@mettlecast/domain-cdk-packer 0.2.55 → 0.2.57

package/dist/DomainStack.d.ts

@@ -33,6 +33,18 @@ export interface DomainStackProps extends cdk.StackProps {
     internetSubnetSelection?: ec2.SubnetSelection;
     /** Shared HTTP API Gateway — when provided, domain routes are added here instead of creating a separate API. */
     httpApi?: apigwv2.IHttpApi;
+    /** Raw VPC id — when provided, the VPC is imported inside this stack's scope. */
+    vpcId?: string;
+    /** Availability zones for the imported shared VPC. */
+    vpcAvailabilityZones?: string[];
+    /** Private subnet ids for the imported shared VPC. */
+    vpcPrivateSubnetIds?: string[];
+    /** Raw Lambda security group id — imported inside this stack's scope. */
+    lambdaSgId?: string;
+    /** Raw HTTP API id — imported inside this stack's scope. */
+    httpApiId?: string;
+    /** HTTP API endpoint URL paired with httpApiId. */
+    httpApiUrl?: string;
     /** Path to domain source root � defaults to ../../domains/{domainId}. */
     domainRoot?: string;
     /** Enable CMK encryption for DynamoDB, S3, SQS. */
@@ -60,6 +72,16 @@ export interface DomainStackProps extends cdk.StackProps {
      * Requires corsAllowedOrigins to be a non-wildcard list.
      */
     allowCredentials?: boolean;
+    /**
+     * Project id used to prefix per-domain physical resource names (e.g. `mtc-dev-data-management`).
+     * Defaults to the first segment of the stack name; falls back to `tib` when not derivable.
+     */
+    projectId?: string;
+    /**
+     * Environment code used to prefix per-domain physical resource names (e.g. `dev`, `prod`).
+     * Defaults to the second segment of the stack name; falls back to `dev` when not derivable.
+     */
+    envCode?: string;
 }
 export declare class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */

package/dist/DomainStack.js

@@ -9,6 +9,7 @@ import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as scheduler from 'aws-cdk-lib/aws-scheduler';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import { createGroupedLambdas } from './grouped-lambda-factory.js';
 import { IamPolicyBuilder } from './iam/iam-policy-builder.js';
@@ -18,6 +19,7 @@ import { CmkConstruct } from './constructs/cmk-construct.js';
 import { WafConstruct } from './constructs/waf-construct.js';
 import { AlarmConstruct } from './constructs/alarm-construct.js';
 import { CanaryConstruct } from './constructs/canary-construct.js';
+import { domainResourceName } from './naming.js';
 /**
  * Top-level CDK Stack that composes all domain constructs from a single DomainRegistry input.
  * Uses grouped Lambdas for each primitive type to reduce deployment artifact size.
@@ -55,8 +57,27 @@ export class DomainStack extends cdk.Stack {
      */
     constructor(scope, id, props) {
         super(scope, id, props);
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, vpc, lambdaSg, internalSubnetSelection, internetSubnetSelection, httpApi, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
+        const vpc = props.vpc ?? (props.vpcId
+            ? ec2.Vpc.fromVpcAttributes(this, 'SharedVpc', {
+                vpcId: props.vpcId,
+                availabilityZones: props.vpcAvailabilityZones ?? [cdk.Fn.select(0, cdk.Fn.getAzs()), cdk.Fn.select(1, cdk.Fn.getAzs())],
+                privateSubnetIds: props.vpcPrivateSubnetIds ?? [],
+            })
+            : undefined);
+        const lambdaSg = props.lambdaSg ?? (props.lambdaSgId
+            ? ec2.SecurityGroup.fromSecurityGroupId(this, 'LambdaSg', props.lambdaSgId)
+            : undefined);
+        const httpApi = props.httpApi ?? (props.httpApiId
+            ? apigwv2.HttpApi.fromHttpApiAttributes(this, 'SharedHttpApi', {
+                httpApiId: props.httpApiId,
+                apiEndpoint: props.httpApiUrl,
+            })
+            : undefined);
         const domainId = registry.domain.id;
+        const projectId = props.projectId ?? this.stackName.split('-')[0] ?? 'tib';
+        const envCode = props.envCode ?? this.stackName.split('-')[1] ?? 'dev';
+        const resourceBaseName = domainResourceName(projectId, envCode, domainId);
         const allowedOrigins = corsAllowedOrigins ?? ['*'];
         this.httpApi = httpApi ?? new apigwv2.HttpApi(this, 'HttpApi', {
             apiName: `${domainId}-api`,
@@ -78,7 +99,7 @@ export class DomainStack extends cdk.Stack {
         }
         // Optional WAF
         if (enableWaf) {
-            new WafConstruct(this, 'Waf', { domainId, httpApi: this.httpApi });
+            new WafConstruct(this, 'Waf', { domainId, namePrefix: resourceBaseName, httpApi: this.httpApi });
         }
         // Optional CMK — customer-managed encryption key for DynamoDB, S3, SQS
         let cmkKey;
@@ -147,7 +168,7 @@ export class DomainStack extends cdk.Stack {
         };
         // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key
         const domainTable = new dynamodb.Table(this, 'DomainTable', {
-            tableName: `tib-${domainId}`,
+            tableName: resourceBaseName,
             partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
             sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
             billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
@@ -158,9 +179,9 @@ export class DomainStack extends cdk.Stack {
             pointInTimeRecovery: true,
         });
         // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime
-        const bucketName = `tib-${domainId}`.length <= 63
-            ? `tib-${domainId}`
-            : `tib-${domainId.slice(0, 55)}-${cdk.Fn.select(0, cdk.Fn.split('-', cdk.Names.uniqueId(this))).toLowerCase()}`;
+        const bucketName = resourceBaseName.length <= 63
+            ? resourceBaseName
+            : `${resourceBaseName.slice(0, 55)}-${cdk.Fn.select(0, cdk.Fn.split('-', cdk.Names.uniqueId(this))).toLowerCase()}`;
         const domainBucket = new s3.Bucket(this, 'DomainBucket', {
             bucketName,
             blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
@@ -177,7 +198,7 @@ export class DomainStack extends cdk.Stack {
         environment['DOMAIN_BUCKET_NAME'] = domainBucket.bucketName;
         // Per-domain tenant-scoped IAM role for defence-in-depth storage segregation
         const tenantScopedRole = new iam.Role(this, 'DomainTenantScopedRole', {
-            roleName: `tib-${domainId}-tenant-scoped`,
+            roleName: `${resourceBaseName}-tenant-scoped`,
             assumedBy: new iam.AccountPrincipal(cdk.Stack.of(this).account),
             description: `Tenant-scoped role for ${domainId} domain. Only assumable with tenantId session tag.`,
             maxSessionDuration: cdk.Duration.hours(1),
@@ -461,6 +482,7 @@ export class DomainStack extends cdk.Stack {
         if (enableAlarms) {
             alarmConstruct = new AlarmConstruct(this, 'Alarms', {
                 domainId,
+                namePrefix: resourceBaseName,
                 lambdaFunctions: allDomainLambdas,
                 dlqs: allDlqs,
                 snsTopicArn: alarmSnsTopicArn,
@@ -471,6 +493,7 @@ export class DomainStack extends cdk.Stack {
         if (enableCanaryDeploy) {
             new CanaryConstruct(this, 'Canary', {
                 domainId,
+                namePrefix: resourceBaseName,
                 lambdaFunctions: allDomainLambdas,
                 rollbackAlarms: alarmConstruct?.alarms ?? [],
             });

package/dist/__tests__/domain-stack.test.js

@@ -134,7 +134,7 @@ describe('DomainStack', () => {
         const template = Template.fromStack(stack);
         it('creates a tenant-scoped IAM role', () => {
             template.hasResourceProperties('AWS::IAM::Role', {
-                RoleName: 'tib-test-domain-tenant-scoped',
+                RoleName: 'testdomainstacktenant-dev-test-domain-tenant-scoped',
             });
         });
         it('sets DOMAIN_TENANT_ROLE_ARN env var on each Lambda', () => {

package/dist/constructs/alarm-construct.d.ts

@@ -4,6 +4,8 @@ import * as lambda from 'aws-cdk-lib/aws-lambda';
 import { Construct } from 'constructs';
 export interface AlarmConstructProps {
     domainId: string;
+    /** Project/env/domain-qualified lowercased prefix (from domainResourceName) used in alarm names. */
+    namePrefix: string;
     lambdaFunctions: lambda.Function[];
     dlqs: sqs.Queue[];
     /** SNS topic ARN for alarm notifications. If omitted, alarms are created without actions. */

package/dist/constructs/alarm-construct.js

@@ -16,7 +16,7 @@ export class AlarmConstruct extends Construct {
         // DLQ depth alarms — fire immediately when any message lands in DLQ
         for (const dlq of props.dlqs) {
             const alarm = new cloudwatch.Alarm(this, `DlqAlarm-${dlq.node.id}`, {
-                alarmName: `tib-${props.domainId}-dlq-${dlq.node.id}-depth`,
+                alarmName: `${props.namePrefix}-dlq-${dlq.node.id}-depth`,
                 alarmDescription: `DLQ ${dlq.node.id} has messages — investigate failed processing`,
                 metric: dlq.metricApproximateNumberOfMessagesVisible({
                     period: cdk.Duration.minutes(1),
@@ -35,7 +35,7 @@ export class AlarmConstruct extends Construct {
         const errorThreshold = props.errorRateThreshold ?? 0.01;
         for (const fn of props.lambdaFunctions) {
             const errorAlarm = new cloudwatch.Alarm(this, `ErrorAlarm-${fn.node.id}`, {
-                alarmName: `tib-${props.domainId}-${fn.node.id}-error-rate`,
+                alarmName: `${props.namePrefix}-${fn.node.id}-error-rate`,
                 alarmDescription: `Lambda ${fn.node.id} error rate exceeded ${errorThreshold * 100}%`,
                 metric: new cloudwatch.MathExpression({
                     expression: 'errors / invocations',

package/dist/constructs/canary-construct.d.ts

@@ -3,6 +3,8 @@ import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
 import { Construct } from 'constructs';
 export interface CanaryConstructProps {
     domainId: string;
+    /** Project/env/domain-qualified lowercased prefix (from domainResourceName) used in CodeDeploy application name. */
+    namePrefix: string;
     lambdaFunctions: lambda.Function[];
     /** CloudWatch alarms that trigger auto-rollback. Typically from AlarmConstruct. */
     rollbackAlarms?: cloudwatch.Alarm[];

package/dist/constructs/canary-construct.js

@@ -6,7 +6,7 @@ export class CanaryConstruct extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         const app = new codedeploy.LambdaApplication(this, 'DeployApp', {
-            applicationName: `tib-${props.domainId}`,
+            applicationName: props.namePrefix,
         });
         for (const fn of props.lambdaFunctions) {
             const alias = new lambda.Alias(this, `${fn.node.id}LiveAlias`, {

package/dist/constructs/waf-construct.d.ts

@@ -3,6 +3,8 @@ import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import { Construct } from 'constructs';
 export interface WafConstructProps {
     domainId: string;
+    /** Project/env/domain-qualified lowercased prefix (from domainResourceName) used in WAF names and metrics. */
+    namePrefix: string;
     httpApi: apigwv2.IHttpApi;
     /** Requests per 5-minute window per IP before blocking. Default: 2000. */
     rateLimit?: number;

package/dist/constructs/waf-construct.js

@@ -7,13 +7,13 @@ export class WafConstruct extends Construct {
         super(scope, id);
         const rateLimit = props.rateLimit ?? 2000;
         this.webAcl = new wafv2.CfnWebACL(this, 'WebAcl', {
-            name: `tib-${props.domainId}-waf`,
+            name: `${props.namePrefix}-waf`,
             scope: 'REGIONAL',
             defaultAction: { allow: {} },
             visibilityConfig: {
                 sampledRequestsEnabled: true,
                 cloudWatchMetricsEnabled: true,
-                metricName: `tib-${props.domainId}-waf`,
+                metricName: `${props.namePrefix}-waf`,
             },
             rules: [
                 {
@@ -29,7 +29,7 @@ export class WafConstruct extends Construct {
                     visibilityConfig: {
                         sampledRequestsEnabled: true,
                         cloudWatchMetricsEnabled: true,
-                        metricName: `tib-${props.domainId}-common-rules`,
+                        metricName: `${props.namePrefix}-common-rules`,
                     },
                 },
                 {
@@ -45,7 +45,7 @@ export class WafConstruct extends Construct {
                     visibilityConfig: {
                         sampledRequestsEnabled: true,
                         cloudWatchMetricsEnabled: true,
-                        metricName: `tib-${props.domainId}-bad-inputs`,
+                        metricName: `${props.namePrefix}-bad-inputs`,
                     },
                 },
                 {
@@ -61,7 +61,7 @@ export class WafConstruct extends Construct {
                     visibilityConfig: {
                         sampledRequestsEnabled: true,
                         cloudWatchMetricsEnabled: true,
-                        metricName: `tib-${props.domainId}-rate-limit`,
+                        metricName: `${props.namePrefix}-rate-limit`,
                     },
                 },
             ],

package/dist/index.d.ts

@@ -34,3 +34,4 @@ export type { DomainActionFlowNode, StepFunctionsTaskState } from './step-functi
 export type { FlowRegistry, FlowRegistryEntry, SerialFlowStep, SerialDomainActionStep, SerialDomainApiStep, SerialDomainEventStep, SerialDomainQueryStep, SerialAwsServiceStep, SerialFlowControlStep } from './flow-registry.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
 export type { PackFlowsOptions } from './pack-flows.js';
+export { domainResourceName } from './naming.js';

package/dist/index.js

@@ -15,3 +15,4 @@ export { DomainStack } from './DomainStack.js';
 export { packDomain } from './pack-domain.js';
 export { StepFunctionsCodegen } from './step-functions-codegen.js';
 export { FlowsStack, packFlows } from './pack-flows.js';
+export { domainResourceName } from './naming.js';

package/dist/naming.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Canonical physical-name builder for per-domain AWS resources.
+ *
+ * Project/env-qualified + lowercased so names are unique per project and
+ * environment and never collide globally (S3) or across environments.
+ *
+ * Used by BOTH the resource constructors (DomainStack table/bucket/role,
+ * WAF/canary/alarm constructs) AND the IAM ARNs that grant access to them
+ * (pack-flows domain-query grants) so the two can never drift.
+ */
+export declare function domainResourceName(projectId: string, envCode: string, domainId: string): string;

package/dist/naming.js

@@ -0,0 +1,13 @@
+/**
+ * Canonical physical-name builder for per-domain AWS resources.
+ *
+ * Project/env-qualified + lowercased so names are unique per project and
+ * environment and never collide globally (S3) or across environments.
+ *
+ * Used by BOTH the resource constructors (DomainStack table/bucket/role,
+ * WAF/canary/alarm constructs) AND the IAM ARNs that grant access to them
+ * (pack-flows domain-query grants) so the two can never drift.
+ */
+export function domainResourceName(projectId, envCode, domainId) {
+    return `${projectId}-${envCode}-${domainId}`.toLowerCase();
+}

package/dist/pack-domain.d.ts

@@ -19,6 +19,18 @@ export interface PackDomainOptions {
     internetSubnetSelection?: ec2.SubnetSelection;
     /** Shared HTTP API Gateway — when provided, domain routes use this instead of creating a separate API. */
     httpApi?: apigwv2.HttpApi;
+    /** Raw VPC id for importing a shared VPC inside the stack scope (avoids App-scope import errors). */
+    vpcId?: string;
+    /** Availability zones for the imported shared VPC. */
+    vpcAvailabilityZones?: string[];
+    /** Private subnet ids for the imported shared VPC. */
+    vpcPrivateSubnetIds?: string[];
+    /** Raw security group id for importing the shared Lambda SG inside the stack scope. */
+    lambdaSgId?: string;
+    /** Raw HTTP API id for importing the shared HTTP API inside the stack scope. */
+    httpApiId?: string;
+    /** HTTP API endpoint URL paired with httpApiId. */
+    httpApiUrl?: string;
     /** Cognito User Pool ARN — when provided, HTTP API routes are JWT-protected. */
     userPoolArn?: string;
     /** Cognito User Pool ID — preferred over parsing userPoolArn for JWT authorizer issuer. */
@@ -31,6 +43,10 @@ export interface PackDomainOptions {
     dbSecretArn?: string;
     /** EventBridge bus name; avoids ARN parsing when ARN is a dynamic reference. */
     eventBusName?: string;
+    /** Project id used to prefix per-domain physical resource names (e.g. `mtc-dev-data-management`). */
+    projectId?: string;
+    /** Environment code used to prefix per-domain physical resource names (e.g. `dev`, `prod`). */
+    envCode?: string;
 }
 /**
  * Convenience entry-point: constructs a DomainStack from a compiled registry.

package/dist/pack-domain.js

@@ -27,11 +27,19 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         internalSubnetSelection: opts.internalSubnetSelection,
         internetSubnetSelection: opts.internetSubnetSelection,
         httpApi: opts.httpApi,
+        vpcId: opts.vpcId,
+        vpcAvailabilityZones: opts.vpcAvailabilityZones,
+        vpcPrivateSubnetIds: opts.vpcPrivateSubnetIds,
+        lambdaSgId: opts.lambdaSgId,
+        httpApiId: opts.httpApiId,
+        httpApiUrl: opts.httpApiUrl,
         userPoolArn: opts.userPoolArn,
         userPoolId: opts.userPoolId,
         userPoolClientId: opts.userPoolClientId,
         databaseUrl: opts.databaseUrl,
         dbSecretArn: opts.dbSecretArn,
         eventBusName: opts.eventBusName,
+        projectId: opts.projectId,
+        envCode: opts.envCode,
     });
 }

package/dist/pack-flows.d.ts

@@ -8,6 +8,10 @@ export interface PackFlowsOptions {
     domainLambdaArns: Record<string, string>;
     /** EventBridge bus ARN for domain-event steps and triggers. */
     eventBusArn: string;
+    /** Project id used to prefix per-domain physical resource names (e.g. `mtc-dev-data-management`). */
+    projectId?: string;
+    /** Environment code used to prefix per-domain physical resource names (e.g. `dev`, `prod`). */
+    envCode?: string;
 }
 /** CDK stack containing one Step Functions state machine per flow in the registry. */
 export declare class FlowsStack extends cdk.Stack {
@@ -15,6 +19,8 @@ export declare class FlowsStack extends cdk.Stack {
     readonly flowArnMap: Record<string, string>;
     readonly taskTokensTableName: string;
     readonly taskTokensTableArn: string;
+    private readonly projectId;
+    private readonly envCode;
     constructor(scope: Construct, id: string, props: {
         registry: FlowRegistry;
         options: PackFlowsOptions;

package/dist/pack-flows.js

@@ -4,15 +4,20 @@ import * as sfn from 'aws-cdk-lib/aws-stepfunctions';
 import * as events from 'aws-cdk-lib/aws-events';
 import * as eventsTargets from 'aws-cdk-lib/aws-events-targets';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import { domainResourceName } from './naming.js';
 /** CDK stack containing one Step Functions state machine per flow in the registry. */
 export class FlowsStack extends cdk.Stack {
     /** Map of flow id -> SFN ARN. Used by domain Lambdas via FLOWS_SFN_ARN_MAP env var. */
     flowArnMap = {};
     taskTokensTableName;
     taskTokensTableArn;
+    projectId;
+    envCode;
     constructor(scope, id, props) {
         super(scope, id, props);
         const { registry, options } = props;
+        this.projectId = options.projectId ?? this.stackName.split('-')[0] ?? 'tib';
+        this.envCode = options.envCode ?? this.stackName.split('-')[1] ?? 'dev';
         // DDB table for WaitForTaskToken task token persistence
         const taskTokensTable = new dynamodb.Table(this, 'FlowTaskTokensTable', {
             tableName: `${this.stackName}-task-tokens`,
@@ -78,18 +83,20 @@ export class FlowsStack extends cdk.Stack {
             }
         }
         for (const domainId of ddbDomains) {
+            const tableName = domainResourceName(this.projectId, this.envCode, domainId);
             stateMachine.addToRolePolicy(new iam.PolicyStatement({
                 actions: ['dynamodb:GetItem', 'dynamodb:Query'],
                 resources: [
-                    this.formatArn({ service: 'dynamodb', resource: `table/tib-${domainId}` }),
-                    this.formatArn({ service: 'dynamodb', resource: `table/tib-${domainId}/index/*` }),
+                    this.formatArn({ service: 'dynamodb', resource: `table/${tableName}` }),
+                    this.formatArn({ service: 'dynamodb', resource: `table/${tableName}/index/*` }),
                 ],
             }));
         }
         for (const domainId of s3Domains) {
+            const bucketName = domainResourceName(this.projectId, this.envCode, domainId);
             stateMachine.addToRolePolicy(new iam.PolicyStatement({
                 actions: ['s3:GetObject'],
-                resources: [`arn:aws:s3:::tib-${domainId}/*`],
+                resources: [`arn:aws:s3:::${bucketName}/*`],
             }));
         }
         // Grant IAM for aws-service steps
@@ -261,7 +268,7 @@ export class FlowsStack extends cdk.Stack {
     translateDomainQuery(step, flowId) {
         switch (step.queryType) {
             case 'dynamodb-get-item': {
-                const tableName = `tib-${step.domainId}`;
+                const tableName = domainResourceName(this.projectId, this.envCode, step.domainId);
                 const key = {};
                 for (const [k, v] of Object.entries(step.key)) {
                     key[k] = v.startsWith('$') ? { 'S.$': v } : { S: v };
@@ -277,7 +284,7 @@ export class FlowsStack extends cdk.Stack {
                 return getItem;
             }
             case 'dynamodb-query': {
-                const tableName = `tib-${step.domainId}`;
+                const tableName = domainResourceName(this.projectId, this.envCode, step.domainId);
                 const eav = {};
                 for (const [k, v] of Object.entries(step.expressionAttributeValues)) {
                     eav[k] = v.value.startsWith('$') ? { [`${v.type}.$`]: v.value } : { [v.type]: v.value };
@@ -308,7 +315,7 @@ export class FlowsStack extends cdk.Stack {
                 return query;
             }
             case 's3-get-object': {
-                const bucketName = `tib-${step.domainId}`;
+                const bucketName = domainResourceName(this.projectId, this.envCode, step.domainId);
                 const getObject = {
                     Type: 'Task',
                     Resource: 'arn:aws:states:::aws-sdk:s3:getObject',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.55",
+  "version": "0.2.57",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",