@composurecdk/neptune 0.9.4 → 0.10.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jason Duffett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -103,30 +103,45 @@ Both the key and the encryption setting are fixed at creation: Neptune cannot en
 
 Audit log _export_ only emits data once audit logging is _enabled_ in the cluster parameter group. So the builder auto-creates a cluster parameter group with `neptune_enable_audit_log = "1"` (parallel to how `createVpcBuilder` auto-creates a flow-log group), with the family derived from the configured engine version. Add or override parameters with `.clusterParameters({...})`, or supply your own group with `.clusterParameterGroup(myGroup)` (mutually exclusive with `.clusterParameters()`).
 
-## Granting access — `allowAccessFrom`
+## Granting access
 
-Because IAM authentication is on by default, a principal needs both a network path (security-group ingress) and an IAM `connect` grant to reach the cluster. `allowAccessFrom(peer)` does both in one declaration, and accepts a `Ref` so the grant lives inside `compose()` rather than in post-build glue:
+Because IAM authentication is on by default, a principal needs two things to reach the cluster, and each is declared where its dependency already points ([ADR-0013](../../docs/adr/0013-consumer-side-grants.md)). The **network path** is a rule in the cluster's own security group, so it stays on the cluster — `allowDefaultPortFrom(peer)`, the same method `createInterfaceEndpointBuilder` exposes. The **IAM grant** lands on the consumer's principal, so it is declared on the grantee builder, pointing back at the cluster via a `ref`:
 
 ```ts
-import { createInstanceBuilder, type InstanceBuilderResult } from "@composurecdk/ec2";
+import { clusterGrants, type ClusterBuilderResult } from "@composurecdk/neptune";
 
-const system = compose(
+compose(
   {
-    network: createVpcBuilder().maxAzs(2),
-    bastion: createInstanceBuilder().vpc(ref("network").get("vpc")).instanceType(/* ... */),
     graph: createClusterBuilder()
-      .vpc(ref("network").get("vpc"))
+      .vpc(ref<VpcBuilderResult>("network").get("vpc"))
       .instanceType(InstanceType.SERVERLESS)
       .serverlessScalingConfiguration({ minCapacity: 1, maxCapacity: 8 })
-      .allowAccessFrom(ref<InstanceBuilderResult>("bastion").get("instance")),
+      .allowDefaultPortFrom(
+        ref<SecurityGroupBuilderResult>("bastionSg").get("securityGroup"),
+        "Bastion to Neptune",
+      ),
+
+    bastion: createInstanceBuilder()
+      .vpc(ref<VpcBuilderResult>("network").get("vpc"))
+      .securityGroup(ref<SecurityGroupBuilderResult>("bastionSg").get("securityGroup"))
+      .grant(clusterGrants.connect(ref<ClusterBuilderResult>("graph").get("cluster"))),
+  },
+  {
+    graph: ["network", "bastionSg"], // cluster → the SG its ingress rule names
+    bastion: ["network", "bastionSg", "graph"], // consumer → resource; no reverse edge, no cycle
   },
-  { network: [], bastion: ["network"], graph: ["network", "bastion"] },
 );
 ```
 
-The `peer` is any `IConnectable & IGrantable` (an EC2 instance, a Lambda function, a Fargate task, …). At build time the builder applies `cluster.connections.allowDefaultPortFrom(peer)` and `cluster.grantConnect(peer)`.
+`clusterGrants.connect(cluster)` delegates to the cluster's native `grantConnect`, which grants the whole `neptune-db:*` namespace on the cluster's ARN. A principal that needs less wants a narrower policy of its own over the [data-plane actions](https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html).
+
+The grant goes on any builder that accepts one — an `InstanceBuilder`, a `FunctionBuilder`, or a `RoleBuilder` where the principal is a role you own. Each routes the policy onto whichever role the component runs as, so no separate role component is needed to hold it.
+
+`allowDefaultPortFrom(peer)` takes any `IConnectable` — a security group, an EC2 instance, a VPC-attached Lambda function — and applies `cluster.connections.allowDefaultPortFrom(peer, description)`, opening ingress on the cluster's SG and the matching egress on the peer's. Prefer the peer's _security group_ over the peer itself: naming a compute component makes the cluster depend on it, the reverse edge consumer-side grants exist to avoid.
+
+If you disable IAM authentication (`.iamAuthentication(false)`), the network path is the whole grant — the alpha L2 then rejects a data-plane grant at synth rather than emitting an inert policy, so drop the `clusterGrants` call along with IAM auth.
 
-If you disable IAM authentication (`.iamAuthentication(false)`), `allowAccessFrom` adapts: it opens only the network path and skips the `grantConnect` IAM policy, which would be inert without IAM auth. Authentication then falls to whatever mechanism you've configured on the cluster.
+For a worked example, see the [Neptune graph stack](../examples/src/neptune-graph-app.ts).
 
 ## Recommended Alarms
 

package/dist/commonjs/cluster-builder.d.ts

@@ -1,20 +1,11 @@
 import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
-import { type IConnectable, type ISecurityGroup, type IVpc } from "aws-cdk-lib/aws-ec2";
-import { type IGrantable } from "aws-cdk-lib/aws-iam";
+import { type IConnectable } from "aws-cdk-lib/aws-ec2";
 import { DatabaseCluster, type DatabaseClusterProps, type IClusterParameterGroup, type IDatabaseCluster, type ISubnetGroup } from "@aws-cdk/aws-neptune-alpha";
 import { type IConstruct } from "constructs";
 import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { type ITaggedBuilder } from "@composurecdk/cloudformation";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
 import type { NeptuneClusterAlarmConfig } from "./cluster-alarm-config.js";
-/**
- * A principal that can be granted access to a Neptune cluster via
- * {@link IClusterBuilder.allowAccessFrom}. Must be both an {@link IConnectable}
- * (so its security group can be opened to the cluster's port) and an
- * {@link IGrantable} (so it can be granted IAM `connect`). EC2 instances,
- * Lambda functions, and Fargate tasks all satisfy this.
- */
-export type ClusterAccessor = IConnectable & IGrantable;
 /**
  * Configuration properties for the Neptune cluster builder.
  *
@@ -25,21 +16,25 @@ export type ClusterAccessor = IConnectable & IGrantable;
  *
  * - `vpc` is supplied via the dedicated {@link IClusterBuilder.vpc | .vpc()}
  *   method (it is required).
- * - `securityGroups` accepts `Resolvable<ISecurityGroup>` entries.
+ * - `securityGroups` accepts `Resolvable` entries.
  * - `kmsKey` accepts a `Resolvable` key.
  *
  * It also adds builder-specific options for the auto-created cluster
  * parameter group and recommended alarms.
+ *
+ * Each re-declared prop reads its inner type from CDK's own prop rather than
+ * naming an interface, so it keeps tracking the installed `aws-cdk-lib` as CDK
+ * moves its prop types (ADR-0018).
  */
 export interface ClusterBuilderProps extends Omit<DatabaseClusterProps, "vpc" | "securityGroups" | "kmsKey"> {
     /**
-     * Security groups to attach to the cluster. Accepts concrete
-     * {@link ISecurityGroup}s or {@link Ref}s that resolve to them at build
-     * time (e.g. a sibling `SecurityGroupBuilder`).
+     * Security groups to attach to the cluster. Accepts concrete security
+     * groups or {@link Ref}s that resolve to them at build time (e.g. a sibling
+     * `SecurityGroupBuilder`).
      *
      * @default - CDK creates a security group for the cluster.
      */
-    securityGroups?: readonly Resolvable<ISecurityGroup>[];
+    securityGroups?: readonly Resolvable<NonNullable<DatabaseClusterProps["securityGroups"]>[number]>[];
     /**
      * The customer-managed KMS key used to encrypt the cluster's storage at
      * rest.
@@ -149,30 +144,35 @@ declare class ClusterBuilder implements Lifecycle<ClusterBuilderResult> {
     #private;
     props: Partial<ClusterBuilderProps>;
     /**
-     * Sets the VPC the cluster runs in. Required. Accepts a concrete
-     * {@link IVpc} or a {@link Ref} that resolves to one at build time — the
-     * standard cross-component wiring path (e.g. to a sibling `VpcBuilder`).
+     * Sets the VPC the cluster runs in. Required. Accepts a concrete VPC or a
+     * {@link Ref} that resolves to one at build time — the standard
+     * cross-component wiring path (e.g. to a sibling `VpcBuilder`).
      *
      * @param vpc - The VPC or a Ref to one.
      * @returns This builder for chaining.
      */
-    vpc(vpc: Resolvable<IVpc>): this;
+    vpc(vpc: Resolvable<NonNullable<DatabaseClusterProps["vpc"]>>): this;
     /**
-     * Grants a principal both network and IAM access to the cluster in a single
-     * declaration. At build time this applies
-     * `cluster.connections.allowDefaultPortFrom(peer)` (opening the cluster's
-     * port to the peer's security group) and `cluster.grantConnect(peer)`
-     * (granting the IAM `connect` action required by the cluster's
-     * IAM-authentication default).
+     * Opens the cluster's port to `peer` via CDK's
+     * `cluster.connections.allowDefaultPortFrom(peer)` — ingress on the
+     * cluster's security group from the peer's, and the matching egress back on
+     * the peer's.
+     *
+     * This is the **network** half of reaching the cluster. Because IAM
+     * authentication is on by default, the peer's principal also needs the
+     * data-plane grant, declared on that principal's own builder:
+     * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))` — the
+     * consumer-side shape every grant in the library follows (ADR-0013).
      *
-     * Accepts a concrete {@link ClusterAccessor} or a {@link Ref} to one, so the
-     * grant can be declared inside `compose()` rather than wired up in an
-     * `afterBuild` hook.
+     * Accepts a concrete {@link IConnectable} (a `SecurityGroup`, an `Instance`,
+     * a `Function` in a VPC, …) or a {@link Ref} to one, so the rule can be
+     * declared inside `compose()` rather than wired up in an `afterBuild` hook.
      *
-     * @param peer - The principal to grant access to, or a Ref to one.
+     * @param peer - The connectable to open the port to, or a Ref to one.
+     * @param description - Optional description recorded on the ingress rule.
      * @returns This builder for chaining.
      */
-    allowAccessFrom(peer: Resolvable<ClusterAccessor>): this;
+    allowDefaultPortFrom(peer: Resolvable<IConnectable>, description?: string): this;
     /**
      * Adds a custom CloudWatch alarm to be created alongside the recommended
      * alarms. The callback receives an {@link AlarmDefinitionBuilder} scoped to
@@ -194,7 +194,7 @@ declare class ClusterBuilder implements Lifecycle<ClusterBuilderResult> {
  * This is the entry point for defining a Neptune component. The returned
  * builder exposes every {@link ClusterBuilderProps} property as a fluent
  * setter/getter, plus {@link IClusterBuilder.vpc | .vpc()} and
- * {@link IClusterBuilder.allowAccessFrom | .allowAccessFrom()} for
+ * {@link IClusterBuilder.allowDefaultPortFrom | .allowDefaultPortFrom()} for
  * cross-component wiring with Ref support. It implements {@link Lifecycle}
  * for use with {@link compose}.
  *

package/dist/commonjs/cluster-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-builder.d.ts","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAEL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAMlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,oBAAoB,EACpB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,CACpC;IACC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,SAAS,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;IAEvD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,GAAG,KAAK,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,eAAe,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,YAAY,CAAC;IAE1B;;;;OAIG;IACH,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;AAElF,cAAM,cAAe,YAAW,SAAS,CAAC,oBAAoB,CAAC;;IAC7D,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAM;IAKzC;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI;IAKhC;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,IAAI;IAKxD;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,KAC5C,sBAAsB,CAAC,gBAAgB,CAAC,GAC5C,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAM1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB;CA2E7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD"}
+{"version":3,"file":"cluster-builder.d.ts","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAEL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAMlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,oBAAoB,EACpB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,CACpC;IACC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,SAAS,UAAU,CAClC,WAAW,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5D,EAAE,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,GAAG,KAAK,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,eAAe,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,YAAY,CAAC;IAE1B;;;;OAIG;IACH,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;AAElF,cAAM,cAAe,YAAW,SAAS,CAAC,oBAAoB,CAAC;;IAC7D,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAM;IAKzC;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;IAKpE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAKhF;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,KAC5C,sBAAsB,CAAC,gBAAgB,CAAC,GAC5C,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAM1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB;CAoE7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD"}

package/dist/commonjs/cluster-builder.js

@@ -11,12 +11,12 @@ const cluster_alarms_js_1 = require("./cluster-alarms.js");
 class ClusterBuilder {
     props = {};
     #customAlarms = [];
-    #accessors = [];
+    #access = [];
     #vpc;
     /**
-     * Sets the VPC the cluster runs in. Required. Accepts a concrete
-     * {@link IVpc} or a {@link Ref} that resolves to one at build time — the
-     * standard cross-component wiring path (e.g. to a sibling `VpcBuilder`).
+     * Sets the VPC the cluster runs in. Required. Accepts a concrete VPC or a
+     * {@link Ref} that resolves to one at build time — the standard
+     * cross-component wiring path (e.g. to a sibling `VpcBuilder`).
      *
      * @param vpc - The VPC or a Ref to one.
      * @returns This builder for chaining.
@@ -26,22 +26,27 @@ class ClusterBuilder {
         return this;
     }
     /**
-     * Grants a principal both network and IAM access to the cluster in a single
-     * declaration. At build time this applies
-     * `cluster.connections.allowDefaultPortFrom(peer)` (opening the cluster's
-     * port to the peer's security group) and `cluster.grantConnect(peer)`
-     * (granting the IAM `connect` action required by the cluster's
-     * IAM-authentication default).
+     * Opens the cluster's port to `peer` via CDK's
+     * `cluster.connections.allowDefaultPortFrom(peer)` — ingress on the
+     * cluster's security group from the peer's, and the matching egress back on
+     * the peer's.
      *
-     * Accepts a concrete {@link ClusterAccessor} or a {@link Ref} to one, so the
-     * grant can be declared inside `compose()` rather than wired up in an
-     * `afterBuild` hook.
+     * This is the **network** half of reaching the cluster. Because IAM
+     * authentication is on by default, the peer's principal also needs the
+     * data-plane grant, declared on that principal's own builder:
+     * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))` — the
+     * consumer-side shape every grant in the library follows (ADR-0013).
      *
-     * @param peer - The principal to grant access to, or a Ref to one.
+     * Accepts a concrete {@link IConnectable} (a `SecurityGroup`, an `Instance`,
+     * a `Function` in a VPC, …) or a {@link Ref} to one, so the rule can be
+     * declared inside `compose()` rather than wired up in an `afterBuild` hook.
+     *
+     * @param peer - The connectable to open the port to, or a Ref to one.
+     * @param description - Optional description recorded on the ingress rule.
      * @returns This builder for chaining.
      */
-    allowAccessFrom(peer) {
-        this.#accessors.push(peer);
+    allowDefaultPortFrom(peer, description) {
+        this.#access.push({ peer, description });
         return this;
     }
     /**
@@ -61,7 +66,7 @@ class ClusterBuilder {
     [core_1.COPY_STATE](target) {
         target.#vpc = this.#vpc;
         target.#customAlarms.push(...this.#customAlarms);
-        target.#accessors.push(...this.#accessors);
+        target.#access.push(...this.#access);
     }
     build(scope, id, context) {
         const resolvedVpc = this.#vpc ? (0, core_1.resolve)(this.#vpc, context) : undefined;
@@ -94,15 +99,8 @@ class ClusterBuilder {
             ...(kmsKey !== undefined ? { kmsKey: (0, core_1.resolve)(kmsKey, context) } : {}),
         };
         const cluster = new aws_neptune_alpha_1.DatabaseCluster(scope, id, mergedProps);
-        for (const resolvable of this.#accessors) {
-            const peer = (0, core_1.resolve)(resolvable, context);
-            cluster.connections.allowDefaultPortFrom(peer);
-            // The IAM `connect` grant is only meaningful when IAM authentication is
-            // enabled (the default). If a user has turned it off, opening the
-            // network path is the whole grant — a grantConnect policy would be inert.
-            if (mergedProps.iamAuthentication !== false) {
-                cluster.grantConnect(peer);
-            }
+        for (const rule of this.#access) {
+            cluster.connections.allowDefaultPortFrom((0, core_1.resolve)(rule.peer, context), rule.description);
         }
         const alarms = (0, cluster_alarms_js_1.createClusterAlarms)(scope, id, cluster, alarmConfig, mergedProps.serverlessScalingConfiguration, this.#customAlarms);
         return { cluster, subnetGroup: cluster.subnetGroup, clusterParameterGroup, alarms };
@@ -115,7 +113,7 @@ class ClusterBuilder {
  * This is the entry point for defining a Neptune component. The returned
  * builder exposes every {@link ClusterBuilderProps} property as a fluent
  * setter/getter, plus {@link IClusterBuilder.vpc | .vpc()} and
- * {@link IClusterBuilder.allowAccessFrom | .allowAccessFrom()} for
+ * {@link IClusterBuilder.allowDefaultPortFrom | .allowDefaultPortFrom()} for
  * cross-component wiring with Ref support. It implements {@link Lifecycle}
  * for use with {@link compose}.
  *

package/dist/commonjs/cluster-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-builder.js","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":";;AAuVA,oDAEC;AAtVD,kEAOoC;AAEpC,6CAA0F;AAC1F,iEAAkF;AAClF,yDAAkE;AAClE,+DAAyD;AACzD,+FAG+C;AAE/C,2DAA0D;AAyJ1D,MAAM,cAAc;IAClB,KAAK,GAAiC,EAAE,CAAC;IAChC,aAAa,GAA+C,EAAE,CAAC;IAC/D,UAAU,GAAkC,EAAE,CAAC;IACxD,IAAI,CAAoB;IAExB;;;;;;;OAOG;IACH,GAAG,CAAC,GAAqB;QACvB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAiC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAW,EACX,SAE6C;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAsB;QACjC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,6DAA6D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,iBAAiB,EAAE,WAAW,EAC9B,cAAc,EAAE,aAAa,EAC7B,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EAAE,kBAAkB,EACzC,GAAG,YAAY,EAChB,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,2DAA2D;gBAC9E,6EAA6E;gBAC7E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,oDAAoD;gBACvE,+EAA+E;gBAC/E,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,kBAAkB;YAClB,IAAI,yCAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE;gBACtD,MAAM,EAAE,IAAA,iEAA2B,EAAC,YAAY,CAAC,aAAa,CAAC;gBAC/D,UAAU,EAAE,EAAE,GAAG,sEAAgC,EAAE,GAAG,iBAAiB,EAAE;aAC1E,CAAC,CAAC;QAEL,MAAM,cAAc,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,cAAO,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG;YAClB,GAAG,sCAAgB;YACnB,GAAG,YAAY;YACf,GAAG,EAAE,WAAW;YAChB,qBAAqB;YACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,cAAO,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,mCAAe,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE5D,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAA,cAAO,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC/C,wEAAwE;YACxE,kEAAkE;YAClE,0EAA0E;YAC1E,IAAI,WAAW,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBAC5C,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAChC,KAAK,EACL,EAAE,EACF,OAAO,EACP,WAAW,EACX,WAAW,CAAC,8BAA8B,EAC1C,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,oBAAoB;IAClC,OAAO,IAAA,8BAAa,EAAsC,cAAc,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"cluster-builder.js","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":";;AAsVA,oDAEC;AAtVD,kEAOoC;AAEpC,6CAA0F;AAC1F,iEAAkF;AAClF,yDAAkE;AAClE,+DAAyD;AACzD,+FAG+C;AAE/C,2DAA0D;AA2J1D,MAAM,cAAc;IAClB,KAAK,GAAiC,EAAE,CAAC;IAChC,aAAa,GAA+C,EAAE,CAAC;IAC/D,OAAO,GAAiB,EAAE,CAAC;IACpC,IAAI,CAAwD;IAE5D;;;;;;;OAOG;IACH,GAAG,CAAC,GAAyD;QAC3D,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,CAAC,IAA8B,EAAE,WAAoB;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAW,EACX,SAE6C;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAsB;QACjC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,6DAA6D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,iBAAiB,EAAE,WAAW,EAC9B,cAAc,EAAE,aAAa,EAC7B,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EAAE,kBAAkB,EACzC,GAAG,YAAY,EAChB,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,2DAA2D;gBAC9E,6EAA6E;gBAC7E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,oDAAoD;gBACvE,+EAA+E;gBAC/E,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,kBAAkB;YAClB,IAAI,yCAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE;gBACtD,MAAM,EAAE,IAAA,iEAA2B,EAAC,YAAY,CAAC,aAAa,CAAC;gBAC/D,UAAU,EAAE,EAAE,GAAG,sEAAgC,EAAE,GAAG,iBAAiB,EAAE;aAC1E,CAAC,CAAC;QAEL,MAAM,cAAc,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,cAAO,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG;YAClB,GAAG,sCAAgB;YACnB,GAAG,YAAY;YACf,GAAG,EAAE,WAAW;YAChB,qBAAqB;YACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,cAAO,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,mCAAe,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE5D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAChC,KAAK,EACL,EAAE,EACF,OAAO,EACP,WAAW,EACX,WAAW,CAAC,8BAA8B,EAC1C,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,oBAAoB;IAClC,OAAO,IAAA,8BAAa,EAAsC,cAAc,CAAC,CAAC;AAC5E,CAAC"}

package/dist/commonjs/cluster-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-defaults.d.ts","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAuE1D,CAAC"}
+{"version":3,"file":"cluster-defaults.d.ts","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAwE1D,CAAC"}

package/dist/commonjs/cluster-defaults.js

@@ -30,8 +30,9 @@ exports.CLUSTER_DEFAULTS = {
     storageEncrypted: true,
     /**
      * Require IAM authentication for data-plane connections, removing the
-     * need for long-lived static credentials. Pair with `.allowAccessFrom()`
-     * (or `cluster.grantConnect()`) to authorise principals.
+     * need for long-lived static credentials. Authorise a principal with
+     * `clusterGrants.connect(...)` on that principal's builder, and open the
+     * network path with `.allowDefaultPortFrom()`.
      * @see https://docs.aws.amazon.com/wellarchitected/latest/framework/sec-03.html
      * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
      */

package/dist/commonjs/cluster-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-defaults.js","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AACtD,mDAAqD;AACrD,kEAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACU,QAAA,gBAAgB,GAAkC;IAC7D;;;;;OAKG;IACH,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,iBAAiB,EAAE,IAAI;IAEvB;;;;;OAKG;IACH,aAAa,EAAE,2BAAa,CAAC,MAAM;IAEnC;;;;;OAKG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,eAAe,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,2BAAO,CAAC,KAAK,CAAC;IAEtC;;;;OAIG;IACH,uBAAuB,EAAE,wBAAa,CAAC,SAAS;IAEhD;;;;OAIG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,uBAAuB,EAAE,IAAI;CAC9B,CAAC"}
+{"version":3,"file":"cluster-defaults.js","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AACtD,mDAAqD;AACrD,kEAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACU,QAAA,gBAAgB,GAAkC;IAC7D;;;;;OAKG;IACH,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;OAOG;IACH,iBAAiB,EAAE,IAAI;IAEvB;;;;;OAKG;IACH,aAAa,EAAE,2BAAa,CAAC,MAAM;IAEnC;;;;;OAKG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,eAAe,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,2BAAO,CAAC,KAAK,CAAC;IAEtC;;;;OAIG;IACH,uBAAuB,EAAE,wBAAa,CAAC,SAAS;IAEhD;;;;OAIG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,uBAAuB,EAAE,IAAI;CAC9B,CAAC"}

package/dist/commonjs/grants.d.ts

@@ -0,0 +1,34 @@
+import type { IGrantable } from "aws-cdk-lib/aws-iam";
+import type { IDatabaseCluster } from "@aws-cdk/aws-neptune-alpha";
+import { type Grant, type Resolvable } from "@composurecdk/core";
+/**
+ * Consumer-side grant helpers for a Neptune cluster's IAM-authenticated data
+ * plane. Pass one to a grantee builder's `grant(...)` — e.g.
+ * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))`.
+ *
+ * Each delegates to the cluster's native `grant*` method. See ADR-0013.
+ *
+ * These cover the **IAM** half of reaching a cluster. The network half — the
+ * security-group ingress that lets the principal open a socket at all — stays
+ * on the cluster, whose own security group the rule is written into:
+ * `createClusterBuilder().allowDefaultPortFrom(peer)`. A principal needs both.
+ *
+ * The cluster's `iamAuthentication` default is `true`; on a cluster that turns
+ * it off, the alpha L2 rejects a grant outright rather than emitting an inert
+ * policy, so network access is then the whole grant.
+ *
+ * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
+ */
+export declare const clusterGrants: {
+    /**
+     * Connect to the cluster's data plane. Delegates to the cluster's
+     * `grantConnect`, which grants the whole `neptune-db:*` action namespace on
+     * the cluster — read, write, load, and management alike. A principal that
+     * needs less than that wants a narrower policy of its own, scoped to the
+     * cluster's `neptune-db` ARN.
+     *
+     * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html
+     */
+    connect: (cluster: Resolvable<IDatabaseCluster>) => Grant<IGrantable>;
+};
+//# sourceMappingURL=grants.d.ts.map

package/dist/commonjs/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa;IACxB;;;;;;;;OAQG;uBACgB,UAAU,CAAC,gBAAgB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAIpE,CAAC"}

package/dist/commonjs/grants.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clusterGrants = void 0;
+const core_1 = require("@composurecdk/core");
+/**
+ * Consumer-side grant helpers for a Neptune cluster's IAM-authenticated data
+ * plane. Pass one to a grantee builder's `grant(...)` — e.g.
+ * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))`.
+ *
+ * Each delegates to the cluster's native `grant*` method. See ADR-0013.
+ *
+ * These cover the **IAM** half of reaching a cluster. The network half — the
+ * security-group ingress that lets the principal open a socket at all — stays
+ * on the cluster, whose own security group the rule is written into:
+ * `createClusterBuilder().allowDefaultPortFrom(peer)`. A principal needs both.
+ *
+ * The cluster's `iamAuthentication` default is `true`; on a cluster that turns
+ * it off, the alpha L2 rejects a grant outright rather than emitting an inert
+ * policy, so network access is then the whole grant.
+ *
+ * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
+ */
+exports.clusterGrants = {
+    /**
+     * Connect to the cluster's data plane. Delegates to the cluster's
+     * `grantConnect`, which grants the whole `neptune-db:*` action namespace on
+     * the cluster — read, write, load, and management alike. A principal that
+     * needs less than that wants a narrower policy of its own, scoped to the
+     * cluster's `neptune-db` ARN.
+     *
+     * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html
+     */
+    connect: (cluster) => (0, core_1.grantVia)(cluster, (c, grantee) => {
+        c.grantConnect(grantee);
+    }),
+};
+//# sourceMappingURL=grants.js.map

package/dist/commonjs/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":";;;AAEA,6CAA2E;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,aAAa,GAAG;IAC3B;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,OAAqC,EAAqB,EAAE,CACpE,IAAA,eAAQ,EAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAmB,EAAE,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;CACL,CAAC"}

package/dist/commonjs/index.d.ts

@@ -1,5 +1,6 @@
-export { createClusterBuilder, type ClusterAccessor, type ClusterBuilderProps, type ClusterBuilderResult, type IClusterBuilder, } from "./cluster-builder.js";
+export { createClusterBuilder, type ClusterBuilderProps, type ClusterBuilderResult, type IClusterBuilder, } from "./cluster-builder.js";
 export { CLUSTER_DEFAULTS } from "./cluster-defaults.js";
+export { clusterGrants } from "./grants.js";
 export { CLUSTER_PARAMETER_GROUP_DEFAULTS, clusterParameterGroupFamily, } from "./cluster-parameter-group-defaults.js";
 export { type NeptuneClusterAlarmConfig } from "./cluster-alarm-config.js";
 export { CLUSTER_ALARM_DEFAULTS } from "./cluster-alarm-defaults.js";

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/commonjs/index.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLUSTER_ALARM_DEFAULTS = exports.clusterParameterGroupFamily = exports.CLUSTER_PARAMETER_GROUP_DEFAULTS = exports.CLUSTER_DEFAULTS = exports.createClusterBuilder = void 0;
+exports.CLUSTER_ALARM_DEFAULTS = exports.clusterParameterGroupFamily = exports.CLUSTER_PARAMETER_GROUP_DEFAULTS = exports.clusterGrants = exports.CLUSTER_DEFAULTS = exports.createClusterBuilder = void 0;
 var cluster_builder_js_1 = require("./cluster-builder.js");
 Object.defineProperty(exports, "createClusterBuilder", { enumerable: true, get: function () { return cluster_builder_js_1.createClusterBuilder; } });
 var cluster_defaults_js_1 = require("./cluster-defaults.js");
 Object.defineProperty(exports, "CLUSTER_DEFAULTS", { enumerable: true, get: function () { return cluster_defaults_js_1.CLUSTER_DEFAULTS; } });
+var grants_js_1 = require("./grants.js");
+Object.defineProperty(exports, "clusterGrants", { enumerable: true, get: function () { return grants_js_1.clusterGrants; } });
 var cluster_parameter_group_defaults_js_1 = require("./cluster-parameter-group-defaults.js");
 Object.defineProperty(exports, "CLUSTER_PARAMETER_GROUP_DEFAULTS", { enumerable: true, get: function () { return cluster_parameter_group_defaults_js_1.CLUSTER_PARAMETER_GROUP_DEFAULTS; } });
 Object.defineProperty(exports, "clusterParameterGroupFamily", { enumerable: true, get: function () { return cluster_parameter_group_defaults_js_1.clusterParameterGroupFamily; } });

package/dist/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,2DAM8B;AAL5B,0HAAA,oBAAoB,OAAA;AAMtB,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AACzB,6FAG+C;AAF7C,uJAAA,gCAAgC,OAAA;AAChC,kJAAA,2BAA2B,OAAA;AAG7B,yEAAqE;AAA5D,mIAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,2DAK8B;AAJ5B,0HAAA,oBAAoB,OAAA;AAKtB,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AACzB,yCAA4C;AAAnC,0GAAA,aAAa,OAAA;AACtB,6FAG+C;AAF7C,uJAAA,gCAAgC,OAAA;AAChC,kJAAA,2BAA2B,OAAA;AAG7B,yEAAqE;AAA5D,mIAAA,sBAAsB,OAAA"}

package/dist/esm/cluster-builder.d.ts

@@ -1,20 +1,11 @@
 import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
-import { type IConnectable, type ISecurityGroup, type IVpc } from "aws-cdk-lib/aws-ec2";
-import { type IGrantable } from "aws-cdk-lib/aws-iam";
+import { type IConnectable } from "aws-cdk-lib/aws-ec2";
 import { DatabaseCluster, type DatabaseClusterProps, type IClusterParameterGroup, type IDatabaseCluster, type ISubnetGroup } from "@aws-cdk/aws-neptune-alpha";
 import { type IConstruct } from "constructs";
 import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { type ITaggedBuilder } from "@composurecdk/cloudformation";
 import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
 import type { NeptuneClusterAlarmConfig } from "./cluster-alarm-config.js";
-/**
- * A principal that can be granted access to a Neptune cluster via
- * {@link IClusterBuilder.allowAccessFrom}. Must be both an {@link IConnectable}
- * (so its security group can be opened to the cluster's port) and an
- * {@link IGrantable} (so it can be granted IAM `connect`). EC2 instances,
- * Lambda functions, and Fargate tasks all satisfy this.
- */
-export type ClusterAccessor = IConnectable & IGrantable;
 /**
  * Configuration properties for the Neptune cluster builder.
  *
@@ -25,21 +16,25 @@ export type ClusterAccessor = IConnectable & IGrantable;
  *
  * - `vpc` is supplied via the dedicated {@link IClusterBuilder.vpc | .vpc()}
  *   method (it is required).
- * - `securityGroups` accepts `Resolvable<ISecurityGroup>` entries.
+ * - `securityGroups` accepts `Resolvable` entries.
  * - `kmsKey` accepts a `Resolvable` key.
  *
  * It also adds builder-specific options for the auto-created cluster
  * parameter group and recommended alarms.
+ *
+ * Each re-declared prop reads its inner type from CDK's own prop rather than
+ * naming an interface, so it keeps tracking the installed `aws-cdk-lib` as CDK
+ * moves its prop types (ADR-0018).
  */
 export interface ClusterBuilderProps extends Omit<DatabaseClusterProps, "vpc" | "securityGroups" | "kmsKey"> {
     /**
-     * Security groups to attach to the cluster. Accepts concrete
-     * {@link ISecurityGroup}s or {@link Ref}s that resolve to them at build
-     * time (e.g. a sibling `SecurityGroupBuilder`).
+     * Security groups to attach to the cluster. Accepts concrete security
+     * groups or {@link Ref}s that resolve to them at build time (e.g. a sibling
+     * `SecurityGroupBuilder`).
      *
      * @default - CDK creates a security group for the cluster.
      */
-    securityGroups?: readonly Resolvable<ISecurityGroup>[];
+    securityGroups?: readonly Resolvable<NonNullable<DatabaseClusterProps["securityGroups"]>[number]>[];
     /**
      * The customer-managed KMS key used to encrypt the cluster's storage at
      * rest.
@@ -149,30 +144,35 @@ declare class ClusterBuilder implements Lifecycle<ClusterBuilderResult> {
     #private;
     props: Partial<ClusterBuilderProps>;
     /**
-     * Sets the VPC the cluster runs in. Required. Accepts a concrete
-     * {@link IVpc} or a {@link Ref} that resolves to one at build time — the
-     * standard cross-component wiring path (e.g. to a sibling `VpcBuilder`).
+     * Sets the VPC the cluster runs in. Required. Accepts a concrete VPC or a
+     * {@link Ref} that resolves to one at build time — the standard
+     * cross-component wiring path (e.g. to a sibling `VpcBuilder`).
      *
      * @param vpc - The VPC or a Ref to one.
      * @returns This builder for chaining.
      */
-    vpc(vpc: Resolvable<IVpc>): this;
+    vpc(vpc: Resolvable<NonNullable<DatabaseClusterProps["vpc"]>>): this;
     /**
-     * Grants a principal both network and IAM access to the cluster in a single
-     * declaration. At build time this applies
-     * `cluster.connections.allowDefaultPortFrom(peer)` (opening the cluster's
-     * port to the peer's security group) and `cluster.grantConnect(peer)`
-     * (granting the IAM `connect` action required by the cluster's
-     * IAM-authentication default).
+     * Opens the cluster's port to `peer` via CDK's
+     * `cluster.connections.allowDefaultPortFrom(peer)` — ingress on the
+     * cluster's security group from the peer's, and the matching egress back on
+     * the peer's.
+     *
+     * This is the **network** half of reaching the cluster. Because IAM
+     * authentication is on by default, the peer's principal also needs the
+     * data-plane grant, declared on that principal's own builder:
+     * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))` — the
+     * consumer-side shape every grant in the library follows (ADR-0013).
      *
-     * Accepts a concrete {@link ClusterAccessor} or a {@link Ref} to one, so the
-     * grant can be declared inside `compose()` rather than wired up in an
-     * `afterBuild` hook.
+     * Accepts a concrete {@link IConnectable} (a `SecurityGroup`, an `Instance`,
+     * a `Function` in a VPC, …) or a {@link Ref} to one, so the rule can be
+     * declared inside `compose()` rather than wired up in an `afterBuild` hook.
      *
-     * @param peer - The principal to grant access to, or a Ref to one.
+     * @param peer - The connectable to open the port to, or a Ref to one.
+     * @param description - Optional description recorded on the ingress rule.
      * @returns This builder for chaining.
      */
-    allowAccessFrom(peer: Resolvable<ClusterAccessor>): this;
+    allowDefaultPortFrom(peer: Resolvable<IConnectable>, description?: string): this;
     /**
      * Adds a custom CloudWatch alarm to be created alongside the recommended
      * alarms. The callback receives an {@link AlarmDefinitionBuilder} scoped to
@@ -194,7 +194,7 @@ declare class ClusterBuilder implements Lifecycle<ClusterBuilderResult> {
  * This is the entry point for defining a Neptune component. The returned
  * builder exposes every {@link ClusterBuilderProps} property as a fluent
  * setter/getter, plus {@link IClusterBuilder.vpc | .vpc()} and
- * {@link IClusterBuilder.allowAccessFrom | .allowAccessFrom()} for
+ * {@link IClusterBuilder.allowDefaultPortFrom | .allowDefaultPortFrom()} for
  * cross-component wiring with Ref support. It implements {@link Lifecycle}
  * for use with {@link compose}.
  *

package/dist/esm/cluster-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-builder.d.ts","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAEL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAMlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,oBAAoB,EACpB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,CACpC;IACC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,SAAS,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;IAEvD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,GAAG,KAAK,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,eAAe,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,YAAY,CAAC;IAE1B;;;;OAIG;IACH,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;AAElF,cAAM,cAAe,YAAW,SAAS,CAAC,oBAAoB,CAAC;;IAC7D,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAM;IAKzC;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI;IAKhC;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,IAAI;IAKxD;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,KAC5C,sBAAsB,CAAC,gBAAgB,CAAC,GAC5C,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAM1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB;CA2E7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD"}
+{"version":3,"file":"cluster-builder.d.ts","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAEL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAMlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,oBAAoB,EACpB,KAAK,GAAG,gBAAgB,GAAG,QAAQ,CACpC;IACC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,SAAS,UAAU,CAClC,WAAW,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5D,EAAE,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,GAAG,KAAK,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,eAAe,CAAC;IAEzB;;;OAGG;IACH,WAAW,EAAE,YAAY,CAAC;IAE1B;;;;OAIG;IACH,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;AAElF,cAAM,cAAe,YAAW,SAAS,CAAC,oBAAoB,CAAC;;IAC7D,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAM;IAKzC;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;IAKpE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAKhF;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,KAC5C,sBAAsB,CAAC,gBAAgB,CAAC,GAC5C,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAM1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB;CAoE7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD"}

package/dist/esm/cluster-builder.js

@@ -8,12 +8,12 @@ import { createClusterAlarms } from "./cluster-alarms.js";
 class ClusterBuilder {
     props = {};
     #customAlarms = [];
-    #accessors = [];
+    #access = [];
     #vpc;
     /**
-     * Sets the VPC the cluster runs in. Required. Accepts a concrete
-     * {@link IVpc} or a {@link Ref} that resolves to one at build time — the
-     * standard cross-component wiring path (e.g. to a sibling `VpcBuilder`).
+     * Sets the VPC the cluster runs in. Required. Accepts a concrete VPC or a
+     * {@link Ref} that resolves to one at build time — the standard
+     * cross-component wiring path (e.g. to a sibling `VpcBuilder`).
      *
      * @param vpc - The VPC or a Ref to one.
      * @returns This builder for chaining.
@@ -23,22 +23,27 @@ class ClusterBuilder {
         return this;
     }
     /**
-     * Grants a principal both network and IAM access to the cluster in a single
-     * declaration. At build time this applies
-     * `cluster.connections.allowDefaultPortFrom(peer)` (opening the cluster's
-     * port to the peer's security group) and `cluster.grantConnect(peer)`
-     * (granting the IAM `connect` action required by the cluster's
-     * IAM-authentication default).
+     * Opens the cluster's port to `peer` via CDK's
+     * `cluster.connections.allowDefaultPortFrom(peer)` — ingress on the
+     * cluster's security group from the peer's, and the matching egress back on
+     * the peer's.
      *
-     * Accepts a concrete {@link ClusterAccessor} or a {@link Ref} to one, so the
-     * grant can be declared inside `compose()` rather than wired up in an
-     * `afterBuild` hook.
+     * This is the **network** half of reaching the cluster. Because IAM
+     * authentication is on by default, the peer's principal also needs the
+     * data-plane grant, declared on that principal's own builder:
+     * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))` — the
+     * consumer-side shape every grant in the library follows (ADR-0013).
      *
-     * @param peer - The principal to grant access to, or a Ref to one.
+     * Accepts a concrete {@link IConnectable} (a `SecurityGroup`, an `Instance`,
+     * a `Function` in a VPC, …) or a {@link Ref} to one, so the rule can be
+     * declared inside `compose()` rather than wired up in an `afterBuild` hook.
+     *
+     * @param peer - The connectable to open the port to, or a Ref to one.
+     * @param description - Optional description recorded on the ingress rule.
      * @returns This builder for chaining.
      */
-    allowAccessFrom(peer) {
-        this.#accessors.push(peer);
+    allowDefaultPortFrom(peer, description) {
+        this.#access.push({ peer, description });
         return this;
     }
     /**
@@ -58,7 +63,7 @@ class ClusterBuilder {
     [COPY_STATE](target) {
         target.#vpc = this.#vpc;
         target.#customAlarms.push(...this.#customAlarms);
-        target.#accessors.push(...this.#accessors);
+        target.#access.push(...this.#access);
     }
     build(scope, id, context) {
         const resolvedVpc = this.#vpc ? resolve(this.#vpc, context) : undefined;
@@ -91,15 +96,8 @@ class ClusterBuilder {
             ...(kmsKey !== undefined ? { kmsKey: resolve(kmsKey, context) } : {}),
         };
         const cluster = new DatabaseCluster(scope, id, mergedProps);
-        for (const resolvable of this.#accessors) {
-            const peer = resolve(resolvable, context);
-            cluster.connections.allowDefaultPortFrom(peer);
-            // The IAM `connect` grant is only meaningful when IAM authentication is
-            // enabled (the default). If a user has turned it off, opening the
-            // network path is the whole grant — a grantConnect policy would be inert.
-            if (mergedProps.iamAuthentication !== false) {
-                cluster.grantConnect(peer);
-            }
+        for (const rule of this.#access) {
+            cluster.connections.allowDefaultPortFrom(resolve(rule.peer, context), rule.description);
         }
         const alarms = createClusterAlarms(scope, id, cluster, alarmConfig, mergedProps.serverlessScalingConfiguration, this.#customAlarms);
         return { cluster, subnetGroup: cluster.subnetGroup, clusterParameterGroup, alarms };
@@ -112,7 +110,7 @@ class ClusterBuilder {
  * This is the entry point for defining a Neptune component. The returned
  * builder exposes every {@link ClusterBuilderProps} property as a fluent
  * setter/getter, plus {@link IClusterBuilder.vpc | .vpc()} and
- * {@link IClusterBuilder.allowAccessFrom | .allowAccessFrom()} for
+ * {@link IClusterBuilder.allowDefaultPortFrom | .allowDefaultPortFrom()} for
  * cross-component wiring with Ref support. It implements {@link Lifecycle}
  * for use with {@link compose}.
  *

package/dist/esm/cluster-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-builder.js","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAyJ1D,MAAM,cAAc;IAClB,KAAK,GAAiC,EAAE,CAAC;IAChC,aAAa,GAA+C,EAAE,CAAC;IAC/D,UAAU,GAAkC,EAAE,CAAC;IACxD,IAAI,CAAoB;IAExB;;;;;;;OAOG;IACH,GAAG,CAAC,GAAqB;QACvB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAiC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAW,EACX,SAE6C;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAsB;QACjC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,6DAA6D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,iBAAiB,EAAE,WAAW,EAC9B,cAAc,EAAE,aAAa,EAC7B,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EAAE,kBAAkB,EACzC,GAAG,YAAY,EAChB,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,2DAA2D;gBAC9E,6EAA6E;gBAC7E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,oDAAoD;gBACvE,+EAA+E;gBAC/E,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,kBAAkB;YAClB,IAAI,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE;gBACtD,MAAM,EAAE,2BAA2B,CAAC,YAAY,CAAC,aAAa,CAAC;gBAC/D,UAAU,EAAE,EAAE,GAAG,gCAAgC,EAAE,GAAG,iBAAiB,EAAE;aAC1E,CAAC,CAAC;QAEL,MAAM,cAAc,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG;YAClB,GAAG,gBAAgB;YACnB,GAAG,YAAY;YACf,GAAG,EAAE,WAAW;YAChB,qBAAqB;YACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE5D,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC/C,wEAAwE;YACxE,kEAAkE;YAClE,0EAA0E;YAC1E,IAAI,WAAW,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBAC5C,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,KAAK,EACL,EAAE,EACF,OAAO,EACP,WAAW,EACX,WAAW,CAAC,8BAA8B,EAC1C,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,aAAa,CAAsC,cAAc,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"cluster-builder.js","sourceRoot":"","sources":["../../src/cluster-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AA2J1D,MAAM,cAAc;IAClB,KAAK,GAAiC,EAAE,CAAC;IAChC,aAAa,GAA+C,EAAE,CAAC;IAC/D,OAAO,GAAiB,EAAE,CAAC;IACpC,IAAI,CAAwD;IAE5D;;;;;;;OAOG;IACH,GAAG,CAAC,GAAyD;QAC3D,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,CAAC,IAA8B,EAAE,WAAoB;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAW,EACX,SAE6C;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAsB;QACjC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,6DAA6D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,iBAAiB,EAAE,WAAW,EAC9B,cAAc,EAAE,aAAa,EAC7B,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EAAE,kBAAkB,EACzC,GAAG,YAAY,EAChB,GAAG,IAAI,CAAC,KAAK,CAAC;QAEf,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,2DAA2D;gBAC9E,6EAA6E;gBAC7E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,mBAAmB,EAAE,oDAAoD;gBACvE,+EAA+E;gBAC/E,6DAA6D,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,kBAAkB;YAClB,IAAI,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE;gBACtD,MAAM,EAAE,2BAA2B,CAAC,YAAY,CAAC,aAAa,CAAC;gBAC/D,UAAU,EAAE,EAAE,GAAG,gCAAgC,EAAE,GAAG,iBAAiB,EAAE;aAC1E,CAAC,CAAC;QAEL,MAAM,cAAc,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG;YAClB,GAAG,gBAAgB;YACnB,GAAG,YAAY;YACf,GAAG,EAAE,WAAW;YAChB,qBAAqB;YACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE5D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,KAAK,EACL,EAAE,EACF,OAAO,EACP,WAAW,EACX,WAAW,CAAC,8BAA8B,EAC1C,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,aAAa,CAAsC,cAAc,CAAC,CAAC;AAC5E,CAAC"}

package/dist/esm/cluster-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-defaults.d.ts","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAuE1D,CAAC"}
+{"version":3,"file":"cluster-defaults.d.ts","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAwE1D,CAAC"}

package/dist/esm/cluster-defaults.js

@@ -27,8 +27,9 @@ export const CLUSTER_DEFAULTS = {
     storageEncrypted: true,
     /**
      * Require IAM authentication for data-plane connections, removing the
-     * need for long-lived static credentials. Pair with `.allowAccessFrom()`
-     * (or `cluster.grantConnect()`) to authorise principals.
+     * need for long-lived static credentials. Authorise a principal with
+     * `clusterGrants.connect(...)` on that principal's builder, and open the
+     * network path with `.allowDefaultPortFrom()`.
      * @see https://docs.aws.amazon.com/wellarchitected/latest/framework/sec-03.html
      * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
      */

package/dist/esm/cluster-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-defaults.js","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,OAAO,EAA6B,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D;;;;;OAKG;IACH,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,iBAAiB,EAAE,IAAI;IAEvB;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC,MAAM;IAEnC;;;;;OAKG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;OAIG;IACH,uBAAuB,EAAE,aAAa,CAAC,SAAS;IAEhD;;;;OAIG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,uBAAuB,EAAE,IAAI;CAC9B,CAAC"}
+{"version":3,"file":"cluster-defaults.js","sourceRoot":"","sources":["../../src/cluster-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,OAAO,EAA6B,MAAM,4BAA4B,CAAC;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D;;;;;OAKG;IACH,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;OAOG;IACH,iBAAiB,EAAE,IAAI;IAEvB;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC,MAAM;IAEnC;;;;;OAKG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;OAIG;IACH,uBAAuB,EAAE,aAAa,CAAC,SAAS;IAEhD;;;;OAIG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;OAIG;IACH,uBAAuB,EAAE,IAAI;CAC9B,CAAC"}

package/dist/esm/grants.d.ts

@@ -0,0 +1,34 @@
+import type { IGrantable } from "aws-cdk-lib/aws-iam";
+import type { IDatabaseCluster } from "@aws-cdk/aws-neptune-alpha";
+import { type Grant, type Resolvable } from "@composurecdk/core";
+/**
+ * Consumer-side grant helpers for a Neptune cluster's IAM-authenticated data
+ * plane. Pass one to a grantee builder's `grant(...)` — e.g.
+ * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))`.
+ *
+ * Each delegates to the cluster's native `grant*` method. See ADR-0013.
+ *
+ * These cover the **IAM** half of reaching a cluster. The network half — the
+ * security-group ingress that lets the principal open a socket at all — stays
+ * on the cluster, whose own security group the rule is written into:
+ * `createClusterBuilder().allowDefaultPortFrom(peer)`. A principal needs both.
+ *
+ * The cluster's `iamAuthentication` default is `true`; on a cluster that turns
+ * it off, the alpha L2 rejects a grant outright rather than emitting an inert
+ * policy, so network access is then the whole grant.
+ *
+ * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
+ */
+export declare const clusterGrants: {
+    /**
+     * Connect to the cluster's data plane. Delegates to the cluster's
+     * `grantConnect`, which grants the whole `neptune-db:*` action namespace on
+     * the cluster — read, write, load, and management alike. A principal that
+     * needs less than that wants a narrower policy of its own, scoped to the
+     * cluster's `neptune-db` ARN.
+     *
+     * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html
+     */
+    connect: (cluster: Resolvable<IDatabaseCluster>) => Grant<IGrantable>;
+};
+//# sourceMappingURL=grants.d.ts.map

package/dist/esm/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa;IACxB;;;;;;;;OAQG;uBACgB,UAAU,CAAC,gBAAgB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAIpE,CAAC"}

package/dist/esm/grants.js

@@ -0,0 +1,34 @@
+import { grantVia } from "@composurecdk/core";
+/**
+ * Consumer-side grant helpers for a Neptune cluster's IAM-authenticated data
+ * plane. Pass one to a grantee builder's `grant(...)` — e.g.
+ * `role.grant(clusterGrants.connect(ref("graph", (r) => r.cluster)))`.
+ *
+ * Each delegates to the cluster's native `grant*` method. See ADR-0013.
+ *
+ * These cover the **IAM** half of reaching a cluster. The network half — the
+ * security-group ingress that lets the principal open a socket at all — stays
+ * on the cluster, whose own security group the rule is written into:
+ * `createClusterBuilder().allowDefaultPortFrom(peer)`. A principal needs both.
+ *
+ * The cluster's `iamAuthentication` default is `true`; on a cluster that turns
+ * it off, the alpha L2 rejects a grant outright rather than emitting an inert
+ * policy, so network access is then the whole grant.
+ *
+ * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html
+ */
+export const clusterGrants = {
+    /**
+     * Connect to the cluster's data plane. Delegates to the cluster's
+     * `grantConnect`, which grants the whole `neptune-db:*` action namespace on
+     * the cluster — read, write, load, and management alike. A principal that
+     * needs less than that wants a narrower policy of its own, scoped to the
+     * cluster's `neptune-db` ARN.
+     *
+     * @see https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html
+     */
+    connect: (cluster) => grantVia(cluster, (c, grantee) => {
+        c.grantConnect(grantee);
+    }),
+};
+//# sourceMappingURL=grants.js.map

package/dist/esm/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,OAAqC,EAAqB,EAAE,CACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAmB,EAAE,EAAE;QAC3C,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;CACL,CAAC"}

package/dist/esm/index.d.ts

@@ -1,5 +1,6 @@
-export { createClusterBuilder, type ClusterAccessor, type ClusterBuilderProps, type ClusterBuilderResult, type IClusterBuilder, } from "./cluster-builder.js";
+export { createClusterBuilder, type ClusterBuilderProps, type ClusterBuilderResult, type IClusterBuilder, } from "./cluster-builder.js";
 export { CLUSTER_DEFAULTS } from "./cluster-defaults.js";
+export { clusterGrants } from "./grants.js";
 export { CLUSTER_PARAMETER_GROUP_DEFAULTS, clusterParameterGroupFamily, } from "./cluster-parameter-group-defaults.js";
 export { type NeptuneClusterAlarmConfig } from "./cluster-alarm-config.js";
 export { CLUSTER_ALARM_DEFAULTS } from "./cluster-alarm-defaults.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/esm/index.js

@@ -1,5 +1,6 @@
 export { createClusterBuilder, } from "./cluster-builder.js";
 export { CLUSTER_DEFAULTS } from "./cluster-defaults.js";
+export { clusterGrants } from "./grants.js";
 export { CLUSTER_PARAMETER_GROUP_DEFAULTS, clusterParameterGroupFamily, } from "./cluster-parameter-group-defaults.js";
 export { CLUSTER_ALARM_DEFAULTS } from "./cluster-alarm-defaults.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAKrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@composurecdk/neptune",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "description": "Composable Amazon Neptune cluster builder with well-architected defaults",
   "repository": {
     "type": "git",
-    "url": "https://github.com/laazyj/composureCDK",
+    "url": "git+https://github.com/laazyj/composureCDK.git",
     "directory": "packages/neptune"
   },
   "files": [
@@ -50,19 +50,20 @@
   },
   "peerDependencies": {
     "@aws-cdk/aws-neptune-alpha": "^2.190.0-alpha.0",
-    "@composurecdk/cloudformation": "^0.9.0",
-    "@composurecdk/cloudwatch": "^0.9.0",
-    "@composurecdk/core": "^0.9.0",
+    "@composurecdk/cloudformation": "^0.10.0",
+    "@composurecdk/cloudwatch": "^0.10.0",
+    "@composurecdk/core": "^0.10.0",
     "aws-cdk-lib": "^2.190.0",
     "constructs": "^10.0.0"
   },
   "devDependencies": {
     "@aws-cdk/aws-neptune-alpha": "2.257.0-alpha.0",
-    "@types/node": "^25.9.3",
-    "aws-cdk-lib": "^2.263.0",
-    "constructs": "^10.6.0",
+    "@composurecdk/cdk-testing": "*",
+    "@types/node": "^26.5.1",
+    "aws-cdk-lib": "^2.268.0",
+    "constructs": "^10.8.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8"
+    "vitest": "^5.0.0"
   },
   "exports": {
     "./package.json": "./package.json",