@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/data-stack.js

@@ -0,0 +1,511 @@
+/**
+ * Tier 1 — Data stack.
+ *
+ * Owns every long-lived stateful resource in the deploy:
+ *
+ *   - RDS instance(s) (Postgres / MySQL) + master credentials
+ *     Secret + the database-side SecurityGroup
+ *   - ElastiCache cluster(s) + ElastiCache SG
+ *   - DynamoDB table(s): user-declared (free-tier) and the
+ *     auto-provisioned rate-limits table (always provisioned —
+ *     `createDefaultRateLimiter()` from `@venturekit/runtime` reads
+ *     `VENTURE_RATE_LIMIT_TABLE` and the rate limiter must "just
+ *     work" on first deploy regardless of preset)
+ *   - S3 bucket(s) — bucket only; CloudFront distribution lives in
+ *     the edge tier and imports the bucket via SSM
+ *   - Internal HMAC Secret used by `@venturekit/auth` for state-
+ *     token signing across Lambda-to-Lambda calls
+ *
+ * # Lifecycle position
+ *
+ * Updated quarterly-ish — RDS minor version, instance-size bumps,
+ * occasional new bucket. Survives stack delete because every
+ * stateful resource has both `DeletionPolicy: Retain` AND
+ * (where AWS supports it) the resource-native deletion-protection
+ * flag (RDS, DynamoDB).
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `dataKeys.rdsEndpoint` / `rdsPort` / `rdsDatabaseName` /
+ *     `rdsSecretArn` / `rdsSecurityGroupId` per declared db id
+ *   - `dataKeys.bucketName` / `bucketArn` per declared bucket id
+ *   - `dataKeys.dynamoTableName` / `dynamoTableArn` per
+ *     user-declared table (free tier) AND for the rate-limits table
+ *     (id `'rate-limits'`)
+ *   - `dataKeys.cacheEndpoint` / `cachePort` / `cacheSecurityGroupId`
+ *     per cache id
+ *   - `dataKeys.internalHmacSecretArn`
+ *
+ * Outputs (`cdk.CfnOutput`) are deliberately NOT used — see plan §3.
+ *
+ * # What this stack does NOT do
+ *
+ * - **No CloudFront distribution.** Edge stack (step 8) imports the
+ *   bucket and creates the distribution with `S3BucketOrigin.with
+ *   OriginAccessControl(bucket)`. The OAC's `aws:SourceArn`-scoped
+ *   bucket policy lands in the edge stack via
+ *   `bucket.addToResourcePolicy()` on the imported `IBucket`.
+ *
+ * - **No migration runner.** The CodeBuild-based migration runner is
+ *   ephemeral wiring (delete-on-redeploy is fine; migrations are
+ *   already applied to the persistent DB). It moves to the app stack
+ *   in step 9, where it imports the RDS endpoint + secret via SSM.
+ *
+ * - **No Lambda permissions wiring.** Every IAM grant
+ *   (`bucket.grantReadWrite(role)`, `secret.grantRead(role)`, etc.)
+ *   produces an `AWS::IAM::Policy` resource attached to the role.
+ *   The role lives in the app stack; therefore so does every grant.
+ *   This is critical: putting grants here would create a circular
+ *   stack dependency (data → app for the role; app → data for the
+ *   bucket).
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as rds from 'aws-cdk-lib/aws-rds';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as elasticache from 'aws-cdk-lib/aws-elasticache';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { DATA_SAFETY_CONFIG } from '@venturekit/core';
+import * as path from 'path';
+import { writeSsm } from './shared/cross-stack-refs.js';
+import { dataKeys } from './shared/ssm-keys.js';
+import { MigrationRunner, hasMigrations } from './migration-runner.js';
+/**
+ * Map a database `intent.size` to an RDS instance type. Graviton
+ * (T4G / R6G) for cost. Mirrors `VentureStack.sizeToInstanceType`.
+ */
+function sizeToInstanceType(size) {
+    switch (size) {
+        case 'xlarge':
+            return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.LARGE);
+        case 'large':
+            return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.MEDIUM);
+        case 'medium':
+            return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.SMALL);
+        default: // 'small'
+            return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MICRO);
+    }
+}
+function sizeToCacheNodeType(size) {
+    switch (size) {
+        case 'xlarge':
+            return 'cache.r6g.large';
+        case 'large':
+            return 'cache.r6g.medium';
+        case 'medium':
+            return 'cache.t4g.small';
+        default: // 'small'
+            return 'cache.t4g.micro';
+    }
+}
+export class VentureDataStack extends cdk.Stack {
+    /**
+     * In-process accessors for sibling stacks (app stack mostly) that
+     * are deployed in the same `cdk.App`. Same rationale as
+     * `VentureNetworkStack.vpc`: direct CDK references give the
+     * consumer fully-typed access; cross-deploy consumers go through
+     * SSM + `import…` helpers.
+     */
+    databases = new Map();
+    buckets = new Map();
+    dynamoTables = new Map();
+    /**
+     * The auto-provisioned rate-limits table. Always populated, even
+     * when no `databases` intent is declared.
+     */
+    rateLimitTable;
+    /** Internal HMAC secret used by `@venturekit/auth/runtime`. */
+    internalHmacSecret;
+    /**
+     * Captured once in the constructor and reused by every private
+     * `create…` method. Avoids re-deriving from `envConfig.dataSafety`
+     * at five separate call sites and keeps the retention semantics
+     * consistent across all data-tier resources within a single stack.
+     */
+    isStrictRetain;
+    /**
+     * Native deletion-protection flag for resources that expose one
+     * (RDS, DynamoDB). Mirrors `dataSafetyConfig.deletionProtection`.
+     */
+    nativeDeletionProtection;
+    /**
+     * Migration runner config captured from props for use by
+     * `createDatabase`. `undefined` skips runner provisioning;
+     * the runner is also skipped per-DB when `hasMigrations` is
+     * false or the engine isn't Postgres.
+     */
+    migrationsConfig;
+    /** Captured for migration runner log retention. */
+    logRetentionDays;
+    /** Captured for migration runner NAT-availability gating. */
+    natType;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { projectName, stage, envConfig, infrastructure, vpc, isFreeTier } = props;
+        const dataSafetyConfig = DATA_SAFETY_CONFIG[envConfig.dataSafety];
+        this.isStrictRetain = dataSafetyConfig.removalPolicy === 'retain';
+        this.nativeDeletionProtection = dataSafetyConfig.deletionProtection;
+        this.migrationsConfig = props.migrations;
+        this.logRetentionDays = envConfig.observability.logs.retentionDays;
+        this.natType = envConfig.vpc.natType;
+        const isStrictRetain = this.isStrictRetain;
+        // ─── Internal HMAC secret ────────────────────────────────────
+        // CloudFormation auto-generates a 64-char alphanumeric value on
+        // first deploy and preserves it across stack updates. The value
+        // is consumed by `@venturekit/auth/runtime` for signing internal
+        // Lambda-to-Lambda state tokens; the app stack reads the secret's
+        // ARN via SSM and either fetches the value at cold start (default)
+        // or — for stages where the SM round-trip latency matters —
+        // injects the value as a Lambda env var directly.
+        this.internalHmacSecret = new secretsmanager.Secret(this, 'internalHmacSecret', {
+            secretName: `venturekit/${projectName}/${stage}/internal-hmac`,
+            description: 'VentureKit internal Lambda-to-Lambda HMAC signing key. Auto-generated.',
+            generateSecretString: {
+                passwordLength: 64,
+                excludePunctuation: true,
+                excludeCharacters: '"\'\\/',
+                requireEachIncludedType: false,
+                includeSpace: false,
+            },
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+        });
+        writeSsm(this, dataKeys.internalHmacSecretArn(projectName, stage), this.internalHmacSecret.secretArn, { description: 'Internal HMAC secret ARN' });
+        // ─── Databases ───────────────────────────────────────────────
+        if (infrastructure.databases) {
+            for (const intent of infrastructure.databases) {
+                if (isFreeTier) {
+                    // Free tier swaps RDS for DynamoDB. Cheaper, fully
+                    // serverless, no VPC required. The `databases` intent
+                    // surface stays the same so vk.config.ts is unchanged.
+                    this.createDynamoDBTable(intent, projectName, stage);
+                }
+                else {
+                    if (!vpc) {
+                        throw new Error(`VentureDataStack: database '${intent.id}' requires a VPC. ` +
+                            `Pass the VentureNetworkStack's vpc to VentureDataStackProps.vpc, ` +
+                            `or use the free preset which routes databases through DynamoDB.`);
+                    }
+                    this.createDatabase(intent, projectName, stage, vpc);
+                }
+            }
+        }
+        // ─── Built-in rate-limits DDB ────────────────────────────────
+        // Always created — the runtime rate limiter expects the table
+        // to exist regardless of preset. Per-stack name avoids cross-
+        // project collisions in shared accounts. See plan §5: this was
+        // historically hardcoded `RemovalPolicy.DESTROY` and now respects
+        // dataSafety.
+        this.rateLimitTable = this.createRateLimitTable(projectName, stage);
+        // ─── Storage buckets ─────────────────────────────────────────
+        if (infrastructure.storage) {
+            for (const intent of infrastructure.storage) {
+                this.createStorage(intent, projectName, stage);
+            }
+        }
+        // ─── Caches ──────────────────────────────────────────────────
+        if (infrastructure.caches) {
+            for (const intent of infrastructure.caches) {
+                if (!vpc) {
+                    throw new Error(`VentureDataStack: cache '${intent.id}' requires a VPC. ` +
+                        `Pass the VentureNetworkStack's vpc to VentureDataStackProps.vpc.`);
+                }
+                this.createCache(intent, projectName, stage, vpc);
+            }
+        }
+    }
+    // ─── RDS ───────────────────────────────────────────────────────
+    createDatabase(intent, projectName, stage, vpc) {
+        const isStrictRetain = this.isStrictRetain;
+        // Stable logical ID — never changes when preset changes.
+        const logicalId = `db-${intent.id}`;
+        const instanceType = sizeToInstanceType(intent.size || 'small');
+        const engine = intent.type === 'mysql'
+            ? rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0 })
+            : rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16 });
+        // Place DB in isolated subnets when the preset ships them
+        // (medium+); otherwise fall back to private-with-egress.
+        const subnetType = vpc.isolatedSubnets?.length
+            ? ec2.SubnetType.PRIVATE_ISOLATED
+            : ec2.SubnetType.PRIVATE_WITH_EGRESS;
+        const commonDbProps = {
+            engine,
+            instanceType,
+            vpc,
+            vpcSubnets: { subnetType },
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            // Native RDS deletion protection — CFN-level RETAIN doesn't
+            // block console / CLI deletes; this flag does.
+            deletionProtection: this.nativeDeletionProtection,
+            multiAz: intent.highAvailability ?? false,
+            storageEncrypted: intent.encrypted ?? true,
+            backupRetention: intent.backups !== false
+                ? cdk.Duration.days(intent.backupRetentionDays ?? 7)
+                : cdk.Duration.days(0),
+            autoMinorVersionUpgrade: true,
+            enablePerformanceInsights: intent.performanceInsights ?? false,
+        };
+        const instance = intent.restoreFromSnapshot
+            ? new rds.DatabaseInstanceFromSnapshot(this, logicalId, {
+                ...commonDbProps,
+                snapshotIdentifier: intent.restoreFromSnapshot,
+                credentials: rds.SnapshotCredentials.fromGeneratedSecret('postgres'),
+            })
+            : new rds.DatabaseInstance(this, logicalId, {
+                ...commonDbProps,
+                databaseName: intent.name || intent.id,
+                credentials: rds.Credentials.fromGeneratedSecret('postgres'),
+            });
+        // UpdateReplacePolicy=Retain on the DB instance so a property
+        // change that requires REPLACE doesn't drop the underlying
+        // storage. Mirrors the §5 retention model.
+        if (isStrictRetain) {
+            const cfnInstance = instance.node.defaultChild;
+            cfnInstance.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // RETAIN the master credentials Secret. `instance.secret`
+        // returns a `SecretTargetAttachment` (CDK metadata, not the
+        // actual Secret); the underlying `AWS::SecretsManager::Secret`
+        // resource is a sibling child of the DB construct under the
+        // well-known id `'Secret'`. Walking to it directly is the only
+        // way to apply RemovalPolicy to the secret itself.
+        if (isStrictRetain) {
+            const dbSecret = instance.node.tryFindChild('Secret');
+            if (dbSecret) {
+                dbSecret.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+                const cfnSecret = dbSecret.node.defaultChild;
+                if (cfnSecret) {
+                    cfnSecret.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+                }
+            }
+        }
+        this.databases.set(intent.id, { instance, intent });
+        // ─── Migration runner (CodeBuild in-VPC) ────────────────────
+        // Provisioned only for Postgres + when the project has a
+        // `db/migrations/` dir + when the VPC has outbound egress.
+        // Skipping silently is OK because the operator can run
+        // `vk migrate` manually via an SSM tunnel.
+        if (this.migrationsConfig &&
+            intent.type === 'postgres' &&
+            instance.secret) {
+            const dbDir = path.join(this.migrationsConfig.projectDir, 'db');
+            if (hasMigrations(dbDir)) {
+                if (this.natType === 'none') {
+                    console.warn(`[venturekit] Skipping auto-migrations for db "${intent.id}": ` +
+                        `natType is 'none', so the in-VPC migration runner can't ` +
+                        `reach npmjs.com to install @venturekit/cli. Fix: set ` +
+                        `'infrastructure.vpc.natType: "instance"' (or "gateway") in ` +
+                        `vk.config.ts. Until then, run \`vk migrate -e ${stage}\` ` +
+                        `manually once the DB is reachable (e.g. via SSM tunnel).`);
+                }
+                else {
+                    new MigrationRunner(this, `migration-runner-${intent.id}`, {
+                        projectName,
+                        stage,
+                        dbId: intent.id,
+                        vpc,
+                        dbInstance: instance,
+                        dbSecret: instance.secret,
+                        dbName: intent.name || intent.id,
+                        dbDir,
+                        extraMigrationsDirs: this.migrationsConfig.packageMigrationsDirs ?? [],
+                        vkCliVersion: this.migrationsConfig.vkCliVersion,
+                        logRetentionDays: this.logRetentionDays,
+                    });
+                }
+            }
+        }
+        else if (this.migrationsConfig && intent.type === 'mysql') {
+            console.warn(`[venturekit] No auto-migration runner for MySQL db "${intent.id}". ` +
+                `Run migrations manually via tunnel.`);
+        }
+        // Publish to SSM for the app stack's connection wiring.
+        writeSsm(this, dataKeys.rdsEndpoint(projectName, stage, intent.id), instance.dbInstanceEndpointAddress, { description: `Postgres/MySQL endpoint for db '${intent.id}'` });
+        writeSsm(this, dataKeys.rdsPort(projectName, stage, intent.id), instance.dbInstanceEndpointPort, { description: `RDS port for db '${intent.id}'` });
+        writeSsm(this, dataKeys.rdsDatabaseName(projectName, stage, intent.id), intent.name || intent.id, { description: `Database name for db '${intent.id}'` });
+        if (instance.secret) {
+            writeSsm(this, dataKeys.rdsSecretArn(projectName, stage, intent.id), instance.secret.secretArn, { description: `Master credentials secret ARN for db '${intent.id}'` });
+        }
+        writeSsm(this, dataKeys.rdsSecurityGroupId(projectName, stage, intent.id), instance.connections.securityGroups[0].securityGroupId, { description: `Database SG ID — app stack imports + adds Lambda ingress` });
+    }
+    // ─── DynamoDB (free-tier `databases` substitute + user tables) ─
+    createDynamoDBTable(intent, projectName, stage) {
+        const isStrictRetain = this.isStrictRetain;
+        const logicalId = `dynamo-${intent.id}`;
+        const table = new dynamodb.Table(this, logicalId, {
+            tableName: `${projectName}-${intent.id}-${stage}`,
+            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            pointInTimeRecovery: isStrictRetain,
+            encryption: dynamodb.TableEncryption.AWS_MANAGED,
+            timeToLiveAttribute: 'ttl',
+            // Native DDB deletion protection — second layer beyond RETAIN.
+            deletionProtection: isStrictRetain,
+        });
+        if (isStrictRetain) {
+            const cfnTable = table.node.defaultChild;
+            cfnTable.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        table.addGlobalSecondaryIndex({
+            indexName: 'gsi1',
+            partitionKey: { name: 'gsi1pk', type: dynamodb.AttributeType.STRING },
+            sortKey: { name: 'gsi1sk', type: dynamodb.AttributeType.STRING },
+            projectionType: dynamodb.ProjectionType.ALL,
+        });
+        this.dynamoTables.set(intent.id, table);
+        writeSsm(this, dataKeys.dynamoTableName(projectName, stage, intent.id), table.tableName, { description: `DynamoDB table name '${intent.id}'` });
+        writeSsm(this, dataKeys.dynamoTableArn(projectName, stage, intent.id), table.tableArn, { description: `DynamoDB table ARN '${intent.id}'` });
+    }
+    createRateLimitTable(projectName, stage) {
+        const isStrictRetain = this.isStrictRetain;
+        // Per-stack name to avoid collisions across multiple projects in
+        // the same AWS account.
+        const tableName = `${projectName}-rate-limits-${stage}`;
+        const table = new dynamodb.Table(this, 'RateLimitTable', {
+            tableName,
+            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
+            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            timeToLiveAttribute: 'ttl',
+            encryption: dynamodb.TableEncryption.AWS_MANAGED,
+            deletionProtection: isStrictRetain,
+        });
+        if (isStrictRetain) {
+            const cfn = table.node.defaultChild;
+            cfn.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // Publish under the stable id `'rate-limits'` so app-stack code
+        // reads through `dataKeys.dynamoTableName(project, stage, 'rate-limits')`.
+        writeSsm(this, dataKeys.dynamoTableName(projectName, stage, 'rate-limits'), table.tableName, { description: 'Rate-limits DDB table name (consumed by @venturekit/runtime)' });
+        writeSsm(this, dataKeys.dynamoTableArn(projectName, stage, 'rate-limits'), table.tableArn, { description: 'Rate-limits DDB table ARN — for IAM grants in app stack' });
+        return table;
+    }
+    // ─── S3 ────────────────────────────────────────────────────────
+    createStorage(intent, projectName, stage) {
+        const isStrictRetain = this.isStrictRetain;
+        const logicalId = `storage-${intent.id}`;
+        const bucket = new s3.Bucket(this, logicalId, {
+            bucketName: `${projectName}-${intent.id}-${stage}`,
+            versioned: intent.versioned ?? intent.purpose === 'backups',
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            autoDeleteObjects: !isStrictRetain,
+            encryption: s3.BucketEncryption.S3_MANAGED,
+            // BLOCK_ALL even when CDN is in use; the edge-tier CloudFront
+            // distribution accesses the bucket through an Origin Access
+            // Control with `aws:SourceArn` scoping, not via direct
+            // anonymous reads.
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+            enforceSSL: true,
+            cors: intent.corsOrigins
+                ? [
+                    {
+                        allowedOrigins: intent.corsOrigins,
+                        allowedMethods: [
+                            s3.HttpMethods.GET,
+                            s3.HttpMethods.PUT,
+                            s3.HttpMethods.POST,
+                            s3.HttpMethods.DELETE,
+                        ],
+                        allowedHeaders: ['*'],
+                    },
+                ]
+                : undefined,
+            lifecycleRules: intent.purpose === 'logs'
+                ? [{ expiration: cdk.Duration.days(intent.retentionDays ?? 90), id: 'log-expiry' }]
+                : intent.purpose === 'backups'
+                    ? [
+                        {
+                            transitions: [
+                                { storageClass: s3.StorageClass.INFREQUENT_ACCESS, transitionAfter: cdk.Duration.days(30) },
+                            ],
+                            id: 'backup-ia',
+                        },
+                        {
+                            transitions: [
+                                { storageClass: s3.StorageClass.GLACIER, transitionAfter: cdk.Duration.days(90) },
+                            ],
+                            id: 'backup-glacier',
+                        },
+                    ]
+                    : [],
+        });
+        if (isStrictRetain) {
+            const cfnBucket = bucket.node.defaultChild;
+            cfnBucket.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        this.buckets.set(intent.id, { bucket, intent });
+        // ── OAC bucket policy (CDN-fronted buckets) ───────────────────
+        // The edge stack creates the CloudFront distribution with an
+        // OriginAccessControl pointing at this bucket. The bucket policy
+        // that authorizes CloudFront's signed S3 GET must live here (the
+        // bucket's home stack); creating it in the edge stack would force
+        // CDK to add a `data → edge` dependency for the distribution ARN
+        // *and* an `edge → data` dependency for the bucket's regional
+        // domain — a synth-time cycle.
+        //
+        // We scope the statement with `aws:SourceAccount` instead of
+        // `aws:SourceArn`. Pinning to a specific distribution ARN would
+        // require a cross-stack reference; the SourceAccount condition
+        // is the AWS-recommended fallback when the distribution lives in
+        // another stack and gives equivalent protection at the account
+        // boundary (the only CloudFront distribution with this OAC will
+        // be the one in the edge stack — anyone else attempting to use
+        // the same OAC must already be inside the same AWS account).
+        if (intent.cdn === true) {
+            bucket.addToResourcePolicy(new iam.PolicyStatement({
+                sid: 'AllowCloudFrontOacRead',
+                effect: iam.Effect.ALLOW,
+                principals: [new iam.ServicePrincipal('cloudfront.amazonaws.com')],
+                actions: ['s3:GetObject'],
+                resources: [bucket.arnForObjects('*')],
+                conditions: {
+                    StringEquals: { 'aws:SourceAccount': cdk.Aws.ACCOUNT_ID },
+                },
+            }));
+        }
+        writeSsm(this, dataKeys.bucketName(projectName, stage, intent.id), bucket.bucketName, { description: `S3 bucket name for storage '${intent.id}'` });
+        writeSsm(this, dataKeys.bucketArn(projectName, stage, intent.id), bucket.bucketArn, { description: `S3 bucket ARN — IAM scoping target` });
+    }
+    // ─── ElastiCache ───────────────────────────────────────────────
+    createCache(intent, projectName, stage, vpc) {
+        const logicalId = `cache-${intent.id}`;
+        const securityGroup = new ec2.SecurityGroup(this, `${logicalId}-sg`, {
+            vpc,
+            description: `Security group for ${projectName}-${intent.id} Redis`,
+            allowAllOutbound: false,
+        });
+        // Allow Redis-port ingress from anywhere in the VPC. Tighter
+        // scoping (Lambda SG → cache SG) isn't possible from this
+        // stack — the Lambda SG lives in the app stack. The CIDR-scoped
+        // rule is still secure (no internet exposure) and sufficient.
+        securityGroup.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(6379), 'Allow Redis access from VPC');
+        const subnetIds = vpc.isolatedSubnets?.length
+            ? vpc.isolatedSubnets.map((s) => s.subnetId)
+            : vpc.privateSubnets.map((s) => s.subnetId);
+        const subnetGroup = new elasticache.CfnSubnetGroup(this, `${logicalId}-subnet-group`, {
+            description: `Subnet group for ${projectName}-${intent.id}`,
+            subnetIds,
+        });
+        const cacheNodeType = sizeToCacheNodeType(intent.size || 'small');
+        const redis = new elasticache.CfnCacheCluster(this, logicalId, {
+            engine: 'redis',
+            cacheNodeType,
+            numCacheNodes: 1,
+            vpcSecurityGroupIds: [securityGroup.securityGroupId],
+            cacheSubnetGroupName: subnetGroup.ref,
+            transitEncryptionEnabled: true,
+            // Snapshot retention for strict (preserves the cache contents
+            // for ad-hoc forensic restore — not as durable as RDS but
+            // better than nothing for stateful Redis use cases).
+            snapshotRetentionLimit: this.isStrictRetain ? 7 : 0,
+            autoMinorVersionUpgrade: true,
+        });
+        writeSsm(this, dataKeys.cacheEndpoint(projectName, stage, intent.id), redis.attrRedisEndpointAddress, { description: `Redis endpoint for cache '${intent.id}'` });
+        writeSsm(this, dataKeys.cachePort(projectName, stage, intent.id), redis.attrRedisEndpointPort, { description: `Redis port for cache '${intent.id}'` });
+        writeSsm(this, dataKeys.cacheSecurityGroupId(projectName, stage, intent.id), securityGroup.securityGroupId, { description: `Cache SG ID — app stack imports + adds Lambda ingress` });
+    }
+}
+//# sourceMappingURL=data-stack.js.map

package/dist/cdk/data-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-stack.js","sourceRoot":"","sources":["../../src/cdk/data-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,KAAK,WAAW,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAsC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAqFvE;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5E,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7E,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5E,SAAS,UAAU;YACjB,OAAO,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,SAAS,UAAU;YACjB,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,GAAG,CAAC,KAAK;IAC7C;;;;;;OAMG;IACa,SAAS,GAGrB,IAAI,GAAG,EAAE,CAAC;IAEE,OAAO,GAAoD,IAAI,GAAG,EAAE,CAAC;IAErE,YAAY,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEtE;;;OAGG;IACa,cAAc,CAAiB;IAE/C,+DAA+D;IAC/C,kBAAkB,CAAwB;IAE1D;;;;;OAKG;IACc,cAAc,CAAU;IAEzC;;;OAGG;IACc,wBAAwB,CAAU;IAEnD;;;;;OAKG;IACc,gBAAgB,CAAuC;IAExE,mDAAmD;IAClC,gBAAgB,CAAS;IAE1C,6DAA6D;IAC5C,OAAO,CAAS;IAEjC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QACjF,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC;QAClE,IAAI,CAAC,wBAAwB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;QACpE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,4DAA4D;QAC5D,kDAAkD;QAClD,IAAI,CAAC,kBAAkB,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE;YAC9E,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,gBAAgB;YAC9D,WAAW,EAAE,wEAAwE;YACrF,oBAAoB,EAAE;gBACpB,cAAc,EAAE,EAAE;gBAClB,kBAAkB,EAAE,IAAI;gBACxB,iBAAiB,EAAE,QAAQ;gBAC3B,uBAAuB,EAAE,KAAK;gBAC9B,YAAY,EAAE,KAAK;aACpB;YACD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;SACrF,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,EAClD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EACjC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAC5C,CAAC;QAEF,gEAAgE;QAChE,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;gBAC9C,IAAI,UAAU,EAAE,CAAC;oBACf,mDAAmD;oBACnD,sDAAsD;oBACtD,uDAAuD;oBACvD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,EAAE,CAAC;wBACT,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,oBAAoB;4BAC5D,mEAAmE;4BACnE,iEAAiE,CAClE,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,cAAc;QACd,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAEpE,gEAAgE;QAChE,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,CAAC,EAAE,oBAAoB;wBACzD,kEAAkE,CACnE,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAE1D,cAAc,CACpB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,GAAa;QAEb,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,yDAAyD;QACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO;YACpC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC/E,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvF,0DAA0D;QAC1D,yDAAyD;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,EAAE,MAAM;YAC5C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB;YACjC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAEvC,MAAM,aAAa,GAAG;YACpB,MAAM;YACN,YAAY;YACZ,GAAG;YACH,UAAU,EAAE,EAAE,UAAU,EAAE;YAC1B,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,4DAA4D;YAC5D,+CAA+C;YAC/C,kBAAkB,EAAE,IAAI,CAAC,wBAAwB;YACjD,OAAO,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;YACzC,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YAC1C,eAAe,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK;gBACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBACpD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACxB,uBAAuB,EAAE,IAAI;YAC7B,yBAAyB,EAAE,MAAM,CAAC,mBAAmB,IAAI,KAAK;SAC/D,CAAC;QAEF,MAAM,QAAQ,GACZ,MAAM,CAAC,mBAAmB;YACxB,CAAC,CAAC,IAAI,GAAG,CAAC,4BAA4B,CAAC,IAAI,EAAE,SAAS,EAAE;gBACpD,GAAG,aAAa;gBAChB,kBAAkB,EAAE,MAAM,CAAC,mBAAmB;gBAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,UAAU,CAAC;aACrE,CAAC;YACJ,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE;gBACxC,GAAG,aAAa;gBAChB,YAAY,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE;gBACtC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC;aAC7D,CAAC,CAAC;QAET,8DAA8D;QAC9D,2DAA2D;QAC3D,2CAA2C;QAC3C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAA+B,CAAC;YAClE,WAAW,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC5E,CAAC;QAED,0DAA0D;QAC1D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAEvC,CAAC;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAA2C,CAAC;gBAC5E,IAAI,SAAS,EAAE,CAAC;oBACd,SAAS,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEpD,+DAA+D;QAC/D,yDAAyD;QACzD,2DAA2D;QAC3D,uDAAuD;QACvD,2CAA2C;QAC3C,IACE,IAAI,CAAC,gBAAgB;YACrB,MAAM,CAAC,IAAI,KAAK,UAAU;YAC1B,QAAQ,CAAC,MAAM,EACf,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CACV,iDAAiD,MAAM,CAAC,EAAE,KAAK;wBAC/D,0DAA0D;wBAC1D,uDAAuD;wBACvD,6DAA6D;wBAC7D,iDAAiD,KAAK,KAAK;wBAC3D,0DAA0D,CAC3D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,eAAe,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,EAAE,EAAE,EAAE;wBACzD,WAAW;wBACX,KAAK;wBACL,IAAI,EAAE,MAAM,CAAC,EAAE;wBACf,GAAG;wBACH,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,QAAQ,CAAC,MAAM;wBACzB,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE;wBAChC,KAAK;wBACL,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,IAAI,EAAE;wBACtE,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY;wBAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CACV,uDAAuD,MAAM,CAAC,EAAE,KAAK;gBACrE,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACnD,QAAQ,CAAC,yBAAyB,EAClC,EAAE,WAAW,EAAE,mCAAmC,MAAM,CAAC,EAAE,GAAG,EAAE,CACjE,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC/C,QAAQ,CAAC,sBAAsB,EAC/B,EAAE,WAAW,EAAE,oBAAoB,MAAM,CAAC,EAAE,GAAG,EAAE,CAClD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACvD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EACxB,EAAE,WAAW,EAAE,yBAAyB,MAAM,CAAC,EAAE,GAAG,EAAE,CACvD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,SAAS,EACzB,EAAE,WAAW,EAAE,yCAAyC,MAAM,CAAC,EAAE,GAAG,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC1D,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,eAAe,EACvD,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,kEAAkE;IAE1D,mBAAmB,CACzB,MAAW,EACX,WAAmB,EACnB,KAAa;QAEb,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,MAAM,SAAS,GAAG,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;YAChD,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YACjD,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;YAC5D,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,eAAe;YACjD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,mBAAmB,EAAE,cAAc;YACnC,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,WAAW;YAChD,mBAAmB,EAAE,KAAK;YAC1B,+DAA+D;YAC/D,kBAAkB,EAAE,cAAc;SACnC,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC5D,QAAQ,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACzE,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC;YAC5B,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;YACrE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;YAChE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAExC,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACvD,KAAK,CAAC,SAAS,EACf,EAAE,WAAW,EAAE,wBAAwB,MAAM,CAAC,EAAE,GAAG,EAAE,CACtD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACtD,KAAK,CAAC,QAAQ,EACd,EAAE,WAAW,EAAE,uBAAuB,MAAM,CAAC,EAAE,GAAG,EAAE,CACrD,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,WAAmB,EAAE,KAAa;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,iEAAiE;QACjE,wBAAwB;QACxB,MAAM,SAAS,GAAG,GAAG,WAAW,gBAAgB,KAAK,EAAE,CAAC;QAExD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE;YACvD,SAAS;YACT,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;YACjE,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,eAAe;YACjD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,QAAQ,CAAC,eAAe,CAAC,WAAW;YAChD,kBAAkB,EAAE,cAAc;SACnC,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,YAA+B,CAAC;YACvD,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QAED,gEAAgE;QAChE,2EAA2E;QAC3E,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,EAC3D,KAAK,CAAC,SAAS,EACf,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAChF,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,EAC1D,KAAK,CAAC,QAAQ,EACd,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAC3E,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAE1D,aAAa,CACnB,MAAW,EACX,WAAmB,EACnB,KAAa;QAEb,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3C,MAAM,SAAS,GAAG,WAAW,MAAM,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE;YAC5C,UAAU,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YAClD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAC3D,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,iBAAiB,EAAE,CAAC,cAAc;YAClC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU;YAC1C,8DAA8D;YAC9D,4DAA4D;YAC5D,uDAAuD;YACvD,mBAAmB;YACnB,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS;YACjD,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,MAAM,CAAC,WAAW;gBACtB,CAAC,CAAC;oBACE;wBACE,cAAc,EAAE,MAAM,CAAC,WAAW;wBAClC,cAAc,EAAE;4BACd,EAAE,CAAC,WAAW,CAAC,GAAG;4BAClB,EAAE,CAAC,WAAW,CAAC,GAAG;4BAClB,EAAE,CAAC,WAAW,CAAC,IAAI;4BACnB,EAAE,CAAC,WAAW,CAAC,MAAM;yBACtB;wBACD,cAAc,EAAE,CAAC,GAAG,CAAC;qBACtB;iBACF;gBACH,CAAC,CAAC,SAAS;YACb,cAAc,EACZ,MAAM,CAAC,OAAO,KAAK,MAAM;gBACvB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;gBACnF,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE;gCACX,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;6BAC5F;4BACD,EAAE,EAAE,WAAW;yBAChB;wBACD;4BACE,WAAW,EAAE;gCACX,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;6BAClF;4BACD,EAAE,EAAE,gBAAgB;yBACrB;qBACF;oBACH,CAAC,CAAC,EAAE;SACX,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC9D,SAAS,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,+BAA+B;QAC/B,EAAE;QACF,6DAA6D;QAC7D,gEAAgE;QAChE,+DAA+D;QAC/D,iEAAiE;QACjE,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,mBAAmB,CACxB,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,GAAG,EAAE,wBAAwB;gBAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBACxB,UAAU,EAAE,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;gBAClE,OAAO,EAAE,CAAC,cAAc,CAAC;gBACzB,SAAS,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACtC,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE;iBAC1D;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAClD,MAAM,CAAC,UAAU,EACjB,EAAE,WAAW,EAAE,+BAA+B,MAAM,CAAC,EAAE,GAAG,EAAE,CAC7D,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACjD,MAAM,CAAC,SAAS,EAChB,EAAE,WAAW,EAAE,oCAAoC,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,kEAAkE;IAE1D,WAAW,CACjB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,GAAa;QAEb,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,KAAK,EAAE;YACnE,GAAG;YACH,WAAW,EAAE,sBAAsB,WAAW,IAAI,MAAM,CAAC,EAAE,QAAQ;YACnE,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAC;QACH,6DAA6D;QAC7D,0DAA0D;QAC1D,gEAAgE;QAChE,8DAA8D;QAC9D,aAAa,CAAC,cAAc,CAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAClB,6BAA6B,CAC9B,CAAC;QAEF,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,MAAM;YAC3C,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,SAAS,eAAe,EAAE;YACpF,WAAW,EAAE,oBAAoB,WAAW,IAAI,MAAM,CAAC,EAAE,EAAE;YAC3D,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE;YAC7D,MAAM,EAAE,OAAO;YACf,aAAa;YACb,aAAa,EAAE,CAAC;YAChB,mBAAmB,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC;YACpD,oBAAoB,EAAE,WAAW,CAAC,GAAG;YACrC,wBAAwB,EAAE,IAAI;YAC9B,8DAA8D;YAC9D,0DAA0D;YAC1D,qDAAqD;YACrD,sBAAsB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC;QAEH,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACrD,KAAK,CAAC,wBAAwB,EAC9B,EAAE,WAAW,EAAE,6BAA6B,MAAM,CAAC,EAAE,GAAG,EAAE,CAC3D,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACjD,KAAK,CAAC,qBAAqB,EAC3B,EAAE,WAAW,EAAE,yBAAyB,MAAM,CAAC,EAAE,GAAG,EAAE,CACvD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC5D,aAAa,CAAC,eAAe,EAC7B,EAAE,WAAW,EAAE,uDAAuD,EAAE,CACzE,CAAC;IACJ,CAAC;CACF"}

package/dist/cdk/edge-stack.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Tier 5 — Edge stack.
+ *
+ * Owns the public-facing entry surface:
+ *
+ *   - The `AWS::ApiGatewayV2::Api` (HttpApi) shell with stable
+ *     ID + access logging configured. Routes (which target Lambdas)
+ *     are added in the app stack via `HttpApi.fromHttpApiAttributes`
+ *     + `addRoutes()`.
+ *   - Custom domain(s) per `domains[]` intent: ACM certificate
+ *     (existing ARN, Route53-validated, or DNS-validation-pending),
+ *     `AWS::ApiGatewayV2::DomainName`, `ApiMapping` to the API's
+ *     default stage, optional Route53 alias.
+ *   - CloudFront distribution(s) over imported S3 buckets per
+ *     `storage[]` intent that has `cdn: true`. Bucket lives in the
+ *     data stack; distribution + Origin Access Control + alias DNS
+ *     live here. The OAC's `aws:SourceArn`-scoped bucket policy
+ *     statement is added to the imported `IBucket` automatically by
+ *     `S3BucketOrigin.withOriginAccessControl(...)`.
+ *
+ * # Lifecycle position
+ *
+ * Updated occasionally (~quarterly): a new domain, a new CDN, an
+ * ACM cert rotation. The HttpApi ID itself is the most fragile:
+ * the `*.execute-api.{region}.amazonaws.com` URL embeds it, and
+ * mobile apps shipped with that URL baked in cannot be patched
+ * without a full update cycle. RETAIN under strict is therefore
+ * not just durability — it's external-contract preservation.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `edgeKeys.apiId / apiEndpoint / apiCustomDomain /
+ *     apiDefaultStageName` — the app stack reads these to import
+ *     the API and add its discovered routes.
+ *   - `edgeKeys.storageCdnDomain(storageId) /
+ *     storageCdnDistributionId(storageId)` per CDN-fronted bucket.
+ *
+ * # What this stack does NOT do
+ *
+ * - **No routes / integrations.** `HttpApi.addRoutes(...)` runs
+ *   in the app stack. CDK's `HttpApi.fromHttpApiAttributes` returns
+ *   an `IHttpApi` that supports `addRoutes`, so the cross-stack
+ *   pattern is the same as the in-stack one.
+ *
+ * - **No Lambda permissions.** API Gateway invoking a Lambda
+ *   requires a `lambda:InvokeFunction` resource policy on the
+ *   Lambda granted to `apigateway.amazonaws.com` with `aws:SourceArn`
+ *   scoping. CDK's `HttpLambdaIntegration` adds that grant
+ *   automatically when the route is created — which happens in the
+ *   app stack.
+ *
+ * - **No CloudFront-Lambda@Edge wiring.** Edge Lambdas (request /
+ *   response viewer functions) are extreme-rare in the VentureKit
+ *   surface. If they're added later, they'd live here because their
+ *   lifecycle is tied to the distribution, not to a single regional
+ *   handler.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { Construct } from 'constructs';
+import { type EnvConfig, type VentureIntent } from '@venturekit/core';
+export interface VentureEdgeStackProps extends cdk.StackProps {
+    projectName: string;
+    stage: string;
+    envConfig: EnvConfig;
+    /** Reads `domains[]` and `storage[]` (CDN flag only). */
+    infrastructure: VentureIntent;
+    /**
+     * Imported `IBucket` per storage intent that has `cdn: true`.
+     * The CLI generator wires these up: data stack creates the bucket
+     * → generator captures `dataStack.buckets.get(id).bucket` → passes
+     * the map here. Edge stack imports each one and creates the
+     * CloudFront distribution + OAC bucket policy.
+     *
+     * Cross-deploy consumers can reconstruct via `s3.Bucket.fromBucketAttributes`
+     * + the data stack's published `bucketArn` SSM key, but the
+     * common case is in-process refs.
+     */
+    storageBuckets?: Map<string, s3.IBucket>;
+}
+export declare class VentureEdgeStack extends cdk.Stack {
+    readonly api: apigatewayv2.HttpApi;
+    readonly distributions: Map<string, cloudfront.Distribution>;
+    private readonly isStrictRetain;
+    constructor(scope: Construct, id: string, props: VentureEdgeStackProps);
+    private createDomain;
+    private createStorageCdn;
+}
+//# sourceMappingURL=edge-stack.d.ts.map

package/dist/cdk/edge-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/edge-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAI7D,OAAO,KAAK,UAAU,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,WAAW,qBAAsB,SAAQ,GAAG,CAAC,UAAU;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IAErB,yDAAyD;IACzD,cAAc,EAAE,aAAa,CAAC;IAE9B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;CAC1C;AAaD,qBAAa,gBAAiB,SAAQ,GAAG,CAAC,KAAK;IAC7C,SAAgB,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC;IAE1C,SAAgB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,CAAa;IAEhF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;IAqJtE,OAAO,CAAC,YAAY;IA8FpB,OAAO,CAAC,gBAAgB;CAoHzB"}