@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/edge-stack.js

@@ -0,0 +1,364 @@
+/**
+ * Tier 5 — Edge stack.
+ *
+ * Owns the public-facing entry surface:
+ *
+ *   - The `AWS::ApiGatewayV2::Api` (HttpApi) shell with stable
+ *     ID + access logging configured. Routes (which target Lambdas)
+ *     are added in the app stack via `HttpApi.fromHttpApiAttributes`
+ *     + `addRoutes()`.
+ *   - Custom domain(s) per `domains[]` intent: ACM certificate
+ *     (existing ARN, Route53-validated, or DNS-validation-pending),
+ *     `AWS::ApiGatewayV2::DomainName`, `ApiMapping` to the API's
+ *     default stage, optional Route53 alias.
+ *   - CloudFront distribution(s) over imported S3 buckets per
+ *     `storage[]` intent that has `cdn: true`. Bucket lives in the
+ *     data stack; distribution + Origin Access Control + alias DNS
+ *     live here. The OAC's `aws:SourceArn`-scoped bucket policy
+ *     statement is added to the imported `IBucket` automatically by
+ *     `S3BucketOrigin.withOriginAccessControl(...)`.
+ *
+ * # Lifecycle position
+ *
+ * Updated occasionally (~quarterly): a new domain, a new CDN, an
+ * ACM cert rotation. The HttpApi ID itself is the most fragile:
+ * the `*.execute-api.{region}.amazonaws.com` URL embeds it, and
+ * mobile apps shipped with that URL baked in cannot be patched
+ * without a full update cycle. RETAIN under strict is therefore
+ * not just durability — it's external-contract preservation.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `edgeKeys.apiId / apiEndpoint / apiCustomDomain /
+ *     apiDefaultStageName` — the app stack reads these to import
+ *     the API and add its discovered routes.
+ *   - `edgeKeys.storageCdnDomain(storageId) /
+ *     storageCdnDistributionId(storageId)` per CDN-fronted bucket.
+ *
+ * # What this stack does NOT do
+ *
+ * - **No routes / integrations.** `HttpApi.addRoutes(...)` runs
+ *   in the app stack. CDK's `HttpApi.fromHttpApiAttributes` returns
+ *   an `IHttpApi` that supports `addRoutes`, so the cross-stack
+ *   pattern is the same as the in-stack one.
+ *
+ * - **No Lambda permissions.** API Gateway invoking a Lambda
+ *   requires a `lambda:InvokeFunction` resource policy on the
+ *   Lambda granted to `apigateway.amazonaws.com` with `aws:SourceArn`
+ *   scoping. CDK's `HttpLambdaIntegration` adds that grant
+ *   automatically when the route is created — which happens in the
+ *   app stack.
+ *
+ * - **No CloudFront-Lambda@Edge wiring.** Edge Lambdas (request /
+ *   response viewer functions) are extreme-rare in the VentureKit
+ *   surface. If they're added later, they'd live here because their
+ *   lifecycle is tied to the distribution, not to a single regional
+ *   handler.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as acm from 'aws-cdk-lib/aws-certificatemanager';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as cloudfrontOrigins from 'aws-cdk-lib/aws-cloudfront-origins';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import { DATA_SAFETY_CONFIG } from '@venturekit/core';
+import { writeSsm } from './shared/cross-stack-refs.js';
+import { edgeKeys } from './shared/ssm-keys.js';
+function toLogRetention(days) {
+    if (days <= 1)
+        return logs.RetentionDays.ONE_DAY;
+    if (days <= 7)
+        return logs.RetentionDays.ONE_WEEK;
+    if (days <= 14)
+        return logs.RetentionDays.TWO_WEEKS;
+    if (days <= 30)
+        return logs.RetentionDays.ONE_MONTH;
+    if (days <= 90)
+        return logs.RetentionDays.THREE_MONTHS;
+    if (days <= 180)
+        return logs.RetentionDays.SIX_MONTHS;
+    if (days <= 365)
+        return logs.RetentionDays.ONE_YEAR;
+    return logs.RetentionDays.INFINITE;
+}
+export class VentureEdgeStack extends cdk.Stack {
+    api;
+    distributions = new Map();
+    isStrictRetain;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { projectName, stage, envConfig, infrastructure, storageBuckets } = props;
+        this.isStrictRetain =
+            DATA_SAFETY_CONFIG[envConfig.dataSafety].removalPolicy === 'retain';
+        const apiConfig = envConfig.api;
+        const obsConfig = envConfig.observability;
+        // ─── HttpApi shell ──────────────────────────────────────────
+        // Created with NO routes — routes live in the app stack.
+        // CORS preflight, throttling, and access logging are all
+        // edge-tier concerns and stay here.
+        this.api = new apigatewayv2.HttpApi(this, 'Api', {
+            apiName: `${projectName}-${stage}`,
+            corsPreflight: apiConfig.cors
+                ? {
+                    allowOrigins: apiConfig.cors.allowOrigins,
+                    allowMethods: apiConfig.cors.allowMethods.map((m) => apigatewayv2.CorsHttpMethod[m.toUpperCase()] ??
+                        apigatewayv2.CorsHttpMethod.ANY),
+                    allowHeaders: apiConfig.cors.allowHeaders,
+                    allowCredentials: apiConfig.cors.allowCredentials,
+                    maxAge: cdk.Duration.seconds(apiConfig.cors.maxAgeSec),
+                }
+                : {
+                    allowOrigins: ['*'],
+                    allowMethods: [
+                        apigatewayv2.CorsHttpMethod.GET,
+                        apigatewayv2.CorsHttpMethod.POST,
+                        apigatewayv2.CorsHttpMethod.PUT,
+                        apigatewayv2.CorsHttpMethod.DELETE,
+                        apigatewayv2.CorsHttpMethod.PATCH,
+                        apigatewayv2.CorsHttpMethod.OPTIONS,
+                    ],
+                    allowHeaders: ['*'],
+                },
+            disableExecuteApiEndpoint: false,
+        });
+        if (this.isStrictRetain) {
+            // The `*.execute-api.{region}.amazonaws.com` URL embeds the
+            // API ID. Mobile apps shipped with that URL baked in cannot
+            // be patched without a full update cycle. RETAIN keeps the
+            // API ID stable across accidental stack deletes.
+            const cfnApi = this.api.node.defaultChild;
+            cfnApi.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
+            cfnApi.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // ─── Access logging on the default stage ─────────────────────
+        const apiLogGroup = new logs.LogGroup(this, 'ApiAccessLog', {
+            logGroupName: `/venturekit/${projectName}/${stage}/api-access`,
+            retention: toLogRetention(obsConfig.logs.retentionDays),
+            removalPolicy: this.isStrictRetain
+                ? cdk.RemovalPolicy.RETAIN
+                : cdk.RemovalPolicy.DESTROY,
+        });
+        const defaultStage = this.api.defaultStage?.node.defaultChild;
+        if (defaultStage) {
+            defaultStage.accessLogSettings = {
+                destinationArn: apiLogGroup.logGroupArn,
+                // Compact JSON access-log format. Operators ingest these
+                // straight into CloudWatch Insights or stream to S3.
+                format: JSON.stringify({
+                    requestId: '$context.requestId',
+                    ip: '$context.identity.sourceIp',
+                    method: '$context.httpMethod',
+                    path: '$context.path',
+                    status: '$context.status',
+                    latency: '$context.responseLatency',
+                    userAgent: '$context.identity.userAgent',
+                }),
+            };
+        }
+        // ─── Public surface ─────────────────────────────────────────
+        writeSsm(this, edgeKeys.apiId(projectName, stage), this.api.apiId, {
+            description: `HttpApi ID — app stack imports via fromHttpApiAttributes.`,
+        });
+        writeSsm(this, edgeKeys.apiEndpoint(projectName, stage), this.api.apiEndpoint, { description: `HttpApi default endpoint URL.` });
+        writeSsm(this, edgeKeys.apiDefaultStageName(projectName, stage), 
+        // HttpApi always uses `$default`. Publishing it explicitly
+        // means future named-stage support doesn't break consumers.
+        '$default', { description: `HttpApi default stage name.` });
+        // ─── Custom domains ─────────────────────────────────────────
+        if (infrastructure.domains) {
+            // VentureKit currently supports a single primary custom
+            // domain — multi-domain projects map them all onto the same
+            // API. We publish only the FIRST domain under
+            // `apiCustomDomain` (the canonical one app code reads).
+            let primaryDomain;
+            for (const intent of infrastructure.domains) {
+                this.createDomain(intent, projectName, stage);
+                if (!primaryDomain)
+                    primaryDomain = intent.domain;
+            }
+            if (primaryDomain) {
+                writeSsm(this, edgeKeys.apiCustomDomain(projectName, stage), primaryDomain, {
+                    description: `Primary custom domain. App code building OAuth redirect ` +
+                        `URIs / webhook URLs should prefer this when set.`,
+                });
+            }
+        }
+        // ─── CloudFront over storage buckets ────────────────────────
+        if (infrastructure.storage) {
+            for (const intent of infrastructure.storage) {
+                if (intent.cdn !== true)
+                    continue;
+                if (!storageBuckets) {
+                    throw new Error(`[venturekit] edge stack: storage intent '${intent.id}' has cdn=true ` +
+                        `but storageBuckets was not passed. The CLI generator ` +
+                        `must wire dataStack.buckets.get('${intent.id}').bucket into ` +
+                        `VentureEdgeStackProps.storageBuckets.`);
+                }
+                const bucket = storageBuckets.get(intent.id);
+                if (!bucket) {
+                    throw new Error(`[venturekit] edge stack: storage intent '${intent.id}' has cdn=true ` +
+                        `but no bucket was passed in storageBuckets. The CLI generator ` +
+                        `must wire dataStack.buckets.get('${intent.id}').bucket into ` +
+                        `VentureEdgeStackProps.storageBuckets.`);
+                }
+                this.createStorageCdn(intent, projectName, stage, bucket);
+            }
+        }
+    }
+    createDomain(intent, projectName, stage) {
+        const resourceName = `${projectName}-${intent.id}`;
+        // Three certificate paths:
+        //   1. Operator pre-issued an ACM cert: pass the ARN.
+        //   2. We own the Route53 zone: auto-issue with DNS validation.
+        //   3. Neither: create the cert without DNS validation — it
+        //      will sit in PENDING until the operator publishes the
+        //      validation CNAMEs from the AWS console.
+        let certificate;
+        if (intent.certificateArn) {
+            certificate = acm.Certificate.fromCertificateArn(this, `${resourceName}-cert`, intent.certificateArn);
+        }
+        else if (intent.hostedZoneId) {
+            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone`, {
+                hostedZoneId: intent.hostedZoneId,
+                // `intent.domain` may be `api.example.com` (apex zone is
+                // `example.com`). Take the trailing two labels for the zone
+                // name — Route53 doesn't accept a subdomain here.
+                zoneName: intent.domain.split('.').slice(-2).join('.'),
+            });
+            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
+                domainName: intent.domain,
+                validation: acm.CertificateValidation.fromDns(hostedZone),
+            });
+        }
+        else {
+            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
+                domainName: intent.domain,
+            });
+        }
+        const domainName = new apigatewayv2.DomainName(this, `${resourceName}-domain`, {
+            domainName: intent.domain,
+            certificate,
+        });
+        if (this.isStrictRetain) {
+            // The custom domain is the public contract with the world;
+            // deleting it forces DNS reconfiguration on every client /
+            // integration. RETAIN keeps it claimed to this AWS account
+            // for `cdk import` recovery.
+            const cfnDomain = domainName.node.defaultChild;
+            cfnDomain.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
+            cfnDomain.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // API mapping — what binds the custom domain to the API's
+        // default stage. Mappings re-create cleanly so RETAIN here is
+        // just a recovery convenience.
+        const apiMapping = new apigatewayv2.ApiMapping(this, `${resourceName}-mapping`, {
+            api: this.api,
+            domainName,
+            stage: this.api.defaultStage,
+        });
+        if (this.isStrictRetain) {
+            const cfnMapping = apiMapping.node.defaultChild;
+            cfnMapping.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
+            cfnMapping.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // Route53 alias when we own the zone.
+        if (intent.hostedZoneId) {
+            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone-record`, {
+                hostedZoneId: intent.hostedZoneId,
+                zoneName: intent.domain.split('.').slice(-2).join('.'),
+            });
+            new route53.ARecord(this, `${resourceName}-a-record`, {
+                zone: hostedZone,
+                recordName: intent.domain,
+                target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayv2DomainProperties(domainName.regionalDomainName, domainName.regionalHostedZoneId)),
+            });
+        }
+    }
+    createStorageCdn(intent, projectName, stage, bucket) {
+        const logicalId = `storage-${intent.id}-cdn`;
+        // Optional alternate domain (CNAME) + ACM cert. CloudFront only
+        // accepts certs from us-east-1 regardless of which region the
+        // rest of the stack runs in.
+        //
+        //   vk cert request --domain cdn.example.com --region us-east-1
+        //
+        // Empty `cdnCertificateArn` is the same "pending" sentinel as
+        // `DomainIntent.certificateArn`: skip the alias and let the
+        // distribution serve at its `*.cloudfront.net` hostname until
+        // the next deploy.
+        const aliasReady = typeof intent.cdnDomain === 'string' &&
+            intent.cdnDomain.length > 0 &&
+            typeof intent.cdnCertificateArn === 'string' &&
+            intent.cdnCertificateArn.length > 0;
+        let aliasProps = {};
+        if (aliasReady) {
+            aliasProps = {
+                domainNames: [intent.cdnDomain],
+                certificate: acm.Certificate.fromCertificateArn(this, `${logicalId}-cert`, intent.cdnCertificateArn),
+            };
+        }
+        // Re-import the bucket as a *purely-attribute-based* IBucket so
+        // CDK's `S3BucketOrigin.withOriginAccessControl` does NOT call
+        // `addToResourcePolicy` on the original bucket construct. The
+        // policy that authorizes CloudFront-OAC reads is created by the
+        // data stack (see `VentureDataStack.createStorage` — `intent.cdn`
+        // branch). If we let `withOriginAccessControl` plumb the policy
+        // automatically here, CDK would add both a `data → edge` (policy
+        // wants the distribution ARN) and an `edge → data` (origin wants
+        // the bucket regional domain) cross-stack dependency, producing
+        // a synth-time cycle.
+        const importedBucket = s3.Bucket.fromBucketAttributes(this, `${logicalId}-imported-bucket`, {
+            bucketName: bucket.bucketName,
+            bucketRegionalDomainName: bucket.bucketRegionalDomainName,
+        });
+        const distribution = new cloudfront.Distribution(this, logicalId, {
+            comment: `${projectName}-${intent.id}-${stage}`,
+            defaultBehavior: {
+                // OAC mode: CloudFront accesses S3 via the service principal
+                // with an `aws:SourceAccount`-scoped bucket policy pinned at
+                // the data tier. Anonymous direct-S3 GETs stay forbidden;
+                // only the CDN's signed CloudFront request can read the
+                // object.
+                origin: cloudfrontOrigins.S3BucketOrigin.withOriginAccessControl(importedBucket),
+                viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+                cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+                cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+                compress: true,
+            },
+            // PriceClass 100 = US/Canada/Europe edges only. Cheaper than
+            // the global default for projects whose audience matches.
+            priceClass: cloudfront.PriceClass.PRICE_CLASS_100,
+            enabled: true,
+            ...aliasProps,
+        });
+        if (this.isStrictRetain) {
+            // Distributions take 15-30 minutes to roll out globally;
+            // their `*.cloudfront.net` hostname is often cached by
+            // upstream consumers. RETAIN keeps the distribution in place
+            // for `cdk import` recovery.
+            const cfn = distribution.node.defaultChild;
+            cfn.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
+            cfn.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        this.distributions.set(intent.id, distribution);
+        // The published `cdn-domain` is either the alias (when
+        // configured + cert is ready) or the bare CloudFront hostname.
+        // Consumers building public URLs must read this rather than
+        // hardcoding either one.
+        const publishedDomain = aliasReady
+            ? intent.cdnDomain
+            : distribution.distributionDomainName;
+        writeSsm(this, edgeKeys.storageCdnDomain(projectName, stage, intent.id), publishedDomain, {
+            description: `CDN domain for storage '${intent.id}' — public URL host.`,
+        });
+        writeSsm(this, edgeKeys.storageCdnDistributionId(projectName, stage, intent.id), distribution.distributionId, {
+            description: `CloudFront distribution ID — for CreateInvalidation calls ` +
+                `from app-stack handlers after content rewrites.`,
+        });
+    }
+}
+//# sourceMappingURL=edge-stack.js.map

package/dist/cdk/edge-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-stack.js","sourceRoot":"","sources":["../../src/cdk/edge-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,GAAG,MAAM,oCAAoC,CAAC;AAC1D,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,iBAAiB,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAsC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAwBhD,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;IACjD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IAClD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;IACvD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IACpD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,GAAG,CAAC,KAAK;IAC7B,GAAG,CAAuB;IAE1B,aAAa,GAAyC,IAAI,GAAG,EAAE,CAAC;IAE/D,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA4B;QACpE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChF,IAAI,CAAC,cAAc;YACjB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;QACtE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;QAChC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC;QAE1C,+DAA+D;QAC/D,yDAAyD;QACzD,yDAAyD;QACzD,oCAAoC;QACpC,IAAI,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAC/C,OAAO,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE;YAClC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC;oBACE,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY;oBACzC,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAC3C,CAAC,CAAS,EAAE,EAAE,CACZ,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAA8C,CAAC;wBACxF,YAAY,CAAC,cAAc,CAAC,GAAG,CAClC;oBACD,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY;oBACzC,gBAAgB,EAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB;oBACjD,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;iBACvD;gBACH,CAAC,CAAC;oBACE,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE;wBACZ,YAAY,CAAC,cAAc,CAAC,GAAG;wBAC/B,YAAY,CAAC,cAAc,CAAC,IAAI;wBAChC,YAAY,CAAC,cAAc,CAAC,GAAG;wBAC/B,YAAY,CAAC,cAAc,CAAC,MAAM;wBAClC,YAAY,CAAC,cAAc,CAAC,KAAK;wBACjC,YAAY,CAAC,cAAc,CAAC,OAAO;qBACpC;oBACD,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;YACL,yBAAyB,EAAE,KAAK;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,iDAAiD;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC7D,MAAM,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAChE,MAAM,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACvE,CAAC;QAED,gEAAgE;QAChE,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE;YAC1D,YAAY,EAAE,eAAe,WAAW,IAAI,KAAK,aAAa;YAC9D,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;YACvD,aAAa,EAAE,IAAI,CAAC,cAAc;gBAChC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM;gBAC1B,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,YAEpC,CAAC;QACd,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,iBAAiB,GAAG;gBAC/B,cAAc,EAAE,WAAW,CAAC,WAAW;gBACvC,yDAAyD;gBACzD,qDAAqD;gBACrD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;oBACrB,SAAS,EAAE,oBAAoB;oBAC/B,EAAE,EAAE,4BAA4B;oBAChC,MAAM,EAAE,qBAAqB;oBAC7B,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,iBAAiB;oBACzB,OAAO,EAAE,0BAA0B;oBACnC,SAAS,EAAE,6BAA6B;iBACzC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;YACjE,WAAW,EAAE,2DAA2D;SACzE,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,EACxC,IAAI,CAAC,GAAG,CAAC,WAAW,EACpB,EAAE,WAAW,EAAE,+BAA+B,EAAE,CACjD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC;QAChD,2DAA2D;QAC3D,4DAA4D;QAC5D,UAAU,EACV,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAC/C,CAAC;QAEF,+DAA+D;QAC/D,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,wDAAwD;YACxD,4DAA4D;YAC5D,8CAA8C;YAC9C,wDAAwD;YACxD,IAAI,aAAiC,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,CAAC,aAAa;oBAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;YACpD,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,EAC5C,aAAa,EACb;oBACE,WAAW,EACT,0DAA0D;wBAC1D,kDAAkD;iBACrD,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;oBAAE,SAAS;gBAClC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,CAAC,EAAE,iBAAiB;wBACtE,uDAAuD;wBACvD,oCAAoC,MAAM,CAAC,EAAE,iBAAiB;wBAC9D,uCAAuC,CACxC,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,CAAC,EAAE,iBAAiB;wBACtE,gEAAgE;wBAChE,oCAAoC,MAAM,CAAC,EAAE,iBAAiB;wBAC9D,uCAAuC,CACxC,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QAClE,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAEnD,2BAA2B;QAC3B,sDAAsD;QACtD,gEAAgE;QAChE,4DAA4D;QAC5D,4DAA4D;QAC5D,+CAA+C;QAC/C,IAAI,WAA6B,CAAC;QAClC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAC9C,IAAI,EACJ,GAAG,YAAY,OAAO,EACtB,MAAM,CAAC,cAAc,CACtB,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAC5D,IAAI,EACJ,GAAG,YAAY,OAAO,EACtB;gBACE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,yDAAyD;gBACzD,4DAA4D;gBAC5D,kDAAkD;gBAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACvD,CACF,CAAC;YACF,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,YAAY,OAAO,EAAE;gBAC9D,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,YAAY,OAAO,EAAE;gBAC9D,UAAU,EAAE,MAAM,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,YAAY,SAAS,EAAE;YAC7E,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,2DAA2D;YAC3D,2DAA2D;YAC3D,2DAA2D;YAC3D,6BAA6B;YAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,YAA+B,CAAC;YAClE,SAAS,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACnE,SAAS,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC1E,CAAC;QAED,0DAA0D;QAC1D,8DAA8D;QAC9D,+BAA+B;QAC/B,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,UAAU,CAC5C,IAAI,EACJ,GAAG,YAAY,UAAU,EACzB;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU;YACV,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,YAAa;SAC9B,CACF,CAAC;QACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,YAA+B,CAAC;YACnE,UAAU,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACpE,UAAU,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC3E,CAAC;QAED,sCAAsC;QACtC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAC5D,IAAI,EACJ,GAAG,YAAY,cAAc,EAC7B;gBACE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACvD,CACF,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,WAAW,EAAE;gBACpD,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CACpC,IAAI,cAAc,CAAC,4BAA4B,CAC7C,UAAU,CAAC,kBAAkB,EAC7B,UAAU,CAAC,oBAAoB,CAChC,CACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,gBAAgB,CACtB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,MAAkB;QAElB,MAAM,SAAS,GAAG,WAAW,MAAM,CAAC,EAAE,MAAM,CAAC;QAE7C,gEAAgE;QAChE,8DAA8D;QAC9D,6BAA6B;QAC7B,EAAE;QACF,gEAAgE;QAChE,EAAE;QACF,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,mBAAmB;QACnB,MAAM,UAAU,GACd,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAC3B,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtC,IAAI,UAAU,GAA+D,EAAE,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG;gBACX,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC/B,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAC7C,IAAI,EACJ,GAAG,SAAS,OAAO,EACnB,MAAM,CAAC,iBAAiB,CACzB;aACF,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,8DAA8D;QAC9D,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,sBAAsB;QACtB,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CACnD,IAAI,EACJ,GAAG,SAAS,kBAAkB,EAC9B;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;SAC1D,CACF,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE;YAChE,OAAO,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YAC/C,eAAe,EAAE;gBACf,6DAA6D;gBAC7D,6DAA6D;gBAC7D,0DAA0D;gBAC1D,wDAAwD;gBACxD,UAAU;gBACV,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,uBAAuB,CAAC,cAAc,CAAC;gBAChF,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,CAAC,iBAAiB;gBACvE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,sBAAsB;gBAChE,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,sBAAsB;gBAC9D,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB;gBACrD,QAAQ,EAAE,IAAI;aACf;YACD,6DAA6D;YAC7D,0DAA0D;YAC1D,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,eAAe;YACjD,OAAO,EAAE,IAAI;YACb,GAAG,UAAU;SACd,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,yDAAyD;YACzD,uDAAuD;YACvD,6DAA6D;YAC7D,6BAA6B;YAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAEhD,uDAAuD;QACvD,+DAA+D;QAC/D,4DAA4D;QAC5D,yBAAyB;QACzB,MAAM,eAAe,GAAG,UAAU;YAChC,CAAC,CAAE,MAAM,CAAC,SAAoB;YAC9B,CAAC,CAAC,YAAY,CAAC,sBAAsB,CAAC;QAExC,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACxD,eAAe,EACf;YACE,WAAW,EAAE,2BAA2B,MAAM,CAAC,EAAE,sBAAsB;SACxE,CACF,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,QAAQ,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAChE,YAAY,CAAC,cAAc,EAC3B;YACE,WAAW,EACT,4DAA4D;gBAC5D,iDAAiD;SACpD,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/cdk/identity-stack.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Tier 2 — Identity stack.
+ *
+ * Owns:
+ *   - Cognito User Pool(s) — one per declared `auth` intent
+ *   - App Client(s) per pool (`auth.clients[]`, defaulting to one
+ *     `'default'` client when omitted)
+ *   - Federated provider Secrets Manager placeholder(s) holding
+ *     `{clientId, clientSecret}` for Google / Apple / Meta /
+ *     other OAuth providers declared in `auth.federated[]`
+ *
+ * # Lifecycle position
+ *
+ * Updated rarely (~quarterly): MFA toggle, password-policy bump,
+ * new federated provider, occasional new app client. Survives stack
+ * delete because losing a User Pool means losing every user
+ * identity + password hash — by far the most catastrophic
+ * recoverable state in a VentureKit deploy. Both `DeletionPolicy:
+ * Retain` AND Cognito's native `deletionProtection` flag must be
+ * flipped before the pool can be deleted, and every flip is
+ * CloudTrail-logged.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `identityKeys.userPoolId(authId)` — the Cognito pool ID
+ *   - `identityKeys.userPoolArn(authId)` — for IAM grant scoping
+ *     in the app stack
+ *   - `identityKeys.appClientId(authId)` — first declared client
+ *     (the canonical one app code reads)
+ *   - `identityKeys.federatedSecretArn(authId, provider)` per
+ *     provider in `auth.federated[]`
+ *
+ * # What this stack does NOT do
+ *
+ * - **No IAM grants.** Lambdas need
+ *   `cognito-idp:AdminCreateUser` / `AdminInitiateAuth` /
+ *   `AdminConfirmSignUp` etc. on the pool, and `secretsmanager:Get
+ *   SecretValue` on each federated provider Secret. Those grants
+ *   produce `AWS::IAM::Policy` resources attached to the
+ *   shared-Lambda-role — which lives in the app stack. The app
+ *   stack imports the pool ARN + secret ARNs via SSM and applies
+ *   the grants there.
+ *
+ * - **No env-var injection.** The legacy single-stack code
+ *   side-effected `this.ventureBaseEnv['COGNITO_USER_POOL_ID'] =
+ *   userPool.userPoolId` to broadcast the pool ID into every
+ *   Lambda's environment at synth time. Cross-stack, the app
+ *   stack pulls the pool ID via `readSsmString` and injects it
+ *   into Lambda env-vars itself — same broadcast, lock-free.
+ *
+ * - **No Cognito Hosted UI / IdP wiring.** VentureKit deliberately
+ *   doesn't enable Cognito's Hosted UI or wire the federated
+ *   providers as Cognito Identity Providers. Your app owns the
+ *   login screen; the SPA does the OAuth dance with the IdP
+ *   directly and posts the resulting tokens to your API.
+ *   `signInAsFederatedUser` from `@venturekit/auth/server`
+ *   verifies them and mints Cognito session tokens via
+ *   `AdminInitiateAuth` — which is why the federated providers
+ *   need `ALLOW_ADMIN_USER_PASSWORD_AUTH` enabled on the app
+ *   client below.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+import { type EnvConfig, type VentureIntent } from '@venturekit/core';
+export interface VentureIdentityStackProps extends cdk.StackProps {
+    /** Project name — feeds resource names + SSM keys. */
+    projectName: string;
+    /** Stage. */
+    stage: string;
+    /** Fully-resolved environment config. */
+    envConfig: EnvConfig;
+    /**
+     * Infrastructure intent. Read for `auth[]`. All other slices are
+     * ignored.
+     */
+    infrastructure: VentureIntent;
+}
+export declare class VentureIdentityStack extends cdk.Stack {
+    /**
+     * In-process accessors for sibling stacks (the app stack reads
+     * the pool reference for IAM grants when deployed in the same
+     * `cdk.App`). Keyed by `auth.id`.
+     */
+    readonly userPools: Map<string, cognito.UserPool>;
+    readonly appClients: Map<string, cognito.UserPoolClient>;
+    /**
+     * Federated provider secrets, keyed by `${authId}:${provider}`.
+     * Order-stable for tests; the actual app stack consumer reads via
+     * SSM rather than this in-memory map.
+     */
+    readonly federatedSecrets: Map<string, secretsmanager.Secret>;
+    private readonly isStrictRetain;
+    constructor(scope: Construct, id: string, props: VentureIdentityStackProps);
+    private createAuth;
+}
+//# sourceMappingURL=identity-stack.d.ts.map

package/dist/cdk/identity-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,WAAW,yBAA0B,SAAQ,GAAG,CAAC,UAAU;IAC/D,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IAEd,yCAAyC;IACzC,SAAS,EAAE,SAAS,CAAC;IAErB;;;OAGG;IACH,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACH,SAAgB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAa;IAErE,SAAgB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAa;IAE5E;;;;OAIG;IACH,SAAgB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IAEjF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB;IAY1E,OAAO,CAAC,UAAU;CA8LnB"}