@mettlecast/domain-cdk-packer 0.2.0

package/dist/DomainStack.js

@@ -0,0 +1,567 @@
+import * as cdk from 'aws-cdk-lib';
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as apigwv2integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import * as apigwv2Authorizers from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
+import * as events from 'aws-cdk-lib/aws-events';
+import * as eventsTargets from 'aws-cdk-lib/aws-events-targets';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as scheduler from 'aws-cdk-lib/aws-scheduler';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { createGroupedLambdas } from './grouped-lambda-factory.js';
+import { IamPolicyBuilder } from './iam/iam-policy-builder.js';
+import { HealthConstruct } from './constructs/health-construct.js';
+import { DashboardConstruct } from './constructs/dashboard-construct.js';
+import { CmkConstruct } from './constructs/cmk-construct.js';
+import { WafConstruct } from './constructs/waf-construct.js';
+import { AlarmConstruct } from './constructs/alarm-construct.js';
+import { CanaryConstruct } from './constructs/canary-construct.js';
+/**
+ * Top-level CDK Stack that composes all domain constructs from a single DomainRegistry input.
+ * Uses grouped Lambdas for each primitive type to reduce deployment artifact size.
+ */
+export class DomainStack extends cdk.Stack {
+    /** Shared HTTP API for routing API and webhook requests. */
+    httpApi;
+    /** Map of primitive-type key to Lambda function ARN, used by FlowsStack for direct invocation. */
+    lambdaArns = {};
+    /**
+     * Create a new DomainStack instance.
+     * @param scope - Parent CDK scope.
+     * @param id - Stack identifier.
+     * @param props - Stack properties including domain registry and event bus ARN.
+     */
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { registry, eventBusArn, databaseUrl, dbSecretArn, userPoolArn, userPoolClientId, vpc, lambdaSg, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
+        const domainId = registry.domain.id;
+        const vpcProps = vpc ? { vpc, securityGroups: lambdaSg ? [lambdaSg] : undefined } : {};
+        const allowedOrigins = corsAllowedOrigins ?? ['*'];
+        this.httpApi = new apigwv2.HttpApi(this, 'HttpApi', {
+            apiName: `${domainId}-api`,
+            corsPreflight: {
+                allowHeaders: ['Content-Type', 'Authorization'],
+                allowMethods: [apigwv2.CorsHttpMethod.ANY],
+                allowOrigins: allowedOrigins,
+                ...(allowCredentials ? { allowCredentials: true } : {}),
+            },
+        });
+        // Wire Cognito JWT authorizer when user pool is provided
+        let jwtAuthorizer;
+        if (userPoolArn && userPoolClientId) {
+            const region = cdk.Stack.of(this).region;
+            const userPoolId = cdk.Fn.select(1, cdk.Fn.split('/', userPoolArn));
+            jwtAuthorizer = new apigwv2Authorizers.HttpJwtAuthorizer('CognitoAuthorizer', `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`, {
+                jwtAudience: [userPoolClientId],
+            });
+        }
+        // Optional WAF
+        if (enableWaf) {
+            new WafConstruct(this, 'Waf', { domainId, httpApi: this.httpApi });
+        }
+        // Optional CMK — customer-managed encryption key for DynamoDB, S3, SQS
+        let cmkKey;
+        if (enableCmk) {
+            const cmk = new CmkConstruct(this, 'Cmk', { domainId });
+            cmkKey = cmk.key;
+        }
+        const iamBuilder = new IamPolicyBuilder();
+        const eventBus = events.EventBus.fromEventBusArn(this, 'TibEventBus', eventBusArn);
+        // Build common environment for all Lambdas
+        const environment = {
+            TIB_DOMAIN_ID: domainId,
+            TIB_EVENT_BUS_ARN: eventBusArn,
+        };
+        if (databaseUrl) {
+            environment.DATABASE_URL = databaseUrl;
+        }
+        if (dbSecretArn) {
+            environment.DB_SECRET_ARN = dbSecretArn;
+        }
+        // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key
+        const domainTable = new dynamodb.Table(this, 'DomainTable', {
+            tableName: `tib-${domainId}`,
+            partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
+            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            encryption: enableCmk ? dynamodb.TableEncryption.CUSTOMER_MANAGED : dynamodb.TableEncryption.AWS_MANAGED,
+            encryptionKey: cmkKey,
+            timeToLiveAttribute: 'expiresAt',
+            removalPolicy: cdk.RemovalPolicy.RETAIN,
+            pointInTimeRecovery: true,
+        });
+        // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime
+        const bucketName = `tib-${domainId}`.length <= 63
+            ? `tib-${domainId}`
+            : `tib-${domainId.slice(0, 55)}-${cdk.Fn.select(0, cdk.Fn.split('-', cdk.Names.uniqueId(this))).toLowerCase()}`;
+        const domainBucket = new s3.Bucket(this, 'DomainBucket', {
+            bucketName,
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+            encryption: enableCmk ? s3.BucketEncryption.KMS : s3.BucketEncryption.S3_MANAGED,
+            encryptionKey: cmkKey,
+            versioned: true,
+            enforceSSL: true,
+            removalPolicy: cdk.RemovalPolicy.RETAIN,
+            lifecycleRules: [{
+                    noncurrentVersionExpiration: cdk.Duration.days(90),
+                }],
+        });
+        environment['DOMAIN_TABLE_NAME'] = domainTable.tableName;
+        environment['DOMAIN_BUCKET_NAME'] = domainBucket.bucketName;
+        // Per-domain tenant-scoped IAM role for defence-in-depth storage segregation
+        const tenantScopedRole = new iam.Role(this, 'DomainTenantScopedRole', {
+            roleName: `tib-${domainId}-tenant-scoped`,
+            assumedBy: new iam.AccountPrincipal(cdk.Stack.of(this).account),
+            description: `Tenant-scoped role for ${domainId} domain. Only assumable with tenantId session tag.`,
+            maxSessionDuration: cdk.Duration.hours(1),
+        });
+        environment['DOMAIN_TENANT_ROLE_ARN'] = tenantScopedRole.roleArn;
+        // Pre-declare lambda group variables
+        let apiLambdas = [];
+        let webhookLambdas = [];
+        let subscriberLambdas = [];
+        let scheduleLambdas = [];
+        let jobLambdas = [];
+        let actionLambdas = [];
+        // Track all DLQs for alarm construct
+        const allDlqs = [];
+        // Deploy API endpoints as grouped Lambdas
+        if (registry.apis.length > 0) {
+            apiLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'api',
+                handlerEntries: registry.apis.map(api => ({
+                    id: api.id,
+                    handlerFile: api.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.apis.some(api => api.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-api`] = apiLambdas[0].functionArn;
+            // Wire each API Lambda to the HttpApi
+            const iamPolicies = iamBuilder.forApi();
+            apiLambdas.forEach((fn) => {
+                iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
+            });
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                apiLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+            // Add routes for each API entry
+            for (const api of registry.apis) {
+                const fn = apiLambdas[0]; // Grouped Lambda or first dedicated
+                const apiRouteBase = {
+                    path: api.path,
+                    methods: [toHttpMethod(api.method)],
+                    integration: new apigwv2integrations.HttpLambdaIntegration(`Apis${toPascalCase(api.id)}Integration`, fn),
+                };
+                let apiRoute;
+                if (api.authType === 'jwt' && jwtAuthorizer) {
+                    apiRoute = { ...apiRouteBase, authorizer: jwtAuthorizer };
+                }
+                else if (api.authType === 'api-key') {
+                    // TODO(#1785): wire HttpApiKeyAuthorizer
+                    apiRoute = apiRouteBase;
+                }
+                else {
+                    apiRoute = apiRouteBase;
+                }
+                this.httpApi.addRoutes(apiRoute);
+            }
+        }
+        // Deploy webhooks as grouped Lambdas
+        if (registry.webhooks.length > 0) {
+            // Create shared dedupe table for webhooks
+            const dedupeTable = new dynamodb.Table(this, 'WebhookDedupeTable', {
+                partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+                billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+                timeToLiveAttribute: 'expiresAt',
+                removalPolicy: cdk.RemovalPolicy.DESTROY,
+            });
+            webhookLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'webhook',
+                handlerEntries: registry.webhooks.map(webhook => ({
+                    id: webhook.id,
+                    handlerFile: webhook.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.webhooks.some(webhook => webhook.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-webhook`] = webhookLambdas[0].functionArn;
+            // Wire each webhook Lambda to the HttpApi
+            const iamPolicies = iamBuilder.forWebhook({ dedupeTableArn: dedupeTable.tableArn });
+            webhookLambdas.forEach((fn) => {
+                iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
+                dedupeTable.grantReadWriteData(fn);
+            });
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                webhookLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+            // Add routes for each webhook entry
+            for (const webhook of registry.webhooks) {
+                const fn = webhookLambdas[0]; // Grouped Lambda or first dedicated
+                this.httpApi.addRoutes({
+                    path: webhook.path,
+                    methods: [apigwv2.HttpMethod.POST],
+                    integration: new apigwv2integrations.HttpLambdaIntegration(`Webhooks${toPascalCase(webhook.id)}Integration`, fn),
+                });
+            }
+        }
+        // Deploy event subscribers as grouped Lambdas
+        if (registry.subscribers.length > 0) {
+            subscriberLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'subscriber',
+                handlerEntries: registry.subscribers.map(subscriber => ({
+                    id: subscriber.id,
+                    handlerFile: subscriber.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.subscribers.some(subscriber => subscriber.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-subscriber`] = subscriberLambdas[0].functionArn;
+            // Wire EventBridge → SQS → Lambda for each subscriber
+            for (const subscriber of registry.subscribers) {
+                const pascalId = toPascalCase(subscriber.id);
+                // Create dead-letter queue
+                const dlq = new sqs.Queue(this, `${pascalId}Dlq`, {
+                    retentionPeriod: cdk.Duration.days(14),
+                    encryption: enableCmk ? sqs.QueueEncryption.KMS : sqs.QueueEncryption.SQS_MANAGED,
+                    encryptionMasterKey: enableCmk ? cmkKey : undefined,
+                });
+                allDlqs.push(dlq);
+                // Create main queue with dead-letter queue configuration
+                const queue = new sqs.Queue(this, `${pascalId}Queue`, {
+                    visibilityTimeout: cdk.Duration.seconds(180),
+                    deadLetterQueue: {
+                        queue: dlq,
+                        maxReceiveCount: 5,
+                    },
+                    encryption: enableCmk ? sqs.QueueEncryption.KMS : sqs.QueueEncryption.SQS_MANAGED,
+                    encryptionMasterKey: enableCmk ? cmkKey : undefined,
+                });
+                // Add SQS as event source for the first grouped Lambda
+                const fn = subscriberLambdas[0];
+                fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
+                    batchSize: 10,
+                    maxConcurrency: subscriber.concurrency ?? 5,
+                }));
+                // Grant IAM permissions for this queue
+                const queuePolicies = iamBuilder.forSubscriber({ queueArn: queue.queueArn, dlqArn: dlq.queueArn });
+                queuePolicies.forEach(statement => fn.addToRolePolicy(statement));
+                // Create EventBridge rule targeting SQS queue
+                new events.Rule(this, `${pascalId}Rule`, {
+                    eventBus,
+                    eventPattern: { detailType: [subscriber.event] },
+                    targets: [new eventsTargets.SqsQueue(queue)],
+                });
+            }
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                subscriberLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+        }
+        // Deploy scheduled tasks as grouped Lambdas
+        if (registry.schedules.length > 0) {
+            scheduleLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'schedule',
+                handlerEntries: registry.schedules.map(schedule => ({
+                    id: schedule.id,
+                    handlerFile: schedule.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.schedules.some(schedule => schedule.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-schedule`] = scheduleLambdas[0].functionArn;
+            const iamPolicies = iamBuilder.forSchedule();
+            scheduleLambdas.forEach((fn) => {
+                iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
+            });
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                scheduleLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+            // Wire EventBridge Scheduler rules to Lambda
+            for (const schedule of registry.schedules) {
+                const pascalId = toPascalCase(schedule.id);
+                const fn = scheduleLambdas[0]; // Grouped Lambda or first dedicated
+                // Create a dedicated IAM role for the EventBridge Scheduler to assume
+                const schedulerRole = new iam.Role(this, `${pascalId}SchedulerRole`, {
+                    assumedBy: new iam.ServicePrincipal('scheduler.amazonaws.com'),
+                });
+                // Grant the scheduler role permission to invoke the Lambda
+                fn.grantInvoke(schedulerRole);
+                // Create the EventBridge Scheduler rule
+                new scheduler.CfnSchedule(this, `${pascalId}Schedule`, {
+                    scheduleExpression: schedule.cron,
+                    flexibleTimeWindow: { mode: 'OFF' },
+                    state: schedule.enabled ? 'ENABLED' : 'DISABLED',
+                    target: {
+                        arn: fn.functionArn,
+                        roleArn: schedulerRole.roleArn,
+                        input: JSON.stringify({}),
+                    },
+                });
+            }
+        }
+        // Deploy background jobs as grouped Lambdas
+        if (registry.jobs.length > 0) {
+            jobLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'job',
+                handlerEntries: registry.jobs.map(job => ({
+                    id: job.id,
+                    handlerFile: job.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.jobs.some(job => job.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-job`] = jobLambdas[0].functionArn;
+            // Wire SQS → Lambda for each job
+            for (const job of registry.jobs) {
+                const pascalId = toPascalCase(job.id);
+                // Create dead-letter queue
+                const dlq = new sqs.Queue(this, `${pascalId}JobDlq`, {
+                    retentionPeriod: cdk.Duration.days(14),
+                    encryption: enableCmk ? sqs.QueueEncryption.KMS : sqs.QueueEncryption.SQS_MANAGED,
+                    encryptionMasterKey: enableCmk ? cmkKey : undefined,
+                });
+                allDlqs.push(dlq);
+                // Create main queue with dead-letter queue configuration
+                const queue = new sqs.Queue(this, `${pascalId}JobQueue`, {
+                    visibilityTimeout: cdk.Duration.seconds(job.visibilityTimeoutSeconds),
+                    deadLetterQueue: {
+                        queue: dlq,
+                        maxReceiveCount: 5,
+                    },
+                    encryption: enableCmk ? sqs.QueueEncryption.KMS : sqs.QueueEncryption.SQS_MANAGED,
+                    encryptionMasterKey: enableCmk ? cmkKey : undefined,
+                });
+                // Add SQS as event source for the first grouped Lambda
+                const fn = jobLambdas[0];
+                fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
+                    batchSize: 1,
+                }));
+                // Grant IAM permissions for this queue
+                const queuePolicies = iamBuilder.forJob({ queueArn: queue.queueArn, dlqArn: dlq.queueArn });
+                queuePolicies.forEach(statement => fn.addToRolePolicy(statement));
+            }
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                jobLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+        }
+        // Deploy callable actions as grouped Lambdas
+        if (registry.actions.length > 0) {
+            const actionLambdas = createGroupedLambdas(this, {
+                domainId,
+                primitiveType: 'action',
+                handlerEntries: registry.actions.map(action => ({
+                    id: action.id,
+                    handlerFile: action.handlerFile,
+                })),
+                environment,
+                eventBusArn,
+                dedicated: registry.actions.some(action => action.deployment?.isolation === 'dedicated'),
+                reservedConcurrency,
+                logRetentionDays: logRetentionDays ?? 30,
+                ...vpcProps,
+            });
+            this.lambdaArns[`${domainId}-action`] = actionLambdas[0].functionArn;
+            const iamPolicies = iamBuilder.forAction([
+                `arn:aws:lambda:${this.region}:${this.account}:function:TIB-*-domain-*-action-*`,
+            ]);
+            actionLambdas.forEach((fn) => {
+                iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
+            });
+            // Add dbSecretArn grant if provided
+            if (dbSecretArn) {
+                actionLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [dbSecretArn],
+                })));
+            }
+        }
+        // Grant all domain Lambdas read/write access to the per-domain table and bucket
+        const allDomainLambdas = [
+            ...apiLambdas, ...webhookLambdas, ...subscriberLambdas,
+            ...scheduleLambdas, ...jobLambdas, ...actionLambdas,
+        ];
+        for (const fn of allDomainLambdas) {
+            domainTable.grantReadWriteData(fn);
+            domainBucket.grantReadWrite(fn);
+        }
+        // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
+        const cfnRole = tenantScopedRole.node.defaultChild;
+        cfnRole.assumeRolePolicyDocument = cdk.Lazy.any({
+            produce: () => ({
+                Version: '2012-10-17',
+                Statement: allDomainLambdas.map(fn => ({
+                    Effect: 'Allow',
+                    Principal: { AWS: fn.role.roleArn },
+                    Action: ['sts:AssumeRole', 'sts:TagSession'],
+                    Condition: {
+                        StringLike: { 'aws:RequestTag/tenantId': '*' },
+                        'ForAllValues:StringEquals': { 'sts:TransitiveTagKeys': ['tenantId'] },
+                    },
+                })),
+            }),
+        });
+        // Attach tenant-scoped storage policy to the tenant-scoped role
+        const tenantStoragePolicies = iamBuilder.forTenantScopedStorage({
+            tableArn: domainTable.tableArn,
+            bucketArn: domainBucket.bucketArn,
+        });
+        tenantStoragePolicies.forEach(statement => tenantScopedRole.addToPolicy(statement));
+        // Grant each Lambda execution role permission to assume the tenant-scoped role
+        allDomainLambdas.forEach(fn => {
+            fn.role.addToPrincipalPolicy(new iam.PolicyStatement({
+                actions: ['sts:AssumeRole', 'sts:TagSession'],
+                resources: [tenantScopedRole.roleArn],
+            }));
+        });
+        // Optional CloudWatch alarms
+        let alarmConstruct;
+        if (enableAlarms) {
+            alarmConstruct = new AlarmConstruct(this, 'Alarms', {
+                domainId,
+                lambdaFunctions: allDomainLambdas,
+                dlqs: allDlqs,
+                snsTopicArn: alarmSnsTopicArn,
+            });
+        }
+        // Optional canary deployments — 10% traffic shift, auto-rollback on alarm breach
+        // Note: requires enableAlarms to be true for auto-rollback to work
+        if (enableCanaryDeploy) {
+            new CanaryConstruct(this, 'Canary', {
+                domainId,
+                lambdaFunctions: allDomainLambdas,
+                rollbackAlarms: alarmConstruct?.alarms ?? [],
+            });
+        }
+        // Deploy built-in health and readiness checks
+        const healthConstruct = new HealthConstruct(this, 'Health', {
+            domainId,
+            environment: {
+                EVENT_BUS_ARN: eventBusArn,
+                DB_SECRET_ARN: dbSecretArn ?? '',
+            },
+        });
+        this.httpApi.addRoutes({
+            path: '/_health',
+            methods: [apigwv2.HttpMethod.GET],
+            integration: new apigwv2integrations.HttpLambdaIntegration('HealthIntegration', healthConstruct.healthFn),
+        });
+        this.httpApi.addRoutes({
+            path: '/_ready',
+            methods: [apigwv2.HttpMethod.GET],
+            integration: new apigwv2integrations.HttpLambdaIntegration('ReadyIntegration', healthConstruct.readyFn),
+        });
+        // Create CloudWatch dashboard for all primitives
+        const allEndpoints = [
+            ...registry.apis.map(a => ({ id: a.id, primitiveClass: 'api' })),
+            ...registry.actions.map(a => ({ id: a.id, primitiveClass: 'action' })),
+            ...registry.subscribers.map(s => ({ id: s.id, primitiveClass: 'subscriber' })),
+            ...registry.jobs.map(j => ({ id: j.id, primitiveClass: 'job' })),
+            ...registry.webhooks.map(w => ({ id: w.id, primitiveClass: 'webhook' })),
+            ...registry.schedules.map(sc => ({ id: sc.id, primitiveClass: 'schedule' })),
+        ];
+        new DashboardConstruct(this, 'Dashboard', {
+            domainId,
+            envCode: this.stackName.split('-')[1] ?? 'dev',
+            endpoints: allEndpoints,
+        });
+        new cdk.CfnOutput(this, 'DomainTableName', {
+            value: domainTable.tableName,
+            description: 'Per-domain DynamoDB table name',
+        });
+        new cdk.CfnOutput(this, 'DomainBucketName', {
+            value: domainBucket.bucketName,
+            description: 'Per-domain S3 bucket name',
+        });
+        new cdk.CfnOutput(this, 'HttpApiUrl', {
+            value: this.httpApi.apiEndpoint,
+            description: 'Domain HTTP API endpoint',
+        });
+        new cdk.CfnOutput(this, 'DomainTenantScopedRoleArn', {
+            value: tenantScopedRole.roleArn,
+            description: 'Per-domain tenant-scoped IAM role ARN',
+        });
+    }
+}
+/**
+ * Convert kebab-case or snake_case string to PascalCase.
+ * @param s - Input string.
+ * @returns PascalCase string.
+ */
+function toPascalCase(s) {
+    return s
+        .split(/[-_]/)
+        .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))
+        .join('');
+}
+/**
+ * Convert HTTP method string to ApiGatewayV2 HttpMethod enum.
+ * @param method - HTTP method string (e.g., 'GET', 'POST').
+ * @returns HttpMethod enum value.
+ */
+function toHttpMethod(method) {
+    switch (method.toUpperCase()) {
+        case 'GET':
+            return apigwv2.HttpMethod.GET;
+        case 'POST':
+            return apigwv2.HttpMethod.POST;
+        case 'PUT':
+            return apigwv2.HttpMethod.PUT;
+        case 'PATCH':
+            return apigwv2.HttpMethod.PATCH;
+        case 'DELETE':
+            return apigwv2.HttpMethod.DELETE;
+        case 'HEAD':
+            return apigwv2.HttpMethod.HEAD;
+        case 'OPTIONS':
+            return apigwv2.HttpMethod.OPTIONS;
+        default:
+            return apigwv2.HttpMethod.ANY;
+    }
+}

package/dist/__tests__/domain-stack.test.d.ts

@@ -0,0 +1 @@
+export {};