@mettlecast/domain-cdk-packer 0.2.94 → 0.2.96

package/dist/DomainStack.d.ts

@@ -84,11 +84,37 @@ export interface DomainStackProps extends cdk.StackProps {
      * Defaults to the second segment of the stack name; falls back to `dev` when not derivable.
      */
     envCode?: string;
+    /**
+     * Map of OTHER domain ids → their internal-action grouped Lambda ARNs.
+     * Injected into this domain's subscriber/action Lambdas (via the
+     * `TIB_ACTION_LAMBDA_ARNS` env var) so `ctx.actions.otherDomain.someAction()`
+     * dispatches cross-domain through the runtime's Lambda invoke envelope
+     * (#5226). ARNs use the deterministic action-Lambda function name
+     * `${projectId}-${envCode}-domain-${domainId}-action`.
+     */
+    crossDomainActionArns?: Record<string, string>;
     /**
      * When true, disables the auto-generated per-domain CloudWatch dashboard.
      * Existing dashboards will be removed on the next CDK deploy.
      */
     disableCloudWatchDashboards?: boolean;
+    /**
+     * When true, the per-domain DynamoDB table and S3 bucket are imported
+     * (adopted) instead of created. This is the migration-safe path for
+     * environments where those resources already exist OUTSIDE the CloudFormation
+     * stack (e.g. created manually or by an earlier deployment generation) —
+     * CloudFormation would otherwise fail the change-set with "already exists".
+     *
+     * Imported resources are not owned by the stack, so:
+     *   - their data is preserved untouched;
+     *   - CloudFormation can never accidentally delete them on stack deletion;
+     *   - IAM grants, env vars (DOMAIN_TABLE_NAME / DOMAIN_BUCKET_NAME) and
+     *     CfnOutputs keep referencing the same physical names.
+     *
+     * The deploy workflow detects pre-existing resources and passes the CDK
+     * context `adopt-existing-resources=true` (see workflowGenerator.ts).
+     */
+    adoptExistingResources?: boolean;
 }
 export declare class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */

package/dist/DomainStack.js

@@ -75,7 +75,7 @@ export class DomainStack extends cdk.Stack {
             throw new Error(`Registry validation failed for domain '${props.registry.domain?.id ?? '<unknown>'}':\n${lines.join('\n')}\n\n` +
                 `Fix registry data before deploying.`);
         }
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, appSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, appSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards, adoptExistingResources } = props;
         const vpc = props.vpc ?? (props.vpcId
             ? ec2.Vpc.fromVpcAttributes(this, 'SharedVpc', {
                 vpcId: props.vpcId,
@@ -191,6 +191,17 @@ export class DomainStack extends cdk.Stack {
         if (process.env['SES_FROM_EMAIL']) {
             environment.SES_FROM_EMAIL = process.env['SES_FROM_EMAIL'];
         }
+        // Cross-domain action dispatch: the runtime's ActionsProxy invokes other
+        // domains' internal-action grouped Lambdas by ARN. The map is resolved by
+        // the generated app (deterministic function names) and injected so
+        // subscribers/actions can call `ctx.actions.otherDomain.someAction()`.
+        const crossDomainActionArns = props.crossDomainActionArns ?? {};
+        if (Object.keys(crossDomainActionArns).length > 0) {
+            environment.TIB_ACTION_LAMBDA_ARNS = JSON.stringify(crossDomainActionArns);
+        }
+        // Deterministic physical name for THIS domain's internal-action grouped
+        // Lambda so other stacks can construct its ARN for cross-domain calls.
+        const actionLambdaName = `${resourceBaseName}-action`;
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;
@@ -257,6 +268,10 @@ export class DomainStack extends cdk.Stack {
                             environment,
                             eventBusArn,
                             dedicated: internalDedicated,
+                            // Deterministic physical name so OTHER domain stacks can resolve
+                            // this Lambda's ARN for cross-domain `ctx.actions` dispatch.
+                            // Only applied in grouped (non-dedicated) mode (#5226).
+                            functionName: actionLambdaName,
                             reservedConcurrency,
                             logRetentionDays: logRetentionDays ?? 30,
                             lambdaGroupId: group.outboundAccess,
@@ -313,34 +328,45 @@ export class DomainStack extends cdk.Stack {
             }
             return { lambdas, byId };
         };
-        // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key
-        const domainTable = new dynamodb.Table(this, 'DomainTable', {
-            tableName: resourceBaseName,
-            partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
-            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
-            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
-            encryption: enableCmk ? dynamodb.TableEncryption.CUSTOMER_MANAGED : dynamodb.TableEncryption.AWS_MANAGED,
-            encryptionKey: cmkKey,
-            timeToLiveAttribute: 'expiresAt',
-            removalPolicy: cdk.RemovalPolicy.RETAIN,
-            pointInTimeRecovery: true,
-        });
-        // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime
+        // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key.
+        //
+        // Issue #5234: when `adoptExistingResources` is set (detected by the deploy
+        // workflow), the table already exists OUTSIDE this CloudFormation stack.
+        // Import it instead of creating it so the change-set does not fail with
+        // "resource already exists"; the imported table is not owned by the stack,
+        // so its data is preserved and CloudFormation can never delete it.
+        const domainTable = adoptExistingResources
+            ? dynamodb.Table.fromTableName(this, 'DomainTable', resourceBaseName)
+            : new dynamodb.Table(this, 'DomainTable', {
+                tableName: resourceBaseName,
+                partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
+                sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+                billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+                encryption: enableCmk ? dynamodb.TableEncryption.CUSTOMER_MANAGED : dynamodb.TableEncryption.AWS_MANAGED,
+                encryptionKey: cmkKey,
+                timeToLiveAttribute: 'expiresAt',
+                removalPolicy: cdk.RemovalPolicy.RETAIN,
+                pointInTimeRecovery: true,
+            });
+        // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime.
         const bucketName = resourceBaseName.length <= 63
             ? resourceBaseName
             : `${resourceBaseName.slice(0, 55)}-${cdk.Fn.select(0, cdk.Fn.split('-', cdk.Names.uniqueId(this))).toLowerCase()}`;
-        const domainBucket = new s3.Bucket(this, 'DomainBucket', {
-            bucketName,
-            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-            encryption: enableCmk ? s3.BucketEncryption.KMS : s3.BucketEncryption.S3_MANAGED,
-            encryptionKey: cmkKey,
-            versioned: true,
-            enforceSSL: true,
-            removalPolicy: cdk.RemovalPolicy.RETAIN,
-            lifecycleRules: [{
-                    noncurrentVersionExpiration: cdk.Duration.days(90),
-                }],
-        });
+        // Issue #5234: same adoption path for the bucket as the table above.
+        const domainBucket = adoptExistingResources
+            ? s3.Bucket.fromBucketName(this, 'DomainBucket', bucketName)
+            : new s3.Bucket(this, 'DomainBucket', {
+                bucketName,
+                blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+                encryption: enableCmk ? s3.BucketEncryption.KMS : s3.BucketEncryption.S3_MANAGED,
+                encryptionKey: cmkKey,
+                versioned: true,
+                enforceSSL: true,
+                removalPolicy: cdk.RemovalPolicy.RETAIN,
+                lifecycleRules: [{
+                        noncurrentVersionExpiration: cdk.Duration.days(90),
+                    }],
+            });
         environment['DOMAIN_TABLE_NAME'] = domainTable.tableName;
         environment['DOMAIN_BUCKET_NAME'] = domainBucket.bucketName;
         // Per-domain tenant-scoped IAM role for defence-in-depth storage segregation
@@ -439,6 +465,16 @@ export class DomainStack extends cdk.Stack {
                 // Grant IAM permissions for this queue
                 const queuePolicies = iamBuilder.forSubscriber({ queueArn: queue.queueArn, dlqArn: dlq.queueArn });
                 queuePolicies.forEach(statement => fn.addToRolePolicy(statement));
+                // Cross-domain action dispatch: subscribers (e.g. auth's
+                // on-member-invited) call other domains' internal-action grouped
+                // Lambdas via `ctx.actions` (#5226).
+                const crossDomainActionArnList = Object.values(crossDomainActionArns);
+                if (crossDomainActionArnList.length > 0) {
+                    fn.addToRolePolicy(new iam.PolicyStatement({
+                        actions: ['lambda:InvokeFunction'],
+                        resources: crossDomainActionArnList,
+                    }));
+                }
                 // Create EventBridge rule targeting SQS queue
                 new events.Rule(this, `${pascalId}Rule`, {
                     eventBus,
@@ -564,9 +600,12 @@ export class DomainStack extends cdk.Stack {
             const actionLambdaById = actionHandlers.byId;
             actionLambdas = actionHandlers.lambdas;
             this.lambdaArns[`${domainId}-action`] = actionLambdas[0].functionArn;
-            const iamPolicies = iamBuilder.forAction([
-                `arn:aws:lambda:${this.region}:${this.account}:function:TIB-*-domain-*-action-*`,
-            ]);
+            // Cross-domain invoke grants: each domain's action/subscriber Lambdas
+            // may call other domains' internal-action grouped Lambdas via
+            // `ctx.actions`. Use the resolved ARN list (deterministic function
+            // names) instead of a stale wildcard pattern (#5226).
+            const crossDomainActionArnList = Object.values(crossDomainActionArns);
+            const iamPolicies = iamBuilder.forAction(crossDomainActionArnList);
             actionLambdas.forEach((fn) => {
                 iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
             });

package/dist/__tests__/bootstrap-invite-registration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bootstrap-invite-registration.test.js

@@ -0,0 +1,115 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, readFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Focused registration test for the API-owned bootstrap-admin invitation
+ * endpoint (#5226).
+ *
+ * The deployment pipeline relies on the DOCUMENTED generation process:
+ * `mc-domain-module build domains/{id}` for every directory under `domains/`,
+ * then `mc-domain-module build-catalog`. There is no hand-edited `.mc`
+ * registry. This test runs the REAL CLI against the checked-in source for ALL
+ * current domains (auth, data-management, email, orgs) and asserts:
+ *   - `bootstrap-invite` is registered with the contract the pipeline depends
+ *     on: POST /v1/auth/bootstrap-invite, auth 'none', tenancy 'none',
+ *     ADMIN_BOOTSTRAP_SECRET securityException, idempotent: true, and an
+ *     input schema that accepts only secret + email.
+ *   - the removed `register-sys-admin` endpoint (fixed-password flow) is gone.
+ *   - the email domain registry is generated so the vanilla
+ *     `on-member-invited` subscriber's `email.send-template-email` call stays
+ *     typed in the regenerated `.mc/actions-types.d.ts` and present in the
+ *     merged catalog (regression: a partial regeneration dropped the email
+ *     declarations because `.mc/email-registry.json` was absent).
+ */
+describe('auth registry — bootstrap-invite registration (#5226)', () => {
+    const repoRoot = fileURLToPath(new URL('../../../../', import.meta.url));
+    // Isolated work tree. `build` must run with cwd=repoRoot (its tsx temp loader
+    // resolves `zod`/`@mettlecast/*` from the repo tree), but `build-catalog` is
+    // pure JSON and writes the merged catalog to `<cwd>/.mc/domain-registry.json`
+    // — so it runs from the temp work dir and never touches the repo's `.mc`.
+    const workDir = mkdtempSync(join(tmpdir(), 'mc-registry-test-'));
+    const regDir = join(workDir, 'registries');
+    const cliJs = join(repoRoot, 'node_modules', '@mettlecast', 'domain-cli', 'dist', 'cli.js');
+    const domains = ['auth', 'data-management', 'email', 'orgs'];
+    let authRegistry;
+    let catalog;
+    let typesContent;
+    beforeAll(() => {
+        mkdirSync(regDir, { recursive: true });
+        // Mirror the CI "Build domain registries" + "Build domain catalog" steps:
+        // delete stale per-domain registries, build every domains/*/, then merge.
+        for (const domain of domains) {
+            execFileSync(process.execPath, [cliJs, 'build', join(repoRoot, 'domains', domain), '--out', join(regDir, `${domain}-registry.json`)], { cwd: repoRoot, stdio: 'pipe', timeout: 120_000 });
+        }
+        execFileSync(process.execPath, [cliJs, 'build-catalog', '--mc-dir', regDir], { cwd: workDir, stdio: 'pipe', timeout: 60_000 });
+        authRegistry = JSON.parse(readFileSync(join(regDir, 'auth-registry.json'), 'utf8'));
+        catalog = JSON.parse(readFileSync(join(workDir, '.mc', 'domain-registry.json'), 'utf8'));
+        // The last `build` regenerates actions-types.d.ts next to the registries.
+        typesContent = readFileSync(join(regDir, 'actions-types.d.ts'), 'utf8');
+    });
+    afterAll(() => {
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    describe('bootstrap-invite contract', () => {
+        it('registers bootstrap-invite as an API-exposed action', () => {
+            const action = authRegistry.actions.find((a) => a.id === 'bootstrap-invite');
+            expect(action).toBeDefined();
+            expect(action.exposure.type).toBe('api');
+        });
+        it('exposes the CDK route POST /auth/v1/auth/bootstrap-invite (domain prefix + path)', () => {
+            const action = authRegistry.actions.find((a) => a.id === 'bootstrap-invite');
+            expect(action.exposure.path).toBe('/v1/auth/bootstrap-invite');
+            expect(action.exposure.method).toBe('POST');
+            // DomainStack.ts wires the route as `/${domainId}${exposure.path}`.
+            expect(`/auth${action.exposure.path}`).toBe('/auth/v1/auth/bootstrap-invite');
+        });
+        it('is auth:none, tenancy:none and carries an ADMIN_BOOTSTRAP_SECRET security exception', () => {
+            const action = authRegistry.actions.find((a) => a.id === 'bootstrap-invite');
+            expect(action.exposure.auth).toBe('none');
+            expect(action.exposure.tenancy).toBe('none');
+            expect(action.exposure.authDeclared).toBe(true);
+            expect(action.exposure.tenancyDeclared).toBe(true);
+            expect(action.exposure.securityException?.reason).toContain('ADMIN_BOOTSTRAP_SECRET');
+        });
+        it('is idempotent and accepts only secret + email', () => {
+            const action = authRegistry.actions.find((a) => a.id === 'bootstrap-invite');
+            expect(action.idempotent).toBe(true);
+            expect(action.inputSchema.required).toEqual(['secret', 'email']);
+            expect(action.inputSchema.properties.password).toBeUndefined();
+            expect(action.inputSchema.default.password).toBeUndefined();
+        });
+        it('no longer registers the fixed-password register-sys-admin endpoint', () => {
+            const action = authRegistry.actions.find((a) => a.id === 'register-sys-admin');
+            expect(action).toBeUndefined();
+        });
+    });
+    describe('full documented build process — all current domains', () => {
+        it('generates a registry file for EVERY domain under domains/ (auth, data-management, email, orgs)', () => {
+            for (const domain of domains) {
+                expect(existsSync(join(regDir, `${domain}-registry.json`))).toBe(true);
+            }
+        });
+        it('generates the email registry so on-member-invited keeps its email.send-template-email call', () => {
+            const email = JSON.parse(readFileSync(join(regDir, 'email-registry.json'), 'utf8'));
+            const sendTemplateEmail = email.actions.find((a) => a.id === 'send-template-email');
+            expect(sendTemplateEmail).toBeDefined();
+            expect(sendTemplateEmail.backendAccess).toBe('domain');
+            expect(sendTemplateEmail.exposure.type).toBe('internal');
+        });
+        it('regenerated actions-types.d.ts keeps email.send-template-email and auth.bootstrap-invite, drops auth.register-sys-admin', () => {
+            expect(typesContent).toContain("call(actionId: 'email.send-template-email'");
+            expect(typesContent).toContain("call(actionId: 'auth.bootstrap-invite'");
+            expect(typesContent).not.toContain("call(actionId: 'auth.register-sys-admin'");
+        });
+        it('merged catalog includes all four domains and both endpoints', () => {
+            expect(catalog.domains.map((d) => d.id)).toEqual(expect.arrayContaining(['auth', 'data-management', 'email', 'orgs']));
+            const ids = catalog.actions.map((a) => a.id);
+            expect(ids).toContain('bootstrap-invite');
+            expect(ids).toContain('send-template-email');
+            expect(ids).not.toContain('register-sys-admin');
+        });
+    });
+});

package/dist/__tests__/cross-domain-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/cross-domain-wiring.test.js

@@ -0,0 +1,126 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+/**
+ * Cross-domain wiring contract (#5226):
+ *
+ * A domain's subscriber and action Lambdas must be able to invoke other
+ * domains' internal-action grouped Lambdas via `ctx.actions`. This test
+ * synthesises a real DomainStack with a subscriber + internal action and
+ * asserts the ACTUAL CDK output:
+ *   - the internal-action grouped Lambda has a deterministic `FunctionName`
+ *     (`<projectId>-<envCode>-<domainId>-action`) so other stacks can resolve
+ *     its ARN;
+ *   - every subscriber/action Lambda receives `TIB_ACTION_LAMBDA_ARNS`
+ *     (the resolved cross-domain ARN map injected by the generated app);
+ *   - the subscriber/action roles carry `lambda:InvokeFunction` on those
+ *     exact ARNs.
+ */
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-cross-domain-cdk-packer');
+const DIST_ROOT = path.join(process.cwd(), 'dist', 'domains', 'test-domain');
+const EVENT_BUS_ARN = 'arn:aws:events:eu-north-1:123456789012:event-bus/test-bus';
+const EMAIL_ACTION_ARN = 'arn:aws:lambda:eu-north-1:123456789012:function:test-dev-domain-email-action';
+const ORGS_ACTION_ARN = 'arn:aws:lambda:eu-north-1:123456789012:function:test-dev-domain-orgs-action';
+const registry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
+    webhooks: [],
+    subscribers: [
+        {
+            id: 'on-thing-created',
+            kind: 'subscriber',
+            handlerFile: 'src/handlers/on-thing-created.ts',
+            event: 'thing.created',
+            semverRange: '^1',
+            outboundAccess: 'internal',
+        },
+    ],
+    schedules: [],
+    jobs: [],
+    actions: [
+        {
+            id: 'internal-helper',
+            kind: 'action',
+            handlerFile: 'src/handlers/internal-helper.ts',
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: false,
+            inputSchema: { type: 'object', properties: {}, required: [] },
+            outputSchema: { type: 'object', properties: {}, required: [] },
+        },
+    ],
+    integrations: [],
+    events: [],
+};
+// The grouped (asset) path requires the dist asset directories to exist at
+// synth time; the dedicated NodejsFunction path needs the handler stubs.
+beforeAll(() => {
+    fs.mkdirSync(path.join(DOMAIN_ROOT, 'src', 'handlers'), { recursive: true });
+    fs.writeFileSync(path.join(DOMAIN_ROOT, 'src', 'handlers', 'internal-helper.ts'), `export const internalHelper = { id: "internal-helper", backendAccess: "domain", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n`);
+    fs.writeFileSync(path.join(DOMAIN_ROOT, 'src', 'handlers', 'on-thing-created.ts'), `export const onThingCreated = { id: "on-thing-created", event: "thing.created", semverRange: "^1", handler: async () => {} };\n`);
+    fs.mkdirSync(path.join(DIST_ROOT, 'action'), { recursive: true });
+    fs.mkdirSync(path.join(DIST_ROOT, 'subscriber'), { recursive: true });
+});
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+    fs.rmSync(path.join(process.cwd(), 'dist', 'domains', 'test-domain'), { recursive: true, force: true });
+});
+describe('DomainStack cross-domain action wiring (#5226)', () => {
+    it('gives the internal-action grouped Lambda a deterministic FunctionName', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestCrossDomainStack', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: 'Test',
+            envCode: 'Dev',
+            crossDomainActionArns: { email: EMAIL_ACTION_ARN, orgs: ORGS_ACTION_ARN },
+        });
+        const template = Template.fromStack(stack);
+        const lambdas = template.findResources('AWS::Lambda::Function');
+        const actionLambda = Object.values(lambdas).find(l => l.Properties.FunctionName === 'test-dev-test-domain-action');
+        expect(actionLambda).toBeDefined();
+    });
+    it('injects TIB_ACTION_LAMBDA_ARNS into subscriber and action Lambdas', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestCrossDomainStackEnv', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: 'Test',
+            envCode: 'Dev',
+            crossDomainActionArns: { email: EMAIL_ACTION_ARN, orgs: ORGS_ACTION_ARN },
+        });
+        const template = Template.fromStack(stack);
+        const lambdas = template.findResources('AWS::Lambda::Function');
+        // The subscriber group (asset) and the internal-action group both carry
+        // the env — select by construct-id substring (keys are hashed, e.g.
+        // `testdomainsubscriberinternal...`), since only the action group has an
+        // explicit FunctionName.
+        const domainLambdas = Object.entries(lambdas).filter(([id]) => /subscriber|action/i.test(id) && !/Health|Ready|LogRetention/i.test(id));
+        expect(domainLambdas.length).toBeGreaterThanOrEqual(2);
+        for (const [, l] of domainLambdas) {
+            const arnsJson = l.Properties.Environment?.Variables?.TIB_ACTION_LAMBDA_ARNS;
+            expect(arnsJson).toBeDefined();
+            const arns = JSON.parse(arnsJson);
+            expect(arns.email).toBe(EMAIL_ACTION_ARN);
+            expect(arns.orgs).toBe(ORGS_ACTION_ARN);
+        }
+    });
+    it('grants lambda:InvokeFunction on the exact cross-domain action ARNs', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestCrossDomainStackIam', {
+            registry,
+            eventBusArn: EVENT_BUS_ARN,
+            projectId: 'Test',
+            envCode: 'Dev',
+            crossDomainActionArns: { email: EMAIL_ACTION_ARN, orgs: ORGS_ACTION_ARN },
+        });
+        const template = Template.fromStack(stack);
+        const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+        const hasInvokeGrant = policies.some(p => p.Properties.PolicyDocument.Statement.some(s => s.Action?.includes('lambda:InvokeFunction') && s.Resource?.includes(EMAIL_ACTION_ARN)));
+        expect(hasInvokeGrant).toBe(true);
+    });
+});

package/dist/__tests__/domain-stack.test.js

@@ -191,6 +191,52 @@ describe('DomainStack', () => {
             template.hasOutput('DomainBucketName', {});
         });
     });
+    describe('adopt existing resources (#5234)', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestDomainStackAdopt', {
+            registry: minimalRegistry,
+            eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
+            adoptExistingResources: true,
+        });
+        const template = Template.fromStack(stack);
+        it('does NOT create a DynamoDB table — the pre-existing table is imported', () => {
+            template.resourceCountIs('AWS::DynamoDB::Table', 0);
+        });
+        it('does NOT create an S3 bucket — the pre-existing bucket is imported', () => {
+            template.resourceCountIs('AWS::S3::Bucket', 0);
+        });
+        it('keeps the CfnOutputs for the adopted table and bucket names', () => {
+            template.hasOutput('DomainTableName', {});
+            template.hasOutput('DomainBucketName', {});
+        });
+        it('sets DOMAIN_TABLE_NAME and DOMAIN_BUCKET_NAME env vars to the adopted names', () => {
+            const lambdas = template.findResources('AWS::Lambda::Function');
+            const domainLambdas = Object.entries(lambdas).filter(([id]) => !id.includes('Health') && !id.includes('Ready') && !id.includes('LogRetention'));
+            for (const [, res] of domainLambdas) {
+                expect(res.Properties.Environment?.Variables?.DOMAIN_TABLE_NAME).toBe('test-dev-test-domain');
+                expect(res.Properties.Environment?.Variables?.DOMAIN_BUCKET_NAME).toBe('test-dev-test-domain');
+            }
+        });
+        it('still grants Lambdas read/write on the adopted table and bucket', () => {
+            const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+            const statementResources = (action) => policies.flatMap(p => p.Properties.PolicyDocument.Statement
+                .filter(s => s.Action?.includes(action))
+                .flatMap(s => {
+                const res = s.Resource;
+                if (Array.isArray(res))
+                    return res.map(r => JSON.stringify(r));
+                if (res === undefined)
+                    return [];
+                return [JSON.stringify(res)];
+            }));
+            // DynamoDB grant targets the imported table ARN (synthesized as Fn::Join).
+            expect(statementResources('dynamodb:PutItem').some(r => r.includes(':table/test-dev-test-domain'))).toBe(true);
+            // S3 grant targets the imported bucket ARN.
+            expect(statementResources('s3:PutObject').some(r => r.includes(':s3:::test-dev-test-domain/*'))).toBe(true);
+        });
+    });
     describe('tenant-scoped IAM role (defence in depth)', () => {
         const app = new cdk.App();
         const stack = new DomainStack(app, 'TestDomainStackTenant', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });

package/dist/__tests__/grouped-lambda-factory.test.js

@@ -49,6 +49,13 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
                     expect(content).toContain('export const handler = createActionLambdaHandler(registry, {');
                     expect(content).toContain(`domainId: "${DOMAIN_ID}"`);
                 }
+                else if (primitive === 'subscriber') {
+                    // Subscribers forward the cross-domain action ARN map so their
+                    // ctx.actions proxy can dispatch other domains' actions (#5226).
+                    expect(content).toContain(`export const handler = ${expectedAdapter}(listThings, {`);
+                    expect(content).toContain(`lambdaArns: JSON.parse(process.env.TIB_ACTION_LAMBDA_ARNS ?? '{}')`);
+                    expect(content).toContain(`callerDomainId: "${DOMAIN_ID}"`);
+                }
                 else {
                     expect(content).toContain(`export const handler = ${expectedAdapter}(listThings);`);
                 }
@@ -147,21 +154,38 @@ describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
         it('generates a single entry that imports all API actions and dispatches by routeKey', () => {
             const entries = [
                 { id: 'whoami', handlerFile: 'actions/whoami.ts', method: 'GET', routePath: '/auth/v1/auth/whoami' },
-                { id: 'register-sys-admin', handlerFile: 'actions/register-sys-admin.ts', method: 'POST', routePath: '/auth/v1/auth/register-sys-admin' },
+                { id: 'bootstrap-invite', handlerFile: 'actions/bootstrap-invite.ts', method: 'POST', routePath: '/auth/v1/auth/bootstrap-invite' },
             ];
             const content = buildGroupedApiActionEntryContent('auth', entries, '/tmp/entry', '/repo/domains/auth');
             // Imports createExposedActionApiHandler from the runtime
             expect(content).toContain("import { createExposedActionApiHandler } from '@mettlecast/domain-runtime'");
             // Imports each action
             expect(content).toContain('import { whoami } from');
-            expect(content).toContain('import { registerSysAdmin } from');
+            expect(content).toContain('import { bootstrapInvite } from');
             // Route handlers keyed by routeKey
             expect(content).toContain('"GET /auth/v1/auth/whoami"');
-            expect(content).toContain('"POST /auth/v1/auth/register-sys-admin"');
+            expect(content).toContain('"POST /auth/v1/auth/bootstrap-invite"');
             // Dispatcher reads routeKey from event
             expect(content).toContain('event.requestContext?.routeKey');
             // 404 fallback
             expect(content).toContain('statusCode: 404');
         });
     });
+    describe('subscriber ctx.actions wiring (#5226)', () => {
+        it('dedicated subscriber entry forwards lambdaArns + callerDomainId to createSubscriberLambdaHandler', () => {
+            const sub = entry('on-member-invited');
+            const content = buildDedicatedEntryContent('./handler.js', sub, 'subscriber', DOMAIN_ID);
+            expect(content).toContain(`export const handler = createSubscriberLambdaHandler(onMemberInvited, {`);
+            // Cross-domain dispatch map is read from env (set by DomainStack from
+            // PackDomainOptions.crossDomainActionArns).
+            expect(content).toContain(`lambdaArns: JSON.parse(process.env.TIB_ACTION_LAMBDA_ARNS ?? '{}')`);
+            expect(content).toContain(`callerDomainId: "${DOMAIN_ID}"`);
+        });
+        it('non-subscriber primitives keep the plain adapter call (no stray options object)', () => {
+            const job = entry('nightly-rollup');
+            const content = buildDedicatedEntryContent('./handler.js', job, 'job', DOMAIN_ID);
+            expect(content).toContain('export const handler = createJobLambdaHandler(nightlyRollup);');
+            expect(content).not.toContain('TIB_ACTION_LAMBDA_ARNS');
+        });
+    });
 });

package/dist/grouped-lambda-factory.d.ts

@@ -55,6 +55,12 @@ export interface GroupedLambdaProps {
     lambdaGroupId?: string;
     /** When true, creates one dedicated Lambda per handler instead of a single grouped Lambda. */
     dedicated?: boolean;
+    /**
+     * Explicit Lambda function name for the GROUPED (non-dedicated) Lambda.
+     * Used for the internal-action group so other stacks can resolve its ARN
+     * deterministically for cross-domain `ctx.actions` dispatch (#5226).
+     */
+    functionName?: string;
     /** Reserved concurrency for all Lambdas in this group. If omitted, no limit. */
     reservedConcurrency?: number;
     /** Log retention in days. Default: 30. */

package/dist/grouped-lambda-factory.js

@@ -122,6 +122,23 @@ export function buildDedicatedEntryContent(handlerImportPath, entry, primitiveTy
             `});`,
         ].join('\n');
     }
+    if (primitiveType === 'subscriber') {
+        // Subscribers need a usable `ctx.actions` proxy. The runtime honours
+        // `lambdaArns` (cross-domain dispatch) whenever an actionRegistry is
+        // passed, so the generated wrapper forwards the resolved cross-domain
+        // action ARN map (injected via TIB_ACTION_LAMBDA_ARNS env) plus the
+        // owning domain id. Without this, `ctx.actions.email['send-template-email']`
+        // in a subscriber is an empty proxy and throws (#5226).
+        return [
+            `import { ${adapter} } from '@mettlecast/domain-runtime';`,
+            `import { ${exportName} } from '${handlerImportPath}';`,
+            '',
+            `export const handler = ${adapter}(${exportName}, {`,
+            `  lambdaArns: JSON.parse(process.env.TIB_ACTION_LAMBDA_ARNS ?? '{}'),`,
+            `  callerDomainId: ${JSON.stringify(domainId)},`,
+            `});`,
+        ].join('\n');
+    }
     return [
         `import { ${adapter} } from '@mettlecast/domain-runtime';`,
         `import { ${exportName} } from '${handlerImportPath}';`,
@@ -202,6 +219,7 @@ export function createGroupedLambdas(scope, props) {
             handler: 'index.handler',
             code: lambda.Code.fromAsset(`dist/domains/${props.domainId}/${props.primitiveType}`),
             layers: [powertoolsLayer],
+            ...(props.functionName ? { functionName: props.functionName } : {}),
             environment: {
                 ...props.environment,
                 POWERTOOLS_SERVICE_NAME: serviceName,

package/dist/pack-domain.d.ts

@@ -49,8 +49,20 @@ export interface PackDomainOptions {
     projectId?: string;
     /** Environment code used to prefix per-domain physical resource names (e.g. `dev`, `prod`). */
     envCode?: string;
+    /**
+     * Map of OTHER domain ids → their internal-action grouped Lambda ARNs.
+     * Injected into this domain's Lambdas so `ctx.actions.otherDomain.someAction()`
+     * dispatches cross-domain (#5226).
+     */
+    crossDomainActionArns?: Record<string, string>;
     /** Disable auto-generated per-domain CloudWatch dashboard. */
     disableCloudWatchDashboards?: boolean;
+    /**
+     * When true, the per-domain DynamoDB table and S3 bucket are imported
+     * (adopted) instead of created — the migration-safe path when those
+     * resources already exist outside the CloudFormation stack (#5234).
+     */
+    adoptExistingResources?: boolean;
 }
 /**
  * Convenience entry-point: constructs a DomainStack from a compiled registry.

package/dist/pack-domain.js

@@ -59,6 +59,8 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         eventBusName: opts.eventBusName,
         projectId: opts.projectId,
         envCode: opts.envCode,
+        crossDomainActionArns: opts.crossDomainActionArns,
         disableCloudWatchDashboards: opts.disableCloudWatchDashboards,
+        adoptExistingResources: opts.adoptExistingResources,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.94",
+  "version": "0.2.96",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",