turned off. The **production default**.
+     *
+     * When omitted, removal policy and deletion protection follow the stack-wide
+     * `defaults` (`BlocksPresets.production` ≈ `'locked'`, `BlocksPresets.sandbox`
+     * ≈ `'disposable'`). A per-block value always wins.
+     *
+     * Replaces the separate `deletionProtection` + `removalPolicy` booleans:
+     * those two knobs could encode the contradictory `deletionProtection: true`
+     * + `removalPolicy: 'destroy'` state, which wedges stack deletion (CFN
+     * issues `DeleteTable`, DynamoDB refuses it, the stack lands in
+     * `DELETE_FAILED`). A single enum makes that state unrepresentable.
+     */
+    protection?: 'disposable' | 'retained' | 'locked';
+    /**
+     * Server-side encryption at rest.
+     *
+     * - `'aws-managed'` (default): SSE with the AWS-managed `aws/dynamodb` KMS
+     *   key. Auditable via CloudTrail with no per-key monthly charge.
+     * - `'customer-managed'`: provisions a **dedicated** customer-managed KMS
+     *   key (CMK) for this table, giving you full control over rotation and key
+     *   policy. Incurs standard KMS key + request charges — and note this mints
+     *   a **separate key per table**, so a dozen tables means a dozen keys.
+     * - a {@link ExternalKmsKeyRef} from {@link DistributedTable.fromKmsKey}:
+     *   uses an **existing** CMK you already own, so several tables can share one
+     *   key (and one monthly charge) instead of each provisioning its own.
+     *
+     * DynamoDB is always encrypted at rest; this only selects the key.
+     *
+     * @example
+     * ```ts
+     * // Share one key across several tables
+     * const key = DistributedTable.fromKmsKey(
+     *   'arn:aws:kms:us-east-1:111122223333:key/abcd-1234',
+     * );
+     * new DistributedTable(scope, 'orders', { schema, key: { partitionKey: 'id' }, encryption: key });
+     * new DistributedTable(scope, 'events', { schema, key: { partitionKey: 'id' }, encryption: key });
+     * ```
+     */
+    encryption?: 'aws-managed' | 'customer-managed' | ExternalKmsKeyRef;
     /**
      * How reads (`get`, `getBatch`, `query`, `scan`) reconcile a stored item with
      * the configured `schema`. Writes (`put`/`putBatch`) always validate; this
@@ -93,6 +169,16 @@ export interface ExternalTableRef {
     readonly __brand: 'ExternalTableRef';
     readonly tableName: string;
 }
+/**
+ * A reference to an existing customer-managed KMS key, produced by
+ * {@link DistributedTable.fromKmsKey}. Pass it as the `encryption` option to
+ * encrypt the table with a CMK you already own — letting several tables share
+ * one key instead of each provisioning its own dedicated key.
+ */
+export interface ExternalKmsKeyRef {
+    readonly __brand: 'ExternalKmsKeyRef';
+    readonly keyArn: string;
+}
 /**
  * Picks exactly the key fields from T and makes them required.
  * Non-key fields are excluded.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAI7D,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/B,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB,CACvC,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,EAC/C,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAErF,mFAAmF;IACnF,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5B,iCAAiC;IACjC,GAAG,EAAE,CAAC,CAAC;IACP,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,sDAAsD;IACtD,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAID;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IACtE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,CAAC,GAAG,MAAM,CAAA;CAAE,GACrD,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,GACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAIzC,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IAAE,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC;AAErD,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IACjC,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,WAAW,CAAC,EAAE,CAAC,CAAC;IAChB,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,CAAC;IACb,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,IACtD,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,CAAC,GAAG,MAAM,CAAA;CAAE,GACrD;KAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACzD;KAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC;KAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAI9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,YAAY,CACvB,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAC9C;KACF,IAAI,IAAI,MAAM,GAAG,MAAM,OAAO,GAAG;QACjC,mDAAmD;QACnD,KAAK,EAAE,IAAI,CAAC;QACZ,oCAAoC;QACpC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,yCAAyC;QACzC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,qCAAqC;QACrC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KACvB;CACD,CAAC,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,CAAC,CAAC,IACrB;IAAE,WAAW,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C;IAAE,WAAW,CAAC,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;CAAE,GAClD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEzB,MAAM,MAAM,aAAa,CAAC,CAAC,IACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,KAAK,CAAA;CAAE,GACzC;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;CAAE,GAC/C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAI7D,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/B,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB,CACvC,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,EAC/C,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAErF,mFAAmF;IACnF,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5B,iCAAiC;IACjC,GAAG,EAAE,CAAC,CAAC;IACP,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,UAAU,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,UAAU,CAAC,EAAE,aAAa,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,sDAAsD;IACtD,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAID;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IACtE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,CAAC,GAAG,MAAM,CAAA;CAAE,GACrD,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,GACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAIzC,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IAAE,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC;AAErD,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IACjC,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,WAAW,CAAC,EAAE,CAAC,CAAC;IAChB,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,CAAC;IACb,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,IACtD,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,CAAC,GAAG,MAAM,CAAA;CAAE,GACrD;KAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACzD;KAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC;KAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAI9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,YAAY,CACvB,CAAC,EACD,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAC9C;KACF,IAAI,IAAI,MAAM,GAAG,MAAM,OAAO,GAAG;QACjC,mDAAmD;QACnD,KAAK,EAAE,IAAI,CAAC;QACZ,oCAAoC;QACpC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,yCAAyC;QACzC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,qCAAqC;QACrC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KACvB;CACD,CAAC,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,CAAC,CAAC,IACrB;IAAE,WAAW,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C;IAAE,WAAW,CAAC,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;CAAE,GAClD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEzB,MAAM,MAAM,aAAa,CAAC,CAAC,IACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,KAAK,CAAA;CAAE,GACzC;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;CAAE,GAC/C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "DistributedTable";
-export declare const BB_VERSION = "0.1.4";
+export declare const BB_VERSION = "0.1.6";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'DistributedTable';
-export const BB_VERSION = '0.1.4';
+export const BB_VERSION = '0.1.6';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/bb-distributed-table",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -39,8 +39,8 @@
     "test": "node --test --test-concurrency=1 dist/index.test.js dist/parity.test.js dist/index.cdk.test.js"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.1.17",
-    "@aws-blocks/bb-logger": "^0.1.3",
+    "@aws-blocks/core": "^0.3.0",
+    "@aws-blocks/bb-logger": "^0.1.5",
     "@aws-sdk/client-dynamodb": "^3.0.0",
     "@aws-sdk/lib-dynamodb": "^3.0.0",
     "@standard-schema/spec": "^1.0.0",

package/src/index.aws.ts

@@ -23,6 +23,7 @@ export type {
 	DistributedTableOptions,
 	ReadValidationMode,
 	ExternalTableRef,
+	ExternalKmsKeyRef,
 	TableKey,
 	PartitionKeyCondition,
 	SortKeyCondition,
@@ -37,6 +38,7 @@ import type {
 	TableKeyConfig,
 	DistributedTableOptions,
 	ExternalTableRef,
+	ExternalKmsKeyRef,
 	ScanOptions,
 	PutOptions,
 	DeleteOptions,
@@ -280,6 +282,10 @@ export class DistributedTable<
 		return { __brand: 'ExternalTableRef' as const, tableName };
 	}
 
+	static fromKmsKey(keyArn: string): ExternalKmsKeyRef {
+		return { __brand: 'ExternalKmsKeyRef' as const, keyArn };
+	}
+
 	// ── Internal ────────────────────────────────────────────────────────────
 
 	private async validateItem(item: T): Promise<void> {