@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/identity-stack.js

@@ -0,0 +1,254 @@
+/**
+ * Tier 2 — Identity stack.
+ *
+ * Owns:
+ *   - Cognito User Pool(s) — one per declared `auth` intent
+ *   - App Client(s) per pool (`auth.clients[]`, defaulting to one
+ *     `'default'` client when omitted)
+ *   - Federated provider Secrets Manager placeholder(s) holding
+ *     `{clientId, clientSecret}` for Google / Apple / Meta /
+ *     other OAuth providers declared in `auth.federated[]`
+ *
+ * # Lifecycle position
+ *
+ * Updated rarely (~quarterly): MFA toggle, password-policy bump,
+ * new federated provider, occasional new app client. Survives stack
+ * delete because losing a User Pool means losing every user
+ * identity + password hash — by far the most catastrophic
+ * recoverable state in a VentureKit deploy. Both `DeletionPolicy:
+ * Retain` AND Cognito's native `deletionProtection` flag must be
+ * flipped before the pool can be deleted, and every flip is
+ * CloudTrail-logged.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `identityKeys.userPoolId(authId)` — the Cognito pool ID
+ *   - `identityKeys.userPoolArn(authId)` — for IAM grant scoping
+ *     in the app stack
+ *   - `identityKeys.appClientId(authId)` — first declared client
+ *     (the canonical one app code reads)
+ *   - `identityKeys.federatedSecretArn(authId, provider)` per
+ *     provider in `auth.federated[]`
+ *
+ * # What this stack does NOT do
+ *
+ * - **No IAM grants.** Lambdas need
+ *   `cognito-idp:AdminCreateUser` / `AdminInitiateAuth` /
+ *   `AdminConfirmSignUp` etc. on the pool, and `secretsmanager:Get
+ *   SecretValue` on each federated provider Secret. Those grants
+ *   produce `AWS::IAM::Policy` resources attached to the
+ *   shared-Lambda-role — which lives in the app stack. The app
+ *   stack imports the pool ARN + secret ARNs via SSM and applies
+ *   the grants there.
+ *
+ * - **No env-var injection.** The legacy single-stack code
+ *   side-effected `this.ventureBaseEnv['COGNITO_USER_POOL_ID'] =
+ *   userPool.userPoolId` to broadcast the pool ID into every
+ *   Lambda's environment at synth time. Cross-stack, the app
+ *   stack pulls the pool ID via `readSsmString` and injects it
+ *   into Lambda env-vars itself — same broadcast, lock-free.
+ *
+ * - **No Cognito Hosted UI / IdP wiring.** VentureKit deliberately
+ *   doesn't enable Cognito's Hosted UI or wire the federated
+ *   providers as Cognito Identity Providers. Your app owns the
+ *   login screen; the SPA does the OAuth dance with the IdP
+ *   directly and posts the resulting tokens to your API.
+ *   `signInAsFederatedUser` from `@venturekit/auth/server`
+ *   verifies them and mints Cognito session tokens via
+ *   `AdminInitiateAuth` — which is why the federated providers
+ *   need `ALLOW_ADMIN_USER_PASSWORD_AUTH` enabled on the app
+ *   client below.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { DATA_SAFETY_CONFIG } from '@venturekit/core';
+import { writeSsm } from './shared/cross-stack-refs.js';
+import { identityKeys } from './shared/ssm-keys.js';
+export class VentureIdentityStack extends cdk.Stack {
+    /**
+     * In-process accessors for sibling stacks (the app stack reads
+     * the pool reference for IAM grants when deployed in the same
+     * `cdk.App`). Keyed by `auth.id`.
+     */
+    userPools = new Map();
+    appClients = new Map();
+    /**
+     * Federated provider secrets, keyed by `${authId}:${provider}`.
+     * Order-stable for tests; the actual app stack consumer reads via
+     * SSM rather than this in-memory map.
+     */
+    federatedSecrets = new Map();
+    isStrictRetain;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { projectName, stage, envConfig, infrastructure } = props;
+        const dataSafetyConfig = DATA_SAFETY_CONFIG[envConfig.dataSafety];
+        this.isStrictRetain = dataSafetyConfig.removalPolicy === 'retain';
+        if (!infrastructure.auth)
+            return;
+        for (const intent of infrastructure.auth) {
+            this.createAuth(intent, projectName, stage, envConfig);
+        }
+    }
+    createAuth(intent, projectName, stage, envConfig) {
+        const isStrictRetain = this.isStrictRetain;
+        // Stable logical ID: `auth-{intent.id}` — preset changes never
+        // trigger a replacement (which would orphan every user record).
+        const logicalId = `auth-${intent.id}`;
+        const passwordPolicy = intent.passwordStrength === 'strong'
+            ? {
+                minLength: 12,
+                requireLowercase: true,
+                requireUppercase: true,
+                requireDigits: true,
+                requireSymbols: true,
+            }
+            : {
+                minLength: 8,
+                requireLowercase: true,
+                requireUppercase: true,
+                requireDigits: true,
+                requireSymbols: false,
+            };
+        // Custom user attributes are declared as mutable strings so they
+        // appear as `custom:<name>` claims on issued JWTs — and so the
+        // `vk dev` cognito-local provisioning, which mirrors this Schema,
+        // matches production exactly. Application code that reads
+        // `custom:tenantId` etc. depends on these being declared on the
+        // pool.
+        const customAttrNames = Array.isArray(intent.customAttributes)
+            ? intent.customAttributes
+            : [];
+        const customAttributes = {};
+        for (const name of customAttrNames) {
+            customAttributes[name] = new cognito.StringAttribute({
+                minLen: 1,
+                maxLen: 2048,
+                mutable: true,
+            });
+        }
+        const userPool = new cognito.UserPool(this, logicalId, {
+            userPoolName: `${projectName}-${intent.id}-${stage}`,
+            // Self-signup defaults OFF — most production apps use invite
+            // flows; opt in with `allowSignUp: true` for consumer products.
+            selfSignUpEnabled: intent.allowSignUp ?? false,
+            // Email + phone aliases let a user authenticate with either
+            // without a duplicate account, mirroring the §1 user model
+            // where buyers register with one and log in with the other.
+            signInAliases: {
+                email: intent.signInWith?.includes('email') ?? true,
+                phone: intent.signInWith?.includes('phone') ?? false,
+                username: intent.signInWith?.includes('username') ?? false,
+            },
+            autoVerify: {
+                email: intent.signInWith?.includes('email') ?? true,
+                phone: intent.signInWith?.includes('phone') ?? false,
+            },
+            passwordPolicy,
+            mfa: intent.mfa === 'required'
+                ? cognito.Mfa.REQUIRED
+                : intent.mfa === 'optional'
+                    ? cognito.Mfa.OPTIONAL
+                    : cognito.Mfa.OFF,
+            removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            // Native Cognito deletion-protection on top of CFN RETAIN.
+            // CFN-level RETAIN only blocks CFN-driven deletes; the pool
+            // can still be deleted via console / API / CLI. Both layers
+            // must be flipped before deletion — every flip CloudTrail-
+            // logged. Losing a User Pool means losing every user identity
+            // + password hash; users must re-register via password reset.
+            deletionProtection: isStrictRetain,
+            // Advanced security mode (compromise detection, risk-based
+            // adaptive authentication) for medium+ presets. Carries a
+            // per-MAU cost; off on free/nano.
+            advancedSecurityMode: envConfig.lambda.memoryMb >= 512
+                ? cognito.AdvancedSecurityMode.ENFORCED
+                : undefined,
+            accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
+            ...(customAttrNames.length > 0 ? { customAttributes } : {}),
+        });
+        if (isStrictRetain) {
+            const cfnPool = userPool.node.defaultChild;
+            cfnPool.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        this.userPools.set(intent.id, userPool);
+        // ── App clients ───────────────────────────────────────────────
+        const clients = intent.clients && intent.clients.length > 0
+            ? intent.clients
+            : [{ name: 'default' }];
+        // When federated providers are declared, the federated sign-in
+        // helper in `@venturekit/auth/server` mints session tokens
+        // through `AdminInitiateAuth` after creating/looking up the user
+        // via `AdminCreateUser` / `AdminGetUser`. That flow needs
+        // `ALLOW_ADMIN_USER_PASSWORD_AUTH` enabled on the app client.
+        // Password sign-in keeps using the public `USER_PASSWORD_AUTH`
+        // path so we leave both turned on.
+        const federatedProviders = Array.isArray(intent.federated)
+            ? intent.federated
+            : [];
+        const enableAdminAuth = federatedProviders.length > 0;
+        let primaryClient;
+        for (const client of clients) {
+            const appClient = userPool.addClient(client.name, {
+                authFlows: {
+                    userPassword: true,
+                    userSrp: true,
+                    ...(enableAdminAuth ? { adminUserPassword: true } : {}),
+                },
+                // Hide whether a username exists from failed sign-in errors —
+                // standard credential-stuffing / user-enumeration defense.
+                preventUserExistenceErrors: true,
+            });
+            if (!primaryClient) {
+                primaryClient = appClient;
+            }
+        }
+        // `clients` always has ≥1 entry (defaulted above).
+        this.appClients.set(intent.id, primaryClient);
+        // ── Public SSM surface for the pool ────────────────────────────
+        writeSsm(this, identityKeys.userPoolId(projectName, stage, intent.id), userPool.userPoolId, {
+            description: `Cognito User Pool ID for auth '${intent.id}'`,
+        });
+        writeSsm(this, identityKeys.userPoolArn(projectName, stage, intent.id), userPool.userPoolArn, {
+            description: `Cognito User Pool ARN — IAM scoping target for AdminInitiateAuth etc.`,
+        });
+        writeSsm(this, identityKeys.primaryClientId(projectName, stage, intent.id), primaryClient.userPoolClientId, { description: `Primary Cognito App Client ID for auth '${intent.id}'` });
+        // ── Federated identity-provider secret placeholders ────────────
+        // Each declared third-party provider gets a Secrets Manager
+        // placeholder holding `{clientId, clientSecret}`. Operators paste
+        // the real values from the Google Cloud / Meta for Developers /
+        // Apple Developer console after the first deploy:
+        //
+        //   aws secretsmanager put-secret-value --secret-id <arn> \
+        //     --secret-string '{"clientId":"…","clientSecret":"…"}'
+        //
+        // The ARN flows to Lambdas via SSM (the app stack reads
+        // `identityKeys.federatedSecretArn(...)` and injects
+        // `COGNITO_FEDERATED_<PROVIDER>_SECRET_ARN` at synth time).
+        for (const provider of federatedProviders) {
+            const secret = new secretsmanager.Secret(this, `${logicalId}-federated-${provider}`, {
+                secretName: `venturekit/${projectName}/${stage}/auth/${intent.id}/${provider}`,
+                description: `OAuth client credentials for ${provider} federated sign-in ` +
+                    `on auth pool '${intent.id}'. Populate after first deploy.`,
+                secretObjectValue: {
+                    clientId: cdk.SecretValue.unsafePlainText('PLACEHOLDER'),
+                    clientSecret: cdk.SecretValue.unsafePlainText('PLACEHOLDER'),
+                },
+                // Federated provider credentials are operator-set values
+                // pasted from third-party developer consoles. They CAN be
+                // re-generated, but doing so requires manually revisiting
+                // that console — we'd rather not force that on every
+                // stack-replace event. Promote to RETAIN under strict so
+                // accidental stack deletes don't wipe them.
+                removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            });
+            this.federatedSecrets.set(`${intent.id}:${provider}`, secret);
+            writeSsm(this, identityKeys.federatedSecretArn(projectName, stage, intent.id, provider), secret.secretArn, {
+                description: `Federated ${provider} OAuth secret ARN for auth pool '${intent.id}'. ` +
+                    `Operators populate via 'aws secretsmanager put-secret-value'.`,
+            });
+        }
+    }
+}
+//# sourceMappingURL=identity-stack.js.map

package/dist/cdk/identity-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-stack.js","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAmBpD,MAAM,OAAO,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACa,SAAS,GAAkC,IAAI,GAAG,EAAE,CAAC;IAErD,UAAU,GAAwC,IAAI,GAAG,EAAE,CAAC;IAE5E;;;;OAIG;IACa,gBAAgB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAEhE,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgC;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,IAAI;YAAE,OAAO;QACjC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,SAAoB;QAEpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAEtC,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,KAAK,QAAQ;YACzD,CAAC,CAAC;gBACE,SAAS,EAAE,EAAE;gBACb,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,IAAI;aACrB;YACH,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC;gBACZ,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,KAAK;aACtB,CAAC;QAEN,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,QAAQ;QACR,MAAM,eAAe,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,gBAAgB,GAA6C,EAAE,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;gBACnD,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE;YACrD,YAAY,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YACpD,6DAA6D;YAC7D,gEAAgE;YAChE,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;YAC9C,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,aAAa,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;gBACpD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK;aAC3D;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;aACrD;YACD,cAAc;YACd,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,UAAU;gBAC5B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;gBACtB,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU;oBACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;oBACtB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG;YACrB,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,8DAA8D;YAC9D,kBAAkB,EAAE,cAAc;YAClC,2DAA2D;YAC3D,0DAA0D;YAC1D,kCAAkC;YAClC,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG;gBACpD,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ;gBACvC,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU;YACnD,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC9D,OAAO,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE1B,+DAA+D;QAC/D,2DAA2D;QAC3D,iEAAiE;QACjE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,mCAAmC;QACnC,MAAM,kBAAkB,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtD,IAAI,aAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;gBAChD,SAAS,EAAE;oBACT,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD;gBACD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,0BAA0B,EAAE,IAAI;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAc,CAAC,CAAC;QAE/C,kEAAkE;QAClE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC1F,WAAW,EAAE,kCAAkC,MAAM,CAAC,EAAE,GAAG;SAC5D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE;YAC5F,WAAW,EAAE,uEAAuE;SACrF,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC3D,aAAc,CAAC,gBAAgB,EAC/B,EAAE,WAAW,EAAE,2CAA2C,MAAM,CAAC,EAAE,GAAG,EAAE,CACzE,CAAC;QAEF,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kDAAkD;QAClD,EAAE;QACF,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,4DAA4D;QAC5D,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,cAAc,QAAQ,EAAE,EACpC;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,SAAS,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE;gBAC9E,WAAW,EACT,gCAAgC,QAAQ,qBAAqB;oBAC7D,iBAAiB,MAAM,CAAC,EAAE,iCAAiC;gBAC7D,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;oBACxD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;iBAC7D;gBACD,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,qDAAqD;gBACrD,yDAAyD;gBACzD,4CAA4C;gBAC5C,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CACF,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EACxE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,aAAa,QAAQ,oCAAoC,MAAM,CAAC,EAAE,KAAK;oBACvE,+DAA+D;aAClE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/cdk/index.d.ts

@@ -7,4 +7,20 @@ export { VentureStack, discoverRouteFiles } from './stack.js';
 export type { VentureStackProps, DiscoveredRoute } from './stack.js';
 export { MigrationRunner, hasMigrations } from './migration-runner.js';
 export type { MigrationRunnerProps } from './migration-runner.js';
+export { VentureNetworkStack } from './network-stack.js';
+export type { VentureNetworkStackProps } from './network-stack.js';
+export { VentureDataStack } from './data-stack.js';
+export type { VentureDataStackProps } from './data-stack.js';
+export { VentureIdentityStack } from './identity-stack.js';
+export type { VentureIdentityStackProps } from './identity-stack.js';
+export { VentureConfigStack } from './config-stack.js';
+export type { VentureConfigStackProps } from './config-stack.js';
+export { VentureMessagingStack } from './messaging-stack.js';
+export type { VentureMessagingStackProps } from './messaging-stack.js';
+export { VentureEdgeStack } from './edge-stack.js';
+export type { VentureEdgeStackProps } from './edge-stack.js';
+export { VentureAppStack } from './app-stack.js';
+export type { VentureAppStackProps, AppStackImports } from './app-stack.js';
+export { writeSsm, writeSsmStringList, readSsmString, readSsmStringList, importVpc, importRdsConnection, importBucket, importDynamoTable, importUserPool, importQueue, importTopic, importSecret, importHttpApi, logicalIdForParameter, } from './shared/cross-stack-refs.js';
+export { ssmKeys, networkKeys, dataKeys, identityKeys, configKeys, messagingKeys, edgeKeys, } from './shared/ssm-keys.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAK5E,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,OAAO,EACP,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,aAAa,EACb,QAAQ,GACT,MAAM,sBAAsB,CAAC"}

package/dist/cdk/index.js

@@ -5,4 +5,21 @@
  */
 export { VentureStack, discoverRouteFiles } from './stack.js';
 export { MigrationRunner, hasMigrations } from './migration-runner.js';
+// ── Multi-stack tier classes (plan §11) ────────────────────────────
+// Lifecycle-aligned split. The CLI's `.vk/cdk/app.ts` generator
+// instantiates each tier conditionally based on declared intents.
+// `VentureStack` (legacy single-stack) stays exported alongside
+// these until plan §11 step 10 deletes it.
+export { VentureNetworkStack } from './network-stack.js';
+export { VentureDataStack } from './data-stack.js';
+export { VentureIdentityStack } from './identity-stack.js';
+export { VentureConfigStack } from './config-stack.js';
+export { VentureMessagingStack } from './messaging-stack.js';
+export { VentureEdgeStack } from './edge-stack.js';
+export { VentureAppStack } from './app-stack.js';
+// ── Cross-stack helpers ────────────────────────────────────────────
+// Re-exported from `shared/` so consumers (other tier classes today,
+// the generated app.ts tomorrow) import from a single entry point.
+export { writeSsm, writeSsmStringList, readSsmString, readSsmStringList, importVpc, importRdsConnection, importBucket, importDynamoTable, importUserPool, importQueue, importTopic, importSecret, importHttpApi, logicalIdForParameter, } from './shared/cross-stack-refs.js';
+export { ssmKeys, networkKeys, dataKeys, identityKeys, configKeys, messagingKeys, edgeKeys, } from './shared/ssm-keys.js';
 //# sourceMappingURL=index.js.map

package/dist/cdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGvE,sEAAsE;AACtE,gEAAgE;AAChE,kEAAkE;AAClE,gEAAgE;AAChE,2CAA2C;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGjD,sEAAsE;AACtE,qEAAqE;AACrE,mEAAmE;AACnE,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,OAAO,EACP,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,aAAa,EACb,QAAQ,GACT,MAAM,sBAAsB,CAAC"}

package/dist/cdk/messaging-stack.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Tier 4 — Messaging stack.
+ *
+ * Owns the durable, persistent message-routing infrastructure. By
+ * design every resource here can outlive an app-stack tear-down:
+ * after `vk deploy` rebuilds the app stack, the new consumer
+ * Lambdas pick up exactly where the old ones left off because the
+ * queue + its in-flight messages survived.
+ *
+ * Resources:
+ *
+ *   - One `AWS::SQS::Queue` + matching DLQ per `queues[]` intent.
+ *     Encryption SQS_MANAGED, RETAIN under strict.
+ *   - One Notify pipeline per `notify[]` intent:
+ *       - SNS events topic (SES configuration-set destination)
+ *       - SES `EmailIdentity` (domain or single-address)
+ *       - Optional Route53 DKIM CNAMEs when `hostedZoneId` is set
+ *       - SES `ConfigurationSet` + `EventDestination` publishing
+ *         to the SNS topic
+ *       - WhatsApp Cloud API token Secrets Manager placeholder
+ *         when `'whatsapp'` is in `channels`
+ *       - Two dedicated DLQs: dispatcher-DLQ and bounce-DLQ. The
+ *         consumer Lambdas live in the app stack but their
+ *         on-failure DLQs need RETAIN-class durability so
+ *         operators can drain them on the rare delivery failure.
+ *
+ * # Lifecycle position
+ *
+ * Updated occasionally (~monthly): a new queue, a notify-channel
+ * toggle, a domain rotation. The contents (in-flight messages)
+ * are operationally critical — losing a queue with N messages in
+ * flight is a permanent message loss event. Both `DeletionPolicy:
+ * Retain` and AWS's lack of a queue-level "deletion protection"
+ * flag mean RETAIN is the only durability lever; we set it
+ * unconditionally under strict dataSafety.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `messagingKeys.queueArn / queueUrl / queueDlqArn /
+ *     queueVisibilityTimeoutSeconds` per `queues[]` intent
+ *   - `messagingKeys.notifyDispatcherDlqArn /
+ *     notifyBounceDlqArn` per `notify[]` intent
+ *   - `configKeys.notifyEventsTopicArn /
+ *     notifyConfigurationSetName / whatsappTokenSecretArn` per
+ *     notify intent. (These straddle the messaging-vs-config
+ *     boundary in the SSM key namespace because the operator pastes
+ *     the WhatsApp token by hand and the SES configuration-set name
+ *     is operator-facing identity, not just plumbing — but they're
+ *     created here because they're inseparable from the SES /
+ *     SNS topology.)
+ *
+ * # What this stack does NOT do
+ *
+ * - **No consumer Lambdas, no event-source mappings.** The Lambda
+ *   that pulls from the queue lives in the app stack. The ESM
+ *   binding it to the queue ALSO lives in the app stack — that
+ *   way an app-stack redeploy can re-create the ESM cleanly without
+ *   touching the persistent queue, which is the whole point of the
+ *   split.
+ *
+ * - **No EventBridge `Rule`s.** Schedules + their Lambda targets
+ *   stay together in the app stack — the Rule + the Lambda are
+ *   inseparable by CDK's permission-grant mechanism, and a Rule on
+ *   its own (with no targets) is dead infrastructure.
+ *
+ * - **No IAM grants.** App-stack Lambda-role wiring grants
+ *   `sqs:SendMessage` / `sqs:ReceiveMessage` / `sns:Publish` /
+ *   `ses:SendEmail` etc. on the imported messaging-tier resources.
+ *
+ * # Why the dispatcher / bounce DLQs live HERE not in the app stack
+ *
+ * Two reasons:
+ *
+ *   1. They're long-lived diagnostic surfaces. An app-stack
+ *      redeploy that drops them means losing every accumulated
+ *      delivery-failure record, which is exactly when the operator
+ *      needs them most.
+ *   2. They're tier-stable. The dispatcher Lambda might rev
+ *      monthly; its DLQ doesn't.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+import { type EnvConfig, type VentureIntent } from '@venturekit/core';
+export interface VentureMessagingStackProps extends cdk.StackProps {
+    projectName: string;
+    stage: string;
+    envConfig: EnvConfig;
+    /** Reads `queues[]` and `notify[]`; ignores everything else. */
+    infrastructure: VentureIntent;
+}
+export declare class VentureMessagingStack extends cdk.Stack {
+    readonly queues: Map<string, {
+        queue: sqs.Queue;
+        dlq: sqs.Queue;
+    }>;
+    readonly notifyEventsTopics: Map<string, sns.Topic>;
+    readonly notifyDispatcherDlqs: Map<string, sqs.Queue>;
+    readonly notifyBounceDlqs: Map<string, sqs.Queue>;
+    readonly whatsappTokenSecrets: Map<string, secretsmanager.Secret>;
+    private readonly isStrictRetain;
+    private readonly removalPolicy;
+    constructor(scope: Construct, id: string, props: VentureMessagingStackProps);
+    private createQueue;
+    private createNotify;
+}
+//# sourceMappingURL=messaging-stack.d.ts.map

package/dist/cdk/messaging-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/messaging-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAG3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,WAAW,0BAA2B,SAAQ,GAAG,CAAC,UAAU;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,gEAAgE;IAChE,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,qBAAsB,SAAQ,GAAG,CAAC,KAAK;IAClD,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAA;KAAE,CAAC,CAAa;IACtF,SAAgB,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACvE,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACzE,SAAgB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACrE,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IAErF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;gBAEtC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;IAoB3E,OAAO,CAAC,WAAW;IAqEnB,OAAO,CAAC,YAAY;CAqMrB"}