@venturekit/infra 0.0.0-dev.20260312012510 → 0.0.0-dev.20260329102450

package/dist/cdk/stack.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * VentureStack — CDK Stack for VentureKit applications
  *
@@ -7,72 +6,122 @@
  *
  * Consumers never see this file — it's invoked by the generated CDK app in .vk/cdk/.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.VentureStack = void 0;
-const cdk = __importStar(require("aws-cdk-lib"));
-const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
-const rds = __importStar(require("aws-cdk-lib/aws-rds"));
-const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
-const sqs = __importStar(require("aws-cdk-lib/aws-sqs"));
-const cognito = __importStar(require("aws-cdk-lib/aws-cognito"));
-const elasticache = __importStar(require("aws-cdk-lib/aws-elasticache"));
-const apigatewayv2 = __importStar(require("aws-cdk-lib/aws-apigatewayv2"));
-class VentureStack extends cdk.Stack {
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as rds from 'aws-cdk-lib/aws-rds';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as elasticache from 'aws-cdk-lib/aws-elasticache';
+import * as events from 'aws-cdk-lib/aws-events';
+import * as targets from 'aws-cdk-lib/aws-events-targets';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
+import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as acm from 'aws-cdk-lib/aws-certificatemanager';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
+import { resolveEnvConfig, DATA_SAFETY_CONFIG } from '@venturekit/core';
+import * as path from 'path';
+import * as fs from 'fs';
+export class VentureStack extends cdk.Stack {
     outputs = {};
+    /** Resolved environment configuration driving all resource sizing */
+    envConfig;
+    /** Data safety configuration for removal policies */
+    dataSafetyConfig;
+    /** Whether this is a free-tier deployment */
+    isFreeTier;
+    /** Standard tags applied to all taggable resources */
+    standardTags;
     constructor(scope, id, props) {
         super(scope, id, props);
-        const { projectName, stage, routesDir, infrastructure, projectDir } = props;
-        // Shared VPC (created if databases or caches are declared)
+        const { projectName, stage, routesDir, functionsDir, queuesDir, cronsDir, infrastructure, projectDir, preset } = props;
+        // --- Resolve environment configuration ---
+        // Priority: explicit envConfig > resolve from preset > fallback to 'micro'
+        const env = (stage === 'prod' ? 'prod' : stage === 'stage' ? 'stage' : 'dev');
+        this.envConfig = props.envConfig ?? resolveEnvConfig(env, { preset: preset ?? 'micro' });
+        this.isFreeTier = preset === 'free' || this.envConfig.dataSafety === 'relaxed' && preset === 'free';
+        this.dataSafetyConfig = DATA_SAFETY_CONFIG[this.envConfig.dataSafety];
+        // --- Well-Architected: Operational Excellence — consistent tagging ---
+        this.standardTags = {
+            Project: projectName,
+            Stage: stage,
+            ManagedBy: 'venturekit',
+            Preset: preset ?? 'micro',
+        };
+        Object.entries(this.standardTags).forEach(([key, value]) => {
+            cdk.Tags.of(this).add(key, value);
+        });
+        const lambdaConfig = this.envConfig.lambda;
+        const vpcConfig = this.envConfig.vpc;
+        const apiConfig = this.envConfig.api;
+        const obsConfig = this.envConfig.observability;
+        // --- Shared VPC ---
+        // Well-Architected: Security — network isolation for databases and caches
+        // Free tier: skip VPC entirely (NAT gateways are not free)
+        // Stable logical ID 'Vpc' ensures preset changes don't replace the VPC
         let vpc;
-        const needsVpc = (infrastructure?.databases && infrastructure.databases.length > 0) ||
-            (infrastructure?.caches && infrastructure.caches.length > 0);
+        const needsVpc = !this.isFreeTier && (lambdaConfig.vpcEnabled ||
+            (infrastructure?.databases && infrastructure.databases.length > 0) ||
+            (infrastructure?.caches && infrastructure.caches.length > 0));
         if (needsVpc) {
-            vpc = new ec2.Vpc(this, `${projectName}-vpc`, {
-                maxAzs: 2,
-                natGateways: stage === 'prod' ? 1 : 0,
-                subnetConfiguration: [
-                    { name: 'public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
-                    { name: 'private', subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 },
-                ],
+            const subnetConfig = [
+                { name: 'public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: vpcConfig.publicSubnets.cidrMask },
+                { name: 'private', subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: vpcConfig.privateSubnets.cidrMask },
+            ];
+            if (vpcConfig.isolatedSubnets) {
+                subnetConfig.push({
+                    name: 'isolated',
+                    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+                    cidrMask: vpcConfig.isolatedSubnets.cidrMask,
+                });
+            }
+            vpc = new ec2.Vpc(this, 'Vpc', {
+                maxAzs: vpcConfig.maxAzs,
+                natGateways: vpcConfig.natGateways,
+                ipAddresses: ec2.IpAddresses.cidr(vpcConfig.cidr),
+                subnetConfiguration: subnetConfig,
+                // Well-Architected: Security — restrict default SG
+                restrictDefaultSecurityGroup: true,
             });
+            // Well-Architected: Security — VPC flow logs for network monitoring
+            if (vpcConfig.flowLogsEnabled) {
+                vpc.addFlowLog('FlowLog', {
+                    destination: ec2.FlowLogDestination.toCloudWatchLogs(new logs.LogGroup(this, 'VpcFlowLogGroup', {
+                        logGroupName: `/venturekit/${projectName}/${stage}/vpc-flow-logs`,
+                        retention: this.toLogRetention(vpcConfig.flowLogsRetentionDays),
+                        removalPolicy: this.toRemovalPolicy(),
+                    })),
+                    trafficType: ec2.FlowLogTrafficType.ALL,
+                });
+            }
+            // Well-Architected: Performance — VPC endpoints reduce latency and cost
+            if (vpcConfig.enableVpcEndpoints) {
+                vpc.addGatewayEndpoint('S3Endpoint', {
+                    service: ec2.GatewayVpcEndpointAwsService.S3,
+                });
+                vpc.addGatewayEndpoint('DynamoEndpoint', {
+                    service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
+                });
+            }
         }
         // --- Databases ---
         if (infrastructure?.databases) {
             for (const db of infrastructure.databases) {
-                this.createDatabase(db, projectName, stage, vpc);
+                if (this.isFreeTier) {
+                    this.createDynamoDBTable(db, projectName, stage);
+                }
+                else {
+                    this.createDatabase(db, projectName, stage, vpc);
+                }
             }
         }
         // --- Storage ---
@@ -94,17 +143,41 @@ class VentureStack extends cdk.Stack {
             }
         }
         // --- Caches ---
-        if (infrastructure?.caches) {
+        // Free tier: skip ElastiCache (not free). Use DynamoDB-based caching
+        // via createDefaultRateLimiter() from @venturekit/runtime instead.
+        if (infrastructure?.caches && !this.isFreeTier) {
             for (const cache of infrastructure.caches) {
                 this.createCache(cache, projectName, stage, vpc);
             }
         }
+        // Free tier: create a DynamoDB table for rate limiting (always-free tier)
+        if (this.isFreeTier) {
+            this.createRateLimitTable(projectName, stage);
+        }
+        // --- Monitoring ---
+        if (infrastructure?.monitoring) {
+            for (const mon of infrastructure.monitoring) {
+                this.createMonitoring(mon, projectName, stage);
+            }
+        }
+        // --- Secrets ---
+        if (infrastructure?.secrets) {
+            for (const secret of infrastructure.secrets) {
+                this.createSecret(secret, projectName, stage);
+            }
+        }
         // --- API Gateway + Lambda routes ---
-        // Routes are discovered at deploy time from the filesystem
-        // For now, create the API Gateway shell; route wiring happens in a future iteration
-        const api = new apigatewayv2.HttpApi(this, `${projectName}-api`, {
+        // Well-Architected: Performance — throttling protects downstream services
+        // Well-Architected: Security — CORS preflight with explicit origins in prod
+        const api = new apigatewayv2.HttpApi(this, 'Api', {
             apiName: `${projectName}-${stage}`,
-            corsPreflight: {
+            corsPreflight: apiConfig.cors ? {
+                allowOrigins: apiConfig.cors.allowOrigins,
+                allowMethods: apiConfig.cors.allowMethods.map((m) => apigatewayv2.CorsHttpMethod[m.toUpperCase()] ?? apigatewayv2.CorsHttpMethod.ANY),
+                allowHeaders: apiConfig.cors.allowHeaders,
+                allowCredentials: apiConfig.cors.allowCredentials,
+                maxAge: cdk.Duration.seconds(apiConfig.cors.maxAgeSec),
+            } : {
                 allowOrigins: ['*'],
                 allowMethods: [
                     apigatewayv2.CorsHttpMethod.GET,
@@ -116,49 +189,178 @@ class VentureStack extends cdk.Stack {
                 ],
                 allowHeaders: ['*'],
             },
+            disableExecuteApiEndpoint: false,
+        });
+        // Well-Architected: Operational Excellence — access logging for API
+        const apiLogGroup = new logs.LogGroup(this, 'ApiAccessLog', {
+            logGroupName: `/venturekit/${projectName}/${stage}/api-access`,
+            retention: this.toLogRetention(obsConfig.logs.retentionDays),
+            removalPolicy: this.toRemovalPolicy(),
         });
+        const defaultStage = api.defaultStage?.node.defaultChild;
+        if (defaultStage) {
+            defaultStage.accessLogSettings = {
+                destinationArn: apiLogGroup.logGroupArn,
+                format: JSON.stringify({
+                    requestId: '$context.requestId',
+                    ip: '$context.identity.sourceIp',
+                    method: '$context.httpMethod',
+                    path: '$context.path',
+                    status: '$context.status',
+                    latency: '$context.responseLatency',
+                    integrationLatency: '$context.integrationLatency',
+                }),
+            };
+            defaultStage.defaultRouteSettings = {
+                detailedMetricsEnabled: apiConfig.detailedMetricsEnabled,
+                throttlingRateLimit: apiConfig.throttleRateLimit,
+                throttlingBurstLimit: apiConfig.throttleBurstLimit,
+            };
+        }
         new cdk.CfnOutput(this, 'ApiUrl', {
             value: api.apiEndpoint,
             description: 'API Gateway URL',
         });
+        // --- Custom Domains ---
+        if (infrastructure?.domains) {
+            for (const domain of infrastructure.domains) {
+                this.createDomain(domain, projectName, stage, api);
+            }
+        }
+        // --- Standalone Lambda Functions ---
+        // Discover functions from src/functions/ and create Lambda functions.
+        // Naming convention: {project}-{stage}-fn-{name}
+        const resolvedFunctionsDir = functionsDir
+            ? path.resolve(projectDir, functionsDir)
+            : path.resolve(projectDir, 'src/functions');
+        if (fs.existsSync(resolvedFunctionsDir)) {
+            const discoveredFunctions = this.discoverFunctionFiles(resolvedFunctionsDir);
+            const functionIntents = infrastructure?.functions ?? [];
+            for (const fnFile of discoveredFunctions) {
+                const intent = functionIntents.find((f) => f.id === fnFile.name);
+                this.createStandaloneFunction(fnFile.name, fnFile.handlerFile, projectName, stage, projectDir, intent);
+            }
+        }
+        // --- Queue Consumer Lambda Functions ---
+        // Discover handlers from src/queues/ and wire them to SQS queues.
+        // Naming convention: {project}-{stage}-queue-{name}
+        const resolvedQueuesDir = queuesDir
+            ? path.resolve(projectDir, queuesDir)
+            : path.resolve(projectDir, 'src/queues');
+        if (fs.existsSync(resolvedQueuesDir)) {
+            const discoveredQueues = this.discoverFunctionFiles(resolvedQueuesDir);
+            const queueIntents = infrastructure?.queues ?? [];
+            for (const qFile of discoveredQueues) {
+                const intent = queueIntents.find((q) => q.id === qFile.name);
+                this.createQueueConsumer(qFile.name, qFile.handlerFile, projectName, stage, projectDir, intent);
+            }
+        }
+        // --- Cron/Scheduled Task Lambda Functions ---
+        // Discover handlers from src/crons/ and wire them to EventBridge rules.
+        // Naming convention: {project}-{stage}-cron-{name}
+        const resolvedCronsDir = cronsDir
+            ? path.resolve(projectDir, cronsDir)
+            : path.resolve(projectDir, 'src/crons');
+        if (fs.existsSync(resolvedCronsDir)) {
+            const discoveredCrons = this.discoverFunctionFiles(resolvedCronsDir);
+            const scheduleIntents = infrastructure?.schedules ?? [];
+            for (const cFile of discoveredCrons) {
+                const intent = scheduleIntents.find((s) => s.id === cFile.name);
+                this.createCronHandler(cFile.name, cFile.handlerFile, projectName, stage, projectDir, intent);
+            }
+        }
     }
+    /**
+     * Well-Architected: Reliability — RDS with stable logical ID so preset
+     * changes (e.g. nano→medium) perform an in-place instance class modify,
+     * not a replacement. Data is preserved because the CloudFormation resource
+     * identity stays the same.
+     *
+     * Well-Architected: Security — encrypted at rest, credentials in Secrets Manager
+     * Well-Architected: Reliability — automated backups, optional multi-AZ
+     * Well-Architected: Performance — instance type driven by intent.size
+     * Well-Architected: Operational Excellence — auto minor version upgrades
+     */
     createDatabase(intent, projectName, stage, vpc) {
-        const resourceName = `${projectName}-${intent.id}`;
+        // Stable logical ID: 'db-{intent.id}' — never changes when preset changes
+        const logicalId = `db-${intent.id}`;
         const instanceType = this.sizeToInstanceType(intent.size || 'small');
-        const instance = new rds.DatabaseInstance(this, resourceName, {
-            engine: rds.DatabaseInstanceEngine.postgres({
-                version: rds.PostgresEngineVersion.VER_16,
-            }),
+        const engine = intent.type === 'mysql'
+            ? rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0 })
+            : rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16 });
+        // Well-Architected: Security — place DB in isolated subnets when available
+        const subnetType = vpc.isolatedSubnets?.length
+            ? ec2.SubnetType.PRIVATE_ISOLATED
+            : ec2.SubnetType.PRIVATE_WITH_EGRESS;
+        const instance = new rds.DatabaseInstance(this, logicalId, {
+            engine,
             instanceType,
             vpc,
-            vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
+            vpcSubnets: { subnetType },
             databaseName: intent.name || intent.id,
             credentials: rds.Credentials.fromGeneratedSecret('postgres'),
-            removalPolicy: stage === 'prod' ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
-            deletionProtection: stage === 'prod',
+            // Well-Architected: Reliability — use dataSafety for removal policy
+            removalPolicy: this.toRemovalPolicy(),
+            deletionProtection: this.dataSafetyConfig.deletionProtection,
             multiAz: intent.highAvailability ?? false,
+            // Well-Architected: Security — encryption at rest
             storageEncrypted: intent.encrypted ?? true,
+            // Well-Architected: Reliability — automated backups
             backupRetention: intent.backups !== false
                 ? cdk.Duration.days(intent.backupRetentionDays ?? 7)
                 : cdk.Duration.days(0),
+            // Well-Architected: Operational Excellence — auto minor version upgrades
+            autoMinorVersionUpgrade: true,
+            // Well-Architected: Performance — performance insights for medium+ presets
+            enablePerformanceInsights: intent.performanceInsights ?? this.envConfig.lambda.memoryMb >= 512,
+            // Well-Architected: Reliability — enhanced monitoring for medium+ presets
+            monitoringInterval: this.envConfig.lambda.memoryMb >= 512
+                ? cdk.Duration.seconds(60)
+                : undefined,
         });
-        new cdk.CfnOutput(this, `${resourceName}-endpoint`, {
+        // Well-Architected: Reliability — prevent accidental replacement
+        // CFN UpdateReplacePolicy ensures data safety on resource property changes
+        const cfnInstance = instance.node.defaultChild;
+        if (this.dataSafetyConfig.removalPolicy === 'retain') {
+            cfnInstance.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        new cdk.CfnOutput(this, `${logicalId}-endpoint`, {
             value: instance.dbInstanceEndpointAddress,
             description: `Database endpoint for ${intent.id}`,
         });
-        new cdk.CfnOutput(this, `${resourceName}-secret-arn`, {
+        new cdk.CfnOutput(this, `${logicalId}-secret-arn`, {
             value: instance.secret?.secretArn || '',
             description: `Database secret ARN for ${intent.id}`,
         });
     }
+    /**
+     * Well-Architected: Security — block public access by default, SSE encryption
+     * Well-Architected: Reliability — versioning for backups, dataSafety removal policy
+     * Well-Architected: Cost — lifecycle rules for logs/backups to reduce storage cost
+     * Well-Architected: Sustainability — intelligent tiering for infrequent access
+     */
     createStorage(intent, projectName, stage) {
-        const resourceName = `${projectName}-${intent.id}`;
-        const bucket = new s3.Bucket(this, resourceName, {
-            bucketName: `${resourceName}-${stage}`,
+        // Stable logical ID: 'storage-{intent.id}'
+        const logicalId = `storage-${intent.id}`;
+        const isPublicAssets = intent.purpose === 'assets' && intent.cdn;
+        const bucket = new s3.Bucket(this, logicalId, {
+            bucketName: `${projectName}-${intent.id}-${stage}`,
             versioned: intent.versioned ?? intent.purpose === 'backups',
-            removalPolicy: stage === 'prod' ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
-            autoDeleteObjects: stage !== 'prod',
+            removalPolicy: this.toRemovalPolicy(),
+            autoDeleteObjects: this.dataSafetyConfig.removalPolicy === 'destroy',
+            // Well-Architected: Security — encryption at rest
             encryption: s3.BucketEncryption.S3_MANAGED,
+            // Well-Architected: Security — block public access unless explicit CDN assets
+            blockPublicAccess: isPublicAssets
+                ? new s3.BlockPublicAccess({
+                    blockPublicAcls: true,
+                    ignorePublicAcls: true,
+                    blockPublicPolicy: false,
+                    restrictPublicBuckets: false,
+                })
+                : s3.BlockPublicAccess.BLOCK_ALL,
+            // Well-Architected: Security — enforce SSL
+            enforceSSL: true,
             cors: intent.corsOrigins
                 ? [
                     {
@@ -173,18 +375,38 @@ class VentureStack extends cdk.Stack {
                     },
                 ]
                 : undefined,
+            // Well-Architected: Cost — lifecycle rules for logs and backups
+            lifecycleRules: intent.purpose === 'logs'
+                ? [{ expiration: cdk.Duration.days(intent.retentionDays ?? 90), id: 'log-expiry' }]
+                : intent.purpose === 'backups'
+                    ? [
+                        { transitions: [{ storageClass: s3.StorageClass.INFREQUENT_ACCESS, transitionAfter: cdk.Duration.days(30) }], id: 'backup-ia' },
+                        { transitions: [{ storageClass: s3.StorageClass.GLACIER, transitionAfter: cdk.Duration.days(90) }], id: 'backup-glacier' },
+                    ]
+                    : [],
         });
-        new cdk.CfnOutput(this, `${resourceName}-bucket-name`, {
+        // Well-Architected: Reliability — UpdateReplacePolicy for stateful resources
+        const cfnBucket = bucket.node.defaultChild;
+        if (this.dataSafetyConfig.removalPolicy === 'retain') {
+            cfnBucket.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        new cdk.CfnOutput(this, `${logicalId}-bucket-name`, {
             value: bucket.bucketName,
             description: `S3 bucket name for ${intent.id}`,
         });
-        new cdk.CfnOutput(this, `${resourceName}-bucket-arn`, {
+        new cdk.CfnOutput(this, `${logicalId}-bucket-arn`, {
             value: bucket.bucketArn,
             description: `S3 bucket ARN for ${intent.id}`,
         });
     }
+    /**
+     * Well-Architected: Security — Cognito with advanced security features,
+     * stable logical ID for safe preset upgrades.
+     * Well-Architected: Reliability — dataSafety-driven removal policy
+     */
     createAuth(intent, projectName, stage) {
-        const resourceName = `${projectName}-${intent.id}`;
+        // Stable logical ID: 'auth-{intent.id}'
+        const logicalId = `auth-${intent.id}`;
         const passwordPolicy = intent.passwordStrength === 'strong'
             ? {
                 minLength: 12,
@@ -200,9 +422,9 @@ class VentureStack extends cdk.Stack {
                 requireDigits: true,
                 requireSymbols: false,
             };
-        const userPool = new cognito.UserPool(this, resourceName, {
-            userPoolName: `${resourceName}-${stage}`,
-            selfSignUpEnabled: true,
+        const userPool = new cognito.UserPool(this, logicalId, {
+            userPoolName: `${projectName}-${intent.id}-${stage}`,
+            selfSignUpEnabled: intent.allowSignUp ?? true,
             signInAliases: {
                 email: intent.signInWith?.includes('email') ?? true,
                 username: intent.signInWith?.includes('username') ?? false,
@@ -213,8 +435,20 @@ class VentureStack extends cdk.Stack {
                 : intent.mfa === 'optional'
                     ? cognito.Mfa.OPTIONAL
                     : cognito.Mfa.OFF,
-            removalPolicy: stage === 'prod' ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            // Well-Architected: Reliability — dataSafety removal policy
+            removalPolicy: this.toRemovalPolicy(),
+            // Well-Architected: Security — advanced security mode for medium+ presets
+            advancedSecurityMode: this.envConfig.lambda.memoryMb >= 512
+                ? cognito.AdvancedSecurityMode.ENFORCED
+                : undefined,
+            // Well-Architected: Security — account recovery via verified email
+            accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
         });
+        // Well-Architected: Reliability — prevent accidental replacement
+        const cfnPool = userPool.node.defaultChild;
+        if (this.dataSafetyConfig.removalPolicy === 'retain') {
+            cfnPool.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
         // Create clients
         const clients = intent.clients && intent.clients.length > 0
             ? intent.clients
@@ -223,79 +457,619 @@ class VentureStack extends cdk.Stack {
         for (const client of clients) {
             const appClient = userPool.addClient(client.name, {
                 authFlows: { userPassword: true, userSrp: true },
+                // Well-Architected: Security — prevent user existence errors
+                preventUserExistenceErrors: true,
             });
             if (!primaryClientId) {
                 primaryClientId = appClient.userPoolClientId;
             }
         }
-        new cdk.CfnOutput(this, `${resourceName}-user-pool-id`, {
+        new cdk.CfnOutput(this, `${logicalId}-user-pool-id`, {
             value: userPool.userPoolId,
             description: `Cognito User Pool ID for ${intent.id}`,
         });
-        new cdk.CfnOutput(this, `${resourceName}-client-id`, {
+        new cdk.CfnOutput(this, `${logicalId}-client-id`, {
             value: primaryClientId,
             description: `Cognito Client ID for ${intent.id}`,
         });
     }
+    /**
+     * Well-Architected: Reliability — DLQ by default, stable logical ID
+     * Well-Architected: Security — encryption at rest with SQS managed keys
+     * Well-Architected: Performance — visibility timeout derived from handler timeout
+     */
     createQueue(intent, projectName, stage) {
-        const resourceName = `${projectName}-${intent.id}`;
-        let dlq;
-        if (intent.deadLetterQueue) {
-            dlq = new sqs.Queue(this, `${resourceName}-dlq`, {
-                queueName: `${resourceName}-dlq-${stage}`,
-                fifo: intent.type === 'fifo',
-                retentionPeriod: cdk.Duration.days(14),
-            });
-        }
-        const queue = new sqs.Queue(this, resourceName, {
-            queueName: `${resourceName}-${stage}${intent.type === 'fifo' ? '.fifo' : ''}`,
+        // Stable logical ID: 'queue-{intent.id}'
+        const logicalId = `queue-${intent.id}`;
+        // Well-Architected: Reliability — always create a DLQ for message safety
+        const dlq = new sqs.Queue(this, `${logicalId}-dlq`, {
+            queueName: `${projectName}-${intent.id}-dlq-${stage}${intent.type === 'fifo' ? '.fifo' : ''}`,
+            fifo: intent.type === 'fifo',
+            retentionPeriod: cdk.Duration.days(14),
+            // Well-Architected: Security — encryption at rest
+            encryption: sqs.QueueEncryption.SQS_MANAGED,
+        });
+        const queue = new sqs.Queue(this, logicalId, {
+            queueName: `${projectName}-${intent.id}-${stage}${intent.type === 'fifo' ? '.fifo' : ''}`,
             fifo: intent.type === 'fifo',
             visibilityTimeout: intent.visibilityTimeoutSeconds
                 ? cdk.Duration.seconds(intent.visibilityTimeoutSeconds)
-                : undefined,
-            deadLetterQueue: dlq
-                ? { queue: dlq, maxReceiveCount: intent.maxReceiveCount ?? 3 }
-                : undefined,
+                : cdk.Duration.seconds((intent.timeout ?? 30) * 6),
+            retentionPeriod: cdk.Duration.days(intent.retentionDays ?? 4),
+            // Well-Architected: Security — encryption at rest
+            encryption: sqs.QueueEncryption.SQS_MANAGED,
+            // Well-Architected: Reliability — DLQ captures failed messages
+            deadLetterQueue: {
+                queue: dlq,
+                maxReceiveCount: intent.maxReceiveCount ?? 3,
+            },
         });
-        new cdk.CfnOutput(this, `${resourceName}-queue-url`, {
+        new cdk.CfnOutput(this, `${logicalId}-queue-url`, {
             value: queue.queueUrl,
             description: `SQS Queue URL for ${intent.id}`,
         });
+        new cdk.CfnOutput(this, `${logicalId}-dlq-url`, {
+            value: dlq.queueUrl,
+            description: `SQS DLQ URL for ${intent.id}`,
+        });
     }
+    /**
+     * Well-Architected: Security — VPC-only access, SG least-privilege
+     * Well-Architected: Performance — cache node type driven by intent.size
+     * Well-Architected: Reliability — encrypted in transit, snapshot retention for prod
+     */
     createCache(intent, projectName, stage, vpc) {
-        const resourceName = `${projectName}-${intent.id}`;
-        const securityGroup = new ec2.SecurityGroup(this, `${resourceName}-sg`, {
+        // Stable logical ID: 'cache-{intent.id}'
+        const logicalId = `cache-${intent.id}`;
+        const securityGroup = new ec2.SecurityGroup(this, `${logicalId}-sg`, {
             vpc,
-            description: `Security group for ${resourceName} Redis`,
-            allowAllOutbound: true,
+            description: `Security group for ${projectName}-${intent.id} Redis`,
+            // Well-Architected: Security — restrict outbound to VPC only
+            allowAllOutbound: false,
         });
         securityGroup.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(6379), 'Allow Redis access from VPC');
-        const subnetGroup = new elasticache.CfnSubnetGroup(this, `${resourceName}-subnet-group`, {
-            description: `Subnet group for ${resourceName}`,
-            subnetIds: vpc.isolatedSubnets.map((s) => s.subnetId),
+        // Well-Architected: Security — use isolated subnets when available
+        const subnetIds = vpc.isolatedSubnets?.length
+            ? vpc.isolatedSubnets.map((s) => s.subnetId)
+            : vpc.privateSubnets.map((s) => s.subnetId);
+        const subnetGroup = new elasticache.CfnSubnetGroup(this, `${logicalId}-subnet-group`, {
+            description: `Subnet group for ${projectName}-${intent.id}`,
+            subnetIds,
         });
-        const redis = new elasticache.CfnCacheCluster(this, resourceName, {
+        const cacheNodeType = this.sizeToCacheNodeType(intent.size || 'small');
+        const redis = new elasticache.CfnCacheCluster(this, logicalId, {
             engine: 'redis',
-            cacheNodeType: 'cache.t3.micro',
+            cacheNodeType,
             numCacheNodes: 1,
             vpcSecurityGroupIds: [securityGroup.securityGroupId],
             cacheSubnetGroupName: subnetGroup.ref,
+            // Well-Architected: Security — encrypt in transit
+            transitEncryptionEnabled: true,
+            // Well-Architected: Reliability — snapshots for prod
+            snapshotRetentionLimit: this.envConfig.dataSafety === 'strict' ? 7 : 0,
+            // Well-Architected: Operational Excellence — auto minor version upgrade
+            autoMinorVersionUpgrade: true,
         });
-        new cdk.CfnOutput(this, `${resourceName}-endpoint`, {
+        new cdk.CfnOutput(this, `${logicalId}-endpoint`, {
             value: redis.attrRedisEndpointAddress,
             description: `Redis endpoint for ${intent.id}`,
         });
     }
+    createMonitoring(intent, projectName, stage) {
+        const resourceName = `${projectName}-${intent.id}`;
+        // SNS topic for notifications
+        let topic;
+        if (intent.notificationArn) {
+            topic = sns.Topic.fromTopicArn(this, `${resourceName}-topic`, intent.notificationArn);
+        }
+        // Create alarms
+        if (intent.alarms) {
+            for (const alarm of intent.alarms) {
+                const comparisonMap = {
+                    gt: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+                    gte: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+                    lt: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
+                    lte: cloudwatch.ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD,
+                };
+                const metric = new cloudwatch.Metric({
+                    namespace: alarm.namespace || 'AWS/Lambda',
+                    metricName: alarm.metric,
+                    period: cdk.Duration.seconds(alarm.periodSeconds ?? 300),
+                    statistic: alarm.statistic || 'Average',
+                    dimensionsMap: alarm.dimensions,
+                });
+                const cwAlarm = new cloudwatch.Alarm(this, `${resourceName}-${alarm.name}`, {
+                    alarmName: `${projectName}-${stage}-${alarm.name}`,
+                    alarmDescription: alarm.description,
+                    metric,
+                    threshold: alarm.threshold,
+                    evaluationPeriods: alarm.evaluationPeriods ?? 1,
+                    comparisonOperator: comparisonMap[alarm.comparison] || cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+                });
+                if (topic) {
+                    cwAlarm.addAlarmAction(new cloudwatchActions.SnsAction(topic));
+                }
+                new cdk.CfnOutput(this, `${resourceName}-${alarm.name}-arn`, {
+                    value: cwAlarm.alarmArn,
+                    description: `Alarm ARN for ${alarm.name}`,
+                });
+            }
+        }
+        // Create dashboard
+        if (intent.dashboard) {
+            const dashboard = new cloudwatch.Dashboard(this, `${resourceName}-dashboard`, {
+                dashboardName: `${projectName}-${stage}-${intent.id}`,
+            });
+            new cdk.CfnOutput(this, `${resourceName}-dashboard-name`, {
+                value: dashboard.dashboardName,
+                description: `Dashboard name for ${intent.id}`,
+            });
+        }
+    }
+    createSecret(intent, projectName, stage) {
+        const resourceName = `${projectName}-${intent.id}`;
+        if (intent.store === 'secretsmanager') {
+            const secret = new secretsmanager.Secret(this, resourceName, {
+                secretName: `${projectName}/${stage}/${intent.id}`,
+                description: intent.description || `Secret for ${intent.id}`,
+            });
+            new cdk.CfnOutput(this, `${resourceName}-secret-arn`, {
+                value: secret.secretArn,
+                description: `Secret ARN for ${intent.id}`,
+            });
+        }
+        else {
+            // SSM Parameter Store
+            const param = new ssm.StringParameter(this, resourceName, {
+                parameterName: `/${projectName}/${stage}/${intent.id}`,
+                description: intent.description || `Parameter for ${intent.id}`,
+                stringValue: 'PLACEHOLDER — set value after deploy',
+                tier: ssm.ParameterTier.STANDARD,
+            });
+            new cdk.CfnOutput(this, `${resourceName}-param-name`, {
+                value: param.parameterName,
+                description: `SSM Parameter name for ${intent.id}`,
+            });
+        }
+    }
+    createDomain(intent, projectName, stage, api) {
+        const resourceName = `${projectName}-${intent.id}`;
+        // Certificate: use provided ARN or create a new one
+        let certificate;
+        if (intent.certificateArn) {
+            certificate = acm.Certificate.fromCertificateArn(this, `${resourceName}-cert`, intent.certificateArn);
+        }
+        else if (intent.hostedZoneId) {
+            // Auto-provision with DNS validation via Route53
+            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone`, {
+                hostedZoneId: intent.hostedZoneId,
+                zoneName: intent.domain.split('.').slice(-2).join('.'),
+            });
+            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
+                domainName: intent.domain,
+                validation: acm.CertificateValidation.fromDns(hostedZone),
+            });
+        }
+        else {
+            // Certificate without DNS validation (manual)
+            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
+                domainName: intent.domain,
+            });
+        }
+        // Custom domain name for API Gateway
+        const domainName = new apigatewayv2.DomainName(this, `${resourceName}-domain`, {
+            domainName: intent.domain,
+            certificate,
+        });
+        // API mapping
+        new apigatewayv2.ApiMapping(this, `${resourceName}-mapping`, {
+            api,
+            domainName,
+            stage: api.defaultStage,
+        });
+        // Route53 A record if hosted zone provided
+        if (intent.hostedZoneId) {
+            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone-record`, {
+                hostedZoneId: intent.hostedZoneId,
+                zoneName: intent.domain.split('.').slice(-2).join('.'),
+            });
+            new route53.ARecord(this, `${resourceName}-a-record`, {
+                zone: hostedZone,
+                recordName: intent.domain,
+                target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayv2DomainProperties(domainName.regionalDomainName, domainName.regionalHostedZoneId)),
+            });
+        }
+        new cdk.CfnOutput(this, `${resourceName}-domain-name`, {
+            value: intent.domain,
+            description: `Custom domain for ${intent.id}`,
+        });
+        new cdk.CfnOutput(this, `${resourceName}-regional-domain`, {
+            value: domainName.regionalDomainName,
+            description: `Regional domain name for ${intent.id} (use for DNS CNAME if not using Route53)`,
+        });
+    }
+    /**
+     * Free-tier alternative to RDS: create a DynamoDB table.
+     * DynamoDB offers 25 GB + 25 RCU/WCU in the always-free tier.
+     *
+     * Well-Architected: Security — encryption at rest (default)
+     * Well-Architected: Reliability — PITR for strict dataSafety
+     * Well-Architected: Cost — PAY_PER_REQUEST for unpredictable workloads
+     */
+    createDynamoDBTable(intent, projectName, stage) {
+        // Stable logical ID: 'dynamo-{intent.id}'
+        const logicalId = `dynamo-${intent.id}`;
+        const table = new dynamodb.Table(this, logicalId, {
+            tableName: `${projectName}-${intent.id}-${stage}`,
+            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            removalPolicy: this.toRemovalPolicy(),
+            // Well-Architected: Reliability — PITR for strict data safety
+            pointInTimeRecovery: this.envConfig.dataSafety === 'strict',
+            // Well-Architected: Security — encryption at rest (AWS managed key)
+            encryption: dynamodb.TableEncryption.AWS_MANAGED,
+            timeToLiveAttribute: 'ttl',
+            // Well-Architected: Operational Excellence — contributor insights for medium+
+            contributorInsightsEnabled: this.envConfig.lambda.memoryMb >= 512,
+        });
+        // Well-Architected: Reliability — prevent accidental replacement
+        const cfnTable = table.node.defaultChild;
+        if (this.dataSafetyConfig.removalPolicy === 'retain') {
+            cfnTable.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // GSI for common access patterns
+        table.addGlobalSecondaryIndex({
+            indexName: 'gsi1',
+            partitionKey: { name: 'gsi1pk', type: dynamodb.AttributeType.STRING },
+            sortKey: { name: 'gsi1sk', type: dynamodb.AttributeType.STRING },
+            projectionType: dynamodb.ProjectionType.ALL,
+        });
+        new cdk.CfnOutput(this, `${logicalId}-table-name`, {
+            value: table.tableName,
+            description: `DynamoDB table name for ${intent.id} (free-tier)`,
+        });
+        new cdk.CfnOutput(this, `${logicalId}-table-arn`, {
+            value: table.tableArn,
+            description: `DynamoDB table ARN for ${intent.id} (free-tier)`,
+        });
+    }
+    /**
+     * Free-tier rate limit table using DynamoDB (always-free tier).
+     * Used by createDefaultRateLimiter() from @venturekit/runtime.
+     */
+    createRateLimitTable(projectName, stage) {
+        const logicalId = 'RateLimitTable';
+        const table = new dynamodb.Table(this, logicalId, {
+            tableName: `venturekit-rate-limits`,
+            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+            timeToLiveAttribute: 'ttl',
+            encryption: dynamodb.TableEncryption.AWS_MANAGED,
+        });
+        new cdk.CfnOutput(this, `${logicalId}-table-name`, {
+            value: table.tableName,
+            description: 'DynamoDB rate limit table (free-tier)',
+        });
+    }
+    // ─── Helper methods ────────────────────────────────────────────────
+    /**
+     * Map ResourceSize to RDS instance type.
+     * Uses Graviton (T4G) instances for cost efficiency.
+     * Changing size triggers an in-place modify, NOT a replacement.
+     */
     sizeToInstanceType(size) {
         switch (size) {
+            case 'xlarge':
+                return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.LARGE);
+            case 'large':
+                return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.MEDIUM);
             case 'medium':
                 return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.SMALL);
-            case 'large':
-                return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MEDIUM);
             default: // 'small'
                 return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MICRO);
         }
     }
+    /**
+     * Map ResourceSize to ElastiCache node type.
+     * Uses Graviton (T4G) instances for cost efficiency.
+     * Changing size triggers an in-place modify, NOT a replacement.
+     */
+    sizeToCacheNodeType(size) {
+        switch (size) {
+            case 'xlarge':
+                return 'cache.r6g.large';
+            case 'large':
+                return 'cache.r6g.medium';
+            case 'medium':
+                return 'cache.t4g.small';
+            default: // 'small'
+                return 'cache.t4g.micro';
+        }
+    }
+    /**
+     * Convert dataSafety config to CDK RemovalPolicy.
+     * Well-Architected: Reliability — prevent accidental data loss.
+     */
+    toRemovalPolicy() {
+        return this.dataSafetyConfig.removalPolicy === 'retain'
+            ? cdk.RemovalPolicy.RETAIN
+            : cdk.RemovalPolicy.DESTROY;
+    }
+    /**
+     * Convert days to CDK logs.RetentionDays enum.
+     * Well-Architected: Cost — don't over-retain logs.
+     */
+    toLogRetention(days) {
+        if (days <= 1)
+            return logs.RetentionDays.ONE_DAY;
+        if (days <= 3)
+            return logs.RetentionDays.THREE_DAYS;
+        if (days <= 5)
+            return logs.RetentionDays.FIVE_DAYS;
+        if (days <= 7)
+            return logs.RetentionDays.ONE_WEEK;
+        if (days <= 14)
+            return logs.RetentionDays.TWO_WEEKS;
+        if (days <= 30)
+            return logs.RetentionDays.ONE_MONTH;
+        if (days <= 60)
+            return logs.RetentionDays.TWO_MONTHS;
+        if (days <= 90)
+            return logs.RetentionDays.THREE_MONTHS;
+        if (days <= 120)
+            return logs.RetentionDays.FOUR_MONTHS;
+        if (days <= 150)
+            return logs.RetentionDays.FIVE_MONTHS;
+        if (days <= 180)
+            return logs.RetentionDays.SIX_MONTHS;
+        if (days <= 365)
+            return logs.RetentionDays.ONE_YEAR;
+        return logs.RetentionDays.INFINITE;
+    }
+    /**
+     * Resolve Lambda runtime from preset config.
+     */
+    toLambdaRuntime() {
+        switch (this.envConfig.lambda.runtime) {
+            case 'nodejs22.x':
+                return lambda.Runtime.NODEJS_22_X;
+            case 'nodejs18.x':
+                return lambda.Runtime.NODEJS_18_X;
+            default:
+                return lambda.Runtime.NODEJS_20_X;
+        }
+    }
+    /**
+     * Resolve Lambda architecture from preset config.
+     */
+    toLambdaArchitecture() {
+        return this.envConfig.lambda.architecture === 'x86_64'
+            ? lambda.Architecture.X86_64
+            : lambda.Architecture.ARM_64;
+    }
+    /**
+     * Recursively discover function files under the functions directory.
+     * Returns an array of { name, handlerFile } where name is the
+     * dash-delimited path (e.g. `order/create-order.ts` → `order-create-order`).
+     */
+    discoverFunctionFiles(dir, baseDir) {
+        const root = baseDir ?? dir;
+        const results = [];
+        if (!fs.existsSync(dir))
+            return results;
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                results.push(...this.discoverFunctionFiles(fullPath, root));
+            }
+            else if (/\.(ts|js)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+                const relativePath = path.relative(root, fullPath);
+                const name = relativePath
+                    .replace(/\.(ts|js)$/, '')
+                    .replace(/[\\/]/g, '-');
+                results.push({ name, handlerFile: fullPath });
+            }
+        }
+        return results;
+    }
+    // ─── Lambda function factories ─────────────────────────────────────
+    /**
+     * Create a standalone Lambda function.
+     * Naming convention: {project}-{stage}-fn-{name}
+     *
+     * Well-Architected: Performance — memory/timeout from preset config
+     * Well-Architected: Sustainability — ARM64 Graviton by default
+     * Well-Architected: Operational Excellence — structured env vars, log retention from preset
+     * Well-Architected: Security — X-Ray tracing from preset config
+     */
+    createStandaloneFunction(name, handlerFile, projectName, stage, projectDir, intent) {
+        const functionName = `${projectName}-${stage}-fn-${name}`;
+        const resourceId = `fn-${name}`;
+        const lambdaConfig = this.envConfig.lambda;
+        const fn = new lambda.Function(this, resourceId, {
+            functionName,
+            runtime: this.toLambdaRuntime(),
+            architecture: this.toLambdaArchitecture(),
+            handler: 'index.main',
+            code: lambda.Code.fromAsset(path.dirname(handlerFile), {
+                bundling: {
+                    image: lambda.Runtime.NODEJS_20_X.bundlingImage,
+                    command: [
+                        'bash', '-c', [
+                            'npm install -g esbuild',
+                            `esbuild ${path.basename(handlerFile)} --bundle --platform=node --target=node20 --outfile=/asset-output/index.js --external:@aws-sdk/*`,
+                        ].join(' && '),
+                    ],
+                },
+            }),
+            // Well-Architected: Performance — memory and timeout from intent or preset
+            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
+            timeout: cdk.Duration.seconds(intent?.timeout ?? lambdaConfig.timeoutSec),
+            description: intent?.description ?? `Standalone function: ${name}`,
+            environment: {
+                VENTURE_PROJECT_NAME: projectName,
+                VENTURE_STAGE: stage,
+                NODE_OPTIONS: '--enable-source-maps',
+                ...lambdaConfig.environmentVariables,
+            },
+            // Well-Architected: Operational Excellence — log retention from preset
+            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
+            // Well-Architected: Security — X-Ray tracing from preset
+            tracing: lambdaConfig.tracingEnabled
+                ? lambda.Tracing.ACTIVE
+                : lambda.Tracing.DISABLED,
+            // Well-Architected: Performance — reserved concurrency from preset
+            reservedConcurrentExecutions: lambdaConfig.reservedConcurrency,
+        });
+        new cdk.CfnOutput(this, `${resourceId}-name`, {
+            value: fn.functionName,
+            description: `Lambda function name for ${name}`,
+        });
+        new cdk.CfnOutput(this, `${resourceId}-arn`, {
+            value: fn.functionArn,
+            description: `Lambda function ARN for ${name}`,
+        });
+    }
+    /**
+     * Create a queue consumer Lambda function wired to an SQS queue.
+     * Naming convention: {project}-{stage}-queue-{name}
+     *
+     * Well-Architected: Reliability — DLQ on consumer queue, encrypted
+     * Well-Architected: Performance — batch size and visibility timeout
+     */
+    createQueueConsumer(name, handlerFile, projectName, stage, projectDir, intent) {
+        const functionName = `${projectName}-${stage}-queue-${name}`;
+        const resourceId = `queue-consumer-${name}`;
+        const lambdaConfig = this.envConfig.lambda;
+        // Create the SQS queue with DLQ
+        const dlq = new sqs.Queue(this, `${resourceId}-dlq`, {
+            queueName: `${projectName}-${stage}-${name}-dlq`,
+            retentionPeriod: cdk.Duration.days(14),
+            encryption: sqs.QueueEncryption.SQS_MANAGED,
+        });
+        const queue = new sqs.Queue(this, `${resourceId}-sqs`, {
+            queueName: `${projectName}-${stage}-${name}`,
+            visibilityTimeout: cdk.Duration.seconds(intent?.visibilityTimeoutSeconds ?? (intent?.timeout ?? 30) * 6),
+            retentionPeriod: cdk.Duration.days(intent?.retentionDays ?? 4),
+            encryption: sqs.QueueEncryption.SQS_MANAGED,
+            deadLetterQueue: {
+                queue: dlq,
+                maxReceiveCount: 3,
+            },
+        });
+        const fn = new lambda.Function(this, resourceId, {
+            functionName,
+            runtime: this.toLambdaRuntime(),
+            architecture: this.toLambdaArchitecture(),
+            handler: 'index.main',
+            code: lambda.Code.fromAsset(path.dirname(handlerFile), {
+                bundling: {
+                    image: lambda.Runtime.NODEJS_20_X.bundlingImage,
+                    command: [
+                        'bash', '-c', [
+                            'npm install -g esbuild',
+                            `esbuild ${path.basename(handlerFile)} --bundle --platform=node --target=node20 --outfile=/asset-output/index.js --external:@aws-sdk/*`,
+                        ].join(' && '),
+                    ],
+                },
+            }),
+            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
+            timeout: cdk.Duration.seconds(intent?.timeout ?? lambdaConfig.timeoutSec),
+            description: intent?.description ?? `Queue consumer: ${name}`,
+            environment: {
+                VENTURE_PROJECT_NAME: projectName,
+                VENTURE_STAGE: stage,
+                NODE_OPTIONS: '--enable-source-maps',
+                ...lambdaConfig.environmentVariables,
+            },
+            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
+            tracing: lambdaConfig.tracingEnabled
+                ? lambda.Tracing.ACTIVE
+                : lambda.Tracing.DISABLED,
+        });
+        // Wire Lambda to SQS queue
+        fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
+            batchSize: intent?.batchSize ?? 10,
+        }));
+        new cdk.CfnOutput(this, `${resourceId}-fn-name`, {
+            value: fn.functionName,
+            description: `Queue consumer Lambda for ${name}`,
+        });
+        new cdk.CfnOutput(this, `${resourceId}-queue-url`, {
+            value: queue.queueUrl,
+            description: `SQS queue URL for ${name}`,
+        });
+    }
+    /**
+     * Create a cron/scheduled task Lambda function wired to an EventBridge rule.
+     * Naming convention: {project}-{stage}-cron-{name}
+     *
+     * Well-Architected: Performance — memory/timeout from preset
+     * Well-Architected: Operational Excellence — log retention, tracing from preset
+     */
+    createCronHandler(name, handlerFile, projectName, stage, projectDir, intent) {
+        const functionName = `${projectName}-${stage}-cron-${name}`;
+        const resourceId = `cron-${name}`;
+        const lambdaConfig = this.envConfig.lambda;
+        const fn = new lambda.Function(this, resourceId, {
+            functionName,
+            runtime: this.toLambdaRuntime(),
+            architecture: this.toLambdaArchitecture(),
+            handler: 'index.main',
+            code: lambda.Code.fromAsset(path.dirname(handlerFile), {
+                bundling: {
+                    image: lambda.Runtime.NODEJS_20_X.bundlingImage,
+                    command: [
+                        'bash', '-c', [
+                            'npm install -g esbuild',
+                            `esbuild ${path.basename(handlerFile)} --bundle --platform=node --target=node20 --outfile=/asset-output/index.js --external:@aws-sdk/*`,
+                        ].join(' && '),
+                    ],
+                },
+            }),
+            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
+            timeout: cdk.Duration.seconds(intent?.timeout ?? 60),
+            description: intent?.description ?? `Cron handler: ${name}`,
+            environment: {
+                VENTURE_PROJECT_NAME: projectName,
+                VENTURE_STAGE: stage,
+                NODE_OPTIONS: '--enable-source-maps',
+                ...lambdaConfig.environmentVariables,
+            },
+            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
+            tracing: lambdaConfig.tracingEnabled
+                ? lambda.Tracing.ACTIVE
+                : lambda.Tracing.DISABLED,
+        });
+        // Wire EventBridge rule if schedule expression is provided
+        if (intent?.schedule) {
+            const scheduleExpr = intent.schedule;
+            const isEnabled = intent.enabled ?? true;
+            let schedule;
+            if ('rate' in scheduleExpr) {
+                schedule = events.Schedule.expression(`rate(${scheduleExpr.rate})`);
+            }
+            else {
+                schedule = events.Schedule.expression(`cron(${scheduleExpr.cron})`);
+            }
+            new events.Rule(this, `${resourceId}-rule`, {
+                ruleName: `${projectName}-${stage}-cron-${name}`,
+                schedule,
+                enabled: isEnabled,
+                targets: [new targets.LambdaFunction(fn)],
+            });
+        }
+        new cdk.CfnOutput(this, `${resourceId}-fn-name`, {
+            value: fn.functionName,
+            description: `Cron handler Lambda for ${name}`,
+        });
+        new cdk.CfnOutput(this, `${resourceId}-fn-arn`, {
+            value: fn.functionArn,
+            description: `Cron handler Lambda ARN for ${name}`,
+        });
+    }
 }
-exports.VentureStack = VentureStack;
 //# sourceMappingURL=stack.js.map