@mettlecast/domain-cdk-packer 0.2.110 → 0.2.111

package/dist/DomainStack.d.ts

@@ -89,8 +89,12 @@ export interface DomainStackProps extends cdk.StackProps {
      * Injected into this domain's subscriber/action Lambdas (via the
      * `TIB_ACTION_LAMBDA_ARNS` env var) so `ctx.actions.otherDomain.someAction()`
      * dispatches cross-domain through the runtime's Lambda invoke envelope
-     * (#5226). ARNs use the deterministic action-Lambda function name
-     * `${projectId}-${envCode}-domain-${domainId}-action`.
+     * (#5226). ARNs MUST be built with `domainActionLambdaArn(projectId,
+     * envCode, domainId)` — the single canonical source that matches the
+     * deterministic physical name this stack assigns to the grouped internal
+     * action Lambda (`${projectId}-${envCode}-${domainId}-action`, lowercased).
+     * Hand-assembled ARN strings drift from that name and make every
+     * cross-domain invoke target a phantom function (#5381).
      */
     crossDomainActionArns?: Record<string, string>;
     /**

package/dist/DomainStack.js

@@ -20,7 +20,7 @@ import { CmkConstruct } from './constructs/cmk-construct.js';
 import { WafConstruct } from './constructs/waf-construct.js';
 import { AlarmConstruct } from './constructs/alarm-construct.js';
 import { CanaryConstruct } from './constructs/canary-construct.js';
-import { domainResourceName } from './naming.js';
+import { domainResourceName, domainActionLambdaName } from './naming.js';
 import { SecurityAssertionAspect } from './aspects/security-assertion-aspect.js';
 import { validateRegistry } from './validate-registry.js';
 /** L1 helper: adds a CfnRoute + CfnIntegration to an existing HTTP API. */
@@ -259,7 +259,9 @@ export class DomainStack extends cdk.Stack {
         }
         // Deterministic physical name for THIS domain's internal-action grouped
         // Lambda so other stacks can construct its ARN for cross-domain calls.
-        const actionLambdaName = `${resourceBaseName}-action`;
+        // Canonical deterministic name shared with every cross-domain ARN
+        // builder (naming.ts) — never hand-assemble this pattern elsewhere.
+        const actionLambdaName = domainActionLambdaName(projectId, envCode, domainId);
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;

package/dist/__tests__/cross-domain-action-arn-naming.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/cross-domain-action-arn-naming.test.js

@@ -0,0 +1,180 @@
+/**
+ * #5381 — the cross-domain action ARN map MUST resolve to the physical name of
+ * the internal-action grouped Lambda that DomainStack actually deploys.
+ *
+ * Production evidence (run 33969906049): auth's `on-member-invited`
+ * subscriber called `ctx.actions.email['send-template-email']` and the email
+ * send never started (no email_send_audit row). The map consumed by the
+ * subscriber Lambda had never been reconciled against the deployed function
+ * name: the generated app hand-assembled
+ * `${projectId}-${envCode}-domain-${other}-action` while DomainStack names
+ * the grouped internal-action Lambda
+ * `${projectId}-${envCode}-${domainId}-action` (naming.ts, lowercased). Every
+ * cross-domain invoke — and the IAM grant backing it — pointed at a phantom
+ * function. The existing cross-domain-wiring.test.ts could not catch this
+ * because it injected a synthetic ARN prop and asserted the SAME string came
+ * back out; it never compared the map against the deployed FunctionName.
+ *
+ * These tests close that loop with the REAL constructs:
+ *   1. synthesize an email DomainStack and read the physical FunctionName of
+ *      its grouped internal-action Lambda out of the template;
+ *   2. synthesize an auth DomainStack whose crossDomainActionArns map is built
+ *      exactly the way the generated deploy entries build it — through the
+ *      shared `domainActionLambdaArn` helper — and assert the subscriber's
+ *      TIB_ACTION_LAMBDA_ARNS value resolves to that same function name;
+ *   3. assert the subscriber's lambda:InvokeFunction grant targets the same
+ *      function resource (a valid map with a missing grant is equally
+ *      undeliverable).
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+import { domainActionLambdaName, domainActionLambdaArn } from '../naming.js';
+const REPO_CWD = process.cwd();
+const EVENT_BUS_ARN = 'arn:aws:events:eu-north-1:123456789012:event-bus/test-bus';
+const PROJECT_ID = 'MTC';
+const ENV_CODE = 'Dev';
+function fixtureRegistry(domainId, opts) {
+    const root = path.join(REPO_CWD, `.test-arn-naming-${domainId}`);
+    return {
+        schemaVersion: '1',
+        domainRoot: root,
+        domain: { id: domainId, kind: 'domain', name: domainId, tenancy: 'none' },
+        webhooks: [],
+        subscribers: opts.subscribers
+            ? [
+                {
+                    id: 'on-member-invited',
+                    kind: 'subscriber',
+                    handlerFile: 'subscribers/on-member-invited.ts',
+                    event: 'auth.member.invited',
+                    semverRange: '^1',
+                    outboundAccess: 'internal',
+                },
+            ]
+            : [],
+        schedules: [],
+        jobs: [],
+        actions: opts.internalActions.map((id) => ({
+            id,
+            kind: 'action',
+            handlerFile: `actions/${id}.ts`,
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: false,
+            inputSchema: { type: 'object', properties: {}, required: [] },
+            outputSchema: { type: 'object', properties: {}, required: [] },
+        })),
+        integrations: [],
+        events: [],
+    };
+}
+/** Create the handler stubs + grouped-Lambda asset dirs DomainStack expects. */
+function materializeFixture(domainId, registry) {
+    const root = registry.domainRoot;
+    fs.mkdirSync(path.join(root, 'subscribers'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'actions'), { recursive: true });
+    for (const sub of registry.subscribers) {
+        fs.writeFileSync(path.join(root, sub.handlerFile), `export const onMemberInvited = { id: "${sub.id}", event: "${sub.event}", semverRange: "^1", handler: async () => {} };\n`);
+    }
+    for (const action of registry.actions) {
+        const exportName = action.id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+        fs.writeFileSync(path.join(root, action.handlerFile), `export const ${exportName} = { id: "${action.id}", backendAccess: "domain", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n`);
+    }
+    for (const prim of ['subscriber', 'action']) {
+        fs.mkdirSync(path.join(REPO_CWD, 'dist', 'domains', domainId, prim), { recursive: true });
+    }
+}
+/**
+ * Resolve a (possibly tokenized) CFN value to a plain string, replacing
+ * pseudo-parameter refs with stable placeholders. The JSON map injected as
+ * TIB_ACTION_LAMBDA_ARNS synthesizes to an Fn::Join of literal segments and
+ * {Ref: AWS::Region}/{Ref: AWS::AccountId} tokens; the region/account do not
+ * affect the function-name segment we assert on.
+ */
+function flattenCfn(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object') {
+        const rec = value;
+        if (Array.isArray(rec['Fn::Join'])) {
+            const [delim, parts] = rec['Fn::Join'];
+            return parts.map(flattenCfn).join(delim);
+        }
+        if (typeof rec['Ref'] === 'string')
+            return `__${rec['Ref']}__`;
+        if (Array.isArray(value))
+            return value.map(flattenCfn).join('');
+    }
+    return String(value);
+}
+function findDomainLambdas(template) {
+    return template.findResources('AWS::Lambda::Function');
+}
+beforeAll(() => {
+    materializeFixture('email', fixtureRegistry('email', { subscribers: false, internalActions: ['send-template-email'] }));
+    materializeFixture('auth', fixtureRegistry('auth', { subscribers: true, internalActions: ['verify-token'] }));
+});
+afterAll(() => {
+    for (const d of ['email', 'auth']) {
+        fs.rmSync(path.join(REPO_CWD, `.test-arn-naming-${d}`), { recursive: true, force: true });
+        fs.rmSync(path.join(REPO_CWD, 'dist', 'domains', d), { recursive: true, force: true });
+    }
+});
+describe('cross-domain action ARN ⇔ deployed Lambda name (#5381)', () => {
+    it('the grouped internal-action Lambda carries the helper-derived physical name', () => {
+        const app = new cdk.App();
+        const registry = fixtureRegistry('email', { subscribers: false, internalActions: ['send-template-email'] });
+        const stack = new DomainStack(app, 'MTC-Dev-domain-email', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: PROJECT_ID,
+            envCode: ENV_CODE,
+        });
+        const template = Template.fromStack(stack);
+        const lambdas = findDomainLambdas(template);
+        const physical = Object.values(lambdas).map((l) => l.Properties.FunctionName).filter(Boolean);
+        // The deployed name has NO 'domain' segment — this exact fact is what the
+        // old hand-assembled app.ts ARN got wrong.
+        expect(physical).toContain('mtc-dev-email-action');
+    });
+    it('a subscriber map built via domainActionLambdaArn resolves to the deployed email action function name', () => {
+        // Build the map the way BOTH generated deploy entries now build it.
+        const crossDomainActionArns = {
+            email: domainActionLambdaArn(PROJECT_ID, ENV_CODE, 'email'),
+        };
+        const app = new cdk.App();
+        const registry = fixtureRegistry('auth', { subscribers: true, internalActions: ['verify-token'] });
+        const stack = new DomainStack(app, 'MTC-Dev-domain-auth', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: PROJECT_ID,
+            envCode: ENV_CODE,
+            crossDomainActionArns,
+        });
+        const template = Template.fromStack(stack);
+        // 1) Locate the grouped subscriber Lambda by its env-injected map.
+        const lambdas = findDomainLambdas(template);
+        const subscriberEntries = Object.entries(lambdas).filter(([id, l]) => /subscriber/i.test(id) && l.Properties.Environment?.Variables?.TIB_ACTION_LAMBDA_ARNS);
+        expect(subscriberEntries.length).toBeGreaterThanOrEqual(1);
+        for (const [, l] of subscriberEntries) {
+            const raw = l.Properties.Environment.Variables.TIB_ACTION_LAMBDA_ARNS;
+            const arns = JSON.parse(flattenCfn(raw));
+            const functionSegment = arns.email.split(':function:')[1];
+            // 2) THE invariant that was broken in production: the map's function
+            //    segment must equal the physical name of the deployed email
+            //    internal-action Lambda, not a hand-assembled approximation.
+            expect(functionSegment).toBe(domainActionLambdaName(PROJECT_ID, ENV_CODE, 'email'));
+            expect(functionSegment).toBe('mtc-dev-email-action');
+        }
+        // 3) The subscriber role must actually be granted invoke on THAT function
+        //    (env correct but IAM phantom = still undeliverable).
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const hasInvokeOnRealName = policies.some((p) => p.Properties.PolicyDocument.Statement.some((s) => s.Action?.includes('lambda:InvokeFunction') &&
+            flattenCfn(s.Resource).includes(`:function:${domainActionLambdaName(PROJECT_ID, ENV_CODE, 'email')}`)));
+        expect(hasInvokeOnRealName).toBe(true);
+    });
+});

package/dist/__tests__/deploy-entry-naming-parity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/deploy-entry-naming-parity.test.js

@@ -0,0 +1,130 @@
+/**
+ * #5385 — the COMMITTED generated deploy entries (infra/modules/app.ts and
+ * app-domain.ts) run in CI against the PUBLISHED @mettlecast/domain-cdk-packer:
+ * the deploy jobs `npm ci` in infra/modules and `npx tsx` loads the installed
+ * ESM tarball. Template v172 (#5384) imported `domainActionLambdaArn` — a
+ * member that exists only in this package's SOURCE — so every domain deploy
+ * died at link time with
+ *   `SyntaxError: The requested module '@mettlecast/domain-cdk-packer' does
+ *    not provide an export named 'domainActionLambdaArn'`
+ * (TIB Deploy run 34000848210) before the #5381 ARN repair could ship.
+ * Template v173 defines the ARN builder LOCALLY in the generated entries, on
+ * top of the published `domainResourceName` primitive.
+ *
+ * This test pins both halves of that contract:
+ *   1. the committed deploy entries value-import ONLY members verified to
+ *      exist on the published packer export surface (npm tarballs 0.2.96 and
+ *      0.2.110 were checked: `packDomain`, `domainResourceName`);
+ *   2. the emitted local helper — extracted and evaluated with the REAL
+ *      `domainResourceName` — produces the exact function name this package's
+ *      canonical `domainActionLambdaName` assigns the deployed grouped
+ *      internal-action Lambda. The local mirror must not fork away from
+ *      naming.ts; if it drifts, this fails. (Region/account halves are CDK
+ *      pseudo-parameters — asserted structurally, not by token identity.)
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { domainResourceName, domainActionLambdaName } from '../naming.js';
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+/** Deploy entries the TIB Deploy jobs execute via `npx tsx`. */
+const DEPLOY_ENTRIES = ['infra/modules/app.ts', 'infra/modules/app-domain.ts'];
+/**
+ * Value exports VERIFIED present on every published packer the generated
+ * package.json range (^0.2.96) can resolve, including the lockfile-pinned
+ * 0.2.110. Widening this set requires first proving the member ships on the
+ * published tarball — that proof is exactly what #5385 lacked.
+ */
+const PUBLISHED_VALUE_EXPORTS = new Set(['packDomain', 'domainResourceName']);
+/** Stub pseudo-parameter values for evaluating the emitted helper offline. */
+const STUB_REGION = '__AWS_REGION__';
+const STUB_ACCOUNT = '__AWS_ACCOUNT_ID__';
+/**
+ * Extract the local `domainActionLambdaArn` function from a deploy entry and
+ * return it as a callable, with `cdk.Aws.*` stubbed and the REAL published
+ * `domainResourceName` primitive injected.
+ */
+function extractLocalArnHelper(src, label) {
+    const match = src.match(/function domainActionLambdaArn\([^)]*\)\s*:\s*string\s*\{[\s\S]*?\n\}/);
+    expect(match, `${label}: must define the local domainActionLambdaArn helper (template v173, #5385)`).toBeTruthy();
+    const stubCdk = { Aws: { REGION: STUB_REGION, ACCOUNT_ID: STUB_ACCOUNT } };
+    // The emitted helper is TypeScript; `new Function` parses plain JS. The
+    // function body contains no `: string` sequences, so stripping the four
+    // signature annotations is safe and keeps the executed logic verbatim.
+    const jsSource = match[0].replace(/: string/g, '');
+    // eslint-disable-next-line no-new-func -- executing the generated mirror IS the parity check
+    const factory = new Function('cdk', 'domainResourceName', `${jsSource}\nreturn domainActionLambdaArn;`);
+    return factory(stubCdk, domainResourceName);
+}
+/** Named value imports from '@mettlecast/domain-cdk-packer' (type imports erased). */
+function packerValueImports(src) {
+    const names = [];
+    for (const line of src.split('\n')) {
+        const t = line.trim();
+        if (!t.startsWith('import') || !t.includes('@mettlecast/domain-cdk-packer'))
+            continue;
+        if (t.startsWith('import type'))
+            continue;
+        const braceOpen = t.indexOf('{');
+        const braceClose = t.indexOf('}');
+        if (braceOpen === -1 || braceClose === -1)
+            continue;
+        for (const raw of t.slice(braceOpen + 1, braceClose).split(',')) {
+            const name = raw.trim().split(/\s+as\s+/)[0].trim();
+            if (name)
+                names.push(name);
+        }
+    }
+    return names;
+}
+describe('deploy entries import only published packer members (#5385)', () => {
+    for (const rel of DEPLOY_ENTRIES) {
+        it(`${rel} value-imports nothing the installed packer lacks`, () => {
+            const src = readFileSync(join(repoRoot, rel), 'utf8');
+            const imported = packerValueImports(src);
+            // The regression itself: an unexported member crashes `npx tsx` at link
+            // time, so every deploy stack fails BEFORE synthesis. Fail loudly here.
+            expect(imported.length, `${rel} must import packDomain from the packer`).toBeGreaterThan(0);
+            for (const name of imported) {
+                expect(PUBLISHED_VALUE_EXPORTS.has(name), `${rel} imports { ${name} } from @mettlecast/domain-cdk-packer, but that member is not on the published export surface (SyntaxError at deploy time — #5385)`).toBe(true);
+            }
+            expect(imported).not.toContain('domainActionLambdaArn');
+            expect(imported).not.toContain('domainActionLambdaName');
+        });
+    }
+});
+describe('local ARN mirror ≡ canonical naming.ts (#5381/#5385)', () => {
+    it('naming.ts itself derives the action name from domainResourceName + "-action"', () => {
+        // The local mirror builds its ARN from the SAME published primitive; this
+        // pins the canonical contract the mirror is allowed to reproduce.
+        expect(domainActionLambdaName('MTC', 'Dev', 'email')).toBe(`${domainResourceName('MTC', 'Dev', 'email')}-action`);
+        expect(domainActionLambdaName('mtc', 'dev', 'email')).toBe('mtc-dev-email-action');
+    });
+    const fixtures = [
+        ['MTC', 'Dev', 'email'],
+        ['MTC', 'prod', 'data-management'],
+        ['MyProj', 'Staging', 'billing'],
+        ['MTC', 'Dev', 'auth'],
+    ];
+    for (const rel of DEPLOY_ENTRIES) {
+        const src = readFileSync(join(repoRoot, rel), 'utf8');
+        const local = extractLocalArnHelper(src, rel);
+        for (const [projectId, envCode, domainId] of fixtures) {
+            it(`${rel}: domainActionLambdaArn('${projectId}', '${envCode}', '${domainId}') resolves to the deployed function name`, () => {
+                const generatedArn = local(projectId, envCode, domainId);
+                // Region/account halves are CFN pseudo-parameters (asserted by shape);
+                // the FUNCTION NAME is what drifted in production and what this guards.
+                expect(generatedArn.startsWith(`arn:aws:lambda:${STUB_REGION}:${STUB_ACCOUNT}:function:`)).toBe(true);
+                const functionSegment = generatedArn.split(':function:')[1];
+                expect(functionSegment).toBe(domainActionLambdaName(projectId, envCode, domainId));
+                // No phantom 'domain' segment (#5381's original bug shape).
+                expect(functionSegment).not.toContain('-domain-');
+            });
+        }
+        it(`${rel}: helper exists exactly once (no forked duplicates)`, () => {
+            const defs = src.match(/function domainActionLambdaArn\(/g) ?? [];
+            expect(defs.length).toBe(1);
+        });
+    }
+});

package/dist/index.d.ts

@@ -36,4 +36,4 @@ export type { DomainActionFlowNode, StepFunctionsTaskState } from './step-functi
 export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialDomainQueryStep, SerialAwsServiceStep, SerialFlowControlStep } from './flow-registry.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
 export type { PackFlowsOptions } from './pack-flows.js';
-export { domainResourceName } from './naming.js';
+export { domainResourceName, domainActionLambdaName, domainActionLambdaArn } from './naming.js';

package/dist/index.js

@@ -16,4 +16,4 @@ export { packDomain } from './pack-domain.js';
 export { validateRegistry } from './validate-registry.js';
 export { StepFunctionsCodegen } from './step-functions-codegen.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
-export { domainResourceName } from './naming.js';
+export { domainResourceName, domainActionLambdaName, domainActionLambdaArn } from './naming.js';

package/dist/naming.d.ts

@@ -9,3 +9,21 @@
  * (pack-flows domain-query grants) so the two can never drift.
  */
 export declare function domainResourceName(projectId: string, envCode: string, domainId: string): string;
+/**
+ * Deterministic physical name of a domain's internal-action grouped Lambda —
+ * the invoke target for cross-domain `ctx.actions.<domain>.<action>()`
+ * dispatch (#5226). DomainStack assigns this exact name via `functionName`,
+ * and callers building cross-domain ARNs MUST derive them from here rather
+ * than hand-assembling the pattern: the generated app constructed
+ * `…-domain-<id>-action`, which never matched the deployed `…-<id>-action`,
+ * so every subscriber cross-domain invoke targeted a phantom function
+ * (bootstrap invitation email dispatch, #5381).
+ */
+export declare function domainActionLambdaName(projectId: string, envCode: string, domainId: string): string;
+/**
+ * Cross-domain ARN for a domain's internal-action grouped Lambda, using
+ * account/region pseudo-parameters so it can be synthesized before the
+ * target stack exists. This is the canonical way to populate
+ * `PackDomainOptions.crossDomainActionArns`.
+ */
+export declare function domainActionLambdaArn(projectId: string, envCode: string, domainId: string): string;

package/dist/naming.js

@@ -1,3 +1,4 @@
+import * as cdk from 'aws-cdk-lib';
 /**
  * Canonical physical-name builder for per-domain AWS resources.
  *
@@ -11,3 +12,25 @@
 export function domainResourceName(projectId, envCode, domainId) {
     return `${projectId}-${envCode}-${domainId}`.toLowerCase();
 }
+/**
+ * Deterministic physical name of a domain's internal-action grouped Lambda —
+ * the invoke target for cross-domain `ctx.actions.<domain>.<action>()`
+ * dispatch (#5226). DomainStack assigns this exact name via `functionName`,
+ * and callers building cross-domain ARNs MUST derive them from here rather
+ * than hand-assembling the pattern: the generated app constructed
+ * `…-domain-<id>-action`, which never matched the deployed `…-<id>-action`,
+ * so every subscriber cross-domain invoke targeted a phantom function
+ * (bootstrap invitation email dispatch, #5381).
+ */
+export function domainActionLambdaName(projectId, envCode, domainId) {
+    return `${domainResourceName(projectId, envCode, domainId)}-action`;
+}
+/**
+ * Cross-domain ARN for a domain's internal-action grouped Lambda, using
+ * account/region pseudo-parameters so it can be synthesized before the
+ * target stack exists. This is the canonical way to populate
+ * `PackDomainOptions.crossDomainActionArns`.
+ */
+export function domainActionLambdaArn(projectId, envCode, domainId) {
+    return `arn:aws:lambda:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:function:${domainActionLambdaName(projectId, envCode, domainId)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.110",
+  "version": "0.2.111",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",