@mettlecast/domain-cdk-packer 0.2.91 → 0.2.93

package/dist/DomainStack.js

@@ -9,7 +9,7 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 import * as scheduler from 'aws-cdk-lib/aws-scheduler';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as s3 from 'aws-cdk-lib/aws-s3';
-import { createGroupedLambdas } from './grouped-lambda-factory.js';
+import { createGroupedLambdas, createGroupedApiActionLambda } from './grouped-lambda-factory.js';
 import { IamPolicyBuilder } from './iam/iam-policy-builder.js';
 import { HealthConstruct } from './constructs/health-construct.js';
 import { DashboardConstruct } from './constructs/dashboard-construct.js';
@@ -124,7 +124,7 @@ export class DomainStack extends cdk.Stack {
             const resolvedUserPoolId = userPoolId ?? cdk.Fn.select(1, cdk.Fn.split('/', userPoolArn));
             jwtAuthorizer = new apigwv2.HttpAuthorizer(this, 'CognitoAuthorizer', {
                 httpApi: this.httpApi,
-                authorizerName: 'CognitoAuthorizer',
+                authorizerName: `CognitoAuthorizer-${domainId}`,
                 type: apigwv2.HttpAuthorizerType.JWT,
                 identitySource: ['$request.header.Authorization'],
                 jwtAudience: [userPoolClientId],
@@ -207,17 +207,77 @@ export class DomainStack extends cdk.Stack {
             const lambdas = [];
             const byId = new Map();
             for (const group of splitByOutboundAccess(entries)) {
-                // Force dedicated mode for action groups that contain any API-exposed
-                // action — the per-entry adapter override only takes effect in
-                // dedicated mode (grouped mode uses a single TIB_HANDLER_MAP dispatcher
-                // which assumes a uniform adapter across all entries). We detect
-                // api-exposed actions by their `adapter` override (set by the caller
-                // in the action block below), since the entry shape is intentionally
-                // primitive-agnostic.
-                const hasApiExposedAction = primitiveType === 'action'
-                    && group.entries.some(e => e.adapter === 'createExposedActionApiHandler');
-                const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated')
-                    || hasApiExposedAction;
+                if (primitiveType === 'action') {
+                    // Split API-exposed actions from internal actions so they can be
+                    // grouped into a single Lambda each (instead of one Lambda per action).
+                    const apiExposed = group.entries.filter(e => e.adapter === 'createExposedActionApiHandler' && e.apiMethod && e.apiRoutePath);
+                    const internal = group.entries.filter(e => !(e.adapter === 'createExposedActionApiHandler' && e.apiMethod && e.apiRoutePath));
+                    // API-exposed actions → ONE grouped Lambda with route-key dispatch
+                    if (apiExposed.length > 0) {
+                        const apiEntries = apiExposed.map(e => ({
+                            id: e.id,
+                            handlerFile: e.handlerFile,
+                            method: e.apiMethod,
+                            routePath: e.apiRoutePath,
+                        }));
+                        const apiLambda = createGroupedApiActionLambda(this, {
+                            domainId,
+                            domainRoot: registry.domainRoot,
+                            apiEntries,
+                            environment,
+                            eventBusArn,
+                            reservedConcurrency,
+                            logRetentionDays: logRetentionDays ?? 30,
+                            lambdaGroupId: group.outboundAccess,
+                            ...(vpc ? {
+                                vpc,
+                                securityGroups: lambdaSg ? [lambdaSg] : undefined,
+                                subnetSelection: resolveSubnetSelection(group.outboundAccess),
+                            } : {}),
+                        });
+                        lambdas.push(apiLambda);
+                        apiExposed.forEach(entry => byId.set(entry.id, apiLambda));
+                    }
+                    // Internal actions → existing grouped mode (one Lambda for all)
+                    if (internal.length > 0) {
+                        const internalDedicated = internal.some(entry => entry.deployment?.isolation === 'dedicated');
+                        const internalLambdas = createGroupedLambdas(this, {
+                            domainId,
+                            domainRoot: registry.domainRoot,
+                            primitiveType,
+                            handlerEntries: internal.map(entry => {
+                                const handlerEntry = {
+                                    id: entry.id,
+                                    handlerFile: entry.handlerFile,
+                                };
+                                if (entry.adapter)
+                                    handlerEntry.adapter = entry.adapter;
+                                return handlerEntry;
+                            }),
+                            environment,
+                            eventBusArn,
+                            dedicated: internalDedicated,
+                            reservedConcurrency,
+                            logRetentionDays: logRetentionDays ?? 30,
+                            lambdaGroupId: group.outboundAccess,
+                            ...(vpc ? {
+                                vpc,
+                                securityGroups: lambdaSg ? [lambdaSg] : undefined,
+                                subnetSelection: resolveSubnetSelection(group.outboundAccess),
+                            } : {}),
+                        });
+                        lambdas.push(...internalLambdas);
+                        if (internalDedicated) {
+                            internal.forEach((entry, index) => byId.set(entry.id, internalLambdas[index]));
+                        }
+                        else {
+                            internal.forEach(entry => byId.set(entry.id, internalLambdas[0]));
+                        }
+                    }
+                    continue;
+                }
+                // Non-action primitives: existing logic
+                const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated');
                 const groupLambdas = createGroupedLambdas(this, {
                     domainId,
                     domainRoot: registry.domainRoot,
@@ -495,6 +555,8 @@ export class DomainStack extends cdk.Stack {
                     entry.deployment = action.deployment;
                 if (action.exposure?.type === 'api') {
                     entry.adapter = 'createExposedActionApiHandler';
+                    entry.apiMethod = action.exposure.method;
+                    entry.apiRoutePath = `/${domainId}${action.exposure.path}`;
                 }
                 return entry;
             });

package/dist/__tests__/domain-stack.test.js

@@ -69,17 +69,17 @@ describe('DomainStack', () => {
     const eventBusArn = 'arn:aws:events:eu-north-1:123456789012:event-bus/tib-event-bus';
     it('synthesises without error for minimal registry', () => {
         const app = new cdk.App();
-        expect(() => new DomainStack(app, 'TestDomainStack', { registry: minimalRegistry, eventBusArn })).not.toThrow();
+        expect(() => new DomainStack(app, 'TestDomainStack', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' })).not.toThrow();
     });
     it('template contains HttpApi', () => {
         const app = new cdk.App();
-        const stack = new DomainStack(app, 'TestDomainStack2', { registry: minimalRegistry, eventBusArn });
+        const stack = new DomainStack(app, 'TestDomainStack2', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });
         const template = Template.fromStack(stack);
         template.resourceCountIs('AWS::ApiGatewayV2::Api', 1);
     });
     it('template contains one Lambda function for the api entry', () => {
         const app = new cdk.App();
-        const stack = new DomainStack(app, 'TestDomainStack3', { registry: minimalRegistry, eventBusArn });
+        const stack = new DomainStack(app, 'TestDomainStack3', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });
         const template = Template.fromStack(stack);
         template.resourceCountIs('AWS::Lambda::Function', 4);
     });
@@ -90,6 +90,8 @@ describe('DomainStack', () => {
         const stack = new DomainStack(app, 'TestDomainStackJwt', {
             registry: minimalRegistry,
             eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
             userPoolArn,
             userPoolClientId,
         });
@@ -98,6 +100,21 @@ describe('DomainStack', () => {
             AuthorizerType: 'JWT',
         });
     });
+    it('authorizer name is unique per-domain (includes domainId)', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestDomainStackName', {
+            registry: minimalRegistry,
+            eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
+            userPoolId: 'eu-north-1_test',
+            userPoolClientId: 'client-id',
+        });
+        const template = Template.fromStack(stack);
+        template.hasResourceProperties('AWS::ApiGatewayV2::Authorizer', {
+            Name: 'CognitoAuthorizer-test-domain',
+        });
+    });
     it('no authorizer attached when no JWT-protected actions are declared', () => {
         const app = new cdk.App();
         const registryNoAuth = {
@@ -120,6 +137,8 @@ describe('DomainStack', () => {
         const stack = new DomainStack(app, 'TestDomainStackNoAuth', {
             registry: registryNoAuth,
             eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
         });
         const template = Template.fromStack(stack);
         template.resourceCountIs('AWS::ApiGatewayV2::Authorizer', 0);
@@ -130,6 +149,8 @@ describe('DomainStack', () => {
         const stack = new DomainStack(app, 'TestDomainStackDbSecret', {
             registry: minimalRegistry,
             eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
             dbSecretArn,
         });
         const template = Template.fromStack(stack);
@@ -143,6 +164,8 @@ describe('DomainStack', () => {
         const stack = new DomainStack(app, 'TestDomainStackSecretGrant', {
             registry: minimalRegistry,
             eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
             dbSecretArn,
         });
         const template = Template.fromStack(stack);
@@ -152,7 +175,7 @@ describe('DomainStack', () => {
     });
     describe('domain S3 bucket', () => {
         const app = new cdk.App();
-        const stack = new DomainStack(app, 'TestDomainStackS3', { registry: minimalRegistry, eventBusArn });
+        const stack = new DomainStack(app, 'TestDomainStackS3', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });
         const template = Template.fromStack(stack);
         it('creates exactly one S3 bucket', () => {
             template.resourceCountIs('AWS::S3::Bucket', 1);
@@ -170,7 +193,7 @@ describe('DomainStack', () => {
     });
     describe('tenant-scoped IAM role (defence in depth)', () => {
         const app = new cdk.App();
-        const stack = new DomainStack(app, 'TestDomainStackTenant', { registry: minimalRegistry, eventBusArn });
+        const stack = new DomainStack(app, 'TestDomainStackTenant', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });
         const template = Template.fromStack(stack);
         it('creates a tenant-scoped IAM role', () => {
             template.hasResourceProperties('AWS::IAM::Role', {
@@ -280,6 +303,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackMethods', {
                 registry: multiMethodRegistry,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn,
                 userPoolClientId,
             });
@@ -302,6 +327,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackRouteAuth', {
                 registry: multiMethodRegistry,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn,
                 userPoolClientId,
             });
@@ -325,6 +352,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackUnauthRoute', {
                 registry: multiMethodRegistry,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn,
                 userPoolClientId,
             });
@@ -340,6 +369,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackMissingPool', {
                 registry: multiMethodRegistry,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 // No userPoolArn / userPoolId / userPoolClientId provided
             });
             // `Annotations.of(stack).errors` is not exposed; read the construct's
@@ -372,6 +403,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackNoJwtNeeded', {
                 registry: noJwtRegistry,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
             });
             const metadata = stack.node.metadata;
             const errorMessages = metadata
@@ -445,6 +478,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackActionRoutes', {
                 registry: registryWithActions,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
                 userPoolClientId: 'test-client-id',
             });
@@ -459,6 +494,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackInternalOnly', {
                 registry: registryWithActions,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
                 userPoolClientId: 'test-client-id',
             });
@@ -472,6 +509,8 @@ describe('DomainStack', () => {
             const stack = new DomainStack(app, 'TestDomainStackActionJwt', {
                 registry: registryWithActions,
                 eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
                 userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
                 userPoolClientId: 'test-client-id',
             });

package/dist/__tests__/grouped-lambda-factory.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { buildDedicatedEntryContent, ADAPTER_BY_PRIMITIVE, EXPOSED_ACTION_ADAPTER, } from '../grouped-lambda-factory.js';
+import { buildDedicatedEntryContent, buildGroupedApiActionEntryContent, ADAPTER_BY_PRIMITIVE, EXPOSED_ACTION_ADAPTER, } from '../grouped-lambda-factory.js';
 /**
  * Wave 7 Task 7.3 (#4619) — narrow, pure tests for the dedicated-mode
  * Lambda entry-content generator.
@@ -143,4 +143,25 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
             expect(EXPOSED_ACTION_ADAPTER).toBe('createExposedActionApiHandler');
         });
     });
+    describe('buildGroupedApiActionEntryContent', () => {
+        it('generates a single entry that imports all API actions and dispatches by routeKey', () => {
+            const entries = [
+                { id: 'whoami', handlerFile: 'actions/whoami.ts', method: 'GET', routePath: '/auth/v1/auth/whoami' },
+                { id: 'register-sys-admin', handlerFile: 'actions/register-sys-admin.ts', method: 'POST', routePath: '/auth/v1/auth/register-sys-admin' },
+            ];
+            const content = buildGroupedApiActionEntryContent('auth', entries, '/tmp/entry', '/repo/domains/auth');
+            // Imports createExposedActionApiHandler from the runtime
+            expect(content).toContain("import { createExposedActionApiHandler } from '@mettlecast/domain-runtime'");
+            // Imports each action
+            expect(content).toContain('import { whoami } from');
+            expect(content).toContain('import { registerSysAdmin } from');
+            // Route handlers keyed by routeKey
+            expect(content).toContain('"GET /auth/v1/auth/whoami"');
+            expect(content).toContain('"POST /auth/v1/auth/register-sys-admin"');
+            // Dispatcher reads routeKey from event
+            expect(content).toContain('event.requestContext?.routeKey');
+            // 404 fallback
+            expect(content).toContain('statusCode: 404');
+        });
+    });
 });

package/dist/grouped-lambda-factory.d.ts

@@ -1,4 +1,5 @@
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import { Construct } from 'constructs';
 /** Primitive types that can be grouped into a single Lambda. */
@@ -115,3 +116,32 @@ export declare function buildDedicatedEntryContent(handlerImportPath: string, en
  * Grouped mode retains Code.fromAsset for backward compatibility.
  */
 export declare function createGroupedLambdas(scope: Construct, props: GroupedLambdaProps): lambda.Function[];
+/** Entry for a single API-exposed action within a grouped Lambda. */
+export interface ApiActionRouteEntry {
+    id: string;
+    handlerFile: string;
+    method: string;
+    /** Full HTTP route path including the domain prefix (e.g. /auth/v1/auth/whoami). */
+    routePath: string;
+}
+/**
+ * Pure entry-content generator for the grouped API-action Lambda.
+ *
+ * Generates a single TypeScript entry that imports all API-exposed actions,
+ * pre-creates per-action HTTP handlers via `createExposedActionApiHandler`,
+ * and dispatches by `event.requestContext.routeKey`.
+ *
+ * Exported so unit tests can assert on the generated content without
+ * instantiating CDK or esbuild.
+ */
+export declare function buildGroupedApiActionEntryContent(domainId: string, entries: ApiActionRouteEntry[], entryDir: string, domainRoot: string): string;
+/**
+ * Creates a single grouped Lambda for all API-exposed actions in a domain.
+ *
+ * Uses NodejsFunction (esbuild on-the-fly) with a generated multi-action entry
+ * that dispatches by `event.requestContext.routeKey`. All HTTP API routes for
+ * the domain's API actions point to this one Lambda.
+ */
+export declare function createGroupedApiActionLambda(scope: Construct, props: Omit<GroupedLambdaProps, 'handlerEntries' | 'primitiveType' | 'dedicated'> & {
+    apiEntries: ApiActionRouteEntry[];
+}): lambdaNode.NodejsFunction;

package/dist/grouped-lambda-factory.js

@@ -226,3 +226,96 @@ function toLogRetention(days) {
     };
     return map[days] ?? logs.RetentionDays.ONE_MONTH;
 }
+/**
+ * Pure entry-content generator for the grouped API-action Lambda.
+ *
+ * Generates a single TypeScript entry that imports all API-exposed actions,
+ * pre-creates per-action HTTP handlers via `createExposedActionApiHandler`,
+ * and dispatches by `event.requestContext.routeKey`.
+ *
+ * Exported so unit tests can assert on the generated content without
+ * instantiating CDK or esbuild.
+ */
+export function buildGroupedApiActionEntryContent(domainId, entries, entryDir, domainRoot) {
+    const lines = [
+        `import { createExposedActionApiHandler } from '@mettlecast/domain-runtime';`,
+    ];
+    // Import each action handler
+    for (const entry of entries) {
+        const exportName = camelCase(entry.id);
+        const absPath = join(domainRoot, entry.handlerFile);
+        let rel = relative(entryDir, absPath).replace(/\\/g, '/');
+        if (!rel.startsWith('.'))
+            rel = `./${rel}`;
+        lines.push(`import { ${exportName} } from '${rel}';`);
+    }
+    lines.push('');
+    // Build the action registry (for ctx.actions cross-domain calls)
+    const registryEntries = entries
+        .map(e => `${JSON.stringify(e.id)}: ${camelCase(e.id)}`)
+        .join(', ');
+    lines.push(`const domainId = ${JSON.stringify(domainId)};`);
+    lines.push(`const actionRegistry = { [domainId]: { ${registryEntries} } };`);
+    lines.push('');
+    // Pre-create per-route handlers
+    lines.push('const routeHandlers: Record<string, (event: any) => Promise<any>> = {');
+    for (const entry of entries) {
+        const exportName = camelCase(entry.id);
+        const routeKey = `${entry.method} ${entry.routePath}`;
+        lines.push(`  ${JSON.stringify(routeKey)}: createExposedActionApiHandler(${exportName}, { definingDomain: domainId, domainId, actionRegistry, callerDomainId: domainId }),`);
+    }
+    lines.push('};');
+    lines.push('');
+    // Dispatcher
+    lines.push('export const handler = async (event: any) => {', '  const routeKey = event.requestContext?.routeKey;', '  const matched = routeHandlers[routeKey];', '  if (!matched) {', '    return { statusCode: 404, headers: { "Content-Type": "application/json" }, body: JSON.stringify({ message: "Not Found" }) };', '  }', '  return matched(event);', '};');
+    return lines.join('\n');
+}
+/**
+ * Creates a single grouped Lambda for all API-exposed actions in a domain.
+ *
+ * Uses NodejsFunction (esbuild on-the-fly) with a generated multi-action entry
+ * that dispatches by `event.requestContext.routeKey`. All HTTP API routes for
+ * the domain's API actions point to this one Lambda.
+ */
+export function createGroupedApiActionLambda(scope, props) {
+    if (!props.domainRoot)
+        throw new Error('domainRoot is required for createGroupedApiActionLambda');
+    const vpcConfig = props.vpc
+        ? {
+            vpc: props.vpc,
+            securityGroups: props.securityGroups,
+            ...(props.subnetSelection ? { vpcSubnets: props.subnetSelection } : {}),
+        }
+        : {};
+    const logRetention = toLogRetention(props.logRetentionDays ?? 30);
+    const powertoolsLayerArn = `arn:aws:lambda:${cdk.Stack.of(scope).region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:26`;
+    const serviceName = `${props.domainId}-action-api`;
+    const entryDir = createTempEntryDir();
+    const entryPath = join(entryDir, 'entry.ts');
+    const entryContent = buildGroupedApiActionEntryContent(props.domainId, props.apiEntries, entryDir, props.domainRoot);
+    writeFileSync(entryPath, entryContent, 'utf8');
+    const powertoolsLayer = lambda.LayerVersion.fromLayerVersionArn(scope, `PowertoolsLayer${props.domainId}-action-api`, powertoolsLayerArn);
+    return new lambdaNode.NodejsFunction(scope, `${props.domainId}-action-api`, {
+        runtime: lambda.Runtime.NODEJS_22_X,
+        architecture: lambda.Architecture.ARM_64,
+        entry: entryPath,
+        handler: 'handler',
+        layers: [powertoolsLayer],
+        bundling: {
+            minify: true,
+            sourceMap: true,
+            externalModules: ['@aws-sdk/*'],
+        },
+        environment: {
+            ...props.environment,
+            POWERTOOLS_SERVICE_NAME: serviceName,
+            POWERTOOLS_LOG_LEVEL: 'INFO',
+            TIB_EVENT_BUS_ARN: props.eventBusArn,
+        },
+        timeout: cdk.Duration.seconds(30),
+        memorySize: 256,
+        reservedConcurrentExecutions: props.reservedConcurrency,
+        logRetention,
+        ...vpcConfig,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.91",
+  "version": "0.2.93",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",