@mettlecast/domain-cdk-packer 0.2.61 → 0.2.63

package/dist/DomainStack.d.ts

@@ -82,6 +82,11 @@ export interface DomainStackProps extends cdk.StackProps {
      * Defaults to the second segment of the stack name; falls back to `dev` when not derivable.
      */
     envCode?: string;
+    /**
+     * When true, disables the auto-generated per-domain CloudWatch dashboard.
+     * Existing dashboards will be removed on the next CDK deploy.
+     */
+    disableCloudWatchDashboards?: boolean;
 }
 export declare class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */

package/dist/DomainStack.js

@@ -64,7 +64,7 @@ export class DomainStack extends cdk.Stack {
      */
     constructor(scope, id, props) {
         super(scope, id, props);
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards } = props;
         const vpc = props.vpc ?? (props.vpcId
             ? ec2.Vpc.fromVpcAttributes(this, 'SharedVpc', {
                 vpcId: props.vpcId,
@@ -124,12 +124,15 @@ export class DomainStack extends cdk.Stack {
         // Determine whether any route in this domain requires a JWT authorizer.
         // If so and `jwtAuth` is undefined, emit a synth-time error so missing Cognito
         // configuration fails fast instead of producing an unauthenticated route.
-        const apiNeedsJwt = registry.apis.some(api => api.authType === 'jwt');
+        //
+        // Issue #4689: only API-exposed actions (`exposure.auth === 'required'`)
+        // contribute to this check. Legacy `registry.apis` rows are always
+        // empty in fresh registries, so checking them would never fire.
         const actionNeedsJwt = registry.actions.some(a => a.exposure?.type === 'api' && a.exposure.auth === 'required');
-        const anyRouteRequiresJwt = apiNeedsJwt || actionNeedsJwt;
+        const anyRouteRequiresJwt = actionNeedsJwt;
         if (anyRouteRequiresJwt && !jwtAuth) {
             cdk.Annotations.of(this).addError(`[DomainStack] Domain "${domainId}" declares one or more JWT-protected routes ` +
-                `(api.authType='jwt' or action.exposure.auth='required') but no Cognito user pool is ` +
+                `(action.exposure.auth='required') but no Cognito user pool is ` +
                 `configured. Provide userPoolArn/userPoolId AND userPoolClientId to DomainStackProps.`);
         }
         // Issue #4662 Task D — deployment-time security assertions. The aspect
@@ -190,7 +193,6 @@ export class DomainStack extends cdk.Stack {
                 const hasApiExposedAction = primitiveType === 'action'
                     && group.entries.some(e => e.adapter === 'createExposedActionApiHandler');
                 const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated')
-                    || primitiveType === 'api'
                     || hasApiExposedAction;
                 const groupLambdas = createGroupedLambdas(this, {
                     domainId,
@@ -266,7 +268,6 @@ export class DomainStack extends cdk.Stack {
         });
         environment['DOMAIN_TENANT_ROLE_ARN'] = tenantScopedRole.roleArn;
         // Pre-declare lambda group variables
-        let apiLambdas = [];
         let webhookLambdas = [];
         let subscriberLambdas = [];
         let scheduleLambdas = [];
@@ -275,33 +276,18 @@ export class DomainStack extends cdk.Stack {
         // Track all DLQs for alarm construct
         const allDlqs = [];
         // Deploy API endpoints as grouped Lambdas
-        if (registry.apis.length > 0) {
-            const apiHandlers = createPrimitiveHandlers(registry.apis, 'api');
-            const apiLambdaById = apiHandlers.byId;
-            apiLambdas = apiHandlers.lambdas;
-            this.lambdaArns[`${domainId}-api`] = apiLambdas[0].functionArn;
-            // Wire each API Lambda to the HttpApi
-            const iamPolicies = iamBuilder.forApi();
-            apiLambdas.forEach((fn) => {
-                iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
-            });
-            // Add dbSecretArn grant if provided
-            if (dbSecretArn) {
-                apiLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({
-                    actions: ['secretsmanager:GetSecretValue'],
-                    resources: [dbSecretArn],
-                })));
-            }
-            // Add routes for each API entry
-            for (const api of registry.apis) {
-                const fn = apiLambdaById.get(api.id);
-                if (api.authType === 'api-key') {
-                    cdk.Annotations.of(this).addWarning(`[DomainStack] API "${api.id}" uses authType "api-key" which is not supported on HTTP API v2 — route is UNAUTHENTICATED. Switch to "jwt" or implement a Lambda authorizer.`);
-                }
-                const routeAuth = api.authType === 'jwt' ? jwtAuth : undefined;
-                addRouteToApi(this, fn, `/${domainId}${api.path}`, [toHttpMethod(api.method)], this.httpApi.httpApiId, routeAuth);
-            }
-        }
+        //
+        // Issue #4689: the legacy `defineApi` primitive was removed. The
+        // canonical HTTP endpoint surface is `actions[]` with
+        // `exposure.type === 'api'`. Each API-exposed action is wrapped with
+        // `createExposedActionApiHandler` (see grouped-lambda-factory) and
+        // mounted on the HTTP API in the action-routing loop below. The
+        // legacy `registry.apis` block has been removed because the builder
+        // no longer populates that slot in fresh registries.
+        //
+        // We intentionally do NOT iterate `registry.apis` here; doing so
+        // would re-introduce legacy routing that is no longer reachable
+        // from the action-first source-of-truth.
         // Deploy webhooks as grouped Lambdas
         if (registry.webhooks.length > 0) {
             // Create shared dedupe table for webhooks
@@ -520,7 +506,7 @@ export class DomainStack extends cdk.Stack {
         }
         // Grant all domain Lambdas read/write access to the per-domain table and bucket
         const allDomainLambdas = [
-            ...apiLambdas, ...webhookLambdas, ...subscriberLambdas,
+            ...webhookLambdas, ...subscriberLambdas,
             ...scheduleLambdas, ...jobLambdas, ...actionLambdas,
         ];
         for (const fn of allDomainLambdas) {
@@ -590,19 +576,30 @@ export class DomainStack extends cdk.Stack {
         addRouteToApi(this, healthConstruct.healthFn, `/${domainId}/_health`, [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
         addRouteToApi(this, healthConstruct.readyFn, `/${domainId}/_ready`, [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
         // Create CloudWatch dashboard for all primitives
+        //
+        // Issue #4689: HTTP endpoints are now action entries with
+        // `exposure.type === 'api'`. We tag those actions with the
+        // `primitiveClass: 'api'` so the dashboard can still group them
+        // separately from internal-only actions.
         const allEndpoints = [
-            ...registry.apis.map(a => ({ id: a.id, primitiveClass: 'api' })),
-            ...registry.actions.map(a => ({ id: a.id, primitiveClass: 'action' })),
+            ...registry.actions
+                .filter(a => a.exposure?.type === 'api')
+                .map(a => ({ id: a.id, primitiveClass: 'api' })),
+            ...registry.actions
+                .filter(a => a.exposure?.type !== 'api')
+                .map(a => ({ id: a.id, primitiveClass: 'action' })),
             ...registry.subscribers.map(s => ({ id: s.id, primitiveClass: 'subscriber' })),
             ...registry.jobs.map(j => ({ id: j.id, primitiveClass: 'job' })),
             ...registry.webhooks.map(w => ({ id: w.id, primitiveClass: 'webhook' })),
             ...registry.schedules.map(sc => ({ id: sc.id, primitiveClass: 'schedule' })),
         ];
-        new DashboardConstruct(this, 'Dashboard', {
-            domainId,
-            envCode: this.stackName.split('-')[1] ?? 'dev',
-            endpoints: allEndpoints,
-        });
+        if (!disableCloudWatchDashboards) {
+            new DashboardConstruct(this, 'Dashboard', {
+                domainId,
+                envCode: this.stackName.split('-')[1] ?? 'dev',
+                endpoints: allEndpoints,
+            });
+        }
         new cdk.CfnOutput(this, 'DomainTableName', {
             value: domainTable.tableName,
             description: 'Per-domain DynamoDB table name',

package/dist/__tests__/action-construct.test.js

@@ -11,7 +11,7 @@ const baseRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
-    apis: [], webhooks: [], subscribers: [], schedules: [], jobs: [],
+    webhooks: [], subscribers: [], schedules: [], jobs: [],
     actions: [], integrations: [], events: [],
 };
 beforeAll(() => {

package/dist/__tests__/domain-stack.test.js

@@ -22,32 +22,44 @@ const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
-    apis: [
+    // Issue #4689: the canonical HTTP endpoint surface is actions[] with
+    // exposure.type === 'api'. The minimal registry now declares its
+    // single test endpoint as an action; apis is always empty.
+    webhooks: [],
+    subscribers: [],
+    schedules: [],
+    jobs: [],
+    actions: [
         {
             id: 'get-users',
-            kind: 'api',
+            kind: 'action',
             handlerFile: 'src/handlers/get-users.ts',
-            path: '/users',
-            method: 'GET',
-            authType: 'jwt',
+            backendAccess: 'domain',
+            exposure: {
+                type: 'api',
+                path: '/v1/tenants/{tenantId}/users',
+                method: 'GET',
+                auth: 'required',
+                tenancy: 'required',
+            },
+            idempotent: false,
         },
     ],
-    webhooks: [],
-    subscribers: [],
-    schedules: [],
-    jobs: [],
-    actions: [],
     integrations: [],
     events: [],
 };
 const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
 fs.mkdirSync(handlerDir, { recursive: true });
-fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const getUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
-    'export const createUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
-    'export const replaceUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
-    'export const patchUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
-    'export const deleteUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
-    'export const listThings = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n');
+// Match the grouped-lambda-factory's export-name conversion: kebab-case
+// ids map to camelCase export names (e.g. `get-users` → `getUsers`).
+const toExportName = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+const handlerStub = (id, method, path, auth = 'required', securityException) => `export const ${toExportName(id)} = { id: ${JSON.stringify(id)}, backendAccess: "domain", exposure: { type: "api", path: ${JSON.stringify(path)}, method: ${JSON.stringify(method)}, auth: ${JSON.stringify(auth)}, tenancy: "required"${securityException ? `, securityException: { reason: ${JSON.stringify(securityException)} }` : ''} }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n`;
+fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), handlerStub('get-users', 'GET', '/v1/tenants/{tenantId}/users'));
+fs.writeFileSync(path.join(handlerDir, 'create-user.ts'), handlerStub('create-user', 'POST', '/v1/tenants/{tenantId}/users'));
+fs.writeFileSync(path.join(handlerDir, 'replace-user.ts'), handlerStub('replace-user', 'PUT', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'patch-user.ts'), handlerStub('patch-user', 'PATCH', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'delete-user.ts'), handlerStub('delete-user', 'DELETE', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'list-things.ts'), handlerStub('list-things', 'GET', '/v1/tenants/{tenantId}/things', 'none', 'public read-only listing'));
 afterAll(() => {
     fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
 });
@@ -84,14 +96,22 @@ describe('DomainStack', () => {
             AuthorizerType: 'JWT',
         });
     });
-    it('no authorizer attached when authType is none', () => {
+    it('no authorizer attached when no JWT-protected actions are declared', () => {
         const app = new cdk.App();
         const registryNoAuth = {
             ...minimalRegistry,
-            apis: [
+            // Replace the JWT action with an auth=none + securityException
+            // action so the authorizer is not required.
+            actions: [
                 {
-                    ...minimalRegistry.apis[0],
-                    authType: 'none',
+                    id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET',
+                        auth: 'none', tenancy: 'required',
+                        securityException: { reason: 'public read-only listing' },
+                    },
+                    idempotent: false,
                 },
             ],
         };
@@ -202,13 +222,43 @@ describe('DomainStack', () => {
          */
         const multiMethodRegistry = {
             ...minimalRegistry,
-            apis: [
-                { ...minimalRegistry.apis[0], id: 'get-users', path: '/users', method: 'GET', authType: 'jwt' },
-                { ...minimalRegistry.apis[0], id: 'create-user', path: '/users', method: 'POST', authType: 'jwt' },
-                { ...minimalRegistry.apis[0], id: 'replace-user', path: '/users/{id}', method: 'PUT', authType: 'jwt' },
-                { ...minimalRegistry.apis[0], id: 'patch-user', path: '/users/{id}', method: 'PATCH', authType: 'jwt' },
-                { ...minimalRegistry.apis[0], id: 'delete-user', path: '/users/{id}', method: 'DELETE', authType: 'jwt' },
-                { ...minimalRegistry.apis[0], id: 'list-things', path: '/things', method: 'GET', authType: 'none' },
+            actions: [
+                {
+                    id: 'get-users', kind: 'action', handlerFile: 'src/handlers/get-users.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'create-user', kind: 'action', handlerFile: 'src/handlers/create-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'POST', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'replace-user', kind: 'action', handlerFile: 'src/handlers/replace-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'PUT', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'patch-user', kind: 'action', handlerFile: 'src/handlers/patch-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'PATCH', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'delete-user', kind: 'action', handlerFile: 'src/handlers/delete-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'DELETE', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET', auth: 'none', tenancy: 'required', securityException: { reason: 'public read-only listing' } },
+                    idempotent: false,
+                },
             ],
         };
         it('uses the actual HTTP method for each route key (GET/POST/PUT/PATCH/DELETE)', () => {
@@ -224,11 +274,14 @@ describe('DomainStack', () => {
             const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
             // Every method must round-trip — the previous implementation coerced all
             // non-GET methods to POST, so PUT/PATCH/DELETE were broken.
-            expect(routeKeys).toContain('GET /test-domain/users');
-            expect(routeKeys).toContain('POST /test-domain/users');
-            expect(routeKeys).toContain('PUT /test-domain/users/{id}');
-            expect(routeKeys).toContain('PATCH /test-domain/users/{id}');
-            expect(routeKeys).toContain('DELETE /test-domain/users/{id}');
+            // Issue #4689: routes now use the action's exposure.path (which
+            // already includes `/v1/tenants/{tenantId}/`) and the canonical
+            // tenant placeholder.
+            expect(routeKeys).toContain('GET /test-domain/v1/tenants/{tenantId}/users');
+            expect(routeKeys).toContain('POST /test-domain/v1/tenants/{tenantId}/users');
+            expect(routeKeys).toContain('PUT /test-domain/v1/tenants/{tenantId}/users/{id}');
+            expect(routeKeys).toContain('PATCH /test-domain/v1/tenants/{tenantId}/users/{id}');
+            expect(routeKeys).toContain('DELETE /test-domain/v1/tenants/{tenantId}/users/{id}');
         });
         it('sets AuthorizationType=JWT and AuthorizerId on jwt-auth routes', () => {
             const app = new cdk.App();
@@ -242,7 +295,8 @@ describe('DomainStack', () => {
             const routes = template.findResources('AWS::ApiGatewayV2::Route');
             const jwtRoutes = Object.values(routes).filter(r => {
                 const key = r.Properties.RouteKey;
-                return key.endsWith('/users') || key.endsWith('/users/{id}');
+                // Issue #4689: paths now include the tenant placeholder.
+                return key.includes('/users') && !key.includes('Health') && !key.includes('Ready');
             });
             // Every jwt-auth route must carry AuthorizationType and AuthorizerId.
             expect(jwtRoutes.length).toBeGreaterThan(0);
@@ -252,7 +306,7 @@ describe('DomainStack', () => {
                 expect(authorizerId).toBeDefined();
             }
         });
-        it('does not attach authorizer to non-jwt routes (authType=none)', () => {
+        it('does not attach authorizer to non-jwt routes (auth=none)', () => {
             const app = new cdk.App();
             const stack = new DomainStack(app, 'TestDomainStackUnauthRoute', {
                 registry: multiMethodRegistry,
@@ -262,7 +316,7 @@ describe('DomainStack', () => {
             });
             const template = Template.fromStack(stack);
             const routes = template.findResources('AWS::ApiGatewayV2::Route');
-            const unauthRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'GET /test-domain/things');
+            const unauthRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'GET /test-domain/v1/tenants/{tenantId}/things');
             expect(unauthRoute).toBeDefined();
             expect(unauthRoute.Properties.AuthorizationType).toBeUndefined();
             expect(unauthRoute.Properties.AuthorizerId).toBeUndefined();
@@ -282,11 +336,24 @@ describe('DomainStack', () => {
                 .map(m => (typeof m.data === 'string' ? m.data : JSON.stringify(m.data)));
             expect(errorMessages.some(a => a.includes('JWT-protected routes') && a.includes('Cognito'))).toBe(true);
         });
-        it('does NOT emit the missing-pool error when authType=none', () => {
+        it('does NOT emit the missing-pool error when no JWT-protected actions are present', () => {
             const app = new cdk.App();
             const noJwtRegistry = {
                 ...minimalRegistry,
-                apis: [{ ...minimalRegistry.apis[0], authType: 'none' }],
+                // Replace the JWT-protected action with an auth=none + securityException
+                // action so the JWT-needs-pool check does not fire.
+                actions: [
+                    {
+                        id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                        backendAccess: 'domain',
+                        exposure: {
+                            type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET',
+                            auth: 'none', tenancy: 'required',
+                            securityException: { reason: 'public read-only listing' },
+                        },
+                        idempotent: false,
+                    },
+                ],
             };
             const stack = new DomainStack(app, 'TestDomainStackNoJwtNeeded', {
                 registry: noJwtRegistry,

package/dist/__tests__/grouped-lambda-factory.test.js

@@ -35,7 +35,6 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
     });
     describe('adapter selection by primitive type (defaults)', () => {
         const cases = [
-            { primitive: 'api', expectedAdapter: 'createApiLambdaHandler' },
             { primitive: 'subscriber', expectedAdapter: 'createSubscriberLambdaHandler' },
             { primitive: 'job', expectedAdapter: 'createJobLambdaHandler' },
             { primitive: 'webhook', expectedAdapter: 'createWebhookLambdaHandler' },
@@ -91,11 +90,11 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
             expect(content).not.toContain(EXPOSED_ACTION_ADAPTER);
         });
         it('per-entry adapter override takes precedence over the primitive-type default', () => {
-            // Even if primitiveType were 'api', an explicit adapter override wins.
+            // Even when an explicit adapter is supplied, the override wins.
             const overridden = entry('charge-card', EXPOSED_ACTION_ADAPTER);
-            const content = buildDedicatedEntryContent('./handler.js', overridden, 'api', DOMAIN_ID);
+            const content = buildDedicatedEntryContent('./handler.js', overridden, 'webhook', DOMAIN_ID);
             expect(content).toContain(`import { ${EXPOSED_ACTION_ADAPTER} } from '@mettlecast/domain-runtime';`);
-            expect(content).not.toContain('createApiLambdaHandler');
+            expect(content).not.toContain('createWebhookLambdaHandler');
         });
     });
     describe('schedule envelope', () => {
@@ -120,7 +119,7 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
     describe('handler import path wiring', () => {
         it('uses the caller-supplied relative import path verbatim', () => {
             const e = entry('list-things');
-            const content = buildDedicatedEntryContent('../../../../src/handlers/list-things.ts', e, 'api', DOMAIN_ID);
+            const content = buildDedicatedEntryContent('../../../../src/handlers/list-things.ts', e, 'webhook', DOMAIN_ID);
             expect(content).toContain(`import { listThings } from '../../../../src/handlers/list-things.ts';`);
         });
         it('converts kebab-case handler IDs to camelCase export names', () => {
@@ -132,7 +131,7 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
         });
         it('emits a single export const handler per entry', () => {
             const e = entry('list-things');
-            const content = buildDedicatedEntryContent('./handler.js', e, 'api', DOMAIN_ID);
+            const content = buildDedicatedEntryContent('./handler.js', e, 'webhook', DOMAIN_ID);
             const matches = content.match(/^export const handler\b/gm) ?? [];
             expect(matches.length).toBe(1);
         });

package/dist/__tests__/lambda-factory.test.js

@@ -5,12 +5,12 @@ import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { LambdaFactory } from '../lambda-factory.js';
-const DOMAIN_ROOT = '/tmp/test-domain-cdk-packer';
+const DOMAIN_ROOT = path.join(process.cwd(), '.tmp', 'test-domain-cdk-packer');
 const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
-    apis: [], webhooks: [], subscribers: [], schedules: [], jobs: [], actions: [], integrations: [], events: [],
+    webhooks: [], subscribers: [], schedules: [], jobs: [], actions: [], integrations: [], events: [],
 };
 beforeAll(() => {
     const handlerDir = path.join(DOMAIN_ROOT, 'src');
@@ -26,7 +26,7 @@ describe('LambdaFactory', () => {
         const stack = new cdk.Stack(app, 'TestStack');
         const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
         expect(() => {
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
         }).not.toThrow();
     });
     describe('bundling configuration', () => {
@@ -34,7 +34,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackArch');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Architectures: ['arm64'],
@@ -44,7 +44,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackRuntime');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Runtime: 'nodejs22.x',
@@ -54,7 +54,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackSourceMaps');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Environment: {
@@ -68,7 +68,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackDefaults');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            const fn = factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            const fn = factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             expect(fn).toBeInstanceOf(lambdaNode.NodejsFunction);
             expect(fn.runtime?.name).toContain('nodejs22');
         });

package/dist/__tests__/registry.test.js

@@ -5,7 +5,6 @@ describe('DomainRegistry type', () => {
             schemaVersion: '1',
             domainRoot: '/workspace/my-domain',
             domain: { id: 'my-domain', kind: 'domain', name: 'My Domain', tenancy: 'required' },
-            apis: [],
             webhooks: [],
             subscribers: [],
             schedules: [],
@@ -19,12 +18,12 @@ describe('DomainRegistry type', () => {
     });
     it('discriminates RegistryEntry union by kind', () => {
         const entries = [
-            { id: 'test-api', kind: 'api', handlerFile: 'src/api.ts', path: '/test', method: 'GET', authType: 'jwt' },
+            { id: 'test-action', kind: 'action', handlerFile: 'src/action.ts', backendAccess: 'domain', exposure: { type: 'api', path: '/test', method: 'GET', auth: 'required', tenancy: 'none' }, idempotent: true },
             { id: 'test-job', kind: 'job', handlerFile: 'src/job.ts', maxRetries: 3, visibilityTimeoutSeconds: 30 },
         ];
         for (const entry of entries) {
-            if (entry.kind === 'api') {
-                expect(entry.path).toBeDefined();
+            if (entry.kind === 'action') {
+                expect(entry.exposure).toBeDefined();
             }
             if (entry.kind === 'job') {
                 expect(entry.maxRetries).toBeDefined();

package/dist/__tests__/security-assertion-aspect.test.js

@@ -8,7 +8,6 @@ const baseRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'sec-domain', kind: 'domain', name: 'Sec Domain', tenancy: 'none' },
-    apis: [],
     webhooks: [],
     subscribers: [],
     schedules: [],
@@ -60,9 +59,15 @@ beforeAll(() => {
     // entry id (`list-users` -> `listUsers`). We provide every named export
     // the security-aspect test uses so each test can pick the same handler
     // file regardless of which entry id it instantiates.
+    //
+    // Issue #4689: defineApi was removed; HTTP endpoints are now declared
+    // as actions with `exposure.type === 'api'`. Each named export below
+    // matches one of the action ids used in the test fixtures.
     fs.writeFileSync(path.join(handlerDir, 'noop.ts'), [
-        'export const listUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };',
-        'export const listAll = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };',
+        // Match the grouped-lambda-factory's export-name conversion so the
+        // bundler can resolve the import for every test fixture.
+        'export const listUsers = { id: "list-users", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/users", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
+        'export const listAll = { id: "list-all", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/all", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
         'export const noopAction = { id: "noop-action", backendAccess: "private", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
     ].join('\n') + '\n');
 });
@@ -75,7 +80,7 @@ afterAll(() => {
  * invariants the CLI validator already enforces. These tests pin each
  * invariant independently so a regression in any single check is caught.
  */
-describe('SecurityAssertionAspect (#4662 Task D)', () => {
+describe('SecurityAssertionAspect (#4662 Task D, #4689)', () => {
     it('does not emit errors for an empty registry', () => {
         const { errorMessages } = buildStackAndGetErrors(baseRegistry);
         // The base stack emits zero routes / zero Function URLs, so the aspect
@@ -83,21 +88,34 @@ describe('SecurityAssertionAspect (#4662 Task D)', () => {
         const aspectCodes = ['SECURITY_MISSING_JWT_AUTHORIZER', 'SECURITY_MISSING_TENANT_PATH', 'SECURITY_ACTION_FUNCTION_URL', 'SECURITY_MISSING_SECURITY_EXCEPTION'];
         expect(errorMessages.filter(m => aspectCodes.some(c => m.includes(c)))).toHaveLength(0);
     });
-    it('emits SECURITY_MISSING_TENANT_PATH when an API path lacks the tenant placeholder', () => {
+    it('emits SECURITY_MISSING_TENANT_PATH when an action API path lacks the tenant placeholder', () => {
+        // Issue #4689: the canonical HTTP endpoint surface is the action
+        // array with `exposure.type === 'api'`. The aspect now reads from
+        // `actions[]` rather than `apis[]`.
         const registry = {
             ...baseRegistry,
-            apis: [
-                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/users', method: 'GET', authType: 'jwt' },
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
             ],
         };
         const { errorMessages } = buildStackAndGetErrors(registry);
         expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH') && m.includes('list-users'))).toBe(true);
     });
-    it('does NOT emit SECURITY_MISSING_TENANT_PATH when the path includes the placeholder', () => {
+    it('does NOT emit SECURITY_MISSING_TENANT_PATH when the action API path includes the placeholder', () => {
         const registry = {
             ...baseRegistry,
-            apis: [
-                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/v1/tenants/{tenantId}/users', method: 'GET', authType: 'jwt' },
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
             ],
         };
         // We expect the JWT authorizer error (because no Cognito is provided),
@@ -105,11 +123,16 @@ describe('SecurityAssertionAspect (#4662 Task D)', () => {
         const { errorMessages } = buildStackAndGetErrors(registry);
         expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH'))).toBe(false);
     });
-    it('emits SECURITY_MISSING_JWT_AUTHORIZER when JWT API is declared without Cognito config', () => {
+    it('emits SECURITY_MISSING_JWT_AUTHORIZER when an action API is declared without Cognito config', () => {
         const registry = {
             ...baseRegistry,
-            apis: [
-                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/v1/tenants/{tenantId}/users', method: 'GET', authType: 'jwt' },
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
             ],
         };
         const { errorMessages } = buildStackAndGetErrors(registry);
@@ -121,7 +144,6 @@ describe('SecurityAssertionAspect (#4662 Task D)', () => {
         // ignores them), the aspect must NOT fire for them.
         const registry = {
             ...baseRegistry,
-            apis: [],
         };
         const { errorMessages } = buildStackAndGetErrors(registry);
         expect(errorMessages.some(m => m.includes('SECURITY_MISSING_SECURITY_EXCEPTION'))).toBe(false);

package/dist/aspects/security-assertion-aspect.d.ts

@@ -113,8 +113,7 @@ export declare class SecurityAssertionAspect implements cdk.IAspect {
      * invariants in one pass:
      *
      * 1. Routes declared as JWT-protected actually carry an `AuthorizerId`.
-     *    Covers both legacy `defineApi` entries (`authType: 'jwt'`) and
-     *    new-style action API exposures (`exposure.auth === 'required'`).
+     *    Covers action API exposures (`exposure.auth === 'required'`).
      * 2. Routes declared as tenant-required include the canonical
      *    `/v1/tenants/{tenantId}/` placeholder in their path.
      *
@@ -136,46 +135,17 @@ export declare class SecurityAssertionAspect implements cdk.IAspect {
      */
     private assertNoFunctionUrls;
     /**
-     * Walk every `CfnRoute` whose registry counterpart declares
-     * `auth: 'none'` or `authType: 'none'` and verify that the registry
-     * entry carries a `securityException.reason`. Public routes must
-     * document the exception so security reviewers can audit the
-     * relaxation.
+     * Walk every `CfnRoute` whose action registry counterpart declares
+     * `auth: 'none'` and verify that the action exposure carries a
+     * `securityException.reason`. Public routes must document the exception
+     * so security reviewers can audit the relaxation.
      */
     private assertAnonymousRoutesHaveException;
-    /**
-     * Find the registry API entry that corresponds to a synthesised route.
-     * DomainStack prefixes every route with `/<domainId>`, so we strip that
-     * prefix before comparing paths.
-     *
-     * @param path - The route path including the domain prefix.
-     * @param method - Upper-case HTTP method.
-     * @returns The matching {@link ApiRegistryEntry} or `undefined`.
-     */
-    private findApiRegistryEntryForRoute;
     /**
      * Find the registry action whose `exposure.path` matches a synthesised
-     * route. Mirrors {@link findApiRegistryEntryForRoute} but for action API
-     * exposures.
+     * route for action API exposures.
      */
     private findActionRegistryEntryForRoute;
-    /**
-     * Predicate — does the registry entry imply that the route must
-     * include `/v1/tenants/{tenantId}/`?
-     *
-     * The legacy `defineApi` surface does not carry an explicit tenancy
-     * marker; we treat any non-anonymous API as tenant-required because
-     * the only legitimate JWT-protected routes are tenant-scoped. Routes
-     * with `authType: 'none'` are exempted — they are explicitly public.
-     */
-    private registryEntryRequiresTenant;
-    /**
-     * Predicate — does the API registry entry carry a securityException?
-     * Legacy `defineApi` rows do not have this field; we accept the
-     * registry absence and rely on the CLI validator to catch it before
-     * synth.
-     */
-    private hasSecurityException;
     /**
      * Predicate — does the action registry entry carry a securityException
      * on its exposure block?

package/dist/aspects/security-assertion-aspect.js

@@ -89,8 +89,7 @@ export class SecurityAssertionAspect {
      * invariants in one pass:
      *
      * 1. Routes declared as JWT-protected actually carry an `AuthorizerId`.
-     *    Covers both legacy `defineApi` entries (`authType: 'jwt'`) and
-     *    new-style action API exposures (`exposure.auth === 'required'`).
+     *    Covers action API exposures (`exposure.auth === 'required'`).
      * 2. Routes declared as tenant-required include the canonical
      *    `/v1/tenants/{tenantId}/` placeholder in their path.
      *
@@ -113,27 +112,6 @@ export class SecurityAssertionAspect {
         const path = routeKey.slice(spaceIndex + 1);
         const method = routeKey.slice(0, spaceIndex).toUpperCase();
         const authorizerId = node.authorizerId;
-        const api = this.findApiRegistryEntryForRoute(path, method);
-        if (api) {
-            // Invariant 1a: JWT-required API has an authorizer
-            if (api.authType === 'jwt' && !authorizerId) {
-                const message = `[SecurityAssertionAspect] ${SECURITY_ASSERTION_CODES.MISSING_JWT_AUTHORIZER}: ` +
-                    `API '${api.id}' declares authType='jwt' but the synthesised route ${routeKey} ` +
-                    `has no AuthorizerId. Provide a Cognito user pool via DomainStackProps.userPoolArn + userPoolClientId.`;
-                if (this.props.failOnMissingAuthorizer) {
-                    cdk.Annotations.of(node).addError(message);
-                }
-                else {
-                    cdk.Annotations.of(node).addWarning(message);
-                }
-            }
-            // Invariant 2: tenant-required API path includes placeholder
-            if (this.registryEntryRequiresTenant(api) && !this.hasTenantPlaceholder(path)) {
-                cdk.Annotations.of(node).addError(`[SecurityAssertionAspect] ${SECURITY_ASSERTION_CODES.MISSING_TENANT_PATH}: ` +
-                    `API '${api.id}' (${method} ${path}) is tenant-required but its path does not include ` +
-                    `the canonical '/v1/tenants/{tenantId}/' placeholder. Synth will fail.`);
-            }
-        }
         const action = this.findActionRegistryEntryForRoute(path, method);
         if (action && action.exposure.type === 'api') {
             const exposure = action.exposure;
@@ -185,11 +163,10 @@ export class SecurityAssertionAspect {
         }
     }
     /**
-     * Walk every `CfnRoute` whose registry counterpart declares
-     * `auth: 'none'` or `authType: 'none'` and verify that the registry
-     * entry carries a `securityException.reason`. Public routes must
-     * document the exception so security reviewers can audit the
-     * relaxation.
+     * Walk every `CfnRoute` whose action registry counterpart declares
+     * `auth: 'none'` and verify that the action exposure carries a
+     * `securityException.reason`. Public routes must document the exception
+     * so security reviewers can audit the relaxation.
      */
     assertAnonymousRoutesHaveException(node) {
         if (!(node instanceof Apigwv2CfnRoute))
@@ -200,12 +177,6 @@ export class SecurityAssertionAspect {
             return;
         const path = routeKey.slice(spaceIndex + 1);
         const method = routeKey.slice(0, spaceIndex).toUpperCase();
-        const api = this.findApiRegistryEntryForRoute(path, method);
-        if (api && api.authType === 'none' && !this.hasSecurityException(api)) {
-            cdk.Annotations.of(node).addError(`[SecurityAssertionAspect] ${SECURITY_ASSERTION_CODES.MISSING_SECURITY_EXCEPTION}: ` +
-                `API '${api.id}' (${method} ${path}) is anonymous (authType='none') but does not declare ` +
-                `a securityException.reason. Public routes must document the exception.`);
-        }
         const action = this.findActionRegistryEntryForRoute(path, method);
         if (action
             && action.exposure.type === 'api'
@@ -216,26 +187,9 @@ export class SecurityAssertionAspect {
                 `exposure.securityException.reason. Public routes must document the exception.`);
         }
     }
-    /**
-     * Find the registry API entry that corresponds to a synthesised route.
-     * DomainStack prefixes every route with `/<domainId>`, so we strip that
-     * prefix before comparing paths.
-     *
-     * @param path - The route path including the domain prefix.
-     * @param method - Upper-case HTTP method.
-     * @returns The matching {@link ApiRegistryEntry} or `undefined`.
-     */
-    findApiRegistryEntryForRoute(path, method) {
-        const domainId = this.props.registry.domain.id;
-        if (!path.startsWith(`/${domainId}`))
-            return undefined;
-        const trimmed = path.slice(`/${domainId}`.length) || '/';
-        return this.props.registry.apis.find(api => api.path === trimmed && api.method.toUpperCase() === method);
-    }
     /**
      * Find the registry action whose `exposure.path` matches a synthesised
-     * route. Mirrors {@link findApiRegistryEntryForRoute} but for action API
-     * exposures.
+     * route for action API exposures.
      */
     findActionRegistryEntryForRoute(path, method) {
         const domainId = this.props.registry.domain.id;
@@ -249,31 +203,6 @@ export class SecurityAssertionAspect {
             return exposure.path === trimmed && exposure.method.toUpperCase() === method;
         });
     }
-    /**
-     * Predicate — does the registry entry imply that the route must
-     * include `/v1/tenants/{tenantId}/`?
-     *
-     * The legacy `defineApi` surface does not carry an explicit tenancy
-     * marker; we treat any non-anonymous API as tenant-required because
-     * the only legitimate JWT-protected routes are tenant-scoped. Routes
-     * with `authType: 'none'` are exempted — they are explicitly public.
-     */
-    registryEntryRequiresTenant(api) {
-        if (api.authType === 'none')
-            return false;
-        return true;
-    }
-    /**
-     * Predicate — does the API registry entry carry a securityException?
-     * Legacy `defineApi` rows do not have this field; we accept the
-     * registry absence and rely on the CLI validator to catch it before
-     * synth.
-     */
-    hasSecurityException(api) {
-        const entry = api;
-        const reason = entry.securityException?.reason;
-        return typeof reason === 'string' && reason.trim().length > 0;
-    }
     /**
      * Predicate — does the action registry entry carry a securityException
      * on its exposure block?

package/dist/constructs/api-construct.d.ts

@@ -7,7 +7,7 @@ import type { DomainRegistry } from '../registry.js';
  * Configuration properties for ApiConstruct.
  */
 export interface ApiConstructProps {
-    /** Domain registry containing all API entries. */
+    /** Domain registry. Issue #4689: HTTP endpoints are now action entries with `exposure.type === 'api'`. */
     registry: DomainRegistry;
     /** Shared HttpApi to route requests to Lambdas. */
     httpApi: apigwv2.HttpApi;
@@ -17,7 +17,15 @@ export interface ApiConstructProps {
     iamBuilder: IamPolicyBuilder;
 }
 /**
- * CDK Construct that synthesises one Lambda per registered API and wires each to the shared HttpApi.
+ * CDK Construct that synthesises one Lambda per API-exposed action and wires each to the shared HttpApi.
+ *
+ * Issue #4689: the legacy `defineApi` primitive was removed. The
+ * canonical HTTP endpoint surface is `defineAction({ exposure: { type:
+ * 'api', ... } })`, so this construct now iterates
+ * `registry.actions` and filters for `exposure.type === 'api'`. The
+ * legacy `registry.apis` slot is always empty in fresh registries; we
+ * intentionally do NOT iterate it because the builder no longer
+ * populates it.
  */
 export declare class ApiConstruct extends Construct {
     /**

package/dist/constructs/api-construct.js

@@ -2,7 +2,15 @@ import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import * as apigwv2integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import { Construct } from 'constructs';
 /**
- * CDK Construct that synthesises one Lambda per registered API and wires each to the shared HttpApi.
+ * CDK Construct that synthesises one Lambda per API-exposed action and wires each to the shared HttpApi.
+ *
+ * Issue #4689: the legacy `defineApi` primitive was removed. The
+ * canonical HTTP endpoint surface is `defineAction({ exposure: { type:
+ * 'api', ... } })`, so this construct now iterates
+ * `registry.actions` and filters for `exposure.type === 'api'`. The
+ * legacy `registry.apis` slot is always empty in fresh registries; we
+ * intentionally do NOT iterate it because the builder no longer
+ * populates it.
  */
 export class ApiConstruct extends Construct {
     /**
@@ -13,15 +21,27 @@ export class ApiConstruct extends Construct {
      */
     constructor(scope, id, props) {
         super(scope, id);
-        for (const entry of props.registry.apis) {
+        for (const action of props.registry.actions) {
+            if (action.exposure?.type !== 'api')
+                continue;
+            const exposure = action.exposure;
+            const entry = {
+                ...action,
+                // The action entry is structurally compatible with the lambda
+                // factory's expected shape; spread the exposure fields onto the
+                // top level so existing IAM / deployment logic does not need to
+                // change.
+                path: exposure.path,
+                method: exposure.method,
+            };
             const fn = props.lambdaFactory.createFunction(entry, entry.deployment);
             props.iamBuilder.forApi().forEach((statement) => {
                 fn.addToRolePolicy(statement);
             });
             props.httpApi.addRoutes({
-                path: entry.path,
-                methods: [toHttpMethod(entry.method)],
-                integration: new apigwv2integrations.HttpLambdaIntegration(`${id}${toPascalCase(entry.id)}Integration`, fn),
+                path: exposure.path,
+                methods: [toHttpMethod(exposure.method)],
+                integration: new apigwv2integrations.HttpLambdaIntegration(`${id}${toPascalCase(action.id)}Integration`, fn),
             });
         }
     }

package/dist/grouped-lambda-factory.d.ts

@@ -2,7 +2,7 @@ import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import { Construct } from 'constructs';
 /** Primitive types that can be grouped into a single Lambda. */
-export type PrimitiveType = 'api' | 'subscriber' | 'schedule' | 'job' | 'webhook' | 'action';
+export type PrimitiveType = 'subscriber' | 'schedule' | 'job' | 'webhook' | 'action';
 /** A single handler entry within a grouped Lambda. */
 export interface HandlerEntry {
     /** Unique handler ID within the domain + primitive type. */
@@ -15,7 +15,6 @@ export interface HandlerEntry {
      * into a Lambda handler.
      *
      * When omitted, the adapter is inferred from `primitiveType`:
-     * - `api`        → `createApiLambdaHandler`
      * - `subscriber` → `createSubscriberLambdaHandler`
      * - `job`        → `createJobLambdaHandler`
      * - `webhook`    → `createWebhookLambdaHandler`

package/dist/grouped-lambda-factory.js

@@ -20,7 +20,6 @@ function toPascalCase(str) {
  * used by API-exposed actions (see `EXPOSED_ACTION_ADAPTER`).
  */
 export const ADAPTER_BY_PRIMITIVE = {
-    api: 'createApiLambdaHandler',
     subscriber: 'createSubscriberLambdaHandler',
     job: 'createJobLambdaHandler',
     webhook: 'createWebhookLambdaHandler',
@@ -83,7 +82,7 @@ export function buildDedicatedEntryContent(handlerImportPath, entry, primitiveTy
     // primitive-type default. Used so API-exposed actions wrap with
     // `createExposedActionApiHandler` while internal actions in the same domain
     // continue to use `createActionLambdaHandler`.
-    const adapter = entry.adapter ?? ADAPTER_BY_PRIMITIVE[primitiveType] ?? 'createApiLambdaHandler';
+    const adapter = entry.adapter ?? ADAPTER_BY_PRIMITIVE[primitiveType];
     // Wave 7 Task 7.1 (#4619): the action adapters take a (registry, options)
     // pair / (action, options) pair, NOT a bare handler export. Generating
     // `${adapter}(${exportName})` would produce invalid JS for actions — the

package/dist/iam/iam-policy-builder.js

@@ -221,8 +221,6 @@ export class IamPolicyBuilder {
                 return this.forSubscriber(params);
             case 'job':
                 return this.forJob(params);
-            case 'api':
-                return this.forApi();
             case 'schedule':
                 return this.forSchedule();
             case 'action':

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { DomainRegistry, RegistryEntry, RegistryEntryKind, BaseRegistryEntry, SerialDeploymentConfig, ApiRegistryEntry, ApiVersionSnapshot, WebhookRegistryEntry, SubscriberRegistryEntry, ScheduleRegistryEntry, JobRegistryEntry, ActionRegistryEntry, ActionBackendAccess, ActionExposure, ActionApiExposure, IntegrationRegistryEntry, EventRegistryEntry, DomainRegistryEntry, SchemaSnapshot, } from './registry.js';
+export type { DomainRegistry, RegistryEntry, RegistryEntryKind, BaseRegistryEntry, SerialDeploymentConfig, WebhookRegistryEntry, SubscriberRegistryEntry, ScheduleRegistryEntry, JobRegistryEntry, ActionRegistryEntry, ActionBackendAccess, ActionExposure, ActionApiExposure, IntegrationRegistryEntry, EventRegistryEntry, DomainRegistryEntry, SchemaSnapshot, } from './registry.js';
 export { LambdaFactory } from './lambda-factory.js';
 export type { LambdaFactoryProps } from './lambda-factory.js';
 export { createGroupedLambdas, buildDedicatedEntryContent, ADAPTER_BY_PRIMITIVE, EXPOSED_ACTION_ADAPTER } from './grouped-lambda-factory.js';

package/dist/pack-domain.d.ts

@@ -47,6 +47,8 @@ export interface PackDomainOptions {
     projectId?: string;
     /** Environment code used to prefix per-domain physical resource names (e.g. `dev`, `prod`). */
     envCode?: string;
+    /** Disable auto-generated per-domain CloudWatch dashboard. */
+    disableCloudWatchDashboards?: boolean;
 }
 /**
  * Convenience entry-point: constructs a DomainStack from a compiled registry.

package/dist/pack-domain.js

@@ -13,9 +13,14 @@ import { DomainStack } from './DomainStack.js';
 export function packDomain(registry, app, stackId, eventBusArn, options) {
     // Support both old (env as 5th arg) and new (options object) calling conventions
     // Check if options looks like a CDK Environment (has 'account' and/or 'region' props, not the full options interface)
-    const opts = options && typeof options === 'object'
-        && ('account' in options || 'region' in options)
-        && !('userPoolArn' in options || 'userPoolId' in options || 'userPoolClientId' in options || 'databaseUrl' in options || 'dbSecretArn' in options)
+    const opts = options &&
+        typeof options === 'object' &&
+        ('account' in options || 'region' in options) &&
+        !('userPoolArn' in options ||
+            'userPoolId' in options ||
+            'userPoolClientId' in options ||
+            'databaseUrl' in options ||
+            'dbSecretArn' in options)
         ? { env: options }
         : options || {};
     return new DomainStack(app, stackId, {
@@ -41,5 +46,6 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         eventBusName: opts.eventBusName,
         projectId: opts.projectId,
         envCode: opts.envCode,
+        disableCloudWatchDashboards: opts.disableCloudWatchDashboards,
     });
 }

package/dist/registry.d.ts

@@ -5,7 +5,7 @@ export type SchemaSnapshot = Record<string, unknown>;
 /**
  * Kind discriminant for registry entries.
  */
-export type RegistryEntryKind = 'api' | 'webhook' | 'subscriber' | 'schedule' | 'job' | 'action' | 'integration' | 'event' | 'domain';
+export type RegistryEntryKind = 'webhook' | 'subscriber' | 'schedule' | 'job' | 'action' | 'integration' | 'event' | 'domain';
 /** Controls whether a VPC-attached handler may use NAT-backed public internet egress. */
 export type RegistryOutboundAccess = 'internal' | 'internet';
 /**
@@ -38,61 +38,6 @@ export interface BaseRegistryEntry {
     /** Optional human-readable description of this primitive. */
     description?: string;
 }
-/**
- * Schema snapshot for a single API version.
- */
-export interface ApiVersionSnapshot {
-    /** Semver-style version string, e.g. '1'. */
-    version: string;
-    /** JSON Schema for the request body of this version. */
-    requestSchema?: SchemaSnapshot;
-    /** JSON Schema for the successful response body of this version. */
-    responseSchema?: SchemaSnapshot;
-}
-/**
- * API registry entry for HTTP endpoint handlers.
- */
-export interface ApiRegistryEntry extends BaseRegistryEntry {
-    /** Discriminant. */
-    kind: 'api';
-    /** Handler file path (required for API). */
-    handlerFile: string;
-    /** HTTP route path, e.g. '/users/:id'. */
-    path: string;
-    /** HTTP method. */
-    method: string;
-    /** Authentication type. */
-    authType: 'jwt' | 'api-key' | 'none';
-    /**
-     * Required for `authType: 'none'` (anonymous) APIs. Carries a free-text
-     * reason that documents the security exception so reviewers can audit
-     * the relaxation. The CDK synth-time aspect and the CLI validator both
-     * refuse to synthesize anonymous APIs without this field.
-     *
-     * Added in #4662 Task D — the legacy `defineApi` surface did not
-     * require a reason because early projects had only a handful of
-     * public routes; that did not scale and the runtime needs the
-     * documentation alongside the route.
-     */
-    securityException?: {
-        reason: string;
-    };
-    /** Optional deployment overrides. */
-    deployment?: SerialDeploymentConfig;
-    /** Whether this handler may use NAT-backed public internet egress. */
-    outboundAccess?: RegistryOutboundAccess;
-    /** JSON Schema snapshot for the HTTP request body. */
-    requestSchema?: SchemaSnapshot;
-    /** JSON Schema snapshot for the HTTP response body. */
-    responseSchema?: SchemaSnapshot;
-    /** Per-version request/response schema snapshots. */
-    versions?: ApiVersionSnapshot[];
-    /** Example request/response payloads for documentation (no runtime impact). */
-    examples?: {
-        request?: Record<string, unknown>;
-        response?: Record<string, unknown>;
-    };
-}
 /**
  * Webhook registry entry for webhook handlers.
  */
@@ -321,7 +266,7 @@ export interface DomainRegistryEntry extends BaseRegistryEntry {
 /**
  * Union type of all registry entry kinds.
  */
-export type RegistryEntry = ApiRegistryEntry | WebhookRegistryEntry | SubscriberRegistryEntry | ScheduleRegistryEntry | JobRegistryEntry | ActionRegistryEntry | IntegrationRegistryEntry | EventRegistryEntry | DomainRegistryEntry;
+export type RegistryEntry = WebhookRegistryEntry | SubscriberRegistryEntry | ScheduleRegistryEntry | JobRegistryEntry | ActionRegistryEntry | IntegrationRegistryEntry | EventRegistryEntry | DomainRegistryEntry;
 /**
  * Top-level domain registry — the compiled snapshot for CDK packer.
  */
@@ -332,8 +277,6 @@ export interface DomainRegistry {
     domainRoot: string;
     /** The domain itself. */
     domain: DomainRegistryEntry;
-    /** All API endpoints. */
-    apis: ApiRegistryEntry[];
     /** All webhook receivers. */
     webhooks: WebhookRegistryEntry[];
     /** All event subscribers. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.61",
+  "version": "0.2.63",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",