@mettlecast/domain-cdk-packer 0.2.110 → 0.2.112

package/dist/DomainStack.d.ts

@@ -89,8 +89,12 @@ export interface DomainStackProps extends cdk.StackProps {
      * Injected into this domain's subscriber/action Lambdas (via the
      * `TIB_ACTION_LAMBDA_ARNS` env var) so `ctx.actions.otherDomain.someAction()`
      * dispatches cross-domain through the runtime's Lambda invoke envelope
-     * (#5226). ARNs use the deterministic action-Lambda function name
-     * `${projectId}-${envCode}-domain-${domainId}-action`.
+     * (#5226). ARNs MUST be built with `domainActionLambdaArn(projectId,
+     * envCode, domainId)` — the single canonical source that matches the
+     * deterministic physical name this stack assigns to the grouped internal
+     * action Lambda (`${projectId}-${envCode}-${domainId}-action`, lowercased).
+     * Hand-assembled ARN strings drift from that name and make every
+     * cross-domain invoke target a phantom function (#5381).
      */
     crossDomainActionArns?: Record<string, string>;
     /**

package/dist/DomainStack.js

@@ -20,7 +20,7 @@ import { CmkConstruct } from './constructs/cmk-construct.js';
 import { WafConstruct } from './constructs/waf-construct.js';
 import { AlarmConstruct } from './constructs/alarm-construct.js';
 import { CanaryConstruct } from './constructs/canary-construct.js';
-import { domainResourceName } from './naming.js';
+import { domainResourceName, domainActionLambdaName } from './naming.js';
 import { SecurityAssertionAspect } from './aspects/security-assertion-aspect.js';
 import { validateRegistry } from './validate-registry.js';
 /** L1 helper: adds a CfnRoute + CfnIntegration to an existing HTTP API. */
@@ -259,7 +259,9 @@ export class DomainStack extends cdk.Stack {
         }
         // Deterministic physical name for THIS domain's internal-action grouped
         // Lambda so other stacks can construct its ARN for cross-domain calls.
-        const actionLambdaName = `${resourceBaseName}-action`;
+        // Canonical deterministic name shared with every cross-domain ARN
+        // builder (naming.ts) — never hand-assemble this pattern elsewhere.
+        const actionLambdaName = domainActionLambdaName(projectId, envCode, domainId);
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;
@@ -662,6 +664,22 @@ export class DomainStack extends cdk.Stack {
                 const queuePolicies = iamBuilder.forJob({ queueArn: queue.queueArn, dlqArn: dlq.queueArn });
                 queuePolicies.forEach(statement => fn.addToRolePolicy(statement));
             }
+            // Cross-domain action dispatch from jobs (#5389): job consumers are
+            // first-class orchestrators — the claim-guarded delivery job invokes
+            // `email.send-template-email` through `ctx.actions`, exactly like the
+            // subscriber path (#5226). Without this grant the durable delivery
+            // path would fail with AccessDenied on every attempt and land
+            // everything in the job DLQ. Same resolved deterministic-ARN list the
+            // subscriber wiring uses — never a wildcard.
+            const jobCrossDomainActionArns = Object.values(crossDomainActionArns);
+            if (jobCrossDomainActionArns.length > 0) {
+                jobLambdas.forEach((fn) => {
+                    fn.addToRolePolicy(new iam.PolicyStatement({
+                        actions: ['lambda:InvokeFunction'],
+                        resources: jobCrossDomainActionArns,
+                    }));
+                });
+            }
             // Add dbSecretArn grant if provided
             if (dbSecretArn) {
                 jobLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({

package/dist/__tests__/cross-domain-action-arn-naming.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/cross-domain-action-arn-naming.test.js

@@ -0,0 +1,180 @@
+/**
+ * #5381 — the cross-domain action ARN map MUST resolve to the physical name of
+ * the internal-action grouped Lambda that DomainStack actually deploys.
+ *
+ * Production evidence (run 33969906049): auth's `on-member-invited`
+ * subscriber called `ctx.actions.email['send-template-email']` and the email
+ * send never started (no email_send_audit row). The map consumed by the
+ * subscriber Lambda had never been reconciled against the deployed function
+ * name: the generated app hand-assembled
+ * `${projectId}-${envCode}-domain-${other}-action` while DomainStack names
+ * the grouped internal-action Lambda
+ * `${projectId}-${envCode}-${domainId}-action` (naming.ts, lowercased). Every
+ * cross-domain invoke — and the IAM grant backing it — pointed at a phantom
+ * function. The existing cross-domain-wiring.test.ts could not catch this
+ * because it injected a synthetic ARN prop and asserted the SAME string came
+ * back out; it never compared the map against the deployed FunctionName.
+ *
+ * These tests close that loop with the REAL constructs:
+ *   1. synthesize an email DomainStack and read the physical FunctionName of
+ *      its grouped internal-action Lambda out of the template;
+ *   2. synthesize an auth DomainStack whose crossDomainActionArns map is built
+ *      exactly the way the generated deploy entries build it — through the
+ *      shared `domainActionLambdaArn` helper — and assert the subscriber's
+ *      TIB_ACTION_LAMBDA_ARNS value resolves to that same function name;
+ *   3. assert the subscriber's lambda:InvokeFunction grant targets the same
+ *      function resource (a valid map with a missing grant is equally
+ *      undeliverable).
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+import { domainActionLambdaName, domainActionLambdaArn } from '../naming.js';
+const REPO_CWD = process.cwd();
+const EVENT_BUS_ARN = 'arn:aws:events:eu-north-1:123456789012:event-bus/test-bus';
+const PROJECT_ID = 'MTC';
+const ENV_CODE = 'Dev';
+function fixtureRegistry(domainId, opts) {
+    const root = path.join(REPO_CWD, `.test-arn-naming-${domainId}`);
+    return {
+        schemaVersion: '1',
+        domainRoot: root,
+        domain: { id: domainId, kind: 'domain', name: domainId, tenancy: 'none' },
+        webhooks: [],
+        subscribers: opts.subscribers
+            ? [
+                {
+                    id: 'on-member-invited',
+                    kind: 'subscriber',
+                    handlerFile: 'subscribers/on-member-invited.ts',
+                    event: 'auth.member.invited',
+                    semverRange: '^1',
+                    outboundAccess: 'internal',
+                },
+            ]
+            : [],
+        schedules: [],
+        jobs: [],
+        actions: opts.internalActions.map((id) => ({
+            id,
+            kind: 'action',
+            handlerFile: `actions/${id}.ts`,
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: false,
+            inputSchema: { type: 'object', properties: {}, required: [] },
+            outputSchema: { type: 'object', properties: {}, required: [] },
+        })),
+        integrations: [],
+        events: [],
+    };
+}
+/** Create the handler stubs + grouped-Lambda asset dirs DomainStack expects. */
+function materializeFixture(domainId, registry) {
+    const root = registry.domainRoot;
+    fs.mkdirSync(path.join(root, 'subscribers'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'actions'), { recursive: true });
+    for (const sub of registry.subscribers) {
+        fs.writeFileSync(path.join(root, sub.handlerFile), `export const onMemberInvited = { id: "${sub.id}", event: "${sub.event}", semverRange: "^1", handler: async () => {} };\n`);
+    }
+    for (const action of registry.actions) {
+        const exportName = action.id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+        fs.writeFileSync(path.join(root, action.handlerFile), `export const ${exportName} = { id: "${action.id}", backendAccess: "domain", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n`);
+    }
+    for (const prim of ['subscriber', 'action']) {
+        fs.mkdirSync(path.join(REPO_CWD, 'dist', 'domains', domainId, prim), { recursive: true });
+    }
+}
+/**
+ * Resolve a (possibly tokenized) CFN value to a plain string, replacing
+ * pseudo-parameter refs with stable placeholders. The JSON map injected as
+ * TIB_ACTION_LAMBDA_ARNS synthesizes to an Fn::Join of literal segments and
+ * {Ref: AWS::Region}/{Ref: AWS::AccountId} tokens; the region/account do not
+ * affect the function-name segment we assert on.
+ */
+function flattenCfn(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object') {
+        const rec = value;
+        if (Array.isArray(rec['Fn::Join'])) {
+            const [delim, parts] = rec['Fn::Join'];
+            return parts.map(flattenCfn).join(delim);
+        }
+        if (typeof rec['Ref'] === 'string')
+            return `__${rec['Ref']}__`;
+        if (Array.isArray(value))
+            return value.map(flattenCfn).join('');
+    }
+    return String(value);
+}
+function findDomainLambdas(template) {
+    return template.findResources('AWS::Lambda::Function');
+}
+beforeAll(() => {
+    materializeFixture('email', fixtureRegistry('email', { subscribers: false, internalActions: ['send-template-email'] }));
+    materializeFixture('auth', fixtureRegistry('auth', { subscribers: true, internalActions: ['verify-token'] }));
+});
+afterAll(() => {
+    for (const d of ['email', 'auth']) {
+        fs.rmSync(path.join(REPO_CWD, `.test-arn-naming-${d}`), { recursive: true, force: true });
+        fs.rmSync(path.join(REPO_CWD, 'dist', 'domains', d), { recursive: true, force: true });
+    }
+});
+describe('cross-domain action ARN ⇔ deployed Lambda name (#5381)', () => {
+    it('the grouped internal-action Lambda carries the helper-derived physical name', () => {
+        const app = new cdk.App();
+        const registry = fixtureRegistry('email', { subscribers: false, internalActions: ['send-template-email'] });
+        const stack = new DomainStack(app, 'MTC-Dev-domain-email', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: PROJECT_ID,
+            envCode: ENV_CODE,
+        });
+        const template = Template.fromStack(stack);
+        const lambdas = findDomainLambdas(template);
+        const physical = Object.values(lambdas).map((l) => l.Properties.FunctionName).filter(Boolean);
+        // The deployed name has NO 'domain' segment — this exact fact is what the
+        // old hand-assembled app.ts ARN got wrong.
+        expect(physical).toContain('mtc-dev-email-action');
+    });
+    it('a subscriber map built via domainActionLambdaArn resolves to the deployed email action function name', () => {
+        // Build the map the way BOTH generated deploy entries now build it.
+        const crossDomainActionArns = {
+            email: domainActionLambdaArn(PROJECT_ID, ENV_CODE, 'email'),
+        };
+        const app = new cdk.App();
+        const registry = fixtureRegistry('auth', { subscribers: true, internalActions: ['verify-token'] });
+        const stack = new DomainStack(app, 'MTC-Dev-domain-auth', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: PROJECT_ID,
+            envCode: ENV_CODE,
+            crossDomainActionArns,
+        });
+        const template = Template.fromStack(stack);
+        // 1) Locate the grouped subscriber Lambda by its env-injected map.
+        const lambdas = findDomainLambdas(template);
+        const subscriberEntries = Object.entries(lambdas).filter(([id, l]) => /subscriber/i.test(id) && l.Properties.Environment?.Variables?.TIB_ACTION_LAMBDA_ARNS);
+        expect(subscriberEntries.length).toBeGreaterThanOrEqual(1);
+        for (const [, l] of subscriberEntries) {
+            const raw = l.Properties.Environment.Variables.TIB_ACTION_LAMBDA_ARNS;
+            const arns = JSON.parse(flattenCfn(raw));
+            const functionSegment = arns.email.split(':function:')[1];
+            // 2) THE invariant that was broken in production: the map's function
+            //    segment must equal the physical name of the deployed email
+            //    internal-action Lambda, not a hand-assembled approximation.
+            expect(functionSegment).toBe(domainActionLambdaName(PROJECT_ID, ENV_CODE, 'email'));
+            expect(functionSegment).toBe('mtc-dev-email-action');
+        }
+        // 3) The subscriber role must actually be granted invoke on THAT function
+        //    (env correct but IAM phantom = still undeliverable).
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const hasInvokeOnRealName = policies.some((p) => p.Properties.PolicyDocument.Statement.some((s) => s.Action?.includes('lambda:InvokeFunction') &&
+            flattenCfn(s.Resource).includes(`:function:${domainActionLambdaName(PROJECT_ID, ENV_CODE, 'email')}`)));
+        expect(hasInvokeOnRealName).toBe(true);
+    });
+});

package/dist/__tests__/deploy-entry-naming-parity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/deploy-entry-naming-parity.test.js

@@ -0,0 +1,130 @@
+/**
+ * #5385 — the COMMITTED generated deploy entries (infra/modules/app.ts and
+ * app-domain.ts) run in CI against the PUBLISHED @mettlecast/domain-cdk-packer:
+ * the deploy jobs `npm ci` in infra/modules and `npx tsx` loads the installed
+ * ESM tarball. Template v172 (#5384) imported `domainActionLambdaArn` — a
+ * member that exists only in this package's SOURCE — so every domain deploy
+ * died at link time with
+ *   `SyntaxError: The requested module '@mettlecast/domain-cdk-packer' does
+ *    not provide an export named 'domainActionLambdaArn'`
+ * (TIB Deploy run 34000848210) before the #5381 ARN repair could ship.
+ * Template v173 defines the ARN builder LOCALLY in the generated entries, on
+ * top of the published `domainResourceName` primitive.
+ *
+ * This test pins both halves of that contract:
+ *   1. the committed deploy entries value-import ONLY members verified to
+ *      exist on the published packer export surface (npm tarballs 0.2.96 and
+ *      0.2.110 were checked: `packDomain`, `domainResourceName`);
+ *   2. the emitted local helper — extracted and evaluated with the REAL
+ *      `domainResourceName` — produces the exact function name this package's
+ *      canonical `domainActionLambdaName` assigns the deployed grouped
+ *      internal-action Lambda. The local mirror must not fork away from
+ *      naming.ts; if it drifts, this fails. (Region/account halves are CDK
+ *      pseudo-parameters — asserted structurally, not by token identity.)
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { domainResourceName, domainActionLambdaName } from '../naming.js';
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+/** Deploy entries the TIB Deploy jobs execute via `npx tsx`. */
+const DEPLOY_ENTRIES = ['infra/modules/app.ts', 'infra/modules/app-domain.ts'];
+/**
+ * Value exports VERIFIED present on every published packer the generated
+ * package.json range (^0.2.96) can resolve, including the lockfile-pinned
+ * 0.2.110. Widening this set requires first proving the member ships on the
+ * published tarball — that proof is exactly what #5385 lacked.
+ */
+const PUBLISHED_VALUE_EXPORTS = new Set(['packDomain', 'domainResourceName']);
+/** Stub pseudo-parameter values for evaluating the emitted helper offline. */
+const STUB_REGION = '__AWS_REGION__';
+const STUB_ACCOUNT = '__AWS_ACCOUNT_ID__';
+/**
+ * Extract the local `domainActionLambdaArn` function from a deploy entry and
+ * return it as a callable, with `cdk.Aws.*` stubbed and the REAL published
+ * `domainResourceName` primitive injected.
+ */
+function extractLocalArnHelper(src, label) {
+    const match = src.match(/function domainActionLambdaArn\([^)]*\)\s*:\s*string\s*\{[\s\S]*?\n\}/);
+    expect(match, `${label}: must define the local domainActionLambdaArn helper (template v173, #5385)`).toBeTruthy();
+    const stubCdk = { Aws: { REGION: STUB_REGION, ACCOUNT_ID: STUB_ACCOUNT } };
+    // The emitted helper is TypeScript; `new Function` parses plain JS. The
+    // function body contains no `: string` sequences, so stripping the four
+    // signature annotations is safe and keeps the executed logic verbatim.
+    const jsSource = match[0].replace(/: string/g, '');
+    // eslint-disable-next-line no-new-func -- executing the generated mirror IS the parity check
+    const factory = new Function('cdk', 'domainResourceName', `${jsSource}\nreturn domainActionLambdaArn;`);
+    return factory(stubCdk, domainResourceName);
+}
+/** Named value imports from '@mettlecast/domain-cdk-packer' (type imports erased). */
+function packerValueImports(src) {
+    const names = [];
+    for (const line of src.split('\n')) {
+        const t = line.trim();
+        if (!t.startsWith('import') || !t.includes('@mettlecast/domain-cdk-packer'))
+            continue;
+        if (t.startsWith('import type'))
+            continue;
+        const braceOpen = t.indexOf('{');
+        const braceClose = t.indexOf('}');
+        if (braceOpen === -1 || braceClose === -1)
+            continue;
+        for (const raw of t.slice(braceOpen + 1, braceClose).split(',')) {
+            const name = raw.trim().split(/\s+as\s+/)[0].trim();
+            if (name)
+                names.push(name);
+        }
+    }
+    return names;
+}
+describe('deploy entries import only published packer members (#5385)', () => {
+    for (const rel of DEPLOY_ENTRIES) {
+        it(`${rel} value-imports nothing the installed packer lacks`, () => {
+            const src = readFileSync(join(repoRoot, rel), 'utf8');
+            const imported = packerValueImports(src);
+            // The regression itself: an unexported member crashes `npx tsx` at link
+            // time, so every deploy stack fails BEFORE synthesis. Fail loudly here.
+            expect(imported.length, `${rel} must import packDomain from the packer`).toBeGreaterThan(0);
+            for (const name of imported) {
+                expect(PUBLISHED_VALUE_EXPORTS.has(name), `${rel} imports { ${name} } from @mettlecast/domain-cdk-packer, but that member is not on the published export surface (SyntaxError at deploy time — #5385)`).toBe(true);
+            }
+            expect(imported).not.toContain('domainActionLambdaArn');
+            expect(imported).not.toContain('domainActionLambdaName');
+        });
+    }
+});
+describe('local ARN mirror ≡ canonical naming.ts (#5381/#5385)', () => {
+    it('naming.ts itself derives the action name from domainResourceName + "-action"', () => {
+        // The local mirror builds its ARN from the SAME published primitive; this
+        // pins the canonical contract the mirror is allowed to reproduce.
+        expect(domainActionLambdaName('MTC', 'Dev', 'email')).toBe(`${domainResourceName('MTC', 'Dev', 'email')}-action`);
+        expect(domainActionLambdaName('mtc', 'dev', 'email')).toBe('mtc-dev-email-action');
+    });
+    const fixtures = [
+        ['MTC', 'Dev', 'email'],
+        ['MTC', 'prod', 'data-management'],
+        ['MyProj', 'Staging', 'billing'],
+        ['MTC', 'Dev', 'auth'],
+    ];
+    for (const rel of DEPLOY_ENTRIES) {
+        const src = readFileSync(join(repoRoot, rel), 'utf8');
+        const local = extractLocalArnHelper(src, rel);
+        for (const [projectId, envCode, domainId] of fixtures) {
+            it(`${rel}: domainActionLambdaArn('${projectId}', '${envCode}', '${domainId}') resolves to the deployed function name`, () => {
+                const generatedArn = local(projectId, envCode, domainId);
+                // Region/account halves are CFN pseudo-parameters (asserted by shape);
+                // the FUNCTION NAME is what drifted in production and what this guards.
+                expect(generatedArn.startsWith(`arn:aws:lambda:${STUB_REGION}:${STUB_ACCOUNT}:function:`)).toBe(true);
+                const functionSegment = generatedArn.split(':function:')[1];
+                expect(functionSegment).toBe(domainActionLambdaName(projectId, envCode, domainId));
+                // No phantom 'domain' segment (#5381's original bug shape).
+                expect(functionSegment).not.toContain('-domain-');
+            });
+        }
+        it(`${rel}: helper exists exactly once (no forked duplicates)`, () => {
+            const defs = src.match(/function domainActionLambdaArn\(/g) ?? [];
+            expect(defs.length).toBe(1);
+        });
+    }
+});

package/dist/__tests__/invitation-delivery-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/invitation-delivery-wiring.test.js

@@ -0,0 +1,170 @@
+import { describe, it, expect, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+/**
+ * #5389 — synth-level contract for the durable invitation-delivery wiring
+ * in the auth domain stack:
+ *
+ *  1. the domain declares `auth.outbox`, so every Lambda gets
+ *     TIB_OUTBOX_TABLE (the dispatcher schedule needs a real ctx.outbox);
+ *  2. the claim-guarded `deliver-invitation-email` job gets its encrypted
+ *     queue + DLQ, redrive `maxReceiveCount = maxRetries + 1`, and the
+ *     standard DLQ depth/age alarms wired to the SNS topic;
+ *  3. the JOB Lambda role receives the cross-domain
+ *     `lambda:InvokeFunction` grant scoped to the resolved internal-action
+ *     ARNs — without it, the job's ctx.actions.email['send-template-email']
+ *     call would AccessDenied on every attempt (the gap this issue found:
+ *     jobs were never granted what subscribers already had);
+ *  4. reconciliation + dispatch schedules synthesize EventBridge Scheduler
+ *     rules.
+ */
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-domain-cdk-packer-5389');
+const handlerDir = path.join(DOMAIN_ROOT, 'subscribers');
+fs.mkdirSync(handlerDir, { recursive: true });
+fs.mkdirSync(path.join(DOMAIN_ROOT, 'jobs'), { recursive: true });
+fs.mkdirSync(path.join(DOMAIN_ROOT, 'schedules'), { recursive: true });
+fs.writeFileSync(path.join(handlerDir, 'on-member-invited.ts'), 'export const onMemberInvited = { id: "on-member-invited", _kind: "subscriber", event: "auth.member.invited", semverRange: ">=1", handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'jobs', 'deliver-invitation-email.ts'), 'export const deliverInvitationEmail = { id: "deliver-invitation-email", _kind: "job", maxRetries: 5, visibilityTimeoutSeconds: 300, handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'schedules', 'dispatch-invitation-outbox.ts'), 'export const dispatchInvitationOutbox = { id: "dispatch-invitation-outbox", _kind: "schedule", cron: "rate(1 minute)", enabled: true, handler: async () => undefined };\n');
+fs.writeFileSync(path.join(DOMAIN_ROOT, 'schedules', 'reconcile-invitation-delivery.ts'), 'export const reconcileInvitationDelivery = { id: "reconcile-invitation-delivery", _kind: "schedule", cron: "rate(15 minutes)", enabled: true, handler: async () => undefined };\n');
+// Grouped Lambdas use Code.fromAsset('dist/domains/{domain}/{type}') — stub
+// the asset dirs so Template.fromStack can synth without a real bundle.
+const assetDirs = ['subscriber', 'schedule', 'job'].map(type => path.join(process.cwd(), 'dist', 'domains', 'auth', type));
+for (const dir of assetDirs) {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'index.js'), 'exports.handler = async () => ({});\n');
+}
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+    for (const dir of assetDirs) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+const EMAIL_ACTION_ARN = 'arn:aws:lambda:eu-north-1:123456789012:function:MTC-Dev-domain-email-actionapi';
+const authRegistry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: {
+        id: 'auth',
+        kind: 'domain',
+        name: 'Auth',
+        tenancy: 'required',
+        outboxTableName: 'auth.outbox',
+    },
+    webhooks: [],
+    subscribers: [
+        {
+            id: 'on-member-invited', kind: 'subscriber', handlerFile: 'subscribers/on-member-invited.ts',
+            event: 'auth.member.invited', semverRange: '>=1',
+        },
+    ],
+    schedules: [
+        {
+            id: 'dispatch-invitation-outbox', kind: 'schedule', handlerFile: 'schedules/dispatch-invitation-outbox.ts',
+            cron: 'rate(1 minute)', enabled: true,
+        },
+        {
+            id: 'reconcile-invitation-delivery', kind: 'schedule', handlerFile: 'schedules/reconcile-invitation-delivery.ts',
+            cron: 'rate(15 minutes)', enabled: true,
+        },
+    ],
+    jobs: [
+        {
+            id: 'deliver-invitation-email', kind: 'job', handlerFile: 'jobs/deliver-invitation-email.ts',
+            maxRetries: 5, visibilityTimeoutSeconds: 300,
+        },
+    ],
+    actions: [],
+    integrations: [],
+    events: [],
+};
+const app = new cdk.App();
+const stack = new DomainStack(app, 'InvitationDelivery5389Stack', {
+    registry: authRegistry,
+    eventBusArn: 'arn:aws:events:eu-north-1:123456789012:event-bus/tib-event-bus',
+    projectId: 'Test',
+    envCode: 'Dev',
+    alarmSnsTopicArn: 'arn:aws:sns:eu-north-1:123456789012:alerts',
+    crossDomainActionArns: { email: EMAIL_ACTION_ARN },
+});
+const template = Template.fromStack(stack);
+/**
+ * Identify the delivery JOB Lambda via its SQS event-source mapping (only
+ * the job consumes the JobQueue; env-var maps are injected into every
+ * domain Lambda, so they cannot identify it), then resolve its execution
+ * role logical id through the Lambda's Fn::GetAtt.
+ */
+function jobLambdaRoleLogicalId() {
+    const mappings = Object.values(template.findResources('AWS::Lambda::EventSourceMapping'));
+    const jobMapping = mappings.find(m => JSON.stringify(m.Properties.EventSourceArn ?? '').includes('JobQueue'));
+    expect(jobMapping, 'job SQS event-source mapping must exist').toBeDefined();
+    const jobLambdaLogicalId = jobMapping.Properties.FunctionName.Ref;
+    const lambdas = template.findResources('AWS::Lambda::Function');
+    const jobLambda = lambdas[jobLambdaLogicalId];
+    expect(jobLambda, `job Lambda resource ${jobLambdaLogicalId} must exist`).toBeDefined();
+    const roleRef = jobLambda.Properties.Role;
+    expect(roleRef['Fn::GetAtt'], 'job Lambda role must be a GetAtt reference').toBeDefined();
+    return roleRef['Fn::GetAtt'][0];
+}
+describe('DomainStack invitation-delivery wiring (#5389)', () => {
+    it('injects TIB_OUTBOX_TABLE=auth.outbox into the domain Lambdas', () => {
+        const envs = Object.values(template.findResources('AWS::Lambda::Function'))
+            .map(res => (res.Properties.Environment?.Variables ?? {}))
+            .filter(env => env.TIB_OUTBOX_TABLE !== undefined);
+        expect(envs.length).toBeGreaterThan(0);
+        for (const env of envs) {
+            expect(env.TIB_OUTBOX_TABLE).toBe('auth.outbox');
+        }
+    });
+    it('gives the delivery job queue+DLQ with maxReceiveCount = maxRetries + 1 (6)', () => {
+        const queues = Object.values(template.findResources('AWS::SQS::Queue'));
+        const redrive = queues
+            .map(q => q.Properties.RedrivePolicy?.maxReceiveCount)
+            .filter(v => v !== undefined)
+            .map(v => String(v));
+        expect(redrive).toContain('6');
+        // the job queue keeps its configured visibility timeout
+        expect(queues.some(q => q.Properties.VisibilityTimeout === 300)).toBe(true);
+    });
+    it('creates DLQ depth + oldest-age alarms for the delivery job wired to SNS', () => {
+        const alarms = Object.values(template.findResources('AWS::CloudWatch::Alarm'));
+        const depth = alarms.find(a => a.Properties.AlarmName?.includes('-job-deliver-invitation-email-dlq-depth'));
+        const age = alarms.find(a => a.Properties.AlarmName?.includes('-job-deliver-invitation-email-dlq-oldest-age'));
+        expect(depth).toBeDefined();
+        expect(age).toBeDefined();
+        expect(JSON.stringify(depth.Properties.AlarmActions)).toContain('alerts');
+    });
+    it('grants the JOB Lambda role cross-domain lambda:InvokeFunction on the resolved action ARNs (#5389 gap)', () => {
+        const jobRoleLogicalId = jobLambdaRoleLogicalId();
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const jobPolicy = policies.find(p => {
+            const roles = p.Properties.Roles;
+            return roles.some(r => (typeof r === 'string' ? r : r.Ref) === jobRoleLogicalId);
+        });
+        expect(jobPolicy, 'IAM policy attached to the job Lambda role must exist').toBeDefined();
+        const statements = jobPolicy.Properties.PolicyDocument.Statement;
+        const invokeStatements = statements.filter(s => (Array.isArray(s.Action) ? s.Action : [s.Action]).includes('lambda:InvokeFunction'));
+        expect(invokeStatements.length).toBeGreaterThan(0);
+        const resources = JSON.stringify(invokeStatements.map(s => s.Resource));
+        expect(resources).toContain('MTC-Dev-domain-email-actionapi');
+        // scoped to exact ARNs, never a wildcard
+        expect(resources).not.toContain('"*"');
+    });
+    it('synthesizes EventBridge Scheduler rules for the dispatcher and reconciliation schedules', () => {
+        const schedules = Object.values(template.findResources('AWS::Scheduler::Schedule'));
+        const expressions = schedules.map(s => s.Properties.ScheduleExpression);
+        expect(expressions).toContain('rate(1 minute)');
+        expect(expressions).toContain('rate(15 minutes)');
+    });
+    it('keeps the subscriber cross-domain grant (delivery mirror path) intact', () => {
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const invokeForSubscriber = policies.some(p => {
+            const statements = p.Properties.PolicyDocument.Statement;
+            return statements.some(s => (Array.isArray(s.Action) ? s.Action : [s.Action]).includes('lambda:InvokeFunction'));
+        });
+        expect(invokeForSubscriber).toBe(true);
+    });
+});

package/dist/index.d.ts

@@ -36,4 +36,4 @@ export type { DomainActionFlowNode, StepFunctionsTaskState } from './step-functi
 export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialDomainQueryStep, SerialAwsServiceStep, SerialFlowControlStep } from './flow-registry.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
 export type { PackFlowsOptions } from './pack-flows.js';
-export { domainResourceName } from './naming.js';
+export { domainResourceName, domainActionLambdaName, domainActionLambdaArn } from './naming.js';

package/dist/index.js

@@ -16,4 +16,4 @@ export { packDomain } from './pack-domain.js';
 export { validateRegistry } from './validate-registry.js';
 export { StepFunctionsCodegen } from './step-functions-codegen.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
-export { domainResourceName } from './naming.js';
+export { domainResourceName, domainActionLambdaName, domainActionLambdaArn } from './naming.js';

package/dist/naming.d.ts

@@ -9,3 +9,21 @@
  * (pack-flows domain-query grants) so the two can never drift.
  */
 export declare function domainResourceName(projectId: string, envCode: string, domainId: string): string;
+/**
+ * Deterministic physical name of a domain's internal-action grouped Lambda —
+ * the invoke target for cross-domain `ctx.actions.<domain>.<action>()`
+ * dispatch (#5226). DomainStack assigns this exact name via `functionName`,
+ * and callers building cross-domain ARNs MUST derive them from here rather
+ * than hand-assembling the pattern: the generated app constructed
+ * `…-domain-<id>-action`, which never matched the deployed `…-<id>-action`,
+ * so every subscriber cross-domain invoke targeted a phantom function
+ * (bootstrap invitation email dispatch, #5381).
+ */
+export declare function domainActionLambdaName(projectId: string, envCode: string, domainId: string): string;
+/**
+ * Cross-domain ARN for a domain's internal-action grouped Lambda, using
+ * account/region pseudo-parameters so it can be synthesized before the
+ * target stack exists. This is the canonical way to populate
+ * `PackDomainOptions.crossDomainActionArns`.
+ */
+export declare function domainActionLambdaArn(projectId: string, envCode: string, domainId: string): string;

package/dist/naming.js

@@ -1,3 +1,4 @@
+import * as cdk from 'aws-cdk-lib';
 /**
  * Canonical physical-name builder for per-domain AWS resources.
  *
@@ -11,3 +12,25 @@
 export function domainResourceName(projectId, envCode, domainId) {
     return `${projectId}-${envCode}-${domainId}`.toLowerCase();
 }
+/**
+ * Deterministic physical name of a domain's internal-action grouped Lambda —
+ * the invoke target for cross-domain `ctx.actions.<domain>.<action>()`
+ * dispatch (#5226). DomainStack assigns this exact name via `functionName`,
+ * and callers building cross-domain ARNs MUST derive them from here rather
+ * than hand-assembling the pattern: the generated app constructed
+ * `…-domain-<id>-action`, which never matched the deployed `…-<id>-action`,
+ * so every subscriber cross-domain invoke targeted a phantom function
+ * (bootstrap invitation email dispatch, #5381).
+ */
+export function domainActionLambdaName(projectId, envCode, domainId) {
+    return `${domainResourceName(projectId, envCode, domainId)}-action`;
+}
+/**
+ * Cross-domain ARN for a domain's internal-action grouped Lambda, using
+ * account/region pseudo-parameters so it can be synthesized before the
+ * target stack exists. This is the canonical way to populate
+ * `PackDomainOptions.crossDomainActionArns`.
+ */
+export function domainActionLambdaArn(projectId, envCode, domainId) {
+    return `arn:aws:lambda:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:function:${domainActionLambdaName(projectId, envCode, domainId)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.110",
+  "version": "0.2.112",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",