@fntio/infra-client 0.0.0-stage → 0.5.0

package/dist/lib/constructs/tailnet-connector.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TailnetConnector = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
+const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
+const logs = __importStar(require("aws-cdk-lib/aws-logs"));
+const mirrored_image_1 = require("./mirrored-image");
+const scratch_tmpfs_1 = require("./scratch-tmpfs");
+/** In-VPC subnet router, one per VPC; dials OUT only. Grants decide who may
+ *  route here — the resource's SG still decides what the VPC accepts. */
+class TailnetConnector extends constructs_1.Construct {
+    securityGroup;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const cluster = new ecs.Cluster(this, "Cluster", {
+            vpc: props.vpc,
+            containerInsightsV2: props.containerInsights
+                ? ecs.ContainerInsights.ENABLED
+                : ecs.ContainerInsights.DISABLED,
+        });
+        const taskDef = new ecs.FargateTaskDefinition(this, "TaskDef", {
+            cpu: 256,
+            memoryLimitMiB: 512,
+        });
+        // Both containers non-root on a read-only root, each with its own tmpfs.
+        // No shared task volume (a Fargate task volume is root-owned whatever the
+        // image says): the minted key crosses the task's loopback,
+        // which the two containers share. Userspace forwarding needs no privilege.
+        const NONROOT = "65534";
+        const HANDOFF_PORT = 9909;
+        const tailscale = taskDef.addContainer("tailscale", {
+            // Pinned: we ship this update train (same policy as the control plane).
+            image: (0, mirrored_image_1.taskImage)(this, "TailscaleImage", "ghcr.io/tailscale/tailscale:v1.98.9", props.mirrorImages, taskDef),
+            // Self-auth waits for the minted key on loopback (busybox nc, one
+            // connection), then hands off to the stock entrypoint — upstream image
+            // stays unmodified. stdin MUST be at EOF: this nc (1.10-compatible)
+            // exits only once both stdin and the peer have closed, so a held-open
+            // stdin hangs it (2026-10-09 crash loop). No key within five minutes =
+            // exit, so the task restarts.
+            entryPoint: [
+                "/bin/sh",
+                "-ec",
+                [
+                    'echo "waiting for the auth key on 127.0.0.1:' + HANDOFF_PORT + '"',
+                    `timeout 300 nc -l -s 127.0.0.1 -p ${HANDOFF_PORT} </dev/null >/tmp/key`,
+                    'TS_AUTHKEY="$(cat /tmp/key)"',
+                    "rm -f /tmp/key",
+                    '[ -n "$TS_AUTHKEY" ] || { echo "no auth key received"; exit 1; }',
+                    'echo "auth key received, starting tailscale"',
+                    "export TS_AUTHKEY",
+                    "exec /usr/local/bin/containerboot",
+                ].join("\n"),
+            ],
+            user: NONROOT,
+            readonlyRootFilesystem: true,
+            linuxParameters: (0, scratch_tmpfs_1.scratchTmpfs)(this, "TmpfsTailscale", 64),
+            environment: {
+                // Fargate grants no NET_ADMIN/tun device; userspace forwarding is fine
+                // for developer access, not bulk transfer.
+                TS_USERSPACE: "true",
+                TS_AUTH_ONCE: "true",
+                TS_HOSTNAME: props.hostname ?? "connector",
+                TS_ROUTES: props.routes.join(","),
+                TS_EXTRA_ARGS: `--login-server=${props.controlUrl}`,
+                TS_STATE_DIR: "/tmp/tailscale",
+            },
+            logging: ecs.LogDrivers.awsLogs({
+                streamPrefix: "connector",
+                logRetention: logs.RetentionDays.ONE_MONTH,
+            }),
+        });
+        // Mint at boot with the task role; aws-cli image has grep/sed, no jq needed.
+        // bash for /dev/tcp: the key goes to the tailscale container's listener,
+        // retried for two minutes while it comes up (it is started first).
+        const init = taskDef.addContainer("mint-authkey", {
+            image: ecs.ContainerImage.fromRegistry("public.ecr.aws/aws-cli/aws-cli:2.15.17"),
+            essential: false,
+            user: NONROOT,
+            readonlyRootFilesystem: true,
+            linuxParameters: (0, scratch_tmpfs_1.scratchTmpfs)(this, "TmpfsMint", 16),
+            entryPoint: ["/usr/bin/bash", "-c"],
+            command: [
+                [
+                    "set -e",
+                    'aws lambda invoke --function-name "$MINTER_ARN"' +
+                        " --cli-binary-format raw-in-base64-out" +
+                        ' --payload \'{"keyType":"connector"}\' /tmp/out.json >/dev/null',
+                    // one-line JSON: {"key":"tskey-…","expiresAt":"…"}
+                    "KEY=$(grep -oE '\"key\":\"[^\"]+\"' /tmp/out.json | head -1 | sed 's/\"key\":\"//;s/\"//')",
+                    'test -n "$KEY"',
+                    "rm -f /tmp/out.json",
+                    "n=0",
+                    `until (printf %s "$KEY" > /dev/tcp/127.0.0.1/${HANDOFF_PORT}) 2>/dev/null; do n=$((n+1)); [ $n -lt 120 ] || exit 1; sleep 1; done`,
+                    'echo "auth key handed to tailscale after $n retries"',
+                ].join("; "),
+            ],
+            environment: {
+                // The uid has no passwd entry in this image; the CLI resolves ~ via HOME.
+                HOME: "/tmp",
+                MINTER_ARN: props.minter.functionArn,
+                // The MINTER's region (from its ARN), not this VPC's — Lambda answers for its own
+                // region's endpoint only, and the hub may sit elsewhere.
+                AWS_REGION: props.minter.env.region,
+            },
+            logging: ecs.LogDrivers.awsLogs({
+                streamPrefix: "connector-mint",
+                logRetention: logs.RetentionDays.ONE_MONTH,
+            }),
+        });
+        init.addContainerDependencies({
+            container: tailscale,
+            condition: ecs.ContainerDependencyCondition.START,
+        });
+        // Identity-policy half of the invoke. Cross-account minters also need the
+        // resource-policy half, granted hub-side (grantConnectorAccount).
+        props.minter.grantInvoke(taskDef.taskRole);
+        this.securityGroup = new ec2.SecurityGroup(this, "Sg", {
+            vpc: props.vpc,
+            // EC2 rejects non-ASCII in this field - plain hyphen only.
+            description: "Tailnet connector - no inbound; resource SGs allow FROM this to be reachable.",
+            allowAllOutbound: true,
+        });
+        new ecs.FargateService(this, "Service", {
+            cluster,
+            taskDefinition: taskDef,
+            desiredCount: 1,
+            securityGroups: [this.securityGroup],
+            // Public subnet + public IP: the connector needs outbound internet to
+            // reach the control plane/DERP, and target-account VPCs often have no NAT.
+            assignPublicIp: true,
+            vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+            minHealthyPercent: 0,
+            maxHealthyPercent: 100,
+            circuitBreaker: { rollback: true },
+        });
+        new cdk.CfnOutput(this, "ConnectorSecurityGroupId", {
+            value: this.securityGroup.securityGroupId,
+            description: "Allow this SG in a resource's security group to make it reachable over the tailnet.",
+        });
+    }
+}
+exports.TailnetConnector = TailnetConnector;

package/dist/lib/constructs/tailnet-resolver.d.ts

@@ -0,0 +1,30 @@
+import { Construct } from "constructs";
+import * as ec2 from "aws-cdk-lib/aws-ec2";
+import * as iam from "aws-cdk-lib/aws-iam";
+import { AppFunction } from "./app-function";
+export interface TailnetResolverProps {
+    /** The hub's SET-ONCE product prefix (hub.resourcePrefix) — the well-known
+     *  function name derives from it. */
+    readonly resourcePrefix: string;
+    /** Site this VPC belongs to — part of the function name, because one account
+     *  may host connector VPCs in TWO sites and each has its own DNS view. */
+    readonly site: string;
+    /** VPC whose private zones the catalog's dnsNames live in — the fn runs
+     *  inside it, so names resolve exactly as a workload there sees them. */
+    readonly vpc: ec2.IVpc;
+    /** The hub's reconciler role (`hub.aclReconcilerPrincipal()`). Omit when
+     *  the reconciler is same-account — identity policy alone suffices. */
+    readonly trustedInvoker?: iam.IPrincipal;
+    /** The connector VPC's name (config `connectorVpcs[].name`) — suffixes the
+     *  function name so an account's second VPC in the same site gets its own. */
+    readonly name?: string;
+}
+/** In-VPC DNS for the hub's ACL reconciler: a Fargate task's IP moves on every
+ *  restart and only this VPC's resolver knows the current one — cross-account,
+ *  the reconciler can't see private zones at all, so drift-healing asks this fn
+ *  (names in, IPs out; DNS needs no internet path, so public subnets suffice —
+ *  same placement as the connector). */
+export declare class TailnetResolver extends Construct {
+    readonly fn: AppFunction;
+    constructor(scope: Construct, id: string, props: TailnetResolverProps);
+}

package/dist/lib/constructs/tailnet-resolver.js

@@ -0,0 +1,71 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TailnetResolver = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
+const app_function_1 = require("./app-function");
+const naming_1 = require("../../lambdacode/network/naming");
+/** In-VPC DNS for the hub's ACL reconciler: a Fargate task's IP moves on every
+ *  restart and only this VPC's resolver knows the current one — cross-account,
+ *  the reconciler can't see private zones at all, so drift-healing asks this fn
+ *  (names in, IPs out; DNS needs no internet path, so public subnets suffice —
+ *  same placement as the connector). */
+class TailnetResolver extends constructs_1.Construct {
+    fn;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.fn = new app_function_1.AppFunction(this, "Fn", {
+            functionName: (0, naming_1.tailnetResolverFnName)(props.resourcePrefix, props.site, props.name),
+            description: "Resolves private DNS names from inside this VPC for the VPN reconciler.",
+            asset: "tailnet-resolver",
+            handler: "handler",
+            timeout: cdk.Duration.seconds(15),
+            vpc: props.vpc,
+            vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
+            allowPublicSubnet: true, // needs VPC DNS, not internet
+        });
+        if (props.trustedInvoker) {
+            // Lambda validates the principal exists — NetworkStack deploys first,
+            // and redeploy here if the reconciler role is ever recreated.
+            this.fn.addPermission("ReconcilerInvoke", {
+                principal: props.trustedInvoker,
+                action: "lambda:InvokeFunction",
+            });
+        }
+    }
+}
+exports.TailnetResolver = TailnetResolver;

package/dist/lib/constructs/target-account-trust.d.ts

@@ -0,0 +1,32 @@
+import { Construct } from "constructs";
+import * as iam from "aws-cdk-lib/aws-iam";
+import { TargetRoleSpec } from "./web-identity";
+export interface TargetAccountTrustProps {
+    /** The OIDC issuer URL served by the hub. */
+    readonly issuerUrl: string;
+    /** The roles to create here, each assumable via web identity. */
+    readonly roles: readonly TargetRoleSpec[];
+    /** Create the provider as a plain `AWS::IAM::OIDCProvider` instead of CDK's custom resource (a Lambda asset
+     *  that needs the bootstrap bucket). For the portable template only: switching a DEPLOYED stack would try to
+     *  create a second provider for the same issuer and fail. */
+    readonly nativeProvider?: boolean;
+}
+export interface TargetAccountTrust {
+    readonly provider: iam.IOpenIdConnectProvider;
+    readonly providerArn: string;
+    readonly roles: iam.Role[];
+}
+/** With `nativeProvider`: the L1 has no construct-level interface, only its ARN. */
+export interface NativeTargetAccountTrust {
+    readonly provider?: undefined;
+    readonly providerArn: string;
+    readonly roles: iam.Role[];
+}
+/** OIDC provider + one fixed-name role per spec, written into the CALLER's
+ *  scope (not a nested construct) so adopting it never replaces deployed resources. */
+export declare function addTargetAccountTrust(scope: Construct, props: TargetAccountTrustProps & {
+    nativeProvider: true;
+}): NativeTargetAccountTrust;
+export declare function addTargetAccountTrust(scope: Construct, props: TargetAccountTrustProps & {
+    nativeProvider?: false;
+}): TargetAccountTrust;

package/dist/lib/constructs/target-account-trust.js

@@ -0,0 +1,81 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addTargetAccountTrust = addTargetAccountTrust;
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const web_identity_1 = require("./web-identity");
+function addTargetAccountTrust(scope, props) {
+    let provider;
+    let providerArn;
+    let principalFor;
+    if (props.nativeProvider) {
+        const cfn = new iam.CfnOIDCProvider(scope, "IssuerProvider", {
+            url: props.issuerUrl,
+            clientIdList: ["sts.amazonaws.com"], // == AUDIENCE in the minted token
+        });
+        providerArn = cfn.attrArn;
+        principalFor = (roleName) => (0, web_identity_1.webIdentityPrincipalFor)(cfn.attrArn, (0, web_identity_1.issuerHost)(props.issuerUrl), roleName);
+    }
+    else {
+        provider = (0, web_identity_1.createIssuerProvider)(scope, "IssuerProvider", props.issuerUrl);
+        providerArn = provider.openIdConnectProviderArn;
+        const p = provider;
+        principalFor = (roleName) => (0, web_identity_1.webIdentityPrincipal)(p, roleName);
+    }
+    new cdk.CfnOutput(scope, "OidcProviderArn", { value: providerArn });
+    const roles = props.roles.map((spec) => {
+        const max = spec.maxSessionDuration ?? cdk.Duration.hours(12);
+        const maxSeconds = max.toSeconds();
+        if (maxSeconds < 3600 || maxSeconds > 43200) {
+            throw new Error(`Role "${spec.roleName}": maxSessionDuration must be between 1 and 12 hours (IAM limit), got ${maxSeconds}s`);
+        }
+        const wrapper = new constructs_1.Construct(scope, `Role-${spec.roleName}`);
+        const role = new iam.Role(wrapper, "Role", {
+            roleName: spec.roleName, // stable ARN for the hub's Roles catalog
+            assumedBy: principalFor(spec.roleName),
+            managedPolicies: [...spec.managedPolicies],
+            description: spec.description ??
+                "Assumed via web identity from the hub's credential-vending issuer.",
+            maxSessionDuration: max,
+        });
+        new cdk.CfnOutput(scope, `RoleArn-${spec.roleName}`, {
+            value: role.roleArn,
+        });
+        return role;
+    });
+    return provider ? { provider, providerArn, roles } : { providerArn, roles };
+}

package/dist/lib/constructs/vending-api.d.ts

@@ -0,0 +1,103 @@
+import type { ResolvedDevShares } from "../network-validation";
+import { Construct } from "constructs";
+import * as cognito from "aws-cdk-lib/aws-cognito";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as kms from "aws-cdk-lib/aws-kms";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import { AppFunction } from "./app-function";
+export interface VendingApiProps {
+    /** The data-layer tables (owned by DataStack), all read/write. */
+    readonly accountsTable: dynamodb.ITable;
+    readonly rolesTable: dynamodb.ITable;
+    readonly requestsTable: dynamodb.ITable;
+    /** Vend-event audit log — never part of an access decision. */
+    readonly auditTable: dynamodb.ITable;
+    readonly auditRetentionDays: number;
+    readonly groupsTable: dynamodb.ITable;
+    readonly resourcesTable: dynamodb.ITable;
+    readonly accessTable: dynamodb.ITable;
+    /** Revoked-access notices for the activity bell (informational only). */
+    readonly revocationsTable: dynamodb.ITable;
+    /** Service-user (M2M app client) registry. */
+    readonly serviceUsersTable: dynamodb.ITable;
+    /** Customer plugins, on: the catalog the API reads (absent env = an empty catalog) + discovery settings. */
+    readonly plugins?: {
+        readonly discoveryRefreshSeconds: number;
+        readonly catalogTable: dynamodb.ITable;
+    };
+    /** The OIDC signing key — the app calls kms:Sign to mint tokens. */
+    readonly signingKey: kms.IKey;
+    /** The public issuer URL, minted into every token's `iss` claim. */
+    readonly issuerUrl: string;
+    /** The pool whose ID tokens the auth middleware verifies, and whose users
+     *  the admin Users routes manage. */
+    readonly userPool: cognito.IUserPool;
+    /** The app's public origin (https://<web domain>) sign-up links are built on; absent = path-only links. */
+    readonly appUrl?: string;
+    /** Surfaced by the public discovery endpoint for desktop-app self-config. */
+    readonly userPoolClientId: string;
+    /** Surfaced by the discovery endpoint to label/brand the desktop tab. */
+    readonly projectName: string;
+    /** The handler's execution role — created by CredsStack so the issuer's
+     *  locked key policy can name it as the sole kms:Sign principal. */
+    readonly handlerRole: iam.IRole;
+    /** Site bucket (by-name contract, see web-stack webBucketName) — the
+     *  branding route writes /branding.json there. */
+    readonly webBucketName: string;
+    /** Private, short-lived: the access-report job writes CSVs here and the API hands out presigned links. */
+    readonly reportsBucket: s3.IBucket;
+    /** The report job function's fixed name (derives from `resourcePrefix`); the API invokes it by name. */
+    readonly reportJobFunctionName: string;
+    /** Whether the deployment sends email from its own domain (EmailConfig
+     *  present) — the setup checklist's "custom email" item reads it. */
+    readonly emailConfigured: boolean;
+    /** Sender address when emailConfigured — the setup checklist shows it. */
+    readonly emailFrom?: string;
+    /** Accounts named in the deploy config's rolesByAccount — the setup
+     *  checklist offers to register the ones not in the Accounts catalog yet. */
+    readonly configAccounts?: ReadonlyArray<{
+        readonly accountNumber: string;
+        readonly roles: readonly string[];
+    }>;
+    /** Enables /network. The key minter is invoked BY NAME so this construct
+     *  never references NetworkStack — deploy order stays free. */
+    readonly network?: {
+        readonly sites: ReadonlyArray<{
+            readonly id: string;
+            readonly displayName: string;
+            readonly controlUrl: string;
+            readonly accounts: readonly string[];
+            readonly splitDns?: Record<string, readonly string[]>;
+            readonly connectorVpcs?: Record<string, ReadonlyArray<{
+                readonly vpcId: string;
+                readonly routes: readonly string[];
+                readonly region?: string;
+                readonly name?: string;
+            }>>;
+        }>;
+        /** Device key-minter function name (derives from `resourcePrefix`). */
+        readonly keyMinterFnName: string;
+        /** ACL reconciler function name — invoked async by POST /admin/network/sync. */
+        readonly reconcilerFnName: string;
+        /** Enabled `network.devShares`; absent = creating shares answers 501. */
+        readonly devShares?: ResolvedDevShares;
+    };
+    /** Enabled `accountDimensions`; absent = registrations store no dims and lists carry none. */
+    readonly accountDimensions?: {
+        readonly enabled: boolean;
+        readonly labels: {
+            readonly tenant: string;
+            readonly project: string;
+            readonly stage: string;
+        };
+        readonly stages: Readonly<Record<string, string>>;
+    };
+}
+/** The Express vending app (lambdacode/api) in Lambda. Express owns routing
+ *  AND auth, so no authorizer is needed at the gateway. */
+export declare class VendingApi extends Construct {
+    /** The Express app's Lambda — front it with API Gateway. */
+    readonly handler: AppFunction;
+    constructor(scope: Construct, id: string, props: VendingApiProps);
+}