@mettlecast/domain-cdk-packer 0.2.0

package/dist/grouped-lambda-factory.d.ts

@@ -0,0 +1,43 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+/** Primitive types that can be grouped into a single Lambda. */
+export type PrimitiveType = 'api' | 'subscriber' | 'schedule' | 'job' | 'webhook' | 'action';
+/** A single handler entry within a grouped Lambda. */
+export interface HandlerEntry {
+    /** Unique handler ID within the domain + primitive type. */
+    id: string;
+    /** Path to the handler file relative to the domain's dist directory. */
+    handlerFile: string;
+}
+/** Props for creating grouped or dedicated Lambdas for a primitive type. */
+export interface GroupedLambdaProps {
+    /** Domain ID this Lambda belongs to. */
+    domainId: string;
+    /** The primitive type being handled (api, subscriber, etc.). */
+    primitiveType: PrimitiveType;
+    /** All handler entries for this primitive type within the domain. */
+    handlerEntries: HandlerEntry[];
+    /** Environment variables injected into the Lambda(s). */
+    environment: Record<string, string>;
+    /** ARN of the project-scoped EventBridge bus. */
+    eventBusArn: string;
+    /** VPC to place Lambdas in — required for Aurora connectivity. */
+    vpc?: ec2.IVpc;
+    /** Security groups to attach to the Lambda(s). */
+    securityGroups?: ec2.ISecurityGroup[];
+    /** When true, creates one dedicated Lambda per handler instead of a single grouped Lambda. */
+    dedicated?: boolean;
+    /** Reserved concurrency for all Lambdas in this group. If omitted, no limit. */
+    reservedConcurrency?: number;
+    /** Log retention in days. Default: 30. */
+    logRetentionDays?: number;
+}
+/**
+ * Creates either a single grouped Lambda (default) or per-handler dedicated Lambdas.
+ *
+ * Grouped Lambdas use an internal dispatch router: TIB_HANDLER_MAP lists all handler IDs,
+ * and the incoming event/request carries a handler ID to route to the correct function.
+ * When dedicated=true (escape hatch for hot/critical handlers), each handler gets its own Lambda.
+ */
+export declare function createGroupedLambdas(scope: Construct, props: GroupedLambdaProps): lambda.Function[];

package/dist/grouped-lambda-factory.js

@@ -0,0 +1,71 @@
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as cdk from 'aws-cdk-lib';
+/**
+ * Creates either a single grouped Lambda (default) or per-handler dedicated Lambdas.
+ *
+ * Grouped Lambdas use an internal dispatch router: TIB_HANDLER_MAP lists all handler IDs,
+ * and the incoming event/request carries a handler ID to route to the correct function.
+ * When dedicated=true (escape hatch for hot/critical handlers), each handler gets its own Lambda.
+ */
+export function createGroupedLambdas(scope, props) {
+    const vpcConfig = props.vpc ? { vpc: props.vpc, securityGroups: props.securityGroups } : {};
+    const logRetention = toLogRetention(props.logRetentionDays ?? 30);
+    const powertoolsLayerArn = `arn:aws:lambda:${cdk.Stack.of(scope).region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:26`;
+    if (props.dedicated) {
+        return props.handlerEntries.map(entry => {
+            const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}-${entry.id}`, powertoolsLayerArn);
+            return new lambda.Function(scope, `${props.domainId}-${props.primitiveType}-${entry.id}`, {
+                runtime: lambda.Runtime.NODEJS_22_X,
+                architecture: lambda.Architecture.ARM_64,
+                handler: 'index.handler',
+                code: lambda.Code.fromAsset(`dist/domains/${props.domainId}/${props.primitiveType}/${entry.id}`),
+                layers: [powertoolsLayer],
+                environment: {
+                    ...props.environment,
+                    POWERTOOLS_SERVICE_NAME: `${props.domainId}-${props.primitiveType}`,
+                    POWERTOOLS_LOG_LEVEL: 'INFO',
+                    TIB_HANDLER_ID: entry.id,
+                    TIB_EVENT_BUS_ARN: props.eventBusArn,
+                },
+                timeout: cdk.Duration.seconds(30),
+                memorySize: 256,
+                reservedConcurrentExecutions: props.reservedConcurrency,
+                logRetention,
+                ...vpcConfig,
+            });
+        });
+    }
+    // Single grouped Lambda — all handlers for this primitive type bundled together
+    const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}`, powertoolsLayerArn);
+    return [
+        new lambda.Function(scope, `${props.domainId}-${props.primitiveType}`, {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            architecture: lambda.Architecture.ARM_64,
+            handler: 'index.handler',
+            code: lambda.Code.fromAsset(`dist/domains/${props.domainId}/${props.primitiveType}`),
+            layers: [powertoolsLayer],
+            environment: {
+                ...props.environment,
+                POWERTOOLS_SERVICE_NAME: `${props.domainId}-${props.primitiveType}`,
+                POWERTOOLS_LOG_LEVEL: 'INFO',
+                TIB_HANDLER_MAP: JSON.stringify(props.handlerEntries.map(e => e.id)),
+                TIB_EVENT_BUS_ARN: props.eventBusArn,
+            },
+            timeout: cdk.Duration.seconds(30),
+            memorySize: 256,
+            reservedConcurrentExecutions: props.reservedConcurrency,
+            logRetention,
+            ...vpcConfig,
+        }),
+    ];
+}
+function toLogRetention(days) {
+    const map = {
+        30: logs.RetentionDays.ONE_MONTH,
+        90: logs.RetentionDays.THREE_MONTHS,
+        365: logs.RetentionDays.ONE_YEAR,
+        2557: logs.RetentionDays.SEVEN_YEARS,
+    };
+    return map[days] ?? logs.RetentionDays.ONE_MONTH;
+}

package/dist/iam/iam-policy-builder.d.ts

@@ -0,0 +1,95 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import type { RegistryEntryKind } from '../registry.js';
+/**
+ * Parameters for webhook IAM policy construction.
+ */
+export interface WebhookPolicyParams {
+    /** ARN of the DynamoDB deduplication table. */
+    dedupeTableArn: string;
+}
+/**
+ * Parameters for queue-based IAM policy construction (subscriber and job).
+ */
+export interface QueuePolicyParams {
+    /** ARN of the SQS queue. */
+    queueArn: string;
+    /** ARN of the SQS dead-letter queue. */
+    dlqArn: string;
+}
+/**
+ * Parameters for storage IAM policy construction.
+ */
+export interface StoragePolicyParams {
+    /** ARN of the DynamoDB table. */
+    tableArn: string;
+    /** ARN of the S3 bucket. */
+    bucketArn: string;
+}
+/**
+ * Generates least-privilege IAM policy statements per handler kind.
+ * Used by CDK constructs to build policies for Lambda execution roles.
+ */
+export declare class IamPolicyBuilder {
+    /**
+     * Returns IAM policy statements for API handlers.
+     * @returns Array of policy statements for Secrets Manager and EventBridge access.
+     */
+    forApi(): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for webhook handlers.
+     * @param params - Webhook policy parameters including deduplication table ARN.
+     * @returns Array of policy statements for Secrets Manager, DynamoDB, and EventBridge access.
+     */
+    forWebhook(params: WebhookPolicyParams): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for event subscriber handlers.
+     * @param params - Queue policy parameters including queue and dead-letter queue ARNs.
+     * @returns Array of policy statements for SQS message receive/delete and DLQ send access.
+     */
+    forSubscriber(params: QueuePolicyParams): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for schedule (cron) handlers.
+     * @returns Array of policy statements for EventBridge and Secrets Manager access.
+     */
+    forSchedule(): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for background job handlers.
+     * @param params - Queue policy parameters including queue and dead-letter queue ARNs.
+     * @returns Array of policy statements for SQS message receive/delete and DLQ send access.
+     */
+    forJob(params: QueuePolicyParams): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for callable action handlers.
+     * @param crossDomainActionArns - Optional ARNs of other domain action Lambdas to invoke.
+     * @returns Array of policy statements for Secrets Manager and Lambda invoke access.
+     */
+    forAction(crossDomainActionArns?: string[]): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for storage (DynamoDB table and S3 bucket).
+     * @param params - Storage policy parameters including table and bucket ARNs.
+     * @returns Array of policy statements for DynamoDB and S3 access.
+     */
+    forStorage(params: StoragePolicyParams): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for the per-domain tenant-scoped role.
+     * These statements use ${aws:PrincipalTag/tenantId} conditions to restrict
+     * access to the current session's tenant only.
+     * @param params - Storage policy parameters including table and bucket ARNs.
+     * @returns Array of IAM policy statements with PrincipalTag conditions.
+     */
+    forTenantScopedStorage(params: StoragePolicyParams): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements for Step Functions flow execution roles.
+     * Grants lambda:InvokeFunction on each domain-action Lambda the flow invokes.
+     * @param actionArns - Unique list of Lambda ARNs referenced by the flow's domain-action steps.
+     * @returns Array of policy statements (empty if no action ARNs).
+     */
+    forFlow(actionArns: string[]): iam.PolicyStatement[];
+    /**
+     * Returns IAM policy statements based on handler kind.
+     * @param kind - The registry entry kind discriminant.
+     * @param params - Optional parameters required for certain kinds (webhook, subscriber, job).
+     * @returns Array of policy statements appropriate for the handler kind.
+     */
+    forKind(kind: RegistryEntryKind, params?: WebhookPolicyParams | QueuePolicyParams): iam.PolicyStatement[];
+}

package/dist/iam/iam-policy-builder.js

@@ -0,0 +1,232 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+/**
+ * Generates least-privilege IAM policy statements per handler kind.
+ * Used by CDK constructs to build policies for Lambda execution roles.
+ */
+export class IamPolicyBuilder {
+    /**
+     * Returns IAM policy statements for API handlers.
+     * @returns Array of policy statements for Secrets Manager and EventBridge access.
+     */
+    forApi() {
+        return [
+            new iam.PolicyStatement({
+                actions: ['secretsmanager:GetSecretValue'],
+                resources: ['*'],
+            }),
+            new iam.PolicyStatement({
+                actions: ['events:PutEvents'],
+                resources: ['*'],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for webhook handlers.
+     * @param params - Webhook policy parameters including deduplication table ARN.
+     * @returns Array of policy statements for Secrets Manager, DynamoDB, and EventBridge access.
+     */
+    forWebhook(params) {
+        return [
+            new iam.PolicyStatement({
+                actions: ['secretsmanager:GetSecretValue'],
+                resources: ['*'],
+            }),
+            new iam.PolicyStatement({
+                actions: ['dynamodb:PutItem', 'dynamodb:GetItem', 'dynamodb:DeleteItem'],
+                resources: [params.dedupeTableArn],
+            }),
+            new iam.PolicyStatement({
+                actions: ['events:PutEvents'],
+                resources: ['*'],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for event subscriber handlers.
+     * @param params - Queue policy parameters including queue and dead-letter queue ARNs.
+     * @returns Array of policy statements for SQS message receive/delete and DLQ send access.
+     */
+    forSubscriber(params) {
+        return [
+            new iam.PolicyStatement({
+                actions: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],
+                resources: [params.queueArn],
+            }),
+            new iam.PolicyStatement({
+                actions: ['sqs:SendMessage'],
+                resources: [params.dlqArn],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for schedule (cron) handlers.
+     * @returns Array of policy statements for EventBridge and Secrets Manager access.
+     */
+    forSchedule() {
+        return [
+            new iam.PolicyStatement({
+                actions: ['events:PutEvents'],
+                resources: ['*'],
+            }),
+            new iam.PolicyStatement({
+                actions: ['secretsmanager:GetSecretValue'],
+                resources: ['*'],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for background job handlers.
+     * @param params - Queue policy parameters including queue and dead-letter queue ARNs.
+     * @returns Array of policy statements for SQS message receive/delete and DLQ send access.
+     */
+    forJob(params) {
+        return [
+            new iam.PolicyStatement({
+                actions: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],
+                resources: [params.queueArn],
+            }),
+            new iam.PolicyStatement({
+                actions: ['sqs:SendMessage'],
+                resources: [params.dlqArn],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for callable action handlers.
+     * @param crossDomainActionArns - Optional ARNs of other domain action Lambdas to invoke.
+     * @returns Array of policy statements for Secrets Manager and Lambda invoke access.
+     */
+    forAction(crossDomainActionArns) {
+        const statements = [
+            new iam.PolicyStatement({
+                actions: ['secretsmanager:GetSecretValue'],
+                resources: ['*'],
+            }),
+        ];
+        if (crossDomainActionArns && crossDomainActionArns.length > 0) {
+            statements.push(new iam.PolicyStatement({
+                actions: ['lambda:InvokeFunction'],
+                resources: crossDomainActionArns,
+            }));
+        }
+        return statements;
+    }
+    /**
+     * Returns IAM policy statements for storage (DynamoDB table and S3 bucket).
+     * @param params - Storage policy parameters including table and bucket ARNs.
+     * @returns Array of policy statements for DynamoDB and S3 access.
+     */
+    forStorage(params) {
+        return [
+            new iam.PolicyStatement({
+                actions: ['dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:DeleteItem', 'dynamodb:Query', 'dynamodb:UpdateItem'],
+                resources: [params.tableArn, `${params.tableArn}/index/*`],
+            }),
+            new iam.PolicyStatement({
+                actions: ['s3:GetObject', 's3:PutObject', 's3:DeleteObject'],
+                resources: [`${params.bucketArn}/*`],
+            }),
+            new iam.PolicyStatement({
+                actions: ['s3:ListBucket'],
+                resources: [params.bucketArn],
+            }),
+            new iam.PolicyStatement({
+                actions: ['s3:GetBucketLocation'],
+                resources: [params.bucketArn],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for the per-domain tenant-scoped role.
+     * These statements use ${aws:PrincipalTag/tenantId} conditions to restrict
+     * access to the current session's tenant only.
+     * @param params - Storage policy parameters including table and bucket ARNs.
+     * @returns Array of IAM policy statements with PrincipalTag conditions.
+     */
+    forTenantScopedStorage(params) {
+        return [
+            // DynamoDB item-level operations — restricted to current tenant's PK
+            new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
+                actions: [
+                    'dynamodb:GetItem',
+                    'dynamodb:PutItem',
+                    'dynamodb:DeleteItem',
+                    'dynamodb:UpdateItem',
+                    'dynamodb:Query',
+                ],
+                resources: [params.tableArn, `${params.tableArn}/index/*`],
+                conditions: {
+                    'ForAllValues:StringEquals': {
+                        'dynamodb:LeadingKeys': ['${aws:PrincipalTag/tenantId}'],
+                    },
+                },
+            }),
+            // S3 object operations — restricted to current tenant's prefix
+            new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
+                actions: ['s3:GetObject', 's3:PutObject', 's3:DeleteObject'],
+                resources: [`${params.bucketArn}/\${aws:PrincipalTag/tenantId}/*`],
+            }),
+            // S3 bucket-level — list restricted to current tenant's prefix
+            new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
+                actions: ['s3:ListBucket'],
+                resources: [params.bucketArn],
+                conditions: {
+                    StringLike: {
+                        's3:prefix': ['${aws:PrincipalTag/tenantId}/*'],
+                    },
+                },
+            }),
+            // S3 bucket location (no tenant scope needed; metadata-only)
+            new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
+                actions: ['s3:GetBucketLocation'],
+                resources: [params.bucketArn],
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements for Step Functions flow execution roles.
+     * Grants lambda:InvokeFunction on each domain-action Lambda the flow invokes.
+     * @param actionArns - Unique list of Lambda ARNs referenced by the flow's domain-action steps.
+     * @returns Array of policy statements (empty if no action ARNs).
+     */
+    forFlow(actionArns) {
+        if (actionArns.length === 0)
+            return [];
+        return [
+            new iam.PolicyStatement({
+                actions: ['lambda:InvokeFunction'],
+                resources: actionArns,
+            }),
+        ];
+    }
+    /**
+     * Returns IAM policy statements based on handler kind.
+     * @param kind - The registry entry kind discriminant.
+     * @param params - Optional parameters required for certain kinds (webhook, subscriber, job).
+     * @returns Array of policy statements appropriate for the handler kind.
+     */
+    forKind(kind, params) {
+        switch (kind) {
+            case 'integration':
+            case 'event':
+            case 'domain':
+                return [];
+            case 'webhook':
+                return this.forWebhook(params);
+            case 'subscriber':
+                return this.forSubscriber(params);
+            case 'job':
+                return this.forJob(params);
+            case 'api':
+                return this.forApi();
+            case 'schedule':
+                return this.forSchedule();
+            case 'action':
+                return this.forAction();
+        }
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+export type { DomainRegistry, RegistryEntry, RegistryEntryKind, BaseRegistryEntry, SerialDeploymentConfig, ApiRegistryEntry, ApiVersionSnapshot, WebhookRegistryEntry, SubscriberRegistryEntry, ScheduleRegistryEntry, JobRegistryEntry, ActionRegistryEntry, IntegrationRegistryEntry, EventRegistryEntry, DomainRegistryEntry, SchemaSnapshot, } from './registry.js';
+export { LambdaFactory } from './lambda-factory.js';
+export type { LambdaFactoryProps } from './lambda-factory.js';
+export { createGroupedLambdas } from './grouped-lambda-factory.js';
+export type { PrimitiveType, HandlerEntry, GroupedLambdaProps } from './grouped-lambda-factory.js';
+export { IamPolicyBuilder } from './iam/iam-policy-builder.js';
+export type { WebhookPolicyParams, QueuePolicyParams } from './iam/iam-policy-builder.js';
+export { ApiConstruct } from './constructs/api-construct.js';
+export type { ApiConstructProps } from './constructs/api-construct.js';
+export { WebhookConstruct } from './constructs/webhook-construct.js';
+export type { WebhookConstructProps } from './constructs/webhook-construct.js';
+export { SubscriberConstruct } from './constructs/subscriber-construct.js';
+export type { SubscriberConstructProps } from './constructs/subscriber-construct.js';
+export { ScheduleConstruct } from './constructs/schedule-construct.js';
+export type { ScheduleConstructProps } from './constructs/schedule-construct.js';
+export { JobConstruct } from './constructs/job-construct.js';
+export type { JobConstructProps } from './constructs/job-construct.js';
+export { ActionConstruct } from './constructs/action-construct.js';
+export type { ActionConstructProps } from './constructs/action-construct.js';
+export { CmkConstruct } from './constructs/cmk-construct.js';
+export type { CmkConstructProps } from './constructs/cmk-construct.js';
+export { WafConstruct } from './constructs/waf-construct.js';
+export type { WafConstructProps } from './constructs/waf-construct.js';
+export { AlarmConstruct } from './constructs/alarm-construct.js';
+export type { AlarmConstructProps } from './constructs/alarm-construct.js';
+export { CanaryConstruct } from './constructs/canary-construct.js';
+export type { CanaryConstructProps } from './constructs/canary-construct.js';
+export { DomainStack } from './DomainStack.js';
+export type { DomainStackProps } from './DomainStack.js';
+export { packDomain } from './pack-domain.js';
+export type { PackDomainOptions } from './pack-domain.js';
+export { StepFunctionsCodegen } from './step-functions-codegen.js';
+export type { DomainActionFlowNode, StepFunctionsTaskState } from './step-functions-codegen.js';
+export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialFlowControlStep } from './flow-registry.js';
+export { FlowsStack, packFlows } from './pack-flows.js';
+export type { PackFlowsOptions } from './pack-flows.js';

package/dist/index.js

@@ -0,0 +1,17 @@
+export { LambdaFactory } from './lambda-factory.js';
+export { createGroupedLambdas } from './grouped-lambda-factory.js';
+export { IamPolicyBuilder } from './iam/iam-policy-builder.js';
+export { ApiConstruct } from './constructs/api-construct.js';
+export { WebhookConstruct } from './constructs/webhook-construct.js';
+export { SubscriberConstruct } from './constructs/subscriber-construct.js';
+export { ScheduleConstruct } from './constructs/schedule-construct.js';
+export { JobConstruct } from './constructs/job-construct.js';
+export { ActionConstruct } from './constructs/action-construct.js';
+export { CmkConstruct } from './constructs/cmk-construct.js';
+export { WafConstruct } from './constructs/waf-construct.js';
+export { AlarmConstruct } from './constructs/alarm-construct.js';
+export { CanaryConstruct } from './constructs/canary-construct.js';
+export { DomainStack } from './DomainStack.js';
+export { packDomain } from './pack-domain.js';
+export { StepFunctionsCodegen } from './step-functions-codegen.js';
+export { FlowsStack, packFlows } from './pack-flows.js';

package/dist/lambda-factory.d.ts

@@ -0,0 +1,46 @@
+import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Construct } from 'constructs';
+import type { BaseRegistryEntry, SerialDeploymentConfig, DomainRegistry } from './registry.js';
+/**
+ * Configuration properties for LambdaFactory.
+ */
+export interface LambdaFactoryProps {
+    /** Parent CDK scope */
+    scope: Construct;
+    /** Full domain registry */
+    registry: DomainRegistry;
+    /** Absolute path to domain root (= registry.domainRoot) */
+    domainRoot: string;
+    /** Extra env vars injected into all Lambdas */
+    sharedEnv?: Record<string, string>;
+}
+/**
+ * Factory for creating CDK NodejsFunction instances from domain registry entries with consistent defaults.
+ */
+export declare class LambdaFactory {
+    private scope;
+    private registry;
+    private domainRoot;
+    private sharedEnv?;
+    /**
+     * Create a new LambdaFactory instance.
+     * @param props - Factory configuration
+     */
+    constructor(props: LambdaFactoryProps);
+    /**
+     * Convert a kebab-case or snake_case string to PascalCase.
+     * @param s - Input string
+     * @returns PascalCase string
+     */
+    private toPascalCase;
+    /**
+     * Create a NodejsFunction from a registry entry.
+     * @param entry - Registry entry with handlerFile property
+     * @param overrides - Optional deployment configuration overrides
+     * @param extraEnv - Optional extra environment variables
+     * @returns Created NodejsFunction
+     */
+    createFunction(entry: BaseRegistryEntry & {
+        handlerFile: string;
+    }, overrides?: SerialDeploymentConfig, extraEnv?: Record<string, string>): lambdaNode.NodejsFunction;
+}

package/dist/lambda-factory.js

@@ -0,0 +1,80 @@
+import * as cdk from 'aws-cdk-lib';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import path from 'node:path';
+/**
+ * Factory for creating CDK NodejsFunction instances from domain registry entries with consistent defaults.
+ */
+export class LambdaFactory {
+    scope;
+    registry;
+    domainRoot;
+    sharedEnv;
+    /**
+     * Create a new LambdaFactory instance.
+     * @param props - Factory configuration
+     */
+    constructor(props) {
+        this.scope = props.scope;
+        this.registry = props.registry;
+        this.domainRoot = props.domainRoot;
+        this.sharedEnv = props.sharedEnv;
+    }
+    /**
+     * Convert a kebab-case or snake_case string to PascalCase.
+     * @param s - Input string
+     * @returns PascalCase string
+     */
+    toPascalCase(s) {
+        return s
+            .split(/[-_]/)
+            .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))
+            .join('');
+    }
+    /**
+     * Create a NodejsFunction from a registry entry.
+     * @param entry - Registry entry with handlerFile property
+     * @param overrides - Optional deployment configuration overrides
+     * @param extraEnv - Optional extra environment variables
+     * @returns Created NodejsFunction
+     */
+    createFunction(entry, overrides, extraEnv) {
+        const merged = { ...this.registry.domain.defaultDeployment, ...overrides };
+        const architecture = merged.architecture === 'x86_64'
+            ? lambda.Architecture.X86_64
+            : lambda.Architecture.ARM_64;
+        const environment = {
+            DOMAIN_ID: this.registry.domain.id,
+            NODE_OPTIONS: '--enable-source-maps',
+            POWERTOOLS_SERVICE_NAME: `${this.registry.domain.id}-${entry.id}`,
+            POWERTOOLS_LOG_LEVEL: process.env['LOG_LEVEL'] ?? 'INFO',
+            ...this.sharedEnv,
+            ...extraEnv,
+        };
+        const fn = new lambdaNode.NodejsFunction(this.scope, `${this.toPascalCase(entry.id)}Fn`, {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            architecture,
+            tracing: lambda.Tracing.ACTIVE,
+            logRetention: logs.RetentionDays.ONE_WEEK,
+            memorySize: merged.memory ?? 512,
+            timeout: cdk.Duration.seconds(merged.timeout ?? 30),
+            ...(merged.reservedConcurrency !== undefined
+                ? { reservedConcurrentExecutions: merged.reservedConcurrency }
+                : {}),
+            entry: path.join(this.domainRoot, entry.handlerFile),
+            handler: 'handler',
+            bundling: {
+                minify: true,
+                sourceMap: true,
+                sourceMapMode: lambdaNode.SourceMapMode.INLINE,
+                externalModules: ['@aws-sdk/*'],
+            },
+            environment,
+        });
+        const powertoolsLayerArn = `arn:aws:lambda:${cdk.Stack.of(this.scope).region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:26`;
+        const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(this.scope, `PowertoolsLayer${this.toPascalCase(entry.id)}`, powertoolsLayerArn);
+        fn.addLayers(powertoolsLayer);
+        return fn;
+    }
+}

package/dist/pack-domain.d.ts

@@ -0,0 +1,35 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { DomainStack } from './DomainStack.js';
+import type { DomainRegistry } from './registry.js';
+/**
+ * Options for packDomain function.
+ */
+export interface PackDomainOptions {
+    /** CDK environment (account + region). */
+    env?: cdk.Environment;
+    /** VPC to place domain Lambdas in — required for Aurora connectivity. */
+    vpc?: ec2.IVpc;
+    /** Security group for domain Lambdas. */
+    lambdaSg?: ec2.ISecurityGroup;
+    /** Cognito User Pool ARN — when provided, HTTP API routes are JWT-protected. */
+    userPoolArn?: string;
+    /** Cognito User Pool Client ID — required alongside userPoolArn for JWT authorizer. */
+    userPoolClientId?: string;
+    /** Database connection URL. */
+    databaseUrl?: string;
+    /** ARN of the RDS secret for DB credentials. */
+    dbSecretArn?: string;
+}
+/**
+ * Convenience entry-point: constructs a DomainStack from a compiled registry.
+ * Intended to be called from a CDK app entrypoint (e.g. bin/app.ts in the project's infra).
+ * Supports both old (env as 5th arg) and new (options object) calling conventions.
+ * @param registry - The compiled domain registry read from .mc/domain-registry.json.
+ * @param app - The CDK App instance.
+ * @param stackId - CloudFormation stack logical ID.
+ * @param eventBusArn - ARN of the named EventBridge event bus for event subscribers.
+ * @param options - Optional configuration including VPC, auth, and DB settings.
+ * @returns The constructed DomainStack.
+ */
+export declare function packDomain(registry: DomainRegistry, app: cdk.App, stackId: string, eventBusArn: string, options?: PackDomainOptions | cdk.Environment): DomainStack;