@mettlecast/domain-cdk-packer 0.2.53 → 0.2.54

package/dist/DomainStack.d.ts

@@ -27,6 +27,10 @@ export interface DomainStackProps extends cdk.StackProps {
     vpc?: ec2.IVpc;
     /** Security group for domain Lambdas — must allow egress to Aurora SG. */
     lambdaSg?: ec2.ISecurityGroup;
+    /** Subnet selection for VPC-attached handlers that should remain internal-only. */
+    internalSubnetSelection?: ec2.SubnetSelection;
+    /** Subnet selection for VPC-attached handlers that need NAT-backed internet egress. */
+    internetSubnetSelection?: ec2.SubnetSelection;
     /** Shared HTTP API Gateway — when provided, domain routes are added here instead of creating a separate API. */
     httpApi?: apigwv2.IHttpApi;
     /** Path to domain source root � defaults to ../../domains/{domainId}. */

package/dist/DomainStack.js

@@ -55,10 +55,8 @@ export class DomainStack extends cdk.Stack {
      */
     constructor(scope, id, props) {
         super(scope, id, props);
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, vpc, lambdaSg, httpApi, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, vpc, lambdaSg, internalSubnetSelection, internetSubnetSelection, httpApi, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
         const domainId = registry.domain.id;
-        const domainRoot = props.domainRoot ?? "../../../../domains/" + domainId;
-        const vpcProps = vpc ? { vpc, securityGroups: lambdaSg ? [lambdaSg] : undefined } : {};
         const allowedOrigins = corsAllowedOrigins ?? ['*'];
         this.httpApi = httpApi ?? new apigwv2.HttpApi(this, 'HttpApi', {
             apiName: `${domainId}-api`,
@@ -103,6 +101,50 @@ export class DomainStack extends cdk.Stack {
         if (dbSecretArn) {
             environment.DB_SECRET_ARN = dbSecretArn;
         }
+        const resolveSubnetSelection = (access) => {
+            if (access === 'internet')
+                return internetSubnetSelection ?? internalSubnetSelection;
+            return internalSubnetSelection ?? internetSubnetSelection;
+        };
+        const normaliseOutboundAccess = (access) => access === 'internet' ? 'internet' : 'internal';
+        const splitByOutboundAccess = (entries) => {
+            const buckets = { internal: [], internet: [] };
+            for (const entry of entries)
+                buckets[normaliseOutboundAccess(entry.outboundAccess)].push(entry);
+            return Object.entries(buckets).filter(([, grouped]) => grouped.length > 0).map(([outboundAccess, grouped]) => ({ outboundAccess, entries: grouped }));
+        };
+        const createPrimitiveHandlers = (entries, primitiveType) => {
+            const lambdas = [];
+            const byId = new Map();
+            for (const group of splitByOutboundAccess(entries)) {
+                const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated') || primitiveType === 'api';
+                const groupLambdas = createGroupedLambdas(this, {
+                    domainId,
+                    domainRoot: registry.domainRoot,
+                    primitiveType,
+                    handlerEntries: group.entries.map(entry => ({ id: entry.id, handlerFile: entry.handlerFile })),
+                    environment,
+                    eventBusArn,
+                    dedicated,
+                    reservedConcurrency,
+                    logRetentionDays: logRetentionDays ?? 30,
+                    lambdaGroupId: group.outboundAccess,
+                    ...(vpc ? {
+                        vpc,
+                        securityGroups: lambdaSg ? [lambdaSg] : undefined,
+                        subnetSelection: resolveSubnetSelection(group.outboundAccess),
+                    } : {}),
+                });
+                lambdas.push(...groupLambdas);
+                if (dedicated) {
+                    group.entries.forEach((entry, index) => byId.set(entry.id, groupLambdas[index]));
+                }
+                else {
+                    group.entries.forEach(entry => byId.set(entry.id, groupLambdas[0]));
+                }
+            }
+            return { lambdas, byId };
+        };
         // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key
         const domainTable = new dynamodb.Table(this, 'DomainTable', {
             tableName: `tib-${domainId}`,
@@ -152,21 +194,9 @@ export class DomainStack extends cdk.Stack {
         const allDlqs = [];
         // Deploy API endpoints as grouped Lambdas
         if (registry.apis.length > 0) {
-            apiLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'api',
-                handlerEntries: registry.apis.map(api => ({
-                    id: api.id,
-                    handlerFile: api.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: true,
-                domainRoot,
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const apiHandlers = createPrimitiveHandlers(registry.apis, 'api');
+            const apiLambdaById = apiHandlers.byId;
+            apiLambdas = apiHandlers.lambdas;
             this.lambdaArns[`${domainId}-api`] = apiLambdas[0].functionArn;
             // Wire each API Lambda to the HttpApi
             const iamPolicies = iamBuilder.forApi();
@@ -182,7 +212,7 @@ export class DomainStack extends cdk.Stack {
             }
             // Add routes for each API entry
             for (const api of registry.apis) {
-                const fn = apiLambdas[0]; // Grouped Lambda or first dedicated
+                const fn = apiLambdaById.get(api.id);
                 const apiRouteBase = {
                     path: api.path,
                     methods: [toHttpMethod(api.method)],
@@ -211,20 +241,9 @@ export class DomainStack extends cdk.Stack {
                 timeToLiveAttribute: 'expiresAt',
                 removalPolicy: cdk.RemovalPolicy.DESTROY,
             });
-            webhookLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'webhook',
-                handlerEntries: registry.webhooks.map(webhook => ({
-                    id: webhook.id,
-                    handlerFile: webhook.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: registry.webhooks.some(webhook => webhook.deployment?.isolation === 'dedicated'),
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const webhookHandlers = createPrimitiveHandlers(registry.webhooks, 'webhook');
+            const webhookLambdaById = webhookHandlers.byId;
+            webhookLambdas = webhookHandlers.lambdas;
             this.lambdaArns[`${domainId}-webhook`] = webhookLambdas[0].functionArn;
             // Wire each webhook Lambda to the HttpApi
             const iamPolicies = iamBuilder.forWebhook({ dedupeTableArn: dedupeTable.tableArn });
@@ -241,26 +260,15 @@ export class DomainStack extends cdk.Stack {
             }
             // Add routes for each webhook entry
             for (const webhook of registry.webhooks) {
-                const fn = webhookLambdas[0]; // Grouped Lambda or first dedicated
+                const fn = webhookLambdaById.get(webhook.id);
                 addRouteToApi(this, fn, `/${domainId}${webhook.path}`, [apigwv2.HttpMethod.POST], this.httpApi.httpApiId);
             }
         }
         // Deploy event subscribers as grouped Lambdas
         if (registry.subscribers.length > 0) {
-            subscriberLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'subscriber',
-                handlerEntries: registry.subscribers.map(subscriber => ({
-                    id: subscriber.id,
-                    handlerFile: subscriber.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: registry.subscribers.some(subscriber => subscriber.deployment?.isolation === 'dedicated'),
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const subscriberHandlers = createPrimitiveHandlers(registry.subscribers, 'subscriber');
+            const subscriberLambdaById = subscriberHandlers.byId;
+            subscriberLambdas = subscriberHandlers.lambdas;
             this.lambdaArns[`${domainId}-subscriber`] = subscriberLambdas[0].functionArn;
             // Wire EventBridge → SQS → Lambda for each subscriber
             for (const subscriber of registry.subscribers) {
@@ -283,7 +291,7 @@ export class DomainStack extends cdk.Stack {
                     encryptionMasterKey: enableCmk ? cmkKey : undefined,
                 });
                 // Add SQS as event source for the first grouped Lambda
-                const fn = subscriberLambdas[0];
+                const fn = subscriberLambdaById.get(subscriber.id);
                 fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
                     batchSize: 10,
                     maxConcurrency: subscriber.concurrency ?? 5,
@@ -308,20 +316,9 @@ export class DomainStack extends cdk.Stack {
         }
         // Deploy scheduled tasks as grouped Lambdas
         if (registry.schedules.length > 0) {
-            scheduleLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'schedule',
-                handlerEntries: registry.schedules.map(schedule => ({
-                    id: schedule.id,
-                    handlerFile: schedule.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: registry.schedules.some(schedule => schedule.deployment?.isolation === 'dedicated'),
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const scheduleHandlers = createPrimitiveHandlers(registry.schedules, 'schedule');
+            const scheduleLambdaById = scheduleHandlers.byId;
+            scheduleLambdas = scheduleHandlers.lambdas;
             this.lambdaArns[`${domainId}-schedule`] = scheduleLambdas[0].functionArn;
             const iamPolicies = iamBuilder.forSchedule();
             scheduleLambdas.forEach((fn) => {
@@ -337,7 +334,7 @@ export class DomainStack extends cdk.Stack {
             // Wire EventBridge Scheduler rules to Lambda
             for (const schedule of registry.schedules) {
                 const pascalId = toPascalCase(schedule.id);
-                const fn = scheduleLambdas[0]; // Grouped Lambda or first dedicated
+                const fn = scheduleLambdaById.get(schedule.id);
                 // Create a dedicated IAM role for the EventBridge Scheduler to assume
                 const schedulerRole = new iam.Role(this, `${pascalId}SchedulerRole`, {
                     assumedBy: new iam.ServicePrincipal('scheduler.amazonaws.com'),
@@ -359,20 +356,9 @@ export class DomainStack extends cdk.Stack {
         }
         // Deploy background jobs as grouped Lambdas
         if (registry.jobs.length > 0) {
-            jobLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'job',
-                handlerEntries: registry.jobs.map(job => ({
-                    id: job.id,
-                    handlerFile: job.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: registry.jobs.some(job => job.deployment?.isolation === 'dedicated'),
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const jobHandlers = createPrimitiveHandlers(registry.jobs, 'job');
+            const jobLambdaById = jobHandlers.byId;
+            jobLambdas = jobHandlers.lambdas;
             this.lambdaArns[`${domainId}-job`] = jobLambdas[0].functionArn;
             // Wire SQS → Lambda for each job
             for (const job of registry.jobs) {
@@ -395,7 +381,7 @@ export class DomainStack extends cdk.Stack {
                     encryptionMasterKey: enableCmk ? cmkKey : undefined,
                 });
                 // Add SQS as event source for the first grouped Lambda
-                const fn = jobLambdas[0];
+                const fn = jobLambdaById.get(job.id);
                 fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
                     batchSize: 1,
                 }));
@@ -413,20 +399,8 @@ export class DomainStack extends cdk.Stack {
         }
         // Deploy callable actions as grouped Lambdas
         if (registry.actions.length > 0) {
-            const actionLambdas = createGroupedLambdas(this, {
-                domainId,
-                primitiveType: 'action',
-                handlerEntries: registry.actions.map(action => ({
-                    id: action.id,
-                    handlerFile: action.handlerFile,
-                })),
-                environment,
-                eventBusArn,
-                dedicated: registry.actions.some(action => action.deployment?.isolation === 'dedicated'),
-                reservedConcurrency,
-                logRetentionDays: logRetentionDays ?? 30,
-                ...vpcProps,
-            });
+            const actionHandlers = createPrimitiveHandlers(registry.actions, 'action');
+            actionLambdas = actionHandlers.lambdas;
             this.lambdaArns[`${domainId}-action`] = actionLambdas[0].functionArn;
             const iamPolicies = iamBuilder.forAction([
                 `arn:aws:lambda:${this.region}:${this.account}:function:TIB-*-domain-*-action-*`,

package/dist/__tests__/domain-stack.test.js

@@ -1,10 +1,10 @@
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { describe, it, expect, afterAll } from 'vitest';
 import * as cdk from 'aws-cdk-lib';
 import { Template } from 'aws-cdk-lib/assertions';
 import fs from 'node:fs';
 import path from 'node:path';
 import { DomainStack } from '../DomainStack.js';
-const DOMAIN_ROOT = '/tmp/test-domain-cdk-packer';
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-domain-cdk-packer');
 const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
@@ -27,11 +27,9 @@ const minimalRegistry = {
     integrations: [],
     events: [],
 };
-beforeAll(() => {
-    const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
-    fs.mkdirSync(handlerDir, { recursive: true });
-    fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const handler = async () => ({ statusCode: 200 });\n');
-});
+const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
+fs.mkdirSync(handlerDir, { recursive: true });
+fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const getUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n');
 afterAll(() => {
     fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
 });
@@ -95,17 +93,9 @@ describe('DomainStack', () => {
             dbSecretArn,
         });
         const template = Template.fromStack(stack);
-        template.allResources('AWS::Lambda::Function', {
-            Environment: {
-                Variables: {
-                    Match: {
-                        stringLike: {
-                            DB_SECRET_ARN: dbSecretArn,
-                        },
-                    },
-                },
-            },
-        });
+        const lambdas = template.findResources('AWS::Lambda::Function');
+        const domainLambdas = Object.entries(lambdas).filter(([id]) => !id.includes('Health') && !id.includes('Ready') && !id.includes('LogRetention'));
+        expect(domainLambdas.some(([, resource]) => resource.Properties.Environment?.Variables?.DB_SECRET_ARN === dbSecretArn)).toBe(true);
     });
     it('secretsmanager:GetSecretValue grant added when dbSecretArn provided', () => {
         const app = new cdk.App();
@@ -116,24 +106,9 @@ describe('DomainStack', () => {
             dbSecretArn,
         });
         const template = Template.fromStack(stack);
-        template.allResources('AWS::IAM::Policy', {
-            PolicyDocument: {
-                Match: {
-                    objectLike: {
-                        Statement: [
-                            {
-                                Match: {
-                                    objectLike: {
-                                        Action: ['secretsmanager:GetSecretValue'],
-                                        Resource: [dbSecretArn],
-                                    },
-                                },
-                            },
-                        ],
-                    },
-                },
-            },
-        });
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const hasSecretGrant = policies.some(resource => resource.Properties.PolicyDocument.Statement.some(statement => statement.Action?.includes('secretsmanager:GetSecretValue') && statement.Resource?.includes(dbSecretArn)));
+        expect(hasSecretGrant).toBe(true);
     });
     describe('domain S3 bucket', () => {
         const app = new cdk.App();
@@ -166,55 +141,29 @@ describe('DomainStack', () => {
             const lambdas = template.findResources('AWS::Lambda::Function');
             for (const [id, res] of Object.entries(lambdas)) {
                 // Skip health/readiness Lambdas from HealthConstruct
-                if (id.includes('Health') || id.includes('Ready'))
+                if (id.includes('Health') || id.includes('Ready') || id.includes('LogRetention'))
                     continue;
-                expect(res.Properties.Environment.Variables).toHaveProperty('DOMAIN_TENANT_ROLE_ARN');
+                expect(res.Properties.Environment?.Variables).toHaveProperty('DOMAIN_TENANT_ROLE_ARN');
             }
         });
         it('grants Lambda execution roles sts:AssumeRole + sts:TagSession on the tenant-scoped role', () => {
-            template.hasResourceProperties('AWS::IAM::Policy', {
-                PolicyDocument: {
-                    Statement: expect.arrayContaining([
-                        expect.objectContaining({
-                            Action: expect.arrayContaining(['sts:AssumeRole', 'sts:TagSession']),
-                            Effect: 'Allow',
-                        }),
-                    ]),
-                },
-            });
+            const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+            const hasAssumeRoleGrant = policies.some(resource => resource.Properties.PolicyDocument.Statement.some(statement => statement.Effect === 'Allow'
+                && statement.Action?.includes('sts:AssumeRole')
+                && statement.Action?.includes('sts:TagSession')));
+            expect(hasAssumeRoleGrant).toBe(true);
         });
         it('tenant-scoped role has trust policy with request-tag condition', () => {
-            template.hasResourceProperties('AWS::IAM::Role', {
-                AssumeRolePolicyDocument: {
-                    Statement: expect.arrayContaining([
-                        expect.objectContaining({
-                            Action: expect.arrayContaining(['sts:AssumeRole', 'sts:TagSession']),
-                            Effect: 'Allow',
-                            Condition: expect.objectContaining({
-                                StringLike: expect.objectContaining({
-                                    'aws:RequestTag/tenantId': '*',
-                                }),
-                            }),
-                        }),
-                    ]),
-                },
-            });
+            const roles = Object.values(template.findResources('AWS::IAM::Role'));
+            const hasTrustCondition = roles.some(resource => resource.Properties.AssumeRolePolicyDocument.Statement.some(statement => statement.Action?.includes('sts:AssumeRole')
+                && statement.Action?.includes('sts:TagSession')
+                && statement.Condition?.StringLike?.['aws:RequestTag/tenantId'] === '*'));
+            expect(hasTrustCondition).toBe(true);
         });
         it('tenant-scoped role policy uses PrincipalTag conditions', () => {
-            template.hasResourceProperties('AWS::IAM::Policy', {
-                Roles: expect.arrayContaining([expect.objectContaining({ Ref: expect.any(String) })]),
-                PolicyDocument: {
-                    Statement: expect.arrayContaining([
-                        expect.objectContaining({
-                            Condition: expect.objectContaining({
-                                'ForAllValues:StringEquals': expect.objectContaining({
-                                    'dynamodb:LeadingKeys': ['${aws:PrincipalTag/tenantId}'],
-                                }),
-                            }),
-                        }),
-                    ]),
-                },
-            });
+            const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+            const hasPrincipalTagCondition = policies.some(resource => resource.Properties.PolicyDocument.Statement.some(statement => statement.Condition?.['ForAllValues:StringEquals']?.['dynamodb:LeadingKeys']?.includes('${aws:PrincipalTag/tenantId}')));
+            expect(hasPrincipalTagCondition).toBe(true);
         });
         it('has CfnOutput for tenant-scoped role ARN', () => {
             template.hasOutput('DomainTenantScopedRoleArn', {});

package/dist/grouped-lambda-factory.d.ts

@@ -28,6 +28,10 @@ export interface GroupedLambdaProps {
     vpc?: ec2.IVpc;
     /** Security groups to attach to the Lambda(s). */
     securityGroups?: ec2.ISecurityGroup[];
+    /** Subnet selection for the Lambda(s) when attached to a VPC. */
+    subnetSelection?: ec2.SubnetSelection;
+    /** Optional suffix used when multiple Lambda groups share the same primitive type. */
+    lambdaGroupId?: string;
     /** When true, creates one dedicated Lambda per handler instead of a single grouped Lambda. */
     dedicated?: boolean;
     /** Reserved concurrency for all Lambdas in this group. If omitted, no limit. */

package/dist/grouped-lambda-factory.js

@@ -3,19 +3,19 @@ import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import * as cdk from 'aws-cdk-lib';
 import { writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
+import { join, relative } from 'path';
 function camelCase(str) {
     return str.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
 function toPascalCase(str) {
     return str.charAt(0).toUpperCase() + camelCase(str).slice(1);
 }
-function generateDedicatedEntry(domainRoot, entry, primitiveType) {
+function generateDedicatedEntry(handlerImportPath, entry, primitiveType) {
     const exportName = camelCase(entry.id);
     if (primitiveType === 'schedule') {
         return [
             `import { hydrateCtx } from '@mettlecast/domain-runtime';`,
-            `import { ${exportName} } from '${domainRoot}/${entry.handlerFile}';`,
+            `import { ${exportName} } from '${handlerImportPath}';`,
             ``,
             `export const handler = async (event: any) => {`,
             `  const ctx = await hydrateCtx(event, {`,
@@ -36,17 +36,15 @@ function generateDedicatedEntry(domainRoot, entry, primitiveType) {
     const adapter = adapterMap[primitiveType] ?? 'createApiLambdaHandler';
     return [
         `import { ${adapter} } from '@mettlecast/domain-runtime';`,
-        `import { ${exportName} } from '${domainRoot}/${entry.handlerFile}';`,
+        `import { ${exportName} } from '${handlerImportPath}';`,
         '',
         `export const handler = ${adapter}(${exportName});`,
     ].join('\n');
 }
-function writeTempEntry(content) {
-    const dir = join('.tib', 'entries');
+function createTempEntryDir() {
+    const dir = join(process.cwd(), '.tib-domain-entries', `${Date.now()}-${Math.random().toString(36).slice(2)}`);
     mkdirSync(dir, { recursive: true });
-    const filePath = join(dir, `entry-${Date.now()}-${Math.random().toString(36).slice(2)}.ts`);
-    writeFileSync(filePath, content, 'utf8');
-    return filePath;
+    return dir;
 }
 const adapterCache = new Map();
 /**
@@ -57,18 +55,30 @@ const adapterCache = new Map();
  * Grouped mode retains Code.fromAsset for backward compatibility.
  */
 export function createGroupedLambdas(scope, props) {
-    const vpcConfig = props.vpc ? { vpc: props.vpc, securityGroups: props.securityGroups } : {};
+    const vpcConfig = props.vpc
+        ? {
+            vpc: props.vpc,
+            securityGroups: props.securityGroups,
+            ...(props.subnetSelection ? { vpcSubnets: props.subnetSelection } : {}),
+        }
+        : {};
     const logRetention = toLogRetention(props.logRetentionDays ?? 30);
     const powertoolsLayerArn = `arn:aws:lambda:${cdk.Stack.of(scope).region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:26`;
+    const groupSuffix = props.lambdaGroupId ? `-${props.lambdaGroupId}` : '';
+    const groupSuffixPascal = props.lambdaGroupId ? toPascalCase(props.lambdaGroupId) : '';
+    const serviceName = `${props.domainId}-${props.primitiveType}${groupSuffix}`;
     if (props.dedicated) {
         if (!props.domainRoot)
             throw new Error('domainRoot is required when dedicated=true');
         const domainRoot = props.domainRoot;
         const fns = props.handlerEntries.map(entry => {
-            const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}-${entry.id}`, powertoolsLayerArn);
-            const entryContent = generateDedicatedEntry(domainRoot, entry, props.primitiveType);
-            const entryPath = writeTempEntry(entryContent);
-            return new lambdaNode.NodejsFunction(scope, `${props.domainId}-${props.primitiveType}-${entry.id}`, {
+            const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}${groupSuffixPascal}-${entry.id}`, powertoolsLayerArn);
+            const entryDir = createTempEntryDir();
+            const entryPath = join(entryDir, 'entry.ts');
+            const handlerImportPath = relative(entryDir, join(domainRoot, entry.handlerFile)).replace(/\\/g, '/');
+            const entryContent = generateDedicatedEntry(handlerImportPath.startsWith('.') ? handlerImportPath : `./${handlerImportPath}`, entry, props.primitiveType);
+            writeFileSync(entryPath, entryContent, 'utf8');
+            return new lambdaNode.NodejsFunction(scope, `${props.domainId}-${props.primitiveType}${groupSuffix}-${entry.id}`, {
                 runtime: lambda.Runtime.NODEJS_22_X,
                 architecture: lambda.Architecture.ARM_64,
                 entry: entryPath,
@@ -81,7 +91,7 @@ export function createGroupedLambdas(scope, props) {
                 },
                 environment: {
                     ...props.environment,
-                    POWERTOOLS_SERVICE_NAME: `${props.domainId}-${props.primitiveType}`,
+                    POWERTOOLS_SERVICE_NAME: serviceName,
                     POWERTOOLS_LOG_LEVEL: 'INFO',
                     TIB_HANDLER_ID: entry.id,
                     TIB_EVENT_BUS_ARN: props.eventBusArn,
@@ -96,9 +106,9 @@ export function createGroupedLambdas(scope, props) {
         return fns;
     }
     // Single grouped Lambda — all handlers for this primitive type bundled together
-    const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}`, powertoolsLayerArn);
+    const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-${props.primitiveType}${groupSuffixPascal}`, powertoolsLayerArn);
     return [
-        new lambda.Function(scope, `${props.domainId}-${props.primitiveType}`, {
+        new lambda.Function(scope, `${props.domainId}-${props.primitiveType}${groupSuffix}`, {
             runtime: lambda.Runtime.NODEJS_22_X,
             architecture: lambda.Architecture.ARM_64,
             handler: 'index.handler',
@@ -106,7 +116,7 @@ export function createGroupedLambdas(scope, props) {
             layers: [powertoolsLayer],
             environment: {
                 ...props.environment,
-                POWERTOOLS_SERVICE_NAME: `${props.domainId}-${props.primitiveType}`,
+                POWERTOOLS_SERVICE_NAME: serviceName,
                 POWERTOOLS_LOG_LEVEL: 'INFO',
                 TIB_HANDLER_MAP: JSON.stringify(props.handlerEntries.map(e => e.id)),
                 TIB_EVENT_BUS_ARN: props.eventBusArn,

package/dist/pack-domain.d.ts

@@ -13,6 +13,10 @@ export interface PackDomainOptions {
     vpc?: ec2.IVpc;
     /** Security group for domain Lambdas. */
     lambdaSg?: ec2.ISecurityGroup;
+    /** Subnet selection for VPC-attached handlers that should remain internal-only. */
+    internalSubnetSelection?: ec2.SubnetSelection;
+    /** Subnet selection for VPC-attached handlers that need NAT-backed internet egress. */
+    internetSubnetSelection?: ec2.SubnetSelection;
     /** Shared HTTP API Gateway — when provided, domain routes use this instead of creating a separate API. */
     httpApi?: apigwv2.HttpApi;
     /** Cognito User Pool ARN — when provided, HTTP API routes are JWT-protected. */

package/dist/pack-domain.js

@@ -24,6 +24,8 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         env: opts.env,
         vpc: opts.vpc,
         lambdaSg: opts.lambdaSg,
+        internalSubnetSelection: opts.internalSubnetSelection,
+        internetSubnetSelection: opts.internetSubnetSelection,
         httpApi: opts.httpApi,
         userPoolArn: opts.userPoolArn,
         userPoolId: opts.userPoolId,

package/dist/registry.d.ts

@@ -6,6 +6,8 @@ export type SchemaSnapshot = Record<string, unknown>;
  * Kind discriminant for registry entries.
  */
 export type RegistryEntryKind = 'api' | 'webhook' | 'subscriber' | 'schedule' | 'job' | 'action' | 'integration' | 'event' | 'domain';
+/** Controls whether a VPC-attached handler may use NAT-backed public internet egress. */
+export type RegistryOutboundAccess = 'internal' | 'internet';
 /**
  * Plain-value subset of DeploymentConfig for serialization.
  */
@@ -63,6 +65,8 @@ export interface ApiRegistryEntry extends BaseRegistryEntry {
     authType: 'jwt' | 'api-key' | 'none';
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
     /** JSON Schema snapshot for the HTTP request body. */
     requestSchema?: SchemaSnapshot;
     /** JSON Schema snapshot for the HTTP response body. */
@@ -93,6 +97,8 @@ export interface WebhookRegistryEntry extends BaseRegistryEntry {
     hmacSecretRef?: string;
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
 }
 /**
  * Event subscriber registry entry.
@@ -110,6 +116,8 @@ export interface SubscriberRegistryEntry extends BaseRegistryEntry {
     concurrency?: number;
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
 }
 /**
  * Schedule (cron) registry entry.
@@ -125,6 +133,8 @@ export interface ScheduleRegistryEntry extends BaseRegistryEntry {
     enabled: boolean;
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
 }
 /**
  * Background job registry entry.
@@ -140,6 +150,8 @@ export interface JobRegistryEntry extends BaseRegistryEntry {
     visibilityTimeoutSeconds: number;
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
 }
 /**
  * Action registry entry for callable domain actions.
@@ -155,6 +167,8 @@ export interface ActionRegistryEntry extends BaseRegistryEntry {
     idempotent: boolean;
     /** Optional deployment overrides. */
     deployment?: SerialDeploymentConfig;
+    /** Whether this handler may use NAT-backed public internet egress. */
+    outboundAccess?: RegistryOutboundAccess;
     /** JSON Schema snapshot for the action input. */
     inputSchema?: SchemaSnapshot;
     /** JSON Schema snapshot for the action output. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.53",
+  "version": "0.2.54",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",