@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/shared/ssm-keys.js

@@ -0,0 +1,291 @@
+/**
+ * SSM Parameter Store key builders for cross-stack references in the
+ * lifecycle-aligned multi-stack layout (network / data / identity /
+ * config / messaging / edge / app).
+ *
+ * # Why SSM and not `Fn::ImportValue`?
+ *
+ * CloudFormation cross-stack `Outputs` + `Fn::ImportValue` carries a
+ * hard lock: once a stack consumes another stack's export, the
+ * exporting stack cannot modify or delete that export until every
+ * consumer is removed. That makes the lower stable tiers (data,
+ * identity) unable to evolve their public surface without coordinated
+ * multi-stack redeploys — a single typo in a Cognito client id rename
+ * becomes a multi-week CFN choreography exercise.
+ *
+ * SSM Parameter Store has no such lock. The producer writes a
+ * `String` parameter; the consumer reads it via
+ * `StringParameter.valueForStringParameter(scope, name)` — a CFN
+ * dynamic reference (`{{resolve:ssm:…}}`) resolved at deploy time, not
+ * a stack-graph dependency. Producers can freely change values; the
+ * next consumer redeploy picks them up. Producers can be deleted with
+ * the parameter still in place; consumers fail loudly at synth/deploy
+ * with a clear "parameter not found" error rather than CFN's
+ * inscrutable "cannot modify export" rejection.
+ *
+ * # Naming convention
+ *
+ *   /venturekit/<project>/<stage>/<category>/<resource-or-id>/<field>
+ *
+ * - Always rooted at `/venturekit/` so this module's parameters never
+ *   collide with operator-managed parameters under `/<project>/...`.
+ * - `<project>` and `<stage>` produce a project- and env-isolated
+ *   namespace so multiple projects in the same AWS account (or
+ *   multiple stages of the same project) do not stomp on each other.
+ * - `<category>` mirrors the seven-tier split (`network`, `data`,
+ *   `identity`, `config`, `messaging`, `edge`, `app`). Operators
+ *   doing forensics can grep CloudTrail / `aws ssm describe-parameters
+ *   --filters "Key=Name,Values=/venturekit/myapp/prod/data/"` to see
+ *   exactly what one tier publishes.
+ * - `<resource-or-id>` is the user-declared `intent.id` for resources
+ *   that come in arrays (databases, queues, auth pools, …); singletons
+ *   collapse to a single key (`api/id` rather than `api/<id>/id`).
+ * - `<field>` is what specific attribute of the resource is stored
+ *   (`endpoint`, `arn`, `secret-arn`, …). Always kebab-case.
+ *
+ * Lists (e.g. multi-AZ subnet IDs) are stored as comma-joined strings
+ * because SSM `StringList` parameters cannot be referenced via the
+ * `{{resolve:ssm:…}}` dynamic reference — only `String` and
+ * `SecureString`. The consumer-side helper `readSsmStringList` in
+ * `cross-stack-refs.ts` does the splitting.
+ *
+ * # Why a single source of truth?
+ *
+ * Every key is constructed via a function in this file — no inline
+ * string templating in stack code anywhere else. That gives us:
+ *
+ *   - One place to change the convention (e.g. add a `version/` prefix
+ *     for forward-compatible breaking changes to a key shape).
+ *   - One place to grep when investigating "why is this Lambda
+ *     reading parameter X?".
+ *   - Test coverage that pins every key shape so a typo in a
+ *     producer's write doesn't silently de-sync from a consumer's
+ *     read three months later.
+ *
+ * # Stability guarantee
+ *
+ * The function names AND their return values are part of the
+ * cross-stack contract. Renaming a function = breaking every
+ * deployed stack that already wrote a parameter at the old name.
+ * Treat changes here the same way you'd treat changes to a public
+ * API: add new keys, deprecate old ones, never silently rename.
+ */
+/** Common path prefix for every key this module produces. */
+const ROOT = '/venturekit';
+/** Per-project, per-stage namespace shared by every category builder. */
+function base(project, stage) {
+    return `${ROOT}/${project}/${stage}`;
+}
+// ─── Network tier ────────────────────────────────────────────────────
+/**
+ * VPC ID for the project's primary VPC. Singleton — VentureKit
+ * provisions exactly one VPC per stack-set even when multiple
+ * databases / caches / Lambdas live in it.
+ */
+export const networkKeys = {
+    vpcId: (project, stage) => `${base(project, stage)}/network/vpc-id`,
+    /**
+     * Comma-joined private subnet IDs (subnets where Lambdas + RDS run).
+     * Stored as a single comma-joined `String` because CFN's
+     * `{{resolve:ssm:…}}` dynamic reference does not support
+     * `StringList` parameters. `readSsmStringList` in
+     * `cross-stack-refs.ts` re-splits on the consumer side.
+     */
+    privateSubnetIds: (project, stage) => `${base(project, stage)}/network/private-subnet-ids`,
+    /** Comma-joined public subnet IDs — used by NAT GW + (future) ALB. */
+    publicSubnetIds: (project, stage) => `${base(project, stage)}/network/public-subnet-ids`,
+    /**
+     * Comma-joined isolated subnet IDs (no internet egress). RDS
+     * instances live here when `dataSafety='strict'` is in effect on
+     * presets that ship isolated subnets (medium+).
+     */
+    isolatedSubnetIds: (project, stage) => `${base(project, stage)}/network/isolated-subnet-ids`,
+    /**
+     * Comma-joined Availability Zone names matching the order of the
+     * subnet ID lists above. CDK's `Vpc.fromVpcAttributes` requires
+     * per-subnet AZ to fully reconstruct the VPC abstraction in a
+     * consumer stack, and CFN won't infer it from the subnet IDs alone.
+     */
+    availabilityZones: (project, stage) => `${base(project, stage)}/network/availability-zones`,
+};
+// ─── Data tier ──────────────────────────────────────────────────────
+export const dataKeys = {
+    /**
+     * RDS endpoint hostname (no port, no protocol). The port is fixed
+     * per engine type, so consumers reconstruct the JDBC URL from
+     * `engine` + `endpoint` + `port` rather than storing the assembled
+     * URL — keeps reads composable and avoids re-writing on engine
+     * upgrades.
+     */
+    rdsEndpoint: (project, stage, dbId) => `${base(project, stage)}/data/rds/${dbId}/endpoint`,
+    /** RDS port. Stored explicitly so consumers don't hardcode 5432/3306. */
+    rdsPort: (project, stage, dbId) => `${base(project, stage)}/data/rds/${dbId}/port`,
+    /**
+     * ARN of the Secrets Manager secret holding `{username,password}`
+     * for the master credentials. Lambdas in the app stack receive this
+     * via env var and call `GetSecretValue` at startup; a future
+     * `connect()` helper will resolve the cached secret to a Postgres
+     * URL transparently.
+     */
+    rdsSecretArn: (project, stage, dbId) => `${base(project, stage)}/data/rds/${dbId}/secret-arn`,
+    /**
+     * Security Group ID for the RDS instance. The app stack creates its
+     * own Lambda SG locally and `rdsSg.connections.allowFrom(lambdaSg,
+     * port)`. CFN emits the resulting `AWS::EC2::SecurityGroupIngress`
+     * in the app stack — on app-stack delete, ingress is removed,
+     * RDS SG unaffected (see plan §6.1).
+     */
+    rdsSecurityGroupId: (project, stage, dbId) => `${base(project, stage)}/data/rds/${dbId}/security-group-id`,
+    /** Database name created on the RDS instance (the actual SQL database). */
+    rdsDatabaseName: (project, stage, dbId) => `${base(project, stage)}/data/rds/${dbId}/database-name`,
+    /** S3 bucket name for an operator-declared storage intent. */
+    bucketName: (project, stage, bucketId) => `${base(project, stage)}/data/storage/${bucketId}/bucket-name`,
+    /** S3 bucket ARN — for IAM scoping on the consumer side. */
+    bucketArn: (project, stage, bucketId) => `${base(project, stage)}/data/storage/${bucketId}/bucket-arn`,
+    /**
+     * CloudFront distribution domain (e.g. `d111111abcdef8.cloudfront.net`)
+     * — only present when the storage intent set `cdn: true`. Consumers
+     * inject as `STORAGE_<ID>_CDN_URL` for presign-then-rewrite flows.
+     */
+    cdnDomain: (project, stage, bucketId) => `${base(project, stage)}/data/storage/${bucketId}/cdn-domain`,
+    /** DynamoDB table name (user-declared on free-tier OR rate-limits). */
+    dynamoTableName: (project, stage, tableId) => `${base(project, stage)}/data/dynamo/${tableId}/table-name`,
+    /** DynamoDB table ARN — for IAM scoping. */
+    dynamoTableArn: (project, stage, tableId) => `${base(project, stage)}/data/dynamo/${tableId}/table-arn`,
+    /**
+     * ARN of the internal HMAC secret used by VentureKit auth/runtime
+     * for state-token signing. Singleton per project+stage.
+     */
+    internalHmacSecretArn: (project, stage) => `${base(project, stage)}/data/internal-hmac-secret-arn`,
+    /**
+     * ElastiCache primary endpoint when a `caches` intent is declared.
+     * Currently keyed by `cacheId`; only one is typical but the keyed
+     * form keeps us forward-compatible with multi-cache setups.
+     */
+    cacheEndpoint: (project, stage, cacheId) => `${base(project, stage)}/data/cache/${cacheId}/endpoint`,
+    /** ElastiCache port. Same rationale as `rdsPort`. */
+    cachePort: (project, stage, cacheId) => `${base(project, stage)}/data/cache/${cacheId}/port`,
+    /** ElastiCache security group ID — for the cross-stack ingress pattern. */
+    cacheSecurityGroupId: (project, stage, cacheId) => `${base(project, stage)}/data/cache/${cacheId}/security-group-id`,
+};
+// ─── Identity tier ──────────────────────────────────────────────────
+export const identityKeys = {
+    /** Cognito User Pool ID for an `auth` intent. */
+    userPoolId: (project, stage, authId) => `${base(project, stage)}/identity/${authId}/user-pool-id`,
+    /** Cognito User Pool ARN — for IAM scoping `cognito-idp:Admin*` actions. */
+    userPoolArn: (project, stage, authId) => `${base(project, stage)}/identity/${authId}/user-pool-arn`,
+    /**
+     * Primary App Client ID. Multi-client support exists in the intent
+     * (auth.clients[]) but the dominant case is a single SPA client;
+     * we publish the primary id as a singleton key to avoid the
+     * multi-client SSM tax for the common case. Future per-client keys
+     * can extend this convention with `${authId}/clients/${clientName}`.
+     */
+    primaryClientId: (project, stage, authId) => `${base(project, stage)}/identity/${authId}/client-id`,
+    /**
+     * ARN of the Secrets Manager secret holding `{clientId, clientSecret}`
+     * for a federated identity provider (Google / Facebook / Apple).
+     * Created by `createAuth` for every entry in
+     * `AuthIntent.federated[]`; the app stack reads it to enable
+     * `signInAsFederatedUser` server-side.
+     */
+    federatedSecretArn: (project, stage, authId, provider) => `${base(project, stage)}/identity/${authId}/federated/${provider}/secret-arn`,
+};
+// ─── Config tier (operator-paste-in values) ────────────────────────
+export const configKeys = {
+    /**
+     * ARN of an operator-declared `secrets` intent (Secrets Manager
+     * variant). The SSM-store variant of the intent is *itself* an SSM
+     * parameter and doesn't need a separate cross-stack key — the app
+     * stack reads the original parameter directly.
+     */
+    secretArn: (project, stage, secretId) => `${base(project, stage)}/config/secrets/${secretId}/arn`,
+    /**
+     * SNS events topic ARN for a `notify` intent. The bounce-handler
+     * Lambda in the app stack subscribes to this; operators may attach
+     * additional console-level subscribers for paging / observability.
+     */
+    notifyEventsTopicArn: (project, stage, notifyId) => `${base(project, stage)}/config/notify/${notifyId}/events-topic-arn`,
+    /** Notify SES configuration set name — needed by the dispatcher Lambda. */
+    notifyConfigurationSetName: (project, stage, notifyId) => `${base(project, stage)}/config/notify/${notifyId}/configuration-set-name`,
+    /**
+     * ARN of the WhatsApp Cloud API token Secret (only present when the
+     * notify intent declares `'whatsapp'` in `channels`). Operator
+     * pastes the Meta token into the secret value after first deploy.
+     */
+    whatsappTokenSecretArn: (project, stage, notifyId) => `${base(project, stage)}/config/notify/${notifyId}/whatsapp-token-secret-arn`,
+};
+// ─── Messaging tier ─────────────────────────────────────────────────
+export const messagingKeys = {
+    /** SQS queue ARN for a user-declared `queues` intent. */
+    queueArn: (project, stage, queueId) => `${base(project, stage)}/messaging/queues/${queueId}/arn`,
+    /** SQS queue URL — what `SendMessage` callers actually need. */
+    queueUrl: (project, stage, queueId) => `${base(project, stage)}/messaging/queues/${queueId}/url`,
+    /** Dead-letter queue ARN — for IAM scoping + ESM redrive policy. */
+    queueDlqArn: (project, stage, queueId) => `${base(project, stage)}/messaging/queues/${queueId}/dlq-arn`,
+    /**
+     * Visibility timeout (seconds, integer) of the primary work queue.
+     * App-stack synth uses this to validate the
+     * `queue.visibilityTimeout >= 6 * fn.timeout` invariant when the
+     * queue lives in another stack and CDK can't infer it (plan §6.3).
+     */
+    queueVisibilityTimeoutSeconds: (project, stage, queueId) => `${base(project, stage)}/messaging/queues/${queueId}/visibility-timeout-seconds`,
+    /** Notify dispatcher DLQ ARN — created by the messaging tier. */
+    notifyDispatcherDlqArn: (project, stage, notifyId) => `${base(project, stage)}/messaging/notify/${notifyId}/dispatcher-dlq-arn`,
+    /** Notify bounce-handler DLQ ARN. */
+    notifyBounceDlqArn: (project, stage, notifyId) => `${base(project, stage)}/messaging/notify/${notifyId}/bounce-dlq-arn`,
+};
+// ─── Edge tier ──────────────────────────────────────────────────────
+export const edgeKeys = {
+    /** API Gateway HttpApi ID. Singleton per stack-set. */
+    apiId: (project, stage) => `${base(project, stage)}/edge/api/id`,
+    /**
+     * API Gateway public endpoint (`https://<id>.execute-api.<region>.amazonaws.com`).
+     * Convenience for monitoring + smoke tests; consumers that need
+     * just the ID use `apiId` above.
+     */
+    apiEndpoint: (project, stage) => `${base(project, stage)}/edge/api/endpoint`,
+    /**
+     * Custom domain hostname (e.g. `api.example.com`). Only present
+     * when a `domains` intent is declared. Consumers that build OAuth
+     * redirect URIs / webhook URLs should prefer this when set.
+     */
+    apiCustomDomain: (project, stage) => `${base(project, stage)}/edge/api/custom-domain`,
+    /**
+     * API Gateway default stage name. Always `'$default'` for HttpApi
+     * but published explicitly so future support for named stages
+     * (canary, blue/green) doesn't require a key-shape change.
+     */
+    apiDefaultStageName: (project, stage) => `${base(project, stage)}/edge/api/default-stage-name`,
+    /**
+     * CloudFront distribution domain (`*.cloudfront.net` or the
+     * configured alias) fronting a storage-tier S3 bucket. Only
+     * present when the `storage` intent declares `cdn: true`. App-
+     * stack code injects this into Lambda env vars as
+     * `STORAGE_<UPPER_ID>_CDN_URL` and `VENTURE_STORAGE_CDN_URL`
+     * (primary intent), so application code can build public URLs
+     * without an SDK lookup.
+     */
+    storageCdnDomain: (project, stage, storageId) => `${base(project, stage)}/edge/storage/${storageId}/cdn-domain`,
+    /**
+     * CloudFront distribution ID for a storage-tier bucket CDN. App-
+     * stack handlers that need to issue invalidations
+     * (`CreateInvalidation` after a content rewrite) read this.
+     */
+    storageCdnDistributionId: (project, stage, storageId) => `${base(project, stage)}/edge/storage/${storageId}/cdn-distribution-id`,
+};
+// ─── Aggregate ──────────────────────────────────────────────────────
+/**
+ * Single namespace exporting every category for ergonomic imports
+ * elsewhere: `import { ssmKeys } from './shared/ssm-keys.js';
+ * ssmKeys.data.rdsEndpoint(project, stage, 'main')`.
+ */
+export const ssmKeys = {
+    network: networkKeys,
+    data: dataKeys,
+    identity: identityKeys,
+    config: configKeys,
+    messaging: messagingKeys,
+    edge: edgeKeys,
+};
+//# sourceMappingURL=ssm-keys.js.map

package/dist/cdk/shared/ssm-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm-keys.js","sourceRoot":"","sources":["../../../src/cdk/shared/ssm-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,6DAA6D;AAC7D,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B,yEAAyE;AACzE,SAAS,IAAI,CAAC,OAAe,EAAE,KAAa;IAC1C,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAChD,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB;IAE1C;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC3D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,6BAA6B;IAEtD,sEAAsE;IACtE,eAAe,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC1D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,4BAA4B;IAErD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC5D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,8BAA8B;IAEvD;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC5D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,6BAA6B;CAC9C,CAAC;AAEX,uEAAuE;AAEvE,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CACpE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,WAAW;IAErD,yEAAyE;IACzE,OAAO,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CAChE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,OAAO;IAEjD;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CACrE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,aAAa;IAEvD;;;;;;OAMG;IACH,kBAAkB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CAC3E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,oBAAoB;IAE9D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CACxE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,gBAAgB;IAE1D,8DAA8D;IAC9D,UAAU,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACvE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,QAAQ,cAAc;IAEhE,4DAA4D;IAC5D,SAAS,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACtE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,QAAQ,aAAa;IAE/D;;;;OAIG;IACH,SAAS,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACtE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,QAAQ,aAAa;IAE/D,uEAAuE;IACvE,eAAe,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CAC3E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,gBAAgB,OAAO,aAAa;IAE7D,4CAA4C;IAC5C,cAAc,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CAC1E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,gBAAgB,OAAO,YAAY;IAE5D;;;OAGG;IACH,qBAAqB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAChE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,gCAAgC;IAEzD;;;;OAIG;IACH,aAAa,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACzE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,OAAO,WAAW;IAE1D,qDAAqD;IACrD,SAAS,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACrE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,OAAO,OAAO;IAEtD,2EAA2E;IAC3E,oBAAoB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CAChF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,OAAO,oBAAoB;CAC3D,CAAC;AAEX,uEAAuE;AAEvE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,iDAAiD;IACjD,UAAU,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE,CACrE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,eAAe;IAE3D,4EAA4E;IAC5E,WAAW,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE,CACtE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,gBAAgB;IAE5D;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE,CAC1E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,YAAY;IAExD;;;;;;OAMG;IACH,kBAAkB,EAAE,CAClB,OAAe,EACf,KAAa,EACb,MAAc,EACd,QAAgB,EACR,EAAE,CACV,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,cAAc,QAAQ,aAAa;CACvE,CAAC;AAEX,sEAAsE;AAEtE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;;;OAKG;IACH,SAAS,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACtE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,QAAQ,MAAM;IAE1D;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACjF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,QAAQ,mBAAmB;IAEtE,2EAA2E;IAC3E,0BAA0B,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACvF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,QAAQ,yBAAyB;IAE5E;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACnF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,QAAQ,4BAA4B;CACvE,CAAC;AAEX,uEAAuE;AAEvE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,yDAAyD;IACzD,QAAQ,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACpE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,OAAO,MAAM;IAE3D,gEAAgE;IAChE,QAAQ,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACpE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,OAAO,MAAM;IAE3D,oEAAoE;IACpE,WAAW,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACvE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,OAAO,UAAU;IAE/D;;;;;OAKG;IACH,6BAA6B,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAAU,EAAE,CACzF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,OAAO,6BAA6B;IAElF,iEAAiE;IACjE,sBAAsB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CACnF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,QAAQ,qBAAqB;IAE3E,qCAAqC;IACrC,kBAAkB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAU,EAAE,CAC/E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,QAAQ,iBAAiB;CAC/D,CAAC;AAEX,uEAAuE;AAEvE,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,uDAAuD;IACvD,KAAK,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAChD,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc;IAEvC;;;;OAIG;IACH,WAAW,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CACtD,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,oBAAoB;IAE7C;;;;OAIG;IACH,eAAe,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC1D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,yBAAyB;IAElD;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAU,EAAE,CAC9D,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,8BAA8B;IAEvD;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,SAAiB,EAAU,EAAE,CAC9E,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,SAAS,aAAa;IAEhE;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,SAAiB,EAAU,EAAE,CACtF,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,SAAS,sBAAsB;CACjE,CAAC;AAEX,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,WAAW;IACpB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,aAAa;IACxB,IAAI,EAAE,QAAQ;CACN,CAAC"}

package/dist/cdk/stack.d.ts

@@ -50,19 +50,11 @@ export interface DiscoveredRoute {
  * full CDK stack, and so external tooling can reuse it.
  */
 export declare function discoverRouteFiles(routesDir: string): DiscoveredRoute[];
-/**
- * Smallest power of two that is `>= n`. Used to pick the nested-stack
- * bucket count, so that growing past a threshold doubles the count
- * rather than incrementing it — the doubled-size hash bucketing only
- * relocates ~half the routes, and growth is geometric (rare events)
- * rather than additive (every deploy after a route added).
- */
-export declare function nextPowerOfTwo(n: number): number;
 /**
  * Map a route slug to a nested-stack slot index in `[0, numSlots)`.
- * `numSlots` MUST be a power of two so the modulo distributes the
- * hash output evenly. Exported for unit tests asserting bucketing
- * stability across route-set changes.
+ * `numSlots` MUST be a power of two so the bitwise-AND modulo
+ * distributes the hash output evenly. Exported for unit tests
+ * asserting bucketing stability across route-set changes.
  */
 export declare function stableSlotFor(slug: string, numSlots: number): number;
 export interface VentureStackProps extends cdk.StackProps {

package/dist/cdk/stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../src/cdk/stack.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AA4BnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EACV,aAAa,EAKb,SAAS,EAMV,MAAM,kBAAkB,CAAC;AAO1B;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAyCvE;AAmBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,GAAG,CAAC,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAgUD,qBAAa,YAAa,SAAQ,GAAG,CAAC,KAAK;IACzC,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAM;IAE5D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuE;IACxG,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IACxD,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;IACpE;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAOvB;IAER;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAUtB;IAER;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAgB;gBAE1C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IA46BlE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAuMtB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAsKrB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA2MlB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,YAAY;IA+NpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,uBAAuB;IAyJ/B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IA4CnB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAyDnB,OAAO,CAAC,gBAAgB;IAgExB,OAAO,CAAC,YAAY;IAiCpB,OAAO,CAAC,YAAY;IA+EpB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAgD3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAMvB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAM5B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAyE3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAkFhC;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqF3B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CA6F1B"}
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../src/cdk/stack.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AA4BnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EACV,aAAa,EAKb,SAAS,EAMV,MAAM,kBAAkB,CAAC;AAO1B;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAyCvE;AAmBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,GAAG,CAAC,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAgUD,qBAAa,YAAa,SAAQ,GAAG,CAAC,KAAK;IACzC,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAM;IAE5D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuE;IACxG,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IACxD,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;IACpE;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAOvB;IAER;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAUtB;IAER;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAgB;gBAE1C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IA88BlE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAuMtB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkLrB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA6NlB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,YAAY;IA6OpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,uBAAuB;IAmK/B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IA2DnB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAyDnB,OAAO,CAAC,gBAAgB;IAgExB,OAAO,CAAC,YAAY;IA+CpB,OAAO,CAAC,YAAY;IAkGpB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAuD3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAqD5B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAMvB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAM5B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAyE3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAkFhC;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqF3B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CA6F1B"}