@venturekit/infra 0.0.0-dev.20260515022321 → 0.0.0-dev.20260515033134

package/dist/cdk/stack.js

@@ -1,3084 +0,0 @@
-/**
- * VentureStack — CDK Stack for VentureKit applications
- *
- * Translates VentureKit infrastructure intents into CloudFormation resources.
- * This is the single entry point for `vk deploy`.
- *
- * Consumers never see this file — it's invoked by the generated CDK app in .vk/cdk/.
- */
-import * as cdk from 'aws-cdk-lib';
-import * as ec2 from 'aws-cdk-lib/aws-ec2';
-import * as rds from 'aws-cdk-lib/aws-rds';
-import * as s3 from 'aws-cdk-lib/aws-s3';
-import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
-import * as cloudfrontOrigins from 'aws-cdk-lib/aws-cloudfront-origins';
-import * as sqs from 'aws-cdk-lib/aws-sqs';
-import * as cognito from 'aws-cdk-lib/aws-cognito';
-import * as elasticache from 'aws-cdk-lib/aws-elasticache';
-import * as events from 'aws-cdk-lib/aws-events';
-import * as targets from 'aws-cdk-lib/aws-events-targets';
-import * as lambda from 'aws-cdk-lib/aws-lambda';
-import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
-import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
-import * as apigatewayv2Integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
-import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
-import * as logs from 'aws-cdk-lib/aws-logs';
-import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
-import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
-import * as sns from 'aws-cdk-lib/aws-sns';
-import * as snsSubscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
-import * as ses from 'aws-cdk-lib/aws-ses';
-import * as ssm from 'aws-cdk-lib/aws-ssm';
-import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
-import * as acm from 'aws-cdk-lib/aws-certificatemanager';
-import * as route53 from 'aws-cdk-lib/aws-route53';
-import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
-import * as iam from 'aws-cdk-lib/aws-iam';
-import { MigrationRunner, hasMigrations } from './migration-runner.js';
-import { resolveEnvConfig, DATA_SAFETY_CONFIG } from '@venturekit/core';
-import * as path from 'path';
-import * as fs from 'fs';
-import * as os from 'os';
-import { createRequire } from 'module';
-/**
- * Filename → HTTP method mapping. Aliases (`list`, `create`, `update`,
- * `remove`) match the local dev server (`@venturekit/cli` →
- * `local-server.ts#fileNameToMethod`) so route discovery is consistent
- * between `vk dev` and `vk deploy`.
- */
-const ROUTE_FILENAME_TO_METHOD = {
-    get: 'GET',
-    list: 'GET',
-    post: 'POST',
-    create: 'POST',
-    put: 'PUT',
-    update: 'PUT',
-    patch: 'PATCH',
-    delete: 'DELETE',
-    remove: 'DELETE',
-};
-/**
- * Recursively discover HTTP route files under `src/routes/`.
- *
- * Walks the directory tree applying the same filesystem convention as the
- * local dev server:
- *   - File name (without extension) determines the HTTP method via
- *     {@link ROUTE_FILENAME_TO_METHOD}. Files whose name doesn't match a
- *     known method (e.g. `helpers.ts`, `_middleware.ts`) are silently
- *     skipped — they're treated as colocated implementation detail.
- *   - Directory `[param]` becomes `{param}` in the API path and `param`
- *     in the slug. Plain directories appear verbatim in both.
- *   - Test/spec/declaration files (`*.test.ts`, `*.spec.ts`, `*.d.ts`)
- *     are skipped.
- *
- * Exported so unit tests can assert the convention without spinning up a
- * full CDK stack, and so external tooling can reuse it.
- */
-export function discoverRouteFiles(routesDir) {
-    const routes = [];
-    if (!fs.existsSync(routesDir))
-        return routes;
-    function scan(dir, apiPath, slug) {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                const isParam = entry.name.startsWith('[') && entry.name.endsWith(']');
-                const paramName = isParam
-                    ? entry.name.slice(1, -1)
-                    : entry.name;
-                const apiSegment = isParam ? `{${paramName}}` : entry.name;
-                scan(fullPath, `${apiPath}/${apiSegment}`, slug ? `${slug}-${paramName}` : paramName);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            if (!/\.(ts|js)$/.test(entry.name))
-                continue;
-            if (entry.name.endsWith('.d.ts'))
-                continue;
-            const baseName = entry.name.replace(/\.(ts|js)$/, '');
-            // Skip colocated tests/specs to keep the deploy flow honest.
-            if (baseName.endsWith('.test') || baseName.endsWith('.spec'))
-                continue;
-            const method = ROUTE_FILENAME_TO_METHOD[baseName.toLowerCase()];
-            if (!method)
-                continue;
-            routes.push({
-                method,
-                apiPath: apiPath || '/',
-                slug: slug ? `${slug}-${baseName.toLowerCase()}` : baseName.toLowerCase(),
-                handlerFile: fullPath,
-            });
-        }
-    }
-    scan(routesDir, '', '');
-    return routes;
-}
-/**
- * djb2 string hash. Stable across Node versions and platforms because
- * it operates on UTF-16 code units returned by `charCodeAt`. Used for
- * route → nested-stack slot assignment, where the only requirement
- * is a deterministic, well-distributed mapping. Do not change the
- * algorithm: every existing deployed VentureKit stack has its
- * route-Lambda slots derived from this exact hash, and altering it
- * would force a one-shot mass migration of every nested-stack route.
- */
-function djb2Hash(input) {
-    let h = 5381;
-    for (let i = 0; i < input.length; i++) {
-        h = ((h << 5) + h + input.charCodeAt(i)) | 0;
-    }
-    return h >>> 0;
-}
-/**
- * Map a route slug to a nested-stack slot index in `[0, numSlots)`.
- * `numSlots` MUST be a power of two so the bitwise-AND modulo
- * distributes the hash output evenly. Exported for unit tests
- * asserting bucketing stability across route-set changes.
- */
-export function stableSlotFor(slug, numSlots) {
-    return djb2Hash(slug) & (numSlots - 1);
-}
-/**
- * Lazily-loaded esbuild module. We avoid a top-level import so unit
- * tests that set `_skipBundling: true` (which short-circuits before any
- * bundling happens) don't pay the import cost or require esbuild to be
- * installed in their sandbox. `createRequire` works around the fact
- * that this file is ESM and esbuild's package exports are CJS-shaped.
- */
-let esbuildModule;
-function loadEsbuild() {
-    if (!esbuildModule) {
-        const requireFromHere = createRequire(import.meta.url);
-        esbuildModule = requireFromHere('esbuild');
-    }
-    return esbuildModule;
-}
-/**
- * Bundle a Lambda handler in-process via esbuild's synchronous API.
- *
- * Replaces an earlier Docker-based bundling pipeline that spun up a
- * SAM Node 20 image, ran `npm install -g esbuild`, and bundled the
- * handler — taking ~30 s per Lambda. With 100+ handlers in a project
- * that meant over an hour of synth time and a long tail of Docker-
- * related failure modes (UID/HOME/permission edge cases on GitHub-
- * hosted runners). In-process bundling collapses the entire sequence
- * to a single `esbuild.buildSync` call: sub-second per handler,
- * native Node module resolution against the consumer's `node_modules`,
- * no Docker daemon dependency.
- *
- * The asset is the temp directory holding the bundled `index.js`, so
- * CDK uploads only the bundled output to S3 — never the source tree.
- *
- * Modules baked into the Lambda runtime (`@aws-sdk/*`) are kept
- * external so they aren't redundantly included in the bundle.
- */
-function bundleHandlerCodeWithEsbuild(handlerFile, projectDir) {
-    const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'venturekit-bundle-'));
-    const outfile = path.join(outDir, 'index.js');
-    loadEsbuild().buildSync({
-        entryPoints: [handlerFile],
-        bundle: true,
-        platform: 'node',
-        target: 'node20',
-        outfile,
-        external: ['@aws-sdk/*'],
-        absWorkingDir: projectDir,
-        logLevel: 'error',
-    });
-    return lambda.Code.fromAsset(outDir);
-}
-/**
- * Inline Lambda stub used in unit tests when `_skipBundling: true`.
- * Satisfies API Gateway's contract; tests assert on resource shape,
- * not on Lambda execution.
- */
-function inlineStubLambdaCode() {
-    return lambda.Code.fromInline("exports.main = async () => ({ statusCode: 200, body: '{\"stub\":true}' });");
-}
-/**
- * Holds a chunk of HTTP route Lambdas in a separate CloudFormation
- * template so the parent VentureStack stays under CloudFormation's hard
- * 500-resource per-stack limit.
- *
- * Each route translates to ~5 CFN resources (Function, Permission,
- * Integration, Route, log-retention custom resource), so projects with
- * more than ~80 routes need this sharding to be deployable at all.
- *
- * The route Lambdas reference the parent stack's API Gateway, IAM role,
- * security group, and VPC via standard CDK cross-stack references —
- * CloudFormation wires the Outputs/Parameters automatically. The
- * helpers (`toLambdaRuntime`, `toLogRetention`, `shortHash`) are
- * replicated here intentionally rather than extracted to a shared
- * module: they are short, change rarely, and keeping the diff localized
- * makes the fix easier to audit and revert.
- */
-class RoutesNestedStack extends cdk.NestedStack {
-    constructor(scope, id, props) {
-        super(scope, id, props);
-        for (const route of props.routes) {
-            this.createRouteFunction(route, props);
-        }
-    }
-    createRouteFunction(route, props) {
-        const { api, role, securityGroup, vpc, envConfig, ventureBaseEnv } = props;
-        const lambdaConfig = envConfig.lambda;
-        const resourceId = `route-${route.slug}`;
-        // Deliberately omit `functionName` for routes living in a nested
-        // stack. The slot a route lands in is derived from a hash of its
-        // slug (see the bucketing logic in `VentureStack`), but the slot
-        // count itself grows monotonically as the project's route count
-        // grows. Each time the slot count changes — and any time the hash
-        // distribution moves a route across an existing slot boundary —
-        // CloudFormation has to migrate the route's Lambda from one
-        // nested stack to another. With an explicit physical name CFN
-        // refuses to create the new copy until the old one is deleted, but
-        // CFN updates nested stacks in parallel, so we'd deadlock with a
-        // `route-foo already exists in stack ...` error. Letting CDK
-        // auto-generate the function name avoids the collision: the new
-        // Lambda gets a unique name, comes up cleanly, and the old one is
-        // deleted as part of the same change set.
-        //
-        // Operators discover route Lambdas via the `Description` field
-        // below (`<METHOD> <api-path>`) and CloudWatch log groups still
-        // resolve via the function ARN attached to API Gateway, so the
-        // loss of the predictable name is mostly cosmetic.
-        const fn = new lambda.Function(this, resourceId, {
-            runtime: this.toLambdaRuntime(envConfig),
-            architecture: this.toLambdaArchitecture(envConfig),
-            handler: 'index.main',
-            code: props.skipBundling
-                ? inlineStubLambdaCode()
-                : bundleHandlerCodeWithEsbuild(route.handlerFile, props.projectDir),
-            memorySize: lambdaConfig.memoryMb,
-            timeout: cdk.Duration.seconds(lambdaConfig.timeoutSec),
-            description: `${route.method} ${route.apiPath}`,
-            environment: {
-                ...ventureBaseEnv,
-                ...lambdaConfig.environmentVariables,
-            },
-            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
-            tracing: lambdaConfig.tracingEnabled
-                ? lambda.Tracing.ACTIVE
-                : lambda.Tracing.DISABLED,
-            reservedConcurrentExecutions: lambdaConfig.reservedConcurrency,
-            role,
-            ...(vpc && securityGroup
-                ? {
-                    vpc,
-                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    securityGroups: [securityGroup],
-                }
-                : {}),
-        });
-        new apigatewayv2.HttpRoute(this, `${resourceId}-route`, {
-            httpApi: api,
-            routeKey: apigatewayv2.HttpRouteKey.with(route.apiPath, apigatewayv2.HttpMethod[route.method]),
-            integration: new apigatewayv2Integrations.HttpLambdaIntegration(`${resourceId}-integration`, fn),
-        });
-    }
-    toLambdaRuntime(envConfig) {
-        switch (envConfig.lambda.runtime) {
-            case 'nodejs22.x':
-                return lambda.Runtime.NODEJS_22_X;
-            case 'nodejs18.x':
-                return lambda.Runtime.NODEJS_18_X;
-            default:
-                return lambda.Runtime.NODEJS_20_X;
-        }
-    }
-    toLambdaArchitecture(envConfig) {
-        return envConfig.lambda.architecture === 'x86_64'
-            ? lambda.Architecture.X86_64
-            : lambda.Architecture.ARM_64;
-    }
-    toLogRetention(days) {
-        if (days <= 1)
-            return logs.RetentionDays.ONE_DAY;
-        if (days <= 3)
-            return logs.RetentionDays.THREE_DAYS;
-        if (days <= 5)
-            return logs.RetentionDays.FIVE_DAYS;
-        if (days <= 7)
-            return logs.RetentionDays.ONE_WEEK;
-        if (days <= 14)
-            return logs.RetentionDays.TWO_WEEKS;
-        if (days <= 30)
-            return logs.RetentionDays.ONE_MONTH;
-        if (days <= 60)
-            return logs.RetentionDays.TWO_MONTHS;
-        if (days <= 90)
-            return logs.RetentionDays.THREE_MONTHS;
-        if (days <= 120)
-            return logs.RetentionDays.FOUR_MONTHS;
-        if (days <= 150)
-            return logs.RetentionDays.FIVE_MONTHS;
-        if (days <= 180)
-            return logs.RetentionDays.SIX_MONTHS;
-        if (days <= 365)
-            return logs.RetentionDays.ONE_YEAR;
-        return logs.RetentionDays.INFINITE;
-    }
-    shortHash(input) {
-        let h = 5381;
-        for (let i = 0; i < input.length; i++) {
-            h = ((h << 5) + h + input.charCodeAt(i)) | 0;
-        }
-        return (h >>> 0).toString(16).padStart(6, '0').slice(0, 6);
-    }
-}
-/**
- * Discover migration directories shipped by installed `@venturekit/*`
- * packages.
- *
- * Convention: a package opts in by declaring a
- * `"vk": { "migrations": "<relative-dir>" }` field in its own
- * `package.json` (e.g. `@venturekit/notify`, `@venturekit/auth`).
- *
- * Resolution walks the project's `package.json` dependencies, then
- * uses `createRequire(projectDir/package.json)` to locate each
- * `@venturekit/*` package's own `package.json`. This works under pnpm
- * (hoisted), npm (flat), and yarn pnp.
- *
- * Returns absolute paths in declaration order. Missing packages,
- * missing `vk.migrations` field, and non-existent dirs are silently
- * skipped — we only add a dir that actually exists on disk so a
- * stripped publish (e.g. without the `migrations/` artifact) doesn't
- * break `vk deploy`. A warning is logged for the "opted-in but missing
- * on disk" case so the operator notices.
- *
- * MUST stay in lockstep with `@venturekit/cli`'s
- * `discoverPackageMigrationDirs` in `commands/migrate.ts` so a local
- * `vk migrate` and a `vk deploy` apply the exact same merged schema.
- */
-/**
- * Locate `<name>/package.json` for a venturekit package installed in
- * `projectDir`'s dependency tree.
- *
- * We can't use `require.resolve(`${name}/package.json`)` because most
- * venturekit packages ship a strict `"exports"` map that doesn't include
- * `"./package.json"`, which makes Node's resolver throw
- * `ERR_PACKAGE_PATH_NOT_EXPORTED`. Instead we walk `node_modules`
- * directories upward from `projectDir` and check for a real file on
- * disk — works under pnpm (hoisted + symlinked), npm flat, and yarn
- * classic.
- *
- * MUST stay in lockstep with the same helper in `@venturekit/cli`'s
- * `commands/migrate.ts` so a `vk deploy` and a local `vk migrate`
- * discover the same set of package migrations.
- */
-function resolvePackageJsonPath(projectDir, name) {
-    let dir = projectDir;
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
-        const candidate = path.join(dir, 'node_modules', name, 'package.json');
-        if (fs.existsSync(candidate))
-            return candidate;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-}
-function discoverPackageMigrationDirs(projectDir) {
-    const dirs = [];
-    const projectPkgPath = path.join(projectDir, 'package.json');
-    let projectPkg;
-    try {
-        projectPkg = JSON.parse(fs.readFileSync(projectPkgPath, 'utf8'));
-    }
-    catch {
-        return dirs;
-    }
-    const candidates = new Set([
-        ...Object.keys(projectPkg.dependencies ?? {}),
-        ...Object.keys(projectPkg.devDependencies ?? {}),
-    ]);
-    for (const name of candidates) {
-        if (!name.startsWith('@venturekit/'))
-            continue;
-        const pkgJsonPath = resolvePackageJsonPath(projectDir, name);
-        if (!pkgJsonPath)
-            continue;
-        let pkgJson;
-        try {
-            pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
-        }
-        catch {
-            continue;
-        }
-        const rel = pkgJson.vk?.migrations;
-        if (typeof rel !== 'string' || rel.length === 0)
-            continue;
-        const abs = path.join(path.dirname(pkgJsonPath), rel);
-        if (!fs.existsSync(abs)) {
-            console.warn(`[venturekit] ${name} declares vk.migrations='${rel}' but ${abs} does not exist — skipping.`);
-            continue;
-        }
-        dirs.push(abs);
-    }
-    return dirs;
-}
-export class VentureStack extends cdk.Stack {
-    outputs = {};
-    /** Resolved environment configuration driving all resource sizing */
-    envConfig;
-    /** Data safety configuration for removal policies */
-    dataSafetyConfig;
-    /** Whether this is a free-tier deployment */
-    isFreeTier;
-    /** Standard tags applied to all taggable resources */
-    standardTags;
-    /**
-     * Per-project HMAC secret used to sign internal Lambda-to-Lambda calls.
-     * Auto-generated on first deploy and preserved across subsequent deploys by
-     * CloudFormation. Injected as `VENTURE_INTERNAL_HMAC_SECRET` into every
-     * Lambda function the stack creates, so `invoke()` callers and handler
-     * receivers share the same key.
-     */
-    internalHmacSecret;
-    /** Base environment variables applied to every VentureKit Lambda. */
-    ventureBaseEnv;
-    /** @internal — when true, all Lambda code uses an inline stub instead of Docker bundling. Tests only. */
-    skipBundling;
-    /**
-     * Absolute path to the consumer project's root (the directory that
-     * holds `package.json` + `node_modules`). Used as the bundling asset
-     * root so esbuild can resolve handler imports against the project's
-     * installed dependencies.
-     */
-    projectDir;
-    /**
-     * Cognito User Pools created by `createAuth`, kept around so the
-     * shared Lambda execution role can be granted admin actions on them
-     * once the role exists (the role is created later in the constructor,
-     * after every infrastructure intent has been processed).
-     */
-    userPools = [];
-    /**
-     * Secrets Manager placeholders provisioned by `createAuth` for
-     * `AuthIntent.federated` providers (Google / Facebook / Apple OAuth
-     * client id + secret). Tracked so the shared Lambda role can be
-     * granted `secretsmanager:GetSecretValue` on each one once the role
-     * exists. The ARNs are also injected as
-     * `COGNITO_FEDERATED_<PROVIDER>_SECRET_ARN` env vars on every Lambda.
-     */
-    federatedAuthSecrets = [];
-    /**
-     * S3 buckets created by `createStorage`, kept around so the shared
-     * Lambda execution role can be granted `s3:Get*` / `s3:Put*` on them
-     * once the role exists, and so the *first* bucket's name can be
-     * injected as `VENTURE_STORAGE_BUCKET` for `createStorageClientFromEnv()`.
-     * Without this wiring, every Lambda calling `@venturekit/storage` would
-     * throw `Storage bucket not configured` at runtime even though the
-     * bucket exists in CloudFormation.
-     */
-    storageBuckets = [];
-    /**
-     * Notify configurations created by `createNotify`. Tracked so the
-     * shared Lambda role can be granted `ses:SendEmail` on the
-     * configuration set + identity ARNs once the role exists, and so
-     * env vars (`VENTURE_NOTIFY_FROM`, `VENTURE_NOTIFY_CONFIG_SET`, …)
-     * land on every Lambda — `@venturekit/notify`'s
-     * `createSesEmailProvider` reads them at cold start. Also drives
-     * the auto-provisioning of dispatcher + bounce-handler Lambdas
-     * after the rest of the stack is wired (we need the shared role
-     * + VPC + SG to exist first).
-     */
-    notifyConfigs = [];
-    /**
-     * Absolute paths to `migrations/` directories shipped by installed
-     * `@venturekit/*` packages (e.g. `@venturekit/notify`,
-     * `@venturekit/auth`). Resolved once at the top of the constructor
-     * via declarative `vk.migrations` discovery so `createDatabase` can
-     * pass the merged list to `MigrationRunner` without re-walking
-     * `node_modules` per database.
-     *
-     * Discovery mirrors the CLI side
-     * (`@venturekit/cli`'s `discoverPackageMigrationDirs`) so a `vk deploy`
-     * and a local `vk migrate` always materialize the same merged schema.
-     * Empty when no installed venturekit package opts in via
-     * `"vk": { "migrations": "<dir>" }` in its `package.json`.
-     */
-    packageMigrationsDirs = [];
-    constructor(scope, id, props) {
-        super(scope, id, props);
-        const { projectName, stage, routesDir, functionsDir, queuesDir, cronsDir, infrastructure, projectDir, preset } = props;
-        this.skipBundling = props._skipBundling === true;
-        this.projectDir = projectDir;
-        // --- Resolve environment configuration ---
-        // Priority: explicit envConfig > resolve from preset > fallback to 'micro'.
-        // We pass the literal `stage` to resolveEnvConfig — any stage name
-        // the project declared (including custom ones like `preview`) is
-        // valid. Unknown stages get conservative defaults (dataSafety
-        // 'standard') inside resolveEnvConfig, not here.
-        this.envConfig = props.envConfig ?? resolveEnvConfig(stage, { preset: preset ?? 'micro' });
-        this.isFreeTier = preset === 'free' || this.envConfig.dataSafety === 'relaxed' && preset === 'free';
-        this.dataSafetyConfig = DATA_SAFETY_CONFIG[this.envConfig.dataSafety];
-        // --- Well-Architected: Operational Excellence — consistent tagging ---
-        this.standardTags = {
-            Project: projectName,
-            Stage: stage,
-            ManagedBy: 'venturekit',
-            Preset: preset ?? 'micro',
-        };
-        Object.entries(this.standardTags).forEach(([key, value]) => {
-            cdk.Tags.of(this).add(key, value);
-        });
-        // --- Well-Architected: Security — per-project HMAC secret for internal calls ---
-        // CloudFormation auto-generates a 64-char alphanumeric value on first deploy
-        // and preserves it across stack updates, so warm Lambdas don't get kicked off
-        // by a secret rotation every deploy. The secret's VALUE is injected as an
-        // env var on every Lambda — not just a reference — so no runtime IAM call.
-        this.internalHmacSecret = new secretsmanager.Secret(this, 'internalHmacSecret', {
-            secretName: `venturekit/${projectName}/${stage}/internal-hmac`,
-            description: 'VentureKit internal Lambda-to-Lambda HMAC signing key. Auto-generated.',
-            generateSecretString: {
-                passwordLength: 64,
-                excludePunctuation: true,
-                excludeCharacters: '"\'\\/',
-                requireEachIncludedType: false,
-                includeSpace: false,
-            },
-            removalPolicy: this.toRemovalPolicy(),
-        });
-        // Centralized base env vars applied to every Lambda in the stack.
-        this.ventureBaseEnv = {
-            VENTURE_PROJECT_NAME: projectName,
-            VENTURE_STAGE: stage,
-            VENTURE_INTERNAL_HMAC_SECRET: this.internalHmacSecret.secretValue.unsafeUnwrap(),
-            NODE_OPTIONS: '--enable-source-maps',
-        };
-        const lambdaConfig = this.envConfig.lambda;
-        const vpcConfig = this.envConfig.vpc;
-        const apiConfig = this.envConfig.api;
-        const obsConfig = this.envConfig.observability;
-        // --- Shared VPC ---
-        // Well-Architected: Security — network isolation for databases and caches
-        // Free tier: skip VPC entirely (NAT gateways are not free)
-        // Stable logical ID 'Vpc' ensures preset changes don't replace the VPC
-        let vpc;
-        const needsVpc = !this.isFreeTier && (lambdaConfig.vpcEnabled ||
-            (infrastructure?.databases && infrastructure.databases.length > 0) ||
-            (infrastructure?.caches && infrastructure.caches.length > 0));
-        if (needsVpc) {
-            const subnetConfig = [
-                { name: 'public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: vpcConfig.publicSubnets.cidrMask },
-                { name: 'private', subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: vpcConfig.privateSubnets.cidrMask },
-            ];
-            if (vpcConfig.isolatedSubnets) {
-                subnetConfig.push({
-                    name: 'isolated',
-                    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
-                    cidrMask: vpcConfig.isolatedSubnets.cidrMask,
-                });
-            }
-            // Well-Architected: Cost — pick the NAT provider per preset. Dev
-            // and small-prod presets (nano/micro/medium) use `fck-nat` EC2
-            // instances (~$3-25/mo per AZ) instead of managed NAT Gateways
-            // (~$33/mo per AZ + $0.045/GB). Large defaults to NAT GW for SLA
-            // and zero-ops reasons. `none` skips NAT entirely (free preset).
-            //
-            // fck-nat is the community-maintained AL2023 NAT AMI, owned by
-            // AWS account `568608671756`. The AMI is published in every
-            // commercial region (verified against the fck-nat packer
-            // manifest). We pin to ARM64 — 20% cheaper and matches the
-            // `t4g.*` default for `natInstanceType`.
-            const natGateways = vpcConfig.natType === 'none' ? 0 : vpcConfig.natGateways;
-            let natGatewayProvider;
-            if (vpcConfig.natType === 'instance' && natGateways > 0) {
-                natGatewayProvider = ec2.NatProvider.instanceV2({
-                    instanceType: new ec2.InstanceType(vpcConfig.natInstanceType ?? 't4g.nano'),
-                    machineImage: ec2.MachineImage.lookup({
-                        name: 'fck-nat-al2023-*-arm64-ebs',
-                        owners: ['568608671756'],
-                    }),
-                });
-            }
-            // natType: 'gateway' leaves natGatewayProvider undefined, which
-            // is CDK's signal to provision managed NAT Gateways.
-            vpc = new ec2.Vpc(this, 'Vpc', {
-                maxAzs: vpcConfig.maxAzs,
-                natGateways,
-                natGatewayProvider,
-                ipAddresses: ec2.IpAddresses.cidr(vpcConfig.cidr),
-                subnetConfiguration: subnetConfig,
-                // Well-Architected: Security — restrict default SG
-                restrictDefaultSecurityGroup: true,
-            });
-            // Well-Architected: Security — VPC flow logs for network monitoring
-            if (vpcConfig.flowLogsEnabled) {
-                vpc.addFlowLog('FlowLog', {
-                    destination: ec2.FlowLogDestination.toCloudWatchLogs(new logs.LogGroup(this, 'VpcFlowLogGroup', {
-                        logGroupName: `/venturekit/${projectName}/${stage}/vpc-flow-logs`,
-                        retention: this.toLogRetention(vpcConfig.flowLogsRetentionDays),
-                        removalPolicy: this.toRemovalPolicy(),
-                    })),
-                    trafficType: ec2.FlowLogTrafficType.ALL,
-                });
-            }
-            // Gateway VPC endpoints (S3, DynamoDB) — always on.
-            //
-            // These are *free* (no hourly charge, no per-GB charge) and are
-            // the only correct way to keep VPC-internal S3/DynamoDB traffic
-            // off the NAT path. The migration runner's CodeBuild source
-            // download targets `cdk-hnb659fds-assets-<account>-<region>` in
-            // S3 and previously routed through the `t4g.nano` fck-nat
-            // instance shipped with the `nano` preset — a single small EC2
-            // that's a single point of failure and timed out under
-            // realistic CDK deploys (tracked as the "DOWNLOAD_SOURCE i/o
-            // timeout" report). With the gateway endpoint installed, the
-            // route table sends S3-prefix-list traffic straight to the
-            // gateway endpoint, bypassing NAT entirely.
-            //
-            // The `enableVpcEndpoints` flag below still gates the
-            // *expensive* Interface endpoints (Secrets Manager, ECR, Logs,
-            // ~$7.20/mo each) — that's a real cost knob worth keeping off
-            // the cheap presets.
-            vpc.addGatewayEndpoint('S3Endpoint', {
-                service: ec2.GatewayVpcEndpointAwsService.S3,
-            });
-            vpc.addGatewayEndpoint('DynamoEndpoint', {
-                service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
-            });
-            // Interface endpoints (paid) — opt-in via preset.
-            //
-            // Each interface endpoint costs ~$0.01/hr per AZ (~$7.20/mo per AZ)
-            // plus $0.01/GB processed, so the flag stays off on `free` and
-            // `nano` and on for `micro`/`medium`/`large`. The single most
-            // important endpoint to wire is Secrets Manager: every VPC-attached
-            // route Lambda calls `applyDbSecretToEnv()` on cold start, and
-            // without an SM endpoint that call has to traverse NAT — which
-            // is a single-AZ `t4g.nano` fck-nat instance on the small presets
-            // and a real reliability hazard (a hung NAT eats the entire
-            // Lambda timeout with no diagnostic output).
-            if (vpcConfig.enableVpcEndpoints) {
-                // Dedicated SG for the endpoints. Allow inbound HTTPS from the
-                // VPC CIDR only — interface endpoints are addressable via
-                // private DNS names that resolve to ENIs inside this VPC, so
-                // restricting ingress to the CIDR is both sufficient and
-                // tighter than the alternative of sharing the Lambda SG (which
-                // doesn't exist yet at this point in `constructor()` anyway).
-                const endpointSg = new ec2.SecurityGroup(this, 'VpcEndpointsSg', {
-                    vpc,
-                    description: `Interface endpoint SG for ${projectName}-${stage}`,
-                    allowAllOutbound: false,
-                });
-                endpointSg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(443), 'HTTPS from anywhere in the VPC');
-                // Secrets Manager — the confirmed cold-start dependency for
-                // every Lambda that does any DB access. `privateDnsEnabled`
-                // makes `secretsmanager.<region>.amazonaws.com` resolve to the
-                // endpoint ENI inside the VPC, so existing AWS SDK clients
-                // (with no code changes) automatically use the endpoint.
-                vpc.addInterfaceEndpoint('SecretsManagerEndpoint', {
-                    service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
-                    securityGroups: [endpointSg],
-                    subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    privateDnsEnabled: true,
-                });
-                // Future endpoints to consider here, gated by feature flags so
-                // small environments don't pay for what they don't use:
-                //   - `LOGS`: only needed if your handlers call CloudWatch Logs
-                //     APIs directly. Lambda's own log delivery does not flow
-                //     through the function's network.
-                //   - `SQS`: only needed if you call SQS from inside the VPC.
-                //     Queue consumers are *triggered* by the Lambda service
-                //     itself, which doesn't need a VPC endpoint either.
-                //   - `KMS`: needed if you call KMS from handler code (e.g. for
-                //     envelope encryption). Cognito + RDS encryption use KMS
-                //     internally without traversing your network.
-                //   - `STS`: needed if handlers assume cross-account roles.
-            }
-        }
-        // --- Resolve VentureKit-shipped migrations ---
-        // Discover every installed `@venturekit/*` package that opts in to
-        // shipping migrations via a `"vk": { "migrations": "<dir>" }` field
-        // in its own `package.json` (e.g. `@venturekit/notify` ships
-        // `vk_notify_*.sql`, `@venturekit/auth` ships `vk_auth_*.sql`).
-        //
-        // We resolve the dirs once here so every database below receives
-        // the same merged set — declaring multiple databases doesn't
-        // multiply the schema.
-        //
-        // Resolution: walk the project's `package.json` dependencies,
-        // then ask `createRequire(projectDir)` where each `@venturekit/*`
-        // package's own `package.json` lives. This survives pnpm hoisted
-        // layouts, npm flat layouts, and yarn pnp (which returns virtual
-        // paths require can still stat).
-        //
-        // This is the deploy-side mirror of `@venturekit/cli`'s
-        // `discoverPackageMigrationDirs` — keeping them in lockstep means
-        // `vk migrate` (local) and `vk deploy` always apply the same
-        // merged schema.
-        this.packageMigrationsDirs.push(...discoverPackageMigrationDirs(projectDir));
-        // --- Databases ---
-        // We collect the RDS instances (alongside the source intent) so the
-        // route-Lambda block below can:
-        //   1. grant ingress on the DB port via a shared security group, and
-        //   2. wire the *primary* DB's secret ARN + endpoint into the Lambda
-        //      env so handlers can authenticate (`@venturekit/data`'s
-        //      `applyDbSecretToEnv` resolves user/password at cold start).
-        // Without #2, every route handler would 503 the moment it tried to
-        // open a pg.Pool.
-        // Both DatabaseInstance and DatabaseInstanceFromSnapshot extend the
-        // (un-exported) DatabaseInstanceNew base, sharing the surface we use
-        // here: `.secret`, `.connections`, `.dbInstanceEndpoint{Address,Port}`,
-        // `.node`. The union keeps the snapshot-restore branch type-safe
-        // without needing a cast.
-        const dbInstances = [];
-        if (infrastructure?.databases) {
-            for (const db of infrastructure.databases) {
-                if (this.isFreeTier) {
-                    this.createDynamoDBTable(db, projectName, stage);
-                }
-                else {
-                    const instance = this.createDatabase(db, projectName, stage, vpc, projectDir, props.vkCliVersion ?? 'latest');
-                    dbInstances.push({ instance, intent: db });
-                }
-            }
-        }
-        // --- Storage ---
-        if (infrastructure?.storage) {
-            for (const storage of infrastructure.storage) {
-                this.createStorage(storage, projectName, stage);
-            }
-        }
-        // --- Auth ---
-        if (infrastructure?.auth) {
-            for (const auth of infrastructure.auth) {
-                this.createAuth(auth, projectName, stage);
-            }
-        }
-        // --- Notify (SES + outbox + auto-provisioned dispatcher cron) ---
-        // We provision SES identity + configuration set + events SNS topic
-        // here, but defer IAM grants and the dispatcher / bounce-handler
-        // Lambda creation until after the shared Lambda role exists below
-        // (so we can reuse the same role for least-privilege wiring).
-        if (infrastructure?.notify) {
-            for (const notify of infrastructure.notify) {
-                this.createNotify(notify, projectName, stage);
-            }
-        }
-        // --- Queues ---
-        if (infrastructure?.queues) {
-            for (const queue of infrastructure.queues) {
-                this.createQueue(queue, projectName, stage);
-            }
-        }
-        // --- Caches ---
-        // Free tier: skip ElastiCache (not free). Use DynamoDB-based caching
-        // via createDefaultRateLimiter() from @venturekit/runtime instead.
-        if (infrastructure?.caches && !this.isFreeTier) {
-            for (const cache of infrastructure.caches) {
-                this.createCache(cache, projectName, stage, vpc);
-            }
-        }
-        // Always create the rate-limit DynamoDB table. It's on the always-free
-        // tier, has zero cost at zero load, and is what `createDefaultRateLimiter()`
-        // falls back to in every environment. Shipping the table unconditionally
-        // means `rateLimitMiddleware()` "just works" on first deploy regardless of
-        // preset, and the fail-closed default on store errors (SEC-S15) won't
-        // surprise anyone with a 503 because the table was missing.
-        this.createRateLimitTable(projectName, stage);
-        // --- Monitoring ---
-        if (infrastructure?.monitoring) {
-            for (const mon of infrastructure.monitoring) {
-                this.createMonitoring(mon, projectName, stage);
-            }
-        }
-        // --- Secrets ---
-        if (infrastructure?.secrets) {
-            for (const secret of infrastructure.secrets) {
-                this.createSecret(secret, projectName, stage);
-            }
-        }
-        // --- API Gateway + Lambda routes ---
-        // Well-Architected: Performance — throttling protects downstream services
-        // Well-Architected: Security — CORS preflight with explicit origins in prod
-        const api = new apigatewayv2.HttpApi(this, 'Api', {
-            apiName: `${projectName}-${stage}`,
-            corsPreflight: apiConfig.cors ? {
-                allowOrigins: apiConfig.cors.allowOrigins,
-                allowMethods: apiConfig.cors.allowMethods.map((m) => apigatewayv2.CorsHttpMethod[m.toUpperCase()] ?? apigatewayv2.CorsHttpMethod.ANY),
-                allowHeaders: apiConfig.cors.allowHeaders,
-                allowCredentials: apiConfig.cors.allowCredentials,
-                maxAge: cdk.Duration.seconds(apiConfig.cors.maxAgeSec),
-            } : {
-                allowOrigins: ['*'],
-                allowMethods: [
-                    apigatewayv2.CorsHttpMethod.GET,
-                    apigatewayv2.CorsHttpMethod.POST,
-                    apigatewayv2.CorsHttpMethod.PUT,
-                    apigatewayv2.CorsHttpMethod.DELETE,
-                    apigatewayv2.CorsHttpMethod.PATCH,
-                    apigatewayv2.CorsHttpMethod.OPTIONS,
-                ],
-                allowHeaders: ['*'],
-            },
-            disableExecuteApiEndpoint: false,
-        });
-        // Well-Architected: Reliability — RETAIN the HttpApi under strict
-        // dataSafety. The `*.execute-api.{region}.amazonaws.com` URL is unique
-        // to the API ID, so deleting the API invalidates every consumer that
-        // hardcoded that URL (mobile apps shipped with the URL baked in,
-        // partner integrations, webhook subscribers, etc.). Custom-domain
-        // mappings live on this same API ID — losing the API also breaks the
-        // mapping until manually re-attached. RETAIN means a deleted CFN
-        // stack leaves the API in place for `cdk import` recovery.
-        const cfnApi = api.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnApi.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
-            cfnApi.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // Well-Architected: Operational Excellence — access logging for API
-        const apiLogGroup = new logs.LogGroup(this, 'ApiAccessLog', {
-            logGroupName: `/venturekit/${projectName}/${stage}/api-access`,
-            retention: this.toLogRetention(obsConfig.logs.retentionDays),
-            removalPolicy: this.toRemovalPolicy(),
-        });
-        const defaultStage = api.defaultStage?.node.defaultChild;
-        if (defaultStage) {
-            defaultStage.accessLogSettings = {
-                destinationArn: apiLogGroup.logGroupArn,
-                format: JSON.stringify({
-                    requestId: '$context.requestId',
-                    ip: '$context.identity.sourceIp',
-                    method: '$context.httpMethod',
-                    path: '$context.path',
-                    status: '$context.status',
-                    latency: '$context.responseLatency',
-                    integrationLatency: '$context.integrationLatency',
-                }),
-            };
-            defaultStage.defaultRouteSettings = {
-                detailedMetricsEnabled: apiConfig.detailedMetricsEnabled,
-                throttlingRateLimit: apiConfig.throttleRateLimit,
-                throttlingBurstLimit: apiConfig.throttleBurstLimit,
-            };
-        }
-        new cdk.CfnOutput(this, 'ApiUrl', {
-            value: api.apiEndpoint,
-            description: 'API Gateway URL',
-        });
-        // --- Custom Domains ---
-        //
-        // An empty-string `certificateArn` is the "pending" sentinel:
-        // `vk cert request` writes the ARN into the user's config file
-        // after DNS-based validation completes, and the first deploy
-        // (before the cert is ready) wants to succeed without trying to
-        // create a zombie ACM cert. Skipping the domain lets the API
-        // remain reachable at the auto-generated API Gateway URL; the
-        // next deploy — after `vk cert request` persists the ARN — wires
-        // the custom domain in.
-        if (infrastructure?.domains) {
-            for (const domain of infrastructure.domains) {
-                if (domain.certificateArn === '') {
-                    new cdk.CfnOutput(this, `${projectName}-${domain.id}-domain-pending`, {
-                        value: `Run \`vk cert request --domain ${domain.domain}\` to activate.`,
-                        description: `Custom domain ${domain.domain} is pending — no ACM cert ARN yet.`,
-                    });
-                    continue;
-                }
-                this.createDomain(domain, projectName, stage, api);
-            }
-        }
-        // --- File-system Lambda discovery (routes + functions + queues + crons) ---
-        //
-        // Convention (mirrors `cli/src/utils/local-server.ts`):
-        //   src/routes/health/get.ts          → GET    /health
-        //   src/routes/users/[id]/put.ts      → PUT    /users/{id}
-        //   src/functions/process-orders.ts   → standalone Lambda
-        //   src/queues/<name>.ts              → SQS queue + consumer Lambda
-        //   src/crons/<name>.ts               → EventBridge rule + Lambda
-        //
-        // Every discovered handler becomes its own Lambda function. All four
-        // kinds share a single IAM role and (when there's a VPC) a single
-        // security group — both because it keeps the CFN resource count
-        // linear in route count rather than O(N × constants), and because
-        // *every* Lambda kind needs the same baseline access to RDS and
-        // Secrets Manager. Routes serve user requests; queue consumers and
-        // cron handlers run async background work that's at least as DB-
-        // hungry. Splitting role/SG by kind would force operators to wire
-        // the DB SG ingress N times instead of once.
-        //
-        // Trade-off: the shared role accumulates per-Lambda grants from CDK
-        // helpers like `queue.grantConsumeMessages(fn)`. A route Lambda
-        // therefore *technically* has SQS receive perms even though it
-        // never tries to use them. We accept that least-privilege drift
-        // because the alternative — one role per Lambda — multiplies role
-        // count by ~Nx and pushes large projects (~80 routes) over CFN's
-        // 500-resource limit per stack.
-        const resolvedRoutesDir = path.resolve(projectDir, routesDir);
-        const resolvedFunctionsDir = functionsDir
-            ? path.resolve(projectDir, functionsDir)
-            : path.resolve(projectDir, 'src/functions');
-        const resolvedQueuesDir = queuesDir
-            ? path.resolve(projectDir, queuesDir)
-            : path.resolve(projectDir, 'src/queues');
-        const resolvedCronsDir = cronsDir
-            ? path.resolve(projectDir, cronsDir)
-            : path.resolve(projectDir, 'src/crons');
-        const discoveredRoutes = fs.existsSync(resolvedRoutesDir)
-            ? discoverRouteFiles(resolvedRoutesDir)
-            : [];
-        const discoveredFunctions = fs.existsSync(resolvedFunctionsDir)
-            ? this.discoverFunctionFiles(resolvedFunctionsDir)
-            : [];
-        const discoveredQueues = fs.existsSync(resolvedQueuesDir)
-            ? this.discoverFunctionFiles(resolvedQueuesDir)
-            : [];
-        const discoveredCrons = fs.existsSync(resolvedCronsDir)
-            ? this.discoverFunctionFiles(resolvedCronsDir)
-            : [];
-        const hasAnyLambda = discoveredRoutes.length > 0
-            || discoveredFunctions.length > 0
-            || discoveredQueues.length > 0
-            || discoveredCrons.length > 0;
-        let lambdaRole;
-        let lambdaSg;
-        if (hasAnyLambda) {
-            // Stack-wide execution role. `AWSLambdaBasicExecutionRole` covers
-            // CloudWatch Logs writes; the VPC variant is bolted on below when
-            // a VPC exists so the Lambda can attach an ENI on cold start.
-            lambdaRole = new iam.Role(this, 'LambdaRole', {
-                assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
-                description: `Shared execution role for ${projectName}-${stage} Lambdas`,
-                managedPolicies: [
-                    iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
-                ],
-            });
-            if (vpc) {
-                lambdaRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'));
-                lambdaSg = new ec2.SecurityGroup(this, 'LambdaSg', {
-                    vpc,
-                    description: `Shared SG for ${projectName}-${stage} Lambdas`,
-                    allowAllOutbound: true,
-                });
-                // Open the DB port for every database from the shared SG. We
-                // use `connections.allowDefaultPortFrom` rather than hard-
-                // coding 5432/3306 so the same code path works for Postgres
-                // *and* MySQL projects (and any future engine `createDatabase`
-                // adds). One ingress rule per DB, regardless of how many
-                // Lambdas the stack creates.
-                for (const { instance } of dbInstances) {
-                    instance.connections.allowDefaultPortFrom(lambdaSg, `${projectName}-${stage} Lambdas`);
-                }
-            }
-            // Wire the *primary* database's credentials into every Lambda's
-            // env so `@venturekit/data`'s `getPool()` (and the `query()` /
-            // `withTransaction()` entry points that wrap it) finds a complete
-            // config. The non-secret slots (host, port, name, ssl) are always
-            // wired the same way; the *username + password* delivery flips
-            // based on whether the VPC has a Secrets Manager interface
-            // endpoint:
-            //
-            //   - **Default — VPC has SM endpoint, OR Lambda is not VPC-attached.**
-            //     Expose `DB_SECRET_ARN`. Runtime fetches user/password via
-            //     `applyDbSecretToEnv()` on cold start. Standard, supports
-            //     rotation without a redeploy, secret value never lands in
-            //     the CloudFormation template or Lambda env config.
-            //
-            //   - **Inline mode — VPC-attached AND `enableVpcEndpoints: false`
-            //     (today only the `nano` preset).**
-            //     CloudFormation resolves the secret value at deploy time and
-            //     injects `DB_USER` + `DB_PASSWORD` as plain Lambda env vars.
-            //     `applyDbSecretToEnv()` short-circuits when both are set, so
-            //     the SM round-trip is skipped entirely. This eliminates the
-            //     hard runtime dependency on a single-AZ fck-nat instance
-            //     reaching `secretsmanager.<region>.amazonaws.com`. Trade-offs:
-            //     rotation requires a `vk deploy`, and the password is visible
-            //     to anyone holding `lambda:GetFunctionConfiguration` IAM —
-            //     acceptable for dev/preview, not for prod (which should run
-            //     on a preset that turns endpoints on).
-            //
-            // "Primary" = the first database intent in `infrastructure.databases`.
-            // This matches the local-dev convention `vk` already uses to
-            // populate `DATABASE_URL` from docker-compose; multi-DB projects
-            // can read the additional secret ARNs from CFN outputs and call
-            // `applyDbSecretToEnv` themselves.
-            if (dbInstances.length > 0) {
-                const { instance: primaryDb, intent: primaryIntent } = dbInstances[0];
-                if (primaryDb.secret) {
-                    this.ventureBaseEnv['DB_HOST'] = primaryDb.dbInstanceEndpointAddress;
-                    this.ventureBaseEnv['DB_PORT'] = primaryDb.dbInstanceEndpointPort;
-                    this.ventureBaseEnv['DB_NAME'] = primaryIntent.name || primaryIntent.id;
-                    // RDS enforces TLS on every modern engine; flipping this here
-                    // means consumers don't have to remember to set it themselves.
-                    this.ventureBaseEnv['DB_SSL'] = 'true';
-                    // Inline mode kicks in only when the Lambda will be VPC-attached
-                    // (a VPC exists) AND no SM interface endpoint is being created.
-                    // Without VPC attachment the Lambda reaches SM via the public
-                    // internet using its execution-role IAM, so the standard ARN
-                    // path stays optimal there.
-                    const inlineDbCredentials = vpc !== undefined && !vpcConfig.enableVpcEndpoints;
-                    if (inlineDbCredentials) {
-                        // `secretValueFromJson(...).unsafeUnwrap()` is the same
-                        // CloudFormation-resolved-at-deploy-time pattern already
-                        // used above for `VENTURE_INTERNAL_HMAC_SECRET`. The token
-                        // becomes a `Fn::Join`/`{{resolve:secretsmanager:...}}` in
-                        // the synthesized template; CFN substitutes the literal
-                        // value when creating/updating the Lambda's Environment
-                        // block, so no IAM call is needed at runtime.
-                        this.ventureBaseEnv['DB_USER'] = primaryDb.secret
-                            .secretValueFromJson('username').unsafeUnwrap();
-                        this.ventureBaseEnv['DB_PASSWORD'] = primaryDb.secret
-                            .secretValueFromJson('password').unsafeUnwrap();
-                        // Deliberately *not* setting DB_SECRET_ARN: with both
-                        // DB_USER and DB_PASSWORD pre-populated, `applyDbSecretToEnv()`
-                        // is a no-op — but if the ARN is set anyway, an operator
-                        // skimming the env vars might think rotation works without
-                        // a redeploy. Keeping it absent makes the contract explicit.
-                    }
-                    else {
-                        this.ventureBaseEnv['DB_SECRET_ARN'] = primaryDb.secret.secretArn;
-                        // Only grant when the runtime actually fetches. Inline mode
-                        // doesn't need it and the principle of least privilege
-                        // says don't hand out IAM you don't use.
-                        primaryDb.secret.grantRead(lambdaRole);
-                    }
-                }
-            }
-            // Grant the shared Lambda role the baseline admin Cognito actions
-            // every non-trivial auth flow needs. The public surface
-            // (`SignUp`, `InitiateAuth`, `RespondToAuthChallenge`,
-            // `ChangePassword`, …) is anonymous and works without IAM, but
-            // self-service register flows that auto-confirm the new user, and
-            // any admin/staff-invite console, hit the `Admin*` API which
-            // does require IAM. Without this grant a `POST /auth/register`
-            // route that calls `AdminConfirmSignUp` after `SignUp` fails at
-            // runtime with `AccessDeniedException`.
-            //
-            // Grants are scoped to each declared pool's ARN (via
-            // `userPool.grant`, which builds an inline policy on the role
-            // pinned to `userPool.userPoolArn`) — never `Resource: *`.
-            //
-            // The action set covers the admin operations VentureKit-shaped
-            // apps actually call from Lambda handlers: confirming/creating
-            // users on registration or invite, flipping enabled status,
-            // updating attributes (e.g. `email_verified`, `custom:role`),
-            // reading user state, force-resetting passwords, and the
-            // admin-flow auth pair used by some server-side login surfaces.
-            // List-side reads (`ListUsers`, `AdminListGroupsForUser`) round
-            // out the set so user-management consoles don't have to ship a
-            // second grant.
-            for (const pool of this.userPools) {
-                pool.grant(lambdaRole, 'cognito-idp:AdminConfirmSignUp', 'cognito-idp:AdminCreateUser', 'cognito-idp:AdminDeleteUser', 'cognito-idp:AdminDisableUser', 'cognito-idp:AdminEnableUser', 'cognito-idp:AdminGetUser', 'cognito-idp:AdminInitiateAuth', 'cognito-idp:AdminListGroupsForUser', 'cognito-idp:AdminRespondToAuthChallenge', 'cognito-idp:AdminSetUserPassword', 'cognito-idp:AdminUpdateUserAttributes', 'cognito-idp:AdminUserGlobalSignOut', 'cognito-idp:ListUsers');
-            }
-            // Federated identity-provider client-credential secrets — created
-            // by `createAuth` when an `AuthIntent` declares
-            // `federated: ['google', 'facebook', …]`. Granting `GetSecretValue`
-            // here (rather than at the secret's creation site) keeps the
-            // grant tied to the same shared Lambda role used for the Cognito
-            // admin actions above, so a single `signInAsFederatedUser` call
-            // can both fetch the OAuth credentials and mint Cognito tokens.
-            for (const secret of this.federatedAuthSecrets) {
-                secret.grantRead(lambdaRole);
-            }
-            // Wire every storage bucket into the shared Lambda role + env.
-            //
-            // - IAM: `bucket.grantReadWrite(lambdaRole)` produces an inline
-            //   policy scoped to the bucket ARN (and `${arn}/*`), covering the
-            //   `s3:Get*` / `s3:Put*` / `s3:DeleteObject` / `s3:List*` actions
-            //   that `@venturekit/storage`'s presign + put/get/list paths need.
-            //   Never `Resource: *` — least privilege per declared intent.
-            //
-            // - Env: `VENTURE_STORAGE_BUCKET` points at the *first* bucket so
-            //   `createStorageClientFromEnv()` (the zero-config entry point
-            //   most handlers use) finds a complete config without an explicit
-            //   `{ bucket }` override. Per-intent `STORAGE_<ID>_BUCKET` vars
-            //   mirror the local-dev convention in `cli/src/utils/docker-compose.ts`
-            //   (`envVars[\`STORAGE_${id.toUpperCase()}_BUCKET\`] = ...`) so
-            //   multi-bucket projects can read each bucket name without an
-            //   extra round-trip to CloudFormation outputs. "Primary" =
-            //   the first storage intent in `infrastructure.storage`, matching
-            //   how the same CLI sets `VENTURE_STORAGE_BUCKET` to
-            //   `intents.storage[0].id` for `vk dev`.
-            if (this.storageBuckets.length > 0) {
-                const primary = this.storageBuckets[0];
-                this.ventureBaseEnv['VENTURE_STORAGE_BUCKET'] = primary.bucket.bucketName;
-                if (primary.distribution) {
-                    // Primary CDN domain — read by zero-config callers that don't
-                    // know the intent id (mirrors `VENTURE_STORAGE_BUCKET`). When
-                    // an alias is configured, prefer it so URLs end up at the
-                    // operator-chosen hostname (e.g. `cdn.example.com`) instead
-                    // of the `*.cloudfront.net` default.
-                    this.ventureBaseEnv['VENTURE_STORAGE_CDN_URL'] = primary.cdnAlias
-                        ? `https://${primary.cdnAlias}`
-                        : `https://${primary.distribution.distributionDomainName}`;
-                }
-                for (const { bucket, intent, distribution, cdnAlias } of this.storageBuckets) {
-                    // Lambda env var keys must match `[a-zA-Z][a-zA-Z0-9_]+`, so
-                    // normalize any non-alphanumerics in the intent id (e.g.
-                    // `user-uploads` -> `USER_UPLOADS`). Without this, a hyphenated
-                    // id would cause CloudFormation to reject the function update.
-                    const idKey = String(intent.id).toUpperCase().replace(/[^A-Z0-9_]/g, '_');
-                    this.ventureBaseEnv[`STORAGE_${idKey}_BUCKET`] = bucket.bucketName;
-                    if (distribution) {
-                        // Per-intent CDN domain — handlers that resolve a stored
-                        // S3 key to a public URL (e.g. `publicUrlForKey()`) read
-                        // this to build `https://<dist>/<key>` without an explicit
-                        // override. Prefer the alternate domain (e.g.
-                        // `cdn.example.com`) when set; fall back to the auto-
-                        // generated `*.cloudfront.net` hostname otherwise.
-                        this.ventureBaseEnv[`STORAGE_${idKey}_CDN_URL`] = cdnAlias
-                            ? `https://${cdnAlias}`
-                            : `https://${distribution.distributionDomainName}`;
-                    }
-                    bucket.grantReadWrite(lambdaRole);
-                }
-            }
-            // Wire every notify configuration into the shared Lambda role + env.
-            //
-            // - IAM: `ses:SendEmail` + `ses:SendRawEmail` scoped to the SES
-            //   identity ARN and the configuration set ARN — never `Resource: *`.
-            //   `secretsmanager:GetSecretValue` is granted on the WhatsApp
-            //   token secret when the channel is enabled.
-            // - Env: the *first* notify config drives the unscoped vars
-            //   (`VENTURE_NOTIFY_FROM`, …) so handlers using the default
-            //   `notify` instance work without per-id config. Per-id vars
-            //   (`NOTIFY_<ID>_FROM`) mirror the storage convention.
-            // - Auto-provisioning: dispatcher cron + bounce-handler Lambda
-            //   are created here too because they share `lambdaRole` and need
-            //   the same VPC/SG. The Lambdas import a stub from
-            //   `@venturekit/notify/runtime/dispatcher-stub.ts`; the consumer
-            //   provides their notify-client module path via
-            //   `VENTURE_NOTIFY_CLIENT_MODULE` env (default `'./lib/notify.js'`,
-            //   resolved against the bundled handler dir).
-            if (this.notifyConfigs.length > 0) {
-                const primary = this.notifyConfigs[0];
-                this.ventureBaseEnv['VENTURE_NOTIFY_FROM'] = primary.intent.defaultFrom ?? '';
-                this.ventureBaseEnv['VENTURE_NOTIFY_CONFIG_SET'] = primary.configurationSetName;
-                this.ventureBaseEnv['VENTURE_NOTIFY_EVENTS_TOPIC_ARN'] = primary.eventsTopic.topicArn;
-                if (primary.intent.whatsapp?.phoneNumberId) {
-                    this.ventureBaseEnv['VENTURE_NOTIFY_WHATSAPP_PHONE_ID'] = String(primary.intent.whatsapp.phoneNumberId);
-                    this.ventureBaseEnv['VENTURE_NOTIFY_WHATSAPP_API_VERSION'] =
-                        primary.intent.whatsapp.apiVersion ?? 'v21.0';
-                }
-                if (primary.whatsappTokenSecret) {
-                    this.ventureBaseEnv['VENTURE_NOTIFY_WHATSAPP_TOKEN_SECRET'] =
-                        primary.whatsappTokenSecret.secretArn;
-                }
-                for (const cfg of this.notifyConfigs) {
-                    const idKey = String(cfg.intent.id).toUpperCase().replace(/[^A-Z0-9_]/g, '_');
-                    this.ventureBaseEnv[`NOTIFY_${idKey}_FROM`] = cfg.intent.defaultFrom ?? '';
-                    this.ventureBaseEnv[`NOTIFY_${idKey}_CONFIG_SET`] = cfg.configurationSetName;
-                    this.ventureBaseEnv[`NOTIFY_${idKey}_EVENTS_TOPIC_ARN`] = cfg.eventsTopic.topicArn;
-                    // Grant SES sending permissions. `ses:SendEmail` /
-                    // `SendRawEmail` are required by SESv2's SendEmail API; the
-                    // resource-level scope is the identity ARN (`arn:aws:ses:…:identity/<from>`)
-                    // *plus* the configuration set ARN (Send is dual-resource in
-                    // SESv2 — both the identity AND the config set must allow).
-                    lambdaRole.addToPolicy(new iam.PolicyStatement({
-                        actions: ['ses:SendEmail', 'ses:SendRawEmail'],
-                        resources: [
-                            cfg.identityArn,
-                            `arn:${cdk.Aws.PARTITION}:ses:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:configuration-set/${cfg.configurationSetName}`,
-                        ],
-                    }));
-                    if (cfg.whatsappTokenSecret) {
-                        cfg.whatsappTokenSecret.grantRead(lambdaRole);
-                    }
-                }
-                // Auto-provision dispatcher + bounce-handler Lambdas now that
-                // the role + VPC + SG exist. Wrapped in a single helper so the
-                // constructor stays readable.
-                this.provisionNotifyHandlers(projectName, stage, projectDir, lambdaRole, lambdaSg, vpc);
-            }
-        }
-        // --- HTTP Routes (file-system discovered) ---
-        //
-        // Each discovered file becomes one Lambda + HttpLambdaIntegration +
-        // HttpRoute. Method-name aliases (list/create/update/remove) are
-        // resolved upstream in `discoverRouteFiles`.
-        if (discoveredRoutes.length > 0) {
-            // De-duplicate: a misconfigured `src/routes/` (e.g. both
-            // `users/get.ts` and `users/list.ts`) would otherwise fail
-            // synth with a duplicate-route-key error from API Gateway.
-            // Surface the conflict early with a clear message instead.
-            const seenRouteKeys = new Set();
-            for (const route of discoveredRoutes) {
-                const routeKey = `${route.method} ${route.apiPath}`;
-                if (seenRouteKeys.has(routeKey)) {
-                    throw new Error(`[venturekit] Duplicate HTTP route detected: ${routeKey} ` +
-                        `(at ${route.handlerFile}). Method aliases like 'get' + 'list' ` +
-                        `or 'post' + 'create' both resolve to the same HTTP method on ` +
-                        `the same path — pick one per directory.`);
-                }
-                seenRouteKeys.add(routeKey);
-            }
-            // CloudFormation enforces a hard 500-resources-per-stack limit.
-            // Each route here translates to ~5 CFN resources (Function,
-            // Permission, Integration, Route, log-retention custom resource),
-            // so a stack with more than ~80 routes can't be deployed without
-            // sharding. Below the threshold we keep the simpler in-stack
-            // layout so existing test assertions (which inspect the parent
-            // template only) still find route Lambdas there. At or above the
-            // threshold we shard routes across nested stacks; CDK wires the
-            // cross-stack references for `api`, `role`, `lambdaSg`, `vpc`
-            // automatically via SSM Parameter passthrough.
-            const NESTED_STACK_THRESHOLD = 80;
-            const ROUTES_PER_NESTED_STACK = 50;
-            // Fixed, immutable nested-stack slot count.
-            //
-            // The bucketing function `stableSlotFor(slug, numSlots)` is a
-            // pure function of these two inputs. As long as `numSlots`
-            // never changes, every previously-deployed route keeps its
-            // slot — which means CloudFormation never has to migrate a
-            // route's `ApiGatewayV2::Route` resource across nested stack
-            // boundaries between deploys.
-            //
-            // That invariant is load-bearing. `ApiGatewayV2::Route` carries
-            // a unique `(method, path)` key at the API Gateway level, not
-            // just the CloudFormation level. If the same route key lives in
-            // two nested stacks (old + new) at the same moment, the create
-            // call fails with `Route with key <METHOD> <path> already exists
-            // for this API` because CFN updates nested stacks in parallel
-            // and has no cross-stack delete-before-create ordering.
-            //
-            // 16 slots × ~80 routes/slot (the CloudFormation per-stack 500-
-            // resource limit at ~5 CFN resources per route) gives ~1280
-            // routes of headroom — comfortably above anything we've seen
-            // in practice. Raising this number later would force a
-            // one-shot mass migration of every nested-stack route in every
-            // already-deployed project; don't do it casually.
-            const NUM_NESTED_STACK_SLOTS = 16;
-            if (discoveredRoutes.length <= NESTED_STACK_THRESHOLD) {
-                for (const route of discoveredRoutes) {
-                    this.createRouteFunction(route, projectName, stage, api, lambdaRole, lambdaSg, vpc);
-                }
-            }
-            else {
-                // Stable hash-based bucketing into a fixed, never-changing slot
-                // pool.
-                //
-                // The previous index-based scheme (`routes.slice(i, i+50)`)
-                // sliced the discovered-route array into fixed 50-route windows.
-                // Adding, removing, or renaming any single route shifted every
-                // later route by one position, which moved a tail of routes
-                // across a 50-route boundary into a different `RoutesN` nested
-                // stack. Combined with the unique `(method, path)` key carried
-                // by `ApiGatewayV2::Route`, this caused
-                // `Route with key <METHOD> <path> already exists for this API`
-                // deploy failures — CFN updates nested stacks in parallel, so
-                // the new route resource tries to register at API Gateway
-                // before the old one in the other nested stack is deleted.
-                //
-                // Hashing the slug into a fixed slot pool pins each route to a
-                // slot that's determined the first time it's deployed and
-                // never moves. Adding or removing siblings doesn't reshuffle
-                // anything; changing slot count is the only event that would —
-                // which is exactly why `NUM_NESTED_STACK_SLOTS` is a hard-coded
-                // constant rather than something derived from the route count.
-                const numSlots = NUM_NESTED_STACK_SLOTS;
-                const buckets = Array.from({ length: numSlots }, () => []);
-                for (const route of discoveredRoutes) {
-                    const slot = stableSlotFor(route.slug, numSlots);
-                    buckets[slot].push(route);
-                }
-                // Only materialise non-empty slots; an empty slot would synth an
-                // empty nested CloudFormation stack, which CDK rejects. Slot
-                // index (1-based, padded so the displayed name is stable as the
-                // bucket count grows) becomes the construct ID, ensuring a
-                // route's logical path stays the same as long as `numSlots`
-                // doesn't change.
-                buckets.forEach((batch, idx) => {
-                    if (batch.length === 0)
-                        return;
-                    new RoutesNestedStack(this, `Routes${idx + 1}`, {
-                        routes: batch,
-                        projectName,
-                        stage,
-                        api,
-                        role: lambdaRole,
-                        securityGroup: lambdaSg,
-                        vpc,
-                        envConfig: this.envConfig,
-                        ventureBaseEnv: this.ventureBaseEnv,
-                        projectDir: this.projectDir,
-                        skipBundling: this.skipBundling,
-                    });
-                });
-            }
-        }
-        // --- Standalone Lambda Functions ---
-        // Discover functions from src/functions/ and create Lambda functions.
-        // Naming convention: {project}-{stage}-fn-{name}
-        if (discoveredFunctions.length > 0) {
-            const functionIntents = infrastructure?.functions ?? [];
-            for (const fnFile of discoveredFunctions) {
-                const intent = functionIntents.find((f) => f.id === fnFile.name);
-                this.createStandaloneFunction(fnFile.name, fnFile.handlerFile, projectName, stage, projectDir, intent, lambdaRole, lambdaSg, vpc);
-            }
-        }
-        // --- Queue Consumer Lambda Functions ---
-        // Discover handlers from src/queues/ and wire them to SQS queues.
-        // Naming convention: {project}-{stage}-queue-{name}
-        if (discoveredQueues.length > 0) {
-            const queueIntents = infrastructure?.queues ?? [];
-            for (const qFile of discoveredQueues) {
-                const intent = queueIntents.find((q) => q.id === qFile.name);
-                this.createQueueConsumer(qFile.name, qFile.handlerFile, projectName, stage, projectDir, intent, lambdaRole, lambdaSg, vpc);
-            }
-        }
-        // --- Cron/Scheduled Task Lambda Functions ---
-        // Discover handlers from src/crons/ and wire them to EventBridge rules.
-        // Naming convention: {project}-{stage}-cron-{name}
-        if (discoveredCrons.length > 0) {
-            const scheduleIntents = infrastructure?.schedules ?? [];
-            for (const cFile of discoveredCrons) {
-                const intent = scheduleIntents.find((s) => s.id === cFile.name);
-                this.createCronHandler(cFile.name, cFile.handlerFile, projectName, stage, projectDir, intent, lambdaRole, lambdaSg, vpc);
-            }
-        }
-    }
-    /**
-     * Well-Architected: Reliability — RDS with stable logical ID so preset
-     * changes (e.g. nano→medium) perform an in-place instance class modify,
-     * not a replacement. Data is preserved because the CloudFormation resource
-     * identity stays the same.
-     *
-     * Well-Architected: Security — encrypted at rest, credentials in Secrets Manager
-     * Well-Architected: Reliability — automated backups, optional multi-AZ
-     * Well-Architected: Performance — instance type driven by intent.size
-     * Well-Architected: Operational Excellence — auto minor version upgrades
-     */
-    createDatabase(intent, projectName, stage, vpc, projectDir, vkCliVersion) {
-        // Stable logical ID: 'db-{intent.id}' — never changes when preset changes
-        const logicalId = `db-${intent.id}`;
-        const instanceType = this.sizeToInstanceType(intent.size || 'small');
-        const engine = intent.type === 'mysql'
-            ? rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0 })
-            : rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16 });
-        // Well-Architected: Security — place DB in isolated subnets when available
-        const subnetType = vpc.isolatedSubnets?.length
-            ? ec2.SubnetType.PRIVATE_ISOLATED
-            : ec2.SubnetType.PRIVATE_WITH_EGRESS;
-        // Common props shared between fresh-create and snapshot-restore
-        // paths. Pulled out so the two branches stay aligned on
-        // dataSafety / VPC / observability config.
-        const commonDbProps = {
-            engine,
-            instanceType,
-            vpc,
-            vpcSubnets: { subnetType },
-            // Well-Architected: Reliability — use dataSafety for removal policy
-            removalPolicy: this.toRemovalPolicy(),
-            deletionProtection: this.dataSafetyConfig.deletionProtection,
-            multiAz: intent.highAvailability ?? false,
-            // Well-Architected: Security — encryption at rest
-            storageEncrypted: intent.encrypted ?? true,
-            // Well-Architected: Reliability — automated backups
-            backupRetention: intent.backups !== false
-                ? cdk.Duration.days(intent.backupRetentionDays ?? 7)
-                : cdk.Duration.days(0),
-            // Well-Architected: Operational Excellence — auto minor version upgrades
-            autoMinorVersionUpgrade: true,
-            // Well-Architected: Performance — performance insights for medium+ presets
-            enablePerformanceInsights: intent.performanceInsights ?? this.envConfig.lambda.memoryMb >= 512,
-            // Well-Architected: Reliability — enhanced monitoring for medium+ presets
-            monitoringInterval: this.envConfig.lambda.memoryMb >= 512
-                ? cdk.Duration.seconds(60)
-                : undefined,
-        };
-        // Branch: snapshot-restore vs fresh-create.
-        //
-        // RDS doesn't expose the original master password from a snapshot,
-        // so `SnapshotCredentials.fromGeneratedSecret` rotates to a fresh
-        // password at restore time and stores it in Secrets Manager —
-        // identical surface to the fresh-create path's `Credentials.from
-        // GeneratedSecret`. Application code reads `instance.secret` either
-        // way, so the migration runner and Lambda env wiring downstream
-        // see no difference.
-        //
-        // `databaseName` is intentionally omitted on the snapshot branch:
-        // the database name is preserved from the snapshot, and passing
-        // a value here is rejected by RDS as conflicting input.
-        const instance = intent.restoreFromSnapshot
-            ? new rds.DatabaseInstanceFromSnapshot(this, logicalId, {
-                ...commonDbProps,
-                snapshotIdentifier: intent.restoreFromSnapshot,
-                credentials: rds.SnapshotCredentials.fromGeneratedSecret('postgres'),
-            })
-            : new rds.DatabaseInstance(this, logicalId, {
-                ...commonDbProps,
-                databaseName: intent.name || intent.id,
-                credentials: rds.Credentials.fromGeneratedSecret('postgres'),
-            });
-        // Well-Architected: Reliability — prevent accidental replacement
-        // CFN UpdateReplacePolicy ensures data safety on resource property changes
-        const cfnInstance = instance.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnInstance.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // Well-Architected: Reliability — retain the master credentials secret
-        // alongside the DB it unlocks. Without this, a stack delete schedules
-        // the secret for permanent deletion (default 7-day window) while the
-        // DB itself survives via RemovalPolicy.RETAIN. Operators recovering
-        // an orphaned DB then face a useless instance whose master password
-        // is gone — they have to `aws rds modify-db-instance
-        // --master-user-password` to a new value, which invalidates every
-        // application credential rotation that referenced the original
-        // secret. Applying RETAIN here keeps the DB and its credentials in
-        // sync, so `cdk import` (or `vk deploy --import-existing-resources`)
-        // can reattach both cleanly. Mirrored UpdateReplacePolicy keeps the
-        // secret safe across CFN-driven replacements too.
-        //
-        // ─── Subtle: don't use `instance.secret` ──────────────────────────
-        // `instance.secret` returns a `SecretTargetAttachment` — CDK's L2
-        // wrapper around `AWS::SecretsManager::SecretTargetAttachment`,
-        // which is just metadata pointing the secret at the DB. Applying
-        // RETAIN to *that* only retains the attachment metadata; the
-        // underlying `AWS::SecretsManager::Secret` (the resource that
-        // holds the generated password) still goes through CFN's default
-        // delete-on-stack-delete flow. `Credentials.fromGeneratedSecret`
-        // / `SnapshotCredentials.fromGeneratedSecret` create the actual
-        // Secret as a sibling child of the DB construct under the
-        // well-known id `'Secret'`, so we walk to it directly.
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            const dbSecret = instance.node.tryFindChild('Secret');
-            if (dbSecret) {
-                dbSecret.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
-                const cfnSecret = dbSecret.node.defaultChild;
-                if (cfnSecret) {
-                    cfnSecret.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-                }
-            }
-        }
-        new cdk.CfnOutput(this, `${logicalId}-endpoint`, {
-            value: instance.dbInstanceEndpointAddress,
-            description: `Database endpoint for ${intent.id}`,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-secret-arn`, {
-            value: instance.secret?.secretArn || '',
-            description: `Database secret ARN for ${intent.id}`,
-        });
-        // --- Auto-run migrations on every deploy ---
-        // The in-VPC CodeBuild runner closes the long-standing gap where
-        // public CI runners can't reach a private RDS. We wire it only for
-        // Postgres (the only engine `@venturekit/data` has a runner for) and
-        // only when the consumer has at least one `.sql` file in
-        // `db/migrations/`. Failures roll back the stack via the custom
-        // resource, making migrations atomic with `vk deploy`.
-        if (intent.type === 'postgres' && instance.secret) {
-            const dbDir = path.join(projectDir, 'db');
-            if (hasMigrations(dbDir)) {
-                // The runner's CodeBuild job lives inside this stack's VPC so it
-                // can reach the private RDS, but its buildspec still needs public
-                // egress to `npm install -g @venturekit/cli` and to ship logs +
-                // build updates to the AWS control plane. When `natType: 'none'`
-                // the private subnets have no default route at all — every
-                // outbound call from the build times out and CFN reports a bare
-                // "Migration build ... ended with status FAILED" on first
-                // deploy. Skipping the runner here, with a loud warning pointing
-                // at the operator's two options, keeps the deploy green and
-                // surfaces the actual decision (enable a NAT provider, or
-                // migrate manually via a tunnel). Every preset except `free`
-                // now ships a NAT provider by default (instance for
-                // nano/micro/medium, gateway for large), so this branch is only
-                // reached when the operator explicitly opts out with
-                // `natType: 'none'`.
-                if (this.envConfig.vpc.natType === 'none') {
-                    console.warn(`[venturekit] Skipping auto-migrations for db "${intent.id}": ` +
-                        `natType is 'none', so the in-VPC migration runner can't ` +
-                        `reach npmjs.com to install @venturekit/cli. Fix: set ` +
-                        `'infrastructure.vpc.natType: "instance"' (or "gateway") in ` +
-                        `vk.config.ts. Until then, run \`vk migrate -e ${stage}\` ` +
-                        `manually once the DB is reachable (e.g. via SSM tunnel).`);
-                }
-                else {
-                    new MigrationRunner(this, `migration-runner-${intent.id}`, {
-                        projectName,
-                        stage,
-                        dbId: intent.id,
-                        vpc,
-                        dbInstance: instance,
-                        dbSecret: instance.secret,
-                        dbName: intent.name || intent.id,
-                        dbDir,
-                        // Merge in any `migrations/` dirs shipped by installed
-                        // `@venturekit/*` packages (resolved at the top of the
-                        // constructor via `discoverPackageMigrationDirs`). The
-                        // runner's `mergeDbDir` overlays them on top of the
-                        // project's own SQL files; collisions throw at synth
-                        // time (we never silently overwrite).
-                        extraMigrationsDirs: this.packageMigrationsDirs,
-                        vkCliVersion,
-                        logRetentionDays: this.envConfig.observability.logs.retentionDays,
-                    });
-                }
-            }
-        }
-        else if (intent.type === 'mysql') {
-            // MySQL projects: no auto-migration runner yet because
-            // `@venturekit/data` only ships a Postgres SQL runner. Operators
-            // must still run migrations manually via a tunnel.
-            console.warn(`[venturekit] MySQL auto-migrations are not yet supported (db: ${intent.id}). ` +
-                `Run \`vk migrate\` manually after deploy until @venturekit/data adds a MySQL runner.`);
-        }
-        return instance;
-    }
-    /**
-     * Well-Architected: Security — block public access by default, SSE encryption
-     * Well-Architected: Reliability — versioning for backups, dataSafety removal policy
-     * Well-Architected: Cost — lifecycle rules for logs/backups to reduce storage cost
-     * Well-Architected: Sustainability — intelligent tiering for infrequent access
-     */
-    createStorage(intent, projectName, stage) {
-        // Stable logical ID: 'storage-{intent.id}'
-        const logicalId = `storage-${intent.id}`;
-        const bucket = new s3.Bucket(this, logicalId, {
-            bucketName: `${projectName}-${intent.id}-${stage}`,
-            versioned: intent.versioned ?? intent.purpose === 'backups',
-            removalPolicy: this.toRemovalPolicy(),
-            autoDeleteObjects: this.dataSafetyConfig.removalPolicy === 'destroy',
-            // Well-Architected: Security — encryption at rest
-            encryption: s3.BucketEncryption.S3_MANAGED,
-            // Well-Architected: Security — bucket is always fully private.
-            // When `intent.cdn === true` we still keep BlockPublicAccess.BLOCK_ALL
-            // and front the bucket with a CloudFront distribution that uses an
-            // Origin Access Control (OAC). CloudFront accesses S3 via the
-            // service principal under a `aws:SourceArn` condition added by
-            // `S3BucketOrigin.withOriginAccessControl()` to the bucket policy,
-            // so anonymous direct-S3 GETs stay forbidden.
-            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-            // Well-Architected: Security — enforce SSL
-            enforceSSL: true,
-            cors: intent.corsOrigins
-                ? [
-                    {
-                        allowedOrigins: intent.corsOrigins,
-                        allowedMethods: [
-                            s3.HttpMethods.GET,
-                            s3.HttpMethods.PUT,
-                            s3.HttpMethods.POST,
-                            s3.HttpMethods.DELETE,
-                        ],
-                        allowedHeaders: ['*'],
-                    },
-                ]
-                : undefined,
-            // Well-Architected: Cost — lifecycle rules for logs and backups
-            lifecycleRules: intent.purpose === 'logs'
-                ? [{ expiration: cdk.Duration.days(intent.retentionDays ?? 90), id: 'log-expiry' }]
-                : intent.purpose === 'backups'
-                    ? [
-                        { transitions: [{ storageClass: s3.StorageClass.INFREQUENT_ACCESS, transitionAfter: cdk.Duration.days(30) }], id: 'backup-ia' },
-                        { transitions: [{ storageClass: s3.StorageClass.GLACIER, transitionAfter: cdk.Duration.days(90) }], id: 'backup-glacier' },
-                    ]
-                    : [],
-        });
-        // Well-Architected: Reliability — UpdateReplacePolicy for stateful resources
-        const cfnBucket = bucket.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnBucket.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        new cdk.CfnOutput(this, `${logicalId}-bucket-name`, {
-            value: bucket.bucketName,
-            description: `S3 bucket name for ${intent.id}`,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-bucket-arn`, {
-            value: bucket.bucketArn,
-            description: `S3 bucket ARN for ${intent.id}`,
-        });
-        // Optional CloudFront distribution in front of the (still-private)
-        // bucket. Enabled by `intent.cdn === true`. The distribution uses an
-        // Origin Access Control (OAC), which is the modern replacement for
-        // OAI: `S3BucketOrigin.withOriginAccessControl(bucket)` auto-creates
-        // the OAC resource and appends a bucket-policy statement granting
-        // `s3:GetObject` to the CloudFront service principal under an
-        // `aws:SourceArn` condition pinned to this distribution. Result:
-        // anonymous viewers can GET image bytes through the CDN, but direct
-        // S3 URLs continue to return 403.
-        //
-        // The distribution's domain name is exposed as a CfnOutput and is
-        // injected into every Lambda as `STORAGE_<ID>_CDN_URL` (and as
-        // `VENTURE_STORAGE_CDN_URL` for the primary intent) in the
-        // role-wiring block below, so application code can build public
-        // URLs without an extra Outputs lookup.
-        let distribution;
-        let cdnAlias;
-        if (intent.cdn === true) {
-            // Optional alternate domain (CNAME) + ACM cert. CloudFront only
-            // accepts certs from `us-east-1`, so the ARN MUST come from there
-            // regardless of which region the rest of the stack runs in. The
-            // CLI helper for this is:
-            //
-            //   vk cert request --domain cdn.example.com --region us-east-1
-            //
-            // followed by pasting the issued ARN into `cdnCertificateArn`.
-            // An empty-string `cdnCertificateArn` is the same "pending"
-            // sentinel used by `DomainIntent.certificateArn`: skip the alias
-            // and let the distribution serve at its auto-generated
-            // `*.cloudfront.net` hostname until the next deploy.
-            const aliasReady = typeof intent.cdnDomain === 'string' &&
-                intent.cdnDomain.length > 0 &&
-                typeof intent.cdnCertificateArn === 'string' &&
-                intent.cdnCertificateArn.length > 0;
-            let aliasProps = {};
-            if (aliasReady) {
-                aliasProps = {
-                    domainNames: [intent.cdnDomain],
-                    certificate: acm.Certificate.fromCertificateArn(this, `${logicalId}-cdn-cert`, intent.cdnCertificateArn),
-                };
-                cdnAlias = intent.cdnDomain;
-            }
-            else if (typeof intent.cdnDomain === 'string' &&
-                intent.cdnDomain.length > 0) {
-                // Domain declared but cert ARN not filled in yet — surface a
-                // hint so operators know exactly what to run, mirroring the
-                // pending-domain CfnOutput in `--- Custom Domains ---`.
-                new cdk.CfnOutput(this, `${logicalId}-cdn-alias-pending`, {
-                    value: `Run \`vk cert request --domain ${intent.cdnDomain} --region us-east-1\` to activate.`,
-                    description: `CDN alias ${intent.cdnDomain} is pending — no ACM cert ARN yet.`,
-                });
-            }
-            distribution = new cloudfront.Distribution(this, `${logicalId}-cdn`, {
-                comment: `${projectName}-${intent.id}-${stage}`,
-                defaultBehavior: {
-                    origin: cloudfrontOrigins.S3BucketOrigin.withOriginAccessControl(bucket),
-                    viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-                    allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
-                    cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
-                    cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
-                    compress: true,
-                },
-                priceClass: cloudfront.PriceClass.PRICE_CLASS_100,
-                enabled: true,
-                ...aliasProps,
-            });
-            // Well-Architected: Reliability — RETAIN the distribution under
-            // strict dataSafety. Distributions are slow to create (~15-30 min
-            // for the global edge rollout), have a stable `*.cloudfront.net`
-            // domain that consumers may cache, and re-issuing the ACM cert
-            // requires re-doing DNS validation. RETAIN means an accidental
-            // stack delete leaves the distribution in place for `cdk import`.
-            if (this.dataSafetyConfig.removalPolicy === 'retain') {
-                const cfnDistribution = distribution.node.defaultChild;
-                cfnDistribution.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
-                cfnDistribution.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-            }
-            new cdk.CfnOutput(this, `${logicalId}-cdn-domain`, {
-                value: distribution.distributionDomainName,
-                description: `CloudFront domain for ${intent.id}`,
-            });
-            if (cdnAlias) {
-                // Reminder for operators: the alias only resolves once the
-                // matching DNS record points at the distribution. Print the
-                // exact target so this isn't lost in the CFN output noise.
-                new cdk.CfnOutput(this, `${logicalId}-cdn-alias`, {
-                    value: `${cdnAlias} → ${distribution.distributionDomainName} (create a CNAME / Cloudflare proxy record)`,
-                    description: `CDN alias for ${intent.id}`,
-                });
-            }
-        }
-        // Tracked for post-role wiring: the shared Lambda execution role is
-        // created later in the constructor (only when the stack actually has
-        // Lambdas), so we record the bucket here and grant + inject env vars
-        // alongside the database / Cognito wiring once the role exists.
-        this.storageBuckets.push({ bucket, intent, distribution, cdnAlias });
-    }
-    /**
-     * Well-Architected: Security — Cognito with advanced security features,
-     * stable logical ID for safe preset upgrades.
-     * Well-Architected: Reliability — dataSafety-driven removal policy
-     */
-    createAuth(intent, projectName, stage) {
-        // Stable logical ID: 'auth-{intent.id}'
-        const logicalId = `auth-${intent.id}`;
-        const passwordPolicy = intent.passwordStrength === 'strong'
-            ? {
-                minLength: 12,
-                requireLowercase: true,
-                requireUppercase: true,
-                requireDigits: true,
-                requireSymbols: true,
-            }
-            : {
-                minLength: 8,
-                requireLowercase: true,
-                requireUppercase: true,
-                requireDigits: true,
-                requireSymbols: false,
-            };
-        // Custom user attributes — declared as mutable strings so the same
-        // names show up as `custom:<name>` claims in the issued JWTs (and so
-        // `vk dev`'s cognito-local provisioning, which mirrors this Schema,
-        // matches production exactly). All app code that reads
-        // `custom:tenantId` etc. relies on these being declared on the pool.
-        const customAttrNames = Array.isArray(intent.customAttributes)
-            ? intent.customAttributes
-            : [];
-        const customAttributes = {};
-        for (const name of customAttrNames) {
-            customAttributes[name] = new cognito.StringAttribute({
-                minLen: 1,
-                maxLen: 2048,
-                mutable: true,
-            });
-        }
-        const userPool = new cognito.UserPool(this, logicalId, {
-            userPoolName: `${projectName}-${intent.id}-${stage}`,
-            // Security default: self-signup disabled unless the intent explicitly
-            // opts in. Most production apps use invite flows; opt in with
-            // `allowSignUp: true` on the auth intent if you run a consumer product.
-            selfSignUpEnabled: intent.allowSignUp ?? false,
-            // `phone` flips on Cognito's `phone_number` alias attribute so a
-            // single user can authenticate with either email or phone without
-            // a duplicate account. `signInWith: ['email', 'phone']` therefore
-            // mirrors the §1 user model where buyers register with one and
-            // log in with the other interchangeably.
-            signInAliases: {
-                email: intent.signInWith?.includes('email') ?? true,
-                phone: intent.signInWith?.includes('phone') ?? false,
-                username: intent.signInWith?.includes('username') ?? false,
-            },
-            autoVerify: {
-                email: intent.signInWith?.includes('email') ?? true,
-                phone: intent.signInWith?.includes('phone') ?? false,
-            },
-            passwordPolicy,
-            mfa: intent.mfa === 'required'
-                ? cognito.Mfa.REQUIRED
-                : intent.mfa === 'optional'
-                    ? cognito.Mfa.OPTIONAL
-                    : cognito.Mfa.OFF,
-            // Well-Architected: Reliability — dataSafety removal policy
-            removalPolicy: this.toRemovalPolicy(),
-            // Well-Architected: Reliability — native deletion protection on top of
-            // RETAIN. `DeletionPolicy=Retain` only blocks CFN-driven deletes; the
-            // user pool can still be deleted via console / API / CLI. Cognito's
-            // native deletionProtection flag blocks that path too. Both layers
-            // must be explicitly disabled before the pool can be deleted, and
-            // every flip is CloudTrail-logged. Losing a Cognito User Pool means
-            // losing every user identity + password hash — the most catastrophic
-            // recoverable state in a VentureKit deploy, since users must re-
-            // register via password reset.
-            deletionProtection: this.dataSafetyConfig.removalPolicy === 'retain',
-            // Well-Architected: Security — advanced security mode for medium+ presets
-            advancedSecurityMode: this.envConfig.lambda.memoryMb >= 512
-                ? cognito.AdvancedSecurityMode.ENFORCED
-                : undefined,
-            // Well-Architected: Security — account recovery via verified email
-            accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
-            ...(customAttrNames.length > 0 ? { customAttributes } : {}),
-        });
-        // Stash the pool so the shared Lambda role (created later in the
-        // constructor, see `if (hasAnyLambda)`) can be granted admin
-        // Cognito actions scoped to this pool's ARN. Without that grant,
-        // any handler that calls `AdminConfirmSignUp`, `AdminCreateUser`
-        // etc. fails at runtime with `AccessDeniedException` — the public
-        // `SignUp` / `InitiateAuth` calls work without IAM, but the admin
-        // surface that self-service register flows almost always need
-        // does not.
-        this.userPools.push(userPool);
-        // Well-Architected: Reliability — prevent accidental replacement
-        const cfnPool = userPool.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnPool.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // Create clients
-        const clients = intent.clients && intent.clients.length > 0
-            ? intent.clients
-            : [{ name: 'default' }];
-        // When the intent declares federated providers, the federated
-        // sign-in helper in `@venturekit/auth/server` mints session tokens
-        // through `AdminInitiateAuth` after creating/looking up the user
-        // via `AdminCreateUser` / `AdminGetUser`. That flow needs
-        // `ALLOW_ADMIN_USER_PASSWORD_AUTH` enabled on the app client —
-        // password sign-in keeps using the public `USER_PASSWORD_AUTH`
-        // path so we leave both turned on.
-        const federatedProviders = Array.isArray(intent.federated)
-            ? intent.federated
-            : [];
-        const enableAdminAuth = federatedProviders.length > 0;
-        let primaryClientId = '';
-        for (const client of clients) {
-            const appClient = userPool.addClient(client.name, {
-                authFlows: {
-                    userPassword: true,
-                    userSrp: true,
-                    ...(enableAdminAuth ? { adminUserPassword: true } : {}),
-                },
-                // Well-Architected: Security — prevent user existence errors
-                preventUserExistenceErrors: true,
-            });
-            if (!primaryClientId) {
-                primaryClientId = appClient.userPoolClientId;
-            }
-        }
-        new cdk.CfnOutput(this, `${logicalId}-user-pool-id`, {
-            value: userPool.userPoolId,
-            description: `Cognito User Pool ID for ${intent.id}`,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-client-id`, {
-            value: primaryClientId,
-            description: `Cognito Client ID for ${intent.id}`,
-        });
-        // Auto-inject the user-pool and app-client IDs into every Lambda's
-        // environment so `@venturekit/auth/server`'s `loadAuthServerConfig()`
-        // resolves without manual operator intervention. We use the FIRST
-        // declared `auth` intent as the canonical pool — multi-pool projects
-        // are rare, and consumers can always override with explicit
-        // `envVars` entries on the intent.
-        //
-        // Lambdas already have `AWS_REGION` set automatically by Lambda, and
-        // `loadAuthServerConfig()` falls back to it when `COGNITO_REGION`
-        // isn't present, so we don't set the region here. (Setting
-        // `AWS_REGION` ourselves is rejected by Lambda as a reserved key.)
-        if (!('COGNITO_USER_POOL_ID' in this.ventureBaseEnv)) {
-            this.ventureBaseEnv['COGNITO_USER_POOL_ID'] = userPool.userPoolId;
-            this.ventureBaseEnv['COGNITO_APP_CLIENT_ID'] = primaryClientId;
-        }
-        // ── Federated identity providers ──────────────────────────────
-        // For each declared third-party provider create a Secrets Manager
-        // placeholder holding `{clientId, clientSecret}`. Operators paste
-        // the real values from the Google Cloud / Meta for Developers /
-        // Apple Developer console after the first deploy via
-        //   aws secretsmanager put-secret-value --secret-id <arn> \
-        //     --secret-string '{"clientId":"…","clientSecret":"…"}'
-        //
-        // The ARN is injected as `COGNITO_FEDERATED_<PROVIDER>_SECRET_ARN`
-        // on every Lambda; `secretsmanager:GetSecretValue` is granted on
-        // the secret in the shared-Lambda-role wiring later in the
-        // constructor (next to the user-pool admin grants).
-        //
-        // VentureKit deliberately does NOT enable the Cognito Hosted UI
-        // or wire these as Cognito Identity Providers — your app owns the
-        // login screen. The SPA performs the OAuth dance with the IdP
-        // directly and posts the resulting id_token / access_token to
-        // your API; `signInAsFederatedUser` from `@venturekit/auth/server`
-        // verifies it and mints Cognito session tokens via
-        // `AdminInitiateAuth`.
-        for (const provider of federatedProviders) {
-            const secret = new secretsmanager.Secret(this, `${logicalId}-federated-${provider}`, {
-                secretName: `venturekit/${projectName}/${stage}/auth/${intent.id}/${provider}`,
-                description: `OAuth client credentials for ${provider} federated sign-in ` +
-                    `on auth pool '${intent.id}'. Populate after first deploy.`,
-                secretObjectValue: {
-                    clientId: cdk.SecretValue.unsafePlainText('PLACEHOLDER'),
-                    clientSecret: cdk.SecretValue.unsafePlainText('PLACEHOLDER'),
-                },
-                // Well-Architected: Reliability — federated provider credentials
-                // are operator-set values pasted from the third-party developer
-                // console (Google Cloud, Meta for Developers, Apple Developer).
-                // They can be re-generated by the operator but require manually
-                // revisiting that console; we'd rather not force that on every
-                // stack-replace event. Promote to RETAIN under strict dataSafety
-                // so accidental stack deletes don't wipe them.
-                removalPolicy: this.toRemovalPolicy(),
-            });
-            this.federatedAuthSecrets.push(secret);
-            const envVar = `COGNITO_FEDERATED_${provider.toUpperCase()}_SECRET_ARN`;
-            this.ventureBaseEnv[envVar] = secret.secretArn;
-            new cdk.CfnOutput(this, `${logicalId}-federated-${provider}-secret-arn`, {
-                value: secret.secretArn,
-                description: `Populate with the ${provider} OAuth client credentials: ` +
-                    `aws secretsmanager put-secret-value --secret-id <arn> ` +
-                    `--secret-string '{"clientId":"…","clientSecret":"…"}'`,
-            });
-        }
-    }
-    /**
-     * Provision SES + outbox infrastructure for one `NotifyIntent`.
-     *
-     * Resources created here:
-     *   - One SES email or domain identity (drives DKIM + verified-from).
-     *   - One SES configuration set with an event destination publishing
-     *     bounce / complaint / delivery / open / click events to an
-     *     SNS topic.
-     *   - The SNS topic itself (`{project}-{stage}-notify-{id}-events`).
-     *   - A Secrets Manager secret for the WhatsApp Cloud API token,
-     *     when `'whatsapp'` is in `channels`. The value is left as a
-     *     placeholder; the operator pastes the Meta token after first
-     *     deploy via the AWS console (the secret rotation knob would be
-     *     a Phase 2 enhancement once token rotation is part of the API).
-     *   - When `domain` AND `hostedZoneId` are both set, Route53 CNAME
-     *     records for the three SES DKIM tokens, plus an MX + TXT record
-     *     on the MAIL FROM subdomain. Without `hostedZoneId`, the
-     *     records are emitted as stack outputs and the operator
-     *     publishes them manually.
-     *
-     * Resources NOT created here: dispatcher cron Lambda, bounce-handler
-     * Lambda, IAM grants on the shared role. Those need the role + VPC
-     * + SG which only exist later in the constructor — see
-     * `provisionNotifyHandlers` below.
-     */
-    createNotify(intent, projectName, stage) {
-        const logicalId = `notify-${intent.id}`;
-        const channels = Array.isArray(intent.channels) ? intent.channels : [];
-        // Stable, predictable resource names. Avoid hashing — operators
-        // often grep CloudFormation outputs / IAM policies for the
-        // intent id and silent hashes break that workflow.
-        const configurationSetName = intent.configurationSetName ?? `${projectName}-${stage}-notify-${intent.id}`;
-        // ── SNS events topic ────────────────────────────────────────────
-        // Receives every SES event for this configuration set. Subscribed
-        // to by the bounce-handler Lambda (provisioned later) and
-        // optionally by external observability tools. Encryption at rest
-        // with the AWS-managed key — events occasionally contain
-        // recipient PII (bounce diagnostic emails) which we don't want
-        // sitting unencrypted in case of an account compromise.
-        const eventsTopic = new sns.Topic(this, `${logicalId}-events`, {
-            topicName: `${projectName}-${stage}-notify-${intent.id}-events`,
-            displayName: `VentureKit notify events for ${intent.id} (${stage})`,
-            masterKey: undefined, // AWS-managed encryption is fine; KMS CMK
-            // would add cost + key-policy maintenance
-            // for a topic only consumed by our own
-            // Lambda + the operator's SNS console.
-        });
-        // Well-Architected: Reliability — RETAIN the events topic under
-        // strict dataSafety. SNS topics carry durable subscriptions (the
-        // bounce-handler Lambda is one; operators may attach additional
-        // subscribers via the console for observability tools or paging).
-        // Deleting the topic silently drops every subscription; re-creating
-        // the topic does NOT restore them. RETAIN means an accidental stack
-        // delete leaves the topic + subscriptions in place for recovery.
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            const cfnEventsTopic = eventsTopic.node.defaultChild;
-            cfnEventsTopic.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
-            cfnEventsTopic.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        new cdk.CfnOutput(this, `${logicalId}-events-topic-arn`, {
-            value: eventsTopic.topicArn,
-            description: `SES events SNS topic for notify '${intent.id}'`,
-        });
-        // ── SES email identity ──────────────────────────────────────────
-        // Two paths depending on what the intent declared:
-        //   - `domain` set        → verify the whole domain. SES creates
-        //                            DKIM tokens; we publish the matching
-        //                            CNAMEs in Route53 when `hostedZoneId`
-        //                            is set.
-        //   - `defaultFrom` only  → verify a single email address. SES
-        //                            sends a verification email to it;
-        //                            sending is blocked until the
-        //                            recipient clicks through. Useful for
-        //                            sandbox / dev where the operator
-        //                            doesn't own the domain DNS.
-        let identityArn;
-        if (intent.domain) {
-            const domainIdentity = new ses.EmailIdentity(this, `${logicalId}-domain`, {
-                identity: ses.Identity.domain(intent.domain),
-                configurationSet: undefined, // attached to per-send command, not identity
-                dkimSigning: true,
-                feedbackForwarding: false, // we use the configuration set
-                // event destination instead — no need
-                // for SES to email the operator on
-                // every bounce.
-            });
-            identityArn = `arn:${cdk.Aws.PARTITION}:ses:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:identity/${intent.domain}`;
-            // CDK's `EmailIdentity` exposes the three DKIM token pairs as
-            // discrete properties (`dkimDnsTokenName1/2/3` +
-            // `dkimDnsTokenValue1/2/3`), not as arrays. We tuple them up
-            // here so the loop below stays uniform.
-            const dkimTokens = [
-                { name: domainIdentity.dkimDnsTokenName1, value: domainIdentity.dkimDnsTokenValue1 },
-                { name: domainIdentity.dkimDnsTokenName2, value: domainIdentity.dkimDnsTokenValue2 },
-                { name: domainIdentity.dkimDnsTokenName3, value: domainIdentity.dkimDnsTokenValue3 },
-            ];
-            // DKIM token outputs — operator publishes these as CNAMEs in DNS
-            // unless we own the zone (Route53 path below).
-            dkimTokens.forEach((tok, i) => {
-                new cdk.CfnOutput(this, `${logicalId}-dkim-${i + 1}-record`, {
-                    value: `${tok.name}.${intent.domain} CNAME ${tok.value}.dkim.amazonses.com`,
-                    description: `DKIM CNAME #${i + 1} for ${intent.domain} — publish in DNS`,
-                });
-            });
-            if (intent.hostedZoneId) {
-                const zone = route53.HostedZone.fromHostedZoneAttributes(this, `${logicalId}-zone`, {
-                    hostedZoneId: intent.hostedZoneId,
-                    zoneName: intent.domain,
-                });
-                // Auto-publish the three DKIM CNAMEs. Route53 charges $0.50
-                // per hosted zone + $0.40 per million queries — these records
-                // are queried only by SES so the cost is negligible.
-                dkimTokens.forEach((tok, i) => {
-                    new route53.CnameRecord(this, `${logicalId}-dkim-record-${i + 1}`, {
-                        zone,
-                        // The token names from CDK are unqualified (e.g. `abc123`);
-                        // SES requires the full `<token>._domainkey.<domain>` form.
-                        // Route53 appends the zone automatically when `recordName`
-                        // is unqualified, so we just pass the SES-style label.
-                        recordName: `${tok.name}._domainkey`,
-                        domainName: `${tok.value}.dkim.amazonses.com`,
-                        ttl: cdk.Duration.minutes(5),
-                    });
-                });
-                // Custom MAIL FROM subdomain (`mail.<domain>`) improves DMARC
-                // alignment by making the SMTP envelope-sender match the From
-                // domain. SES requires an MX record on the subdomain pointing
-                // at `feedback-smtp.<region>.amazonses.com` plus a TXT record
-                // for SPF. We don't auto-enable in Phase 1 — turning it on
-                // mid-life would temporarily break sending if the records
-                // aren't published — but emit the recommendation as an output.
-                new cdk.CfnOutput(this, `${logicalId}-mail-from-suggestion`, {
-                    value: `mail.${intent.domain}`,
-                    description: `Suggested MAIL FROM subdomain — enable in SES console for SPF alignment`,
-                });
-            }
-            new cdk.CfnOutput(this, `${logicalId}-domain-identity`, {
-                value: intent.domain,
-                description: `SES domain identity for notify '${intent.id}'`,
-            });
-        }
-        else if (intent.defaultFrom) {
-            new ses.EmailIdentity(this, `${logicalId}-email`, {
-                identity: ses.Identity.email(intent.defaultFrom),
-                // No DKIM signing on single-address identities — SES doesn't
-                // support DKIM without a verified domain.
-                feedbackForwarding: false,
-            });
-            identityArn = `arn:${cdk.Aws.PARTITION}:ses:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:identity/${intent.defaultFrom}`;
-            new cdk.CfnOutput(this, `${logicalId}-email-identity`, {
-                value: intent.defaultFrom,
-                description: `SES email identity for notify '${intent.id}'. ` +
-                    `Verify by clicking the SES email sent to this address on first deploy.`,
-            });
-        }
-        else {
-            throw new Error(`[venturekit] notify intent '${intent.id}' must declare either ` +
-                `'defaultFrom' (single-address SES identity) or 'domain' (DomainIdentity).`);
-        }
-        // ── Configuration set + event destination ───────────────────────
-        // The configuration set is attached at send-time (every
-        // SendEmailCommand carries `ConfigurationSetName`). Its event
-        // destination publishes selected event types to the SNS topic
-        // above. We subscribe to bounce/complaint always (suppression
-        // logic depends on them), plus delivery/open/click for
-        // observability. Reject — SES rejecting a send for content
-        // reasons — is implicit (the SendEmail call throws synchronously
-        // and the dispatcher captures it without needing the event).
-        const configSet = new ses.ConfigurationSet(this, `${logicalId}-config-set`, {
-            configurationSetName,
-            sendingEnabled: true,
-            reputationMetrics: true, // surface deliverability metrics in
-            // CloudWatch — free, helpful for
-            // operators chasing soft-bounce rates.
-            tlsPolicy: ses.ConfigurationSetTlsPolicy.REQUIRE,
-        });
-        new ses.ConfigurationSetEventDestination(this, `${logicalId}-event-dest`, {
-            configurationSet: configSet,
-            destination: ses.EventDestination.snsTopic(eventsTopic),
-            events: [
-                ses.EmailSendingEvent.SEND,
-                ses.EmailSendingEvent.REJECT,
-                ses.EmailSendingEvent.BOUNCE,
-                ses.EmailSendingEvent.COMPLAINT,
-                ses.EmailSendingEvent.DELIVERY,
-                ses.EmailSendingEvent.OPEN,
-                ses.EmailSendingEvent.CLICK,
-            ],
-            enabled: true,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-config-set-name`, {
-            value: configurationSetName,
-            description: `SES configuration set name for notify '${intent.id}'`,
-        });
-        // ── WhatsApp token secret ───────────────────────────────────────
-        let whatsappTokenSecret;
-        if (channels.includes('whatsapp')) {
-            if (!intent.whatsapp?.phoneNumberId) {
-                throw new Error(`[venturekit] notify intent '${intent.id}' has 'whatsapp' channel ` +
-                    `but no 'whatsapp.phoneNumberId'. Set it from Meta Business Suite ` +
-                    `→ WhatsApp → API Setup.`);
-            }
-            whatsappTokenSecret = new secretsmanager.Secret(this, `${logicalId}-whatsapp-token`, {
-                secretName: `venturekit/${projectName}/${stage}/notify-${intent.id}-whatsapp-token`,
-                description: `Meta WhatsApp Cloud API access token for notify '${intent.id}'. ` +
-                    `Set the value via the Secrets Manager console after first deploy.`,
-                // The secret is created with a placeholder — the operator
-                // pastes the real Meta token via the console. Auto-rotation
-                // is not wired (Meta tokens are long-lived; rotation is a
-                // Phase 2 concern).
-                secretStringValue: cdk.SecretValue.unsafePlainText('PLACEHOLDER_SET_VALUE_AFTER_DEPLOY'),
-                removalPolicy: this.toRemovalPolicy(),
-            });
-            new cdk.CfnOutput(this, `${logicalId}-whatsapp-token-arn`, {
-                value: whatsappTokenSecret.secretArn,
-                description: `Set the value of this secret to your Meta WhatsApp access token: ` +
-                    `aws secretsmanager put-secret-value --secret-id <arn> --secret-string '<token>'`,
-            });
-        }
-        this.notifyConfigs.push({
-            intent,
-            configurationSetName,
-            eventsTopic,
-            identityArn,
-            whatsappTokenSecret,
-        });
-    }
-    /**
-     * Auto-provision the dispatcher cron Lambda + the bounce-handler
-     * Lambda subscribed to the SES events SNS topic, for every notify
-     * intent.
-     *
-     * Implementation notes:
-     *
-     * - The Lambdas import a stub shipped inside `@venturekit/notify`
-     *   (`runtime/dispatcher-stub.ts`, `runtime/bounce-handler-stub.ts`).
-     *   At synth time we copy the stub into the project's `.vk/` dir
-     *   alongside a generated `notify-client-import.ts` shim that
-     *   re-exports the consumer's `notify` instance from
-     *   `VENTURE_NOTIFY_CLIENT_MODULE` (default `src/lib/notify.ts`).
-     *   esbuild then bundles the whole closure into the Lambda — the
-     *   consumer's notify config + every provider + the @venturekit
-     *   runtime, all in one deploy artefact.
-     *
-     * - We re-use the shared Lambda role for these handlers. Permissions:
-     *   - SES + secrets grants are already attached above
-     *     (`provisionNotifyHandlers` is called from the same block).
-     *   - SNS topic subscription + invocation perms are added by CDK
-     *     when we wire `topic.addSubscription(LambdaSubscription)`.
-     *
-     * - VPC attachment: yes, when the project has a VPC. The dispatcher
-     *   needs DB access (Postgres outbox + preferences); the bounce
-     *   handler also writes `notification_event_log`.
-     */
-    provisionNotifyHandlers(projectName, stage, projectDir, role, securityGroup, vpc) {
-        // Resolve the path to the stubs inside the consumer's
-        // `node_modules/@venturekit/notify`. We use Node's resolver via a
-        // module-relative `require.resolve` pinned at the consumer's
-        // `package.json`. If `@venturekit/notify` isn't a project
-        // dependency we throw with a helpful message — declaring a
-        // notify intent in vk.config.ts without installing the runtime
-        // package is a frequent first-time-user mistake.
-        const projectRequire = createRequire(path.join(projectDir, 'package.json'));
-        let dispatcherStubSrc;
-        let bounceStubSrc;
-        try {
-            dispatcherStubSrc = projectRequire.resolve('@venturekit/notify/runtime/dispatcher-stub');
-            bounceStubSrc = projectRequire.resolve('@venturekit/notify/runtime/bounce-handler-stub');
-        }
-        catch (err) {
-            throw new Error(`[venturekit] notify intent declared but '@venturekit/notify' is not ` +
-                `installed in the project. Run \`pnpm add @venturekit/notify\` ` +
-                `(or your equivalent) and redeploy. Underlying error: ${err.message}`);
-        }
-        // Materialize copies of the stubs in `.vk/` so esbuild can resolve
-        // their `import { notify } from '<projectClientModule>'` against
-        // the project's source tree. Writing to `.vk/` keeps the stubs out
-        // of the consumer's `src/` (and out of `git status` if they
-        // gitignore `.vk/`, which the init template already does).
-        const vkDir = path.join(projectDir, '.vk');
-        fs.mkdirSync(vkDir, { recursive: true });
-        for (const cfg of this.notifyConfigs) {
-            const id = String(cfg.intent.id);
-            const dispatchRateMinutes = cfg.intent.dispatchRateMinutes && cfg.intent.dispatchRateMinutes >= 1
-                ? cfg.intent.dispatchRateMinutes
-                : 1;
-            const batchSize = cfg.intent.dispatchBatchSize && cfg.intent.dispatchBatchSize >= 1
-                ? cfg.intent.dispatchBatchSize
-                : 50;
-            // Per-intent stub copies — the consumer might declare multiple
-            // notify intents (separate domains for marketing vs
-            // transactional, say), each with its own client module. Naming
-            // by id prevents collisions.
-            const dispatchStubPath = path.join(vkDir, `notify-${id}-dispatcher.ts`);
-            const bounceStubPath = path.join(vkDir, `notify-${id}-bounce.ts`);
-            fs.copyFileSync(dispatcherStubSrc, dispatchStubPath);
-            fs.copyFileSync(bounceStubSrc, bounceStubPath);
-            // --- Dispatcher cron Lambda --------------------------------
-            const dispatcherFnId = `notify-${id}-dispatcher`;
-            const dispatcherDlq = new sqs.Queue(this, `${dispatcherFnId}-dlq`, {
-                queueName: `${projectName}-${stage}-${dispatcherFnId}-dlq`,
-                retentionPeriod: cdk.Duration.days(14),
-                encryption: sqs.QueueEncryption.SQS_MANAGED,
-                // Well-Architected: Reliability — queues hold accepted-but-not-yet-
-                // processed work. CDK's default removalPolicy for sqs.Queue is
-                // DESTROY, which would silently delete the DLQ and all its failed-
-                // message diagnostics on stack delete. Under dataSafety='strict' we
-                // promote to RETAIN so the queue + messages survive any stack churn.
-                removalPolicy: this.toRemovalPolicy(),
-            });
-            const dispatcherFn = new lambda.Function(this, dispatcherFnId, {
-                functionName: `${projectName}-${stage}-${dispatcherFnId}`,
-                runtime: this.toLambdaRuntime(),
-                architecture: this.toLambdaArchitecture(),
-                handler: 'index.main',
-                code: this.bundleHandlerCode(dispatchStubPath),
-                memorySize: this.envConfig.lambda.memoryMb,
-                timeout: cdk.Duration.seconds(60),
-                description: `Notify dispatcher for '${id}' — drains the outbox.`,
-                environment: {
-                    ...this.ventureBaseEnv,
-                    VENTURE_NOTIFY_BATCH_SIZE: String(batchSize),
-                },
-                logRetention: this.toLogRetention(this.envConfig.observability.logs.retentionDays),
-                tracing: this.envConfig.lambda.tracingEnabled
-                    ? lambda.Tracing.ACTIVE
-                    : lambda.Tracing.DISABLED,
-                deadLetterQueue: dispatcherDlq,
-                deadLetterQueueEnabled: true,
-                role,
-                ...(vpc && securityGroup
-                    ? {
-                        vpc,
-                        vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                        securityGroups: [securityGroup],
-                    }
-                    : {}),
-            });
-            new events.Rule(this, `${dispatcherFnId}-rule`, {
-                ruleName: `${projectName}-${stage}-${dispatcherFnId}`,
-                schedule: events.Schedule.rate(cdk.Duration.minutes(dispatchRateMinutes)),
-                enabled: true,
-                targets: [new targets.LambdaFunction(dispatcherFn)],
-            });
-            new cdk.CfnOutput(this, `${dispatcherFnId}-arn`, {
-                value: dispatcherFn.functionArn,
-                description: `Notify dispatcher Lambda ARN for '${id}'`,
-            });
-            // --- Bounce handler Lambda ---------------------------------
-            const bounceFnId = `notify-${id}-bounce-handler`;
-            const bounceDlq = new sqs.Queue(this, `${bounceFnId}-dlq`, {
-                queueName: `${projectName}-${stage}-${bounceFnId}-dlq`,
-                retentionPeriod: cdk.Duration.days(14),
-                encryption: sqs.QueueEncryption.SQS_MANAGED,
-                // Same rationale as the dispatcher DLQ above: bounced/complained
-                // notifications are the canonical record of what failed and why;
-                // dropping them on stack delete loses the audit trail.
-                removalPolicy: this.toRemovalPolicy(),
-            });
-            const bounceFn = new lambda.Function(this, bounceFnId, {
-                functionName: `${projectName}-${stage}-${bounceFnId}`,
-                runtime: this.toLambdaRuntime(),
-                architecture: this.toLambdaArchitecture(),
-                handler: 'index.main',
-                code: this.bundleHandlerCode(bounceStubPath),
-                memorySize: this.envConfig.lambda.memoryMb,
-                timeout: cdk.Duration.seconds(30),
-                description: `Notify bounce/complaint handler for '${id}'.`,
-                environment: { ...this.ventureBaseEnv },
-                logRetention: this.toLogRetention(this.envConfig.observability.logs.retentionDays),
-                tracing: this.envConfig.lambda.tracingEnabled
-                    ? lambda.Tracing.ACTIVE
-                    : lambda.Tracing.DISABLED,
-                deadLetterQueue: bounceDlq,
-                deadLetterQueueEnabled: true,
-                role,
-                ...(vpc && securityGroup
-                    ? {
-                        vpc,
-                        vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                        securityGroups: [securityGroup],
-                    }
-                    : {}),
-            });
-            cfg.eventsTopic.addSubscription(new snsSubscriptions.LambdaSubscription(bounceFn));
-            new cdk.CfnOutput(this, `${bounceFnId}-arn`, {
-                value: bounceFn.functionArn,
-                description: `Notify bounce-handler Lambda ARN for '${id}'`,
-            });
-        }
-    }
-    /**
-     * Well-Architected: Reliability — DLQ by default, stable logical ID
-     * Well-Architected: Security — encryption at rest with SQS managed keys
-     * Well-Architected: Performance — visibility timeout derived from handler timeout
-     */
-    createQueue(intent, projectName, stage) {
-        // Stable logical ID: 'queue-{intent.id}'
-        const logicalId = `queue-${intent.id}`;
-        // Well-Architected: Reliability — always create a DLQ for message safety
-        const dlq = new sqs.Queue(this, `${logicalId}-dlq`, {
-            queueName: `${projectName}-${intent.id}-dlq-${stage}${intent.type === 'fifo' ? '.fifo' : ''}`,
-            fifo: intent.type === 'fifo',
-            retentionPeriod: cdk.Duration.days(14),
-            // Well-Architected: Security — encryption at rest
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-            // Well-Architected: Reliability — DLQs are the durable record of every
-            // message a consumer Lambda failed to process. Default CDK removalPolicy
-            // for sqs.Queue is DESTROY; under dataSafety='strict' we promote to
-            // RETAIN so investigation of past failures survives any redeploy or
-            // stack-delete event.
-            removalPolicy: this.toRemovalPolicy(),
-        });
-        const queue = new sqs.Queue(this, logicalId, {
-            queueName: `${projectName}-${intent.id}-${stage}${intent.type === 'fifo' ? '.fifo' : ''}`,
-            fifo: intent.type === 'fifo',
-            visibilityTimeout: intent.visibilityTimeoutSeconds
-                ? cdk.Duration.seconds(intent.visibilityTimeoutSeconds)
-                : cdk.Duration.seconds((intent.timeout ?? 30) * 6),
-            retentionPeriod: cdk.Duration.days(intent.retentionDays ?? 4),
-            // Well-Architected: Security — encryption at rest
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-            // Well-Architected: Reliability — DLQ captures failed messages
-            deadLetterQueue: {
-                queue: dlq,
-                maxReceiveCount: intent.maxReceiveCount ?? 3,
-            },
-            // Well-Architected: Reliability — primary work queue holds accepted
-            // jobs that have not yet been processed. CDK's default is DESTROY,
-            // which would lose every in-flight message on any stack delete or
-            // logical-ID rename. Under dataSafety='strict' we promote to RETAIN.
-            // Combined with the upcoming multi-stack messaging-tier split, the
-            // queue then survives even an app-stack tear-down — new ESMs in the
-            // redeployed app stack resume consumption from where the old one
-            // stopped.
-            removalPolicy: this.toRemovalPolicy(),
-        });
-        new cdk.CfnOutput(this, `${logicalId}-queue-url`, {
-            value: queue.queueUrl,
-            description: `SQS Queue URL for ${intent.id}`,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-dlq-url`, {
-            value: dlq.queueUrl,
-            description: `SQS DLQ URL for ${intent.id}`,
-        });
-    }
-    /**
-     * Well-Architected: Security — VPC-only access, SG least-privilege
-     * Well-Architected: Performance — cache node type driven by intent.size
-     * Well-Architected: Reliability — encrypted in transit, snapshot retention for prod
-     */
-    createCache(intent, projectName, stage, vpc) {
-        // Stable logical ID: 'cache-{intent.id}'
-        const logicalId = `cache-${intent.id}`;
-        const securityGroup = new ec2.SecurityGroup(this, `${logicalId}-sg`, {
-            vpc,
-            description: `Security group for ${projectName}-${intent.id} Redis`,
-            // Well-Architected: Security — restrict outbound to VPC only
-            allowAllOutbound: false,
-        });
-        securityGroup.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(6379), 'Allow Redis access from VPC');
-        // Well-Architected: Security — use isolated subnets when available
-        const subnetIds = vpc.isolatedSubnets?.length
-            ? vpc.isolatedSubnets.map((s) => s.subnetId)
-            : vpc.privateSubnets.map((s) => s.subnetId);
-        const subnetGroup = new elasticache.CfnSubnetGroup(this, `${logicalId}-subnet-group`, {
-            description: `Subnet group for ${projectName}-${intent.id}`,
-            subnetIds,
-        });
-        const cacheNodeType = this.sizeToCacheNodeType(intent.size || 'small');
-        const redis = new elasticache.CfnCacheCluster(this, logicalId, {
-            engine: 'redis',
-            cacheNodeType,
-            numCacheNodes: 1,
-            vpcSecurityGroupIds: [securityGroup.securityGroupId],
-            cacheSubnetGroupName: subnetGroup.ref,
-            // Well-Architected: Security — encrypt in transit
-            transitEncryptionEnabled: true,
-            // Well-Architected: Reliability — snapshots for prod
-            snapshotRetentionLimit: this.envConfig.dataSafety === 'strict' ? 7 : 0,
-            // Well-Architected: Operational Excellence — auto minor version upgrade
-            autoMinorVersionUpgrade: true,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-endpoint`, {
-            value: redis.attrRedisEndpointAddress,
-            description: `Redis endpoint for ${intent.id}`,
-        });
-    }
-    createMonitoring(intent, projectName, stage) {
-        const resourceName = `${projectName}-${intent.id}`;
-        // SNS topic for notifications
-        let topic;
-        if (intent.notificationArn) {
-            topic = sns.Topic.fromTopicArn(this, `${resourceName}-topic`, intent.notificationArn);
-        }
-        // Create alarms
-        if (intent.alarms) {
-            for (const alarm of intent.alarms) {
-                const comparisonMap = {
-                    gt: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-                    gte: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
-                    lt: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
-                    lte: cloudwatch.ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD,
-                };
-                const metric = new cloudwatch.Metric({
-                    namespace: alarm.namespace || 'AWS/Lambda',
-                    metricName: alarm.metric,
-                    period: cdk.Duration.seconds(alarm.periodSeconds ?? 300),
-                    statistic: alarm.statistic || 'Average',
-                    dimensionsMap: alarm.dimensions,
-                });
-                const cwAlarm = new cloudwatch.Alarm(this, `${resourceName}-${alarm.name}`, {
-                    alarmName: `${projectName}-${stage}-${alarm.name}`,
-                    alarmDescription: alarm.description,
-                    metric,
-                    threshold: alarm.threshold,
-                    evaluationPeriods: alarm.evaluationPeriods ?? 1,
-                    comparisonOperator: comparisonMap[alarm.comparison] || cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-                });
-                if (topic) {
-                    cwAlarm.addAlarmAction(new cloudwatchActions.SnsAction(topic));
-                }
-                new cdk.CfnOutput(this, `${resourceName}-${alarm.name}-arn`, {
-                    value: cwAlarm.alarmArn,
-                    description: `Alarm ARN for ${alarm.name}`,
-                });
-            }
-        }
-        // Create dashboard
-        if (intent.dashboard) {
-            const dashboard = new cloudwatch.Dashboard(this, `${resourceName}-dashboard`, {
-                dashboardName: `${projectName}-${stage}-${intent.id}`,
-            });
-            new cdk.CfnOutput(this, `${resourceName}-dashboard-name`, {
-                value: dashboard.dashboardName,
-                description: `Dashboard name for ${intent.id}`,
-            });
-        }
-    }
-    createSecret(intent, projectName, stage) {
-        const resourceName = `${projectName}-${intent.id}`;
-        if (intent.store === 'secretsmanager') {
-            const secret = new secretsmanager.Secret(this, resourceName, {
-                secretName: `${projectName}/${stage}/${intent.id}`,
-                description: intent.description || `Secret for ${intent.id}`,
-                // Well-Architected: Reliability — operator-declared secrets hold
-                // values the operator pasted in manually (API keys, third-party
-                // integration tokens). They cannot be re-generated by VentureKit
-                // and an accidental delete forces a manual rotation of every
-                // downstream credential. RETAIN under strict dataSafety.
-                removalPolicy: this.toRemovalPolicy(),
-            });
-            new cdk.CfnOutput(this, `${resourceName}-secret-arn`, {
-                value: secret.secretArn,
-                description: `Secret ARN for ${intent.id}`,
-            });
-        }
-        else {
-            // SSM Parameter Store
-            const param = new ssm.StringParameter(this, resourceName, {
-                parameterName: `/${projectName}/${stage}/${intent.id}`,
-                description: intent.description || `Parameter for ${intent.id}`,
-                stringValue: 'PLACEHOLDER — set value after deploy',
-                tier: ssm.ParameterTier.STANDARD,
-            });
-            // SSM parameters don't carry their own DeletionPolicy attribute
-            // (the resource type doesn't support it in CFN), and AWS doesn't
-            // expose a "deletion protection" flag for them either. Operators
-            // relying on these for production secret-like config should
-            // either move to Secrets Manager via `store: 'secretsmanager'`
-            // (which we now RETAIN above) or accept that an accidental
-            // stack delete loses the value.
-            new cdk.CfnOutput(this, `${resourceName}-param-name`, {
-                value: param.parameterName,
-                description: `SSM Parameter name for ${intent.id}`,
-            });
-        }
-    }
-    createDomain(intent, projectName, stage, api) {
-        const resourceName = `${projectName}-${intent.id}`;
-        // Certificate: use provided ARN or create a new one
-        let certificate;
-        if (intent.certificateArn) {
-            certificate = acm.Certificate.fromCertificateArn(this, `${resourceName}-cert`, intent.certificateArn);
-        }
-        else if (intent.hostedZoneId) {
-            // Auto-provision with DNS validation via Route53
-            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone`, {
-                hostedZoneId: intent.hostedZoneId,
-                zoneName: intent.domain.split('.').slice(-2).join('.'),
-            });
-            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
-                domainName: intent.domain,
-                validation: acm.CertificateValidation.fromDns(hostedZone),
-            });
-        }
-        else {
-            // Certificate without DNS validation (manual)
-            certificate = new acm.Certificate(this, `${resourceName}-cert`, {
-                domainName: intent.domain,
-            });
-        }
-        // Custom domain name for API Gateway
-        const domainName = new apigatewayv2.DomainName(this, `${resourceName}-domain`, {
-            domainName: intent.domain,
-            certificate,
-        });
-        // Well-Architected: Reliability — RETAIN both the domain name and the
-        // mapping under strict dataSafety. The custom domain is the *public*
-        // contract with the world; deleting it forces DNS reconfiguration on
-        // every client/integration. RETAIN means an accidental stack delete
-        // leaves the domain claimed to this account and ready for `cdk
-        // import`. The ApiMapping rides along — without it the domain points
-        // nowhere, but mappings recreate cleanly so RETAIN is mostly a
-        // convenience for the recovery path.
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            const cfnDomain = domainName.node.defaultChild;
-            cfnDomain.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
-            cfnDomain.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // API mapping
-        const apiMapping = new apigatewayv2.ApiMapping(this, `${resourceName}-mapping`, {
-            api,
-            domainName,
-            stage: api.defaultStage,
-        });
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            const cfnMapping = apiMapping.node.defaultChild;
-            cfnMapping.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
-            cfnMapping.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // Route53 A record if hosted zone provided
-        if (intent.hostedZoneId) {
-            const hostedZone = route53.HostedZone.fromHostedZoneAttributes(this, `${resourceName}-zone-record`, {
-                hostedZoneId: intent.hostedZoneId,
-                zoneName: intent.domain.split('.').slice(-2).join('.'),
-            });
-            new route53.ARecord(this, `${resourceName}-a-record`, {
-                zone: hostedZone,
-                recordName: intent.domain,
-                target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayv2DomainProperties(domainName.regionalDomainName, domainName.regionalHostedZoneId)),
-            });
-        }
-        new cdk.CfnOutput(this, `${resourceName}-domain-name`, {
-            value: intent.domain,
-            description: `Custom domain for ${intent.id}`,
-        });
-        new cdk.CfnOutput(this, `${resourceName}-regional-domain`, {
-            value: domainName.regionalDomainName,
-            description: `Regional domain name for ${intent.id} (use for DNS CNAME if not using Route53)`,
-        });
-    }
-    /**
-     * Free-tier alternative to RDS: create a DynamoDB table.
-     * DynamoDB offers 25 GB + 25 RCU/WCU in the always-free tier.
-     *
-     * Well-Architected: Security — encryption at rest (default)
-     * Well-Architected: Reliability — PITR for strict dataSafety
-     * Well-Architected: Cost — PAY_PER_REQUEST for unpredictable workloads
-     */
-    createDynamoDBTable(intent, projectName, stage) {
-        // Stable logical ID: 'dynamo-{intent.id}'
-        const logicalId = `dynamo-${intent.id}`;
-        const table = new dynamodb.Table(this, logicalId, {
-            tableName: `${projectName}-${intent.id}-${stage}`,
-            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
-            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
-            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
-            removalPolicy: this.toRemovalPolicy(),
-            // Well-Architected: Reliability — PITR for strict data safety
-            pointInTimeRecovery: this.envConfig.dataSafety === 'strict',
-            // Well-Architected: Security — encryption at rest (AWS managed key)
-            encryption: dynamodb.TableEncryption.AWS_MANAGED,
-            timeToLiveAttribute: 'ttl',
-            // Well-Architected: Operational Excellence — contributor insights for medium+
-            contributorInsightsEnabled: this.envConfig.lambda.memoryMb >= 512,
-            // Well-Architected: Reliability — native deletion protection on top of
-            // RETAIN. DeletionPolicy=Retain only blocks CFN-driven deletes; turning
-            // on deletionProtectionEnabled also blocks the AWS console / API / CLI
-            // "delete table" path. Together they make accidental data loss require
-            // two explicit operator actions (disable protection AND override the
-            // deletion policy), each loggable in CloudTrail.
-            deletionProtection: this.dataSafetyConfig.removalPolicy === 'retain',
-        });
-        // Well-Architected: Reliability — prevent accidental replacement
-        const cfnTable = table.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnTable.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        // GSI for common access patterns
-        table.addGlobalSecondaryIndex({
-            indexName: 'gsi1',
-            partitionKey: { name: 'gsi1pk', type: dynamodb.AttributeType.STRING },
-            sortKey: { name: 'gsi1sk', type: dynamodb.AttributeType.STRING },
-            projectionType: dynamodb.ProjectionType.ALL,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-table-name`, {
-            value: table.tableName,
-            description: `DynamoDB table name for ${intent.id} (free-tier)`,
-        });
-        new cdk.CfnOutput(this, `${logicalId}-table-arn`, {
-            value: table.tableArn,
-            description: `DynamoDB table ARN for ${intent.id} (free-tier)`,
-        });
-    }
-    /**
-     * Free-tier rate limit table using DynamoDB (always-free tier).
-     * Used by createDefaultRateLimiter() from @venturekit/runtime.
-     */
-    createRateLimitTable(projectName, stage) {
-        const logicalId = 'RateLimitTable';
-        // Per-stack table name so multiple environments (preview/prod) and
-        // multiple projects in the same AWS account don't collide on the
-        // single global `venturekit-rate-limits` name. The runtime store
-        // reads `VENTURE_RATE_LIMIT_TABLE` (see @venturekit/runtime
-        // rate-limit-store), so we plumb the resolved name through the
-        // base Lambda env to keep `createDefaultRateLimiter()` working
-        // without per-app configuration.
-        const tableName = `${projectName}-rate-limits-${stage}`;
-        const table = new dynamodb.Table(this, logicalId, {
-            tableName,
-            partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
-            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
-            // Well-Architected: Reliability — rate-limit counters are per-user
-            // state. Hardcoding DESTROY would erase every user's current rate-
-            // limit window on any stack churn, surfacing as a simultaneous
-            // "all users get a fresh quota" event — minor but observable under
-            // load and not what dataSafety='strict' implies. Track dataSafety
-            // the same way every other stateful resource does.
-            removalPolicy: this.toRemovalPolicy(),
-            timeToLiveAttribute: 'ttl',
-            encryption: dynamodb.TableEncryption.AWS_MANAGED,
-            // Native AWS deletion protection alongside RETAIN. See the
-            // user-declared DDB path above for the two-layer rationale.
-            deletionProtection: this.dataSafetyConfig.removalPolicy === 'retain',
-        });
-        // Well-Architected: Reliability — UpdateReplacePolicy=Retain so that a
-        // property change requiring REPLACE (e.g. changing the partition-key
-        // schema, which CFN executes as delete-then-create) preserves the old
-        // table rather than dropping every active rate-limit window. Matches
-        // the user-declared DDB path.
-        const cfnRateLimitTable = table.node.defaultChild;
-        if (this.dataSafetyConfig.removalPolicy === 'retain') {
-            cfnRateLimitTable.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
-        }
-        this.ventureBaseEnv['VENTURE_RATE_LIMIT_TABLE'] = table.tableName;
-        new cdk.CfnOutput(this, `${logicalId}-table-name`, {
-            value: table.tableName,
-            description: 'DynamoDB rate limit table (free-tier)',
-        });
-    }
-    // ─── Helper methods ────────────────────────────────────────────────
-    /**
-     * Map ResourceSize to RDS instance type.
-     * Uses Graviton (T4G) instances for cost efficiency.
-     * Changing size triggers an in-place modify, NOT a replacement.
-     */
-    sizeToInstanceType(size) {
-        switch (size) {
-            case 'xlarge':
-                return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.LARGE);
-            case 'large':
-                return ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.MEDIUM);
-            case 'medium':
-                return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.SMALL);
-            default: // 'small'
-                return ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MICRO);
-        }
-    }
-    /**
-     * Map ResourceSize to ElastiCache node type.
-     * Uses Graviton (T4G) instances for cost efficiency.
-     * Changing size triggers an in-place modify, NOT a replacement.
-     */
-    sizeToCacheNodeType(size) {
-        switch (size) {
-            case 'xlarge':
-                return 'cache.r6g.large';
-            case 'large':
-                return 'cache.r6g.medium';
-            case 'medium':
-                return 'cache.t4g.small';
-            default: // 'small'
-                return 'cache.t4g.micro';
-        }
-    }
-    /**
-     * Convert dataSafety config to CDK RemovalPolicy.
-     * Well-Architected: Reliability — prevent accidental data loss.
-     */
-    toRemovalPolicy() {
-        return this.dataSafetyConfig.removalPolicy === 'retain'
-            ? cdk.RemovalPolicy.RETAIN
-            : cdk.RemovalPolicy.DESTROY;
-    }
-    /**
-     * Convert days to CDK logs.RetentionDays enum.
-     * Well-Architected: Cost — don't over-retain logs.
-     */
-    toLogRetention(days) {
-        if (days <= 1)
-            return logs.RetentionDays.ONE_DAY;
-        if (days <= 3)
-            return logs.RetentionDays.THREE_DAYS;
-        if (days <= 5)
-            return logs.RetentionDays.FIVE_DAYS;
-        if (days <= 7)
-            return logs.RetentionDays.ONE_WEEK;
-        if (days <= 14)
-            return logs.RetentionDays.TWO_WEEKS;
-        if (days <= 30)
-            return logs.RetentionDays.ONE_MONTH;
-        if (days <= 60)
-            return logs.RetentionDays.TWO_MONTHS;
-        if (days <= 90)
-            return logs.RetentionDays.THREE_MONTHS;
-        if (days <= 120)
-            return logs.RetentionDays.FOUR_MONTHS;
-        if (days <= 150)
-            return logs.RetentionDays.FIVE_MONTHS;
-        if (days <= 180)
-            return logs.RetentionDays.SIX_MONTHS;
-        if (days <= 365)
-            return logs.RetentionDays.ONE_YEAR;
-        return logs.RetentionDays.INFINITE;
-    }
-    /**
-     * Resolve Lambda runtime from preset config.
-     */
-    toLambdaRuntime() {
-        switch (this.envConfig.lambda.runtime) {
-            case 'nodejs22.x':
-                return lambda.Runtime.NODEJS_22_X;
-            case 'nodejs18.x':
-                return lambda.Runtime.NODEJS_18_X;
-            default:
-                return lambda.Runtime.NODEJS_20_X;
-        }
-    }
-    /**
-     * Resolve Lambda architecture from preset config.
-     */
-    toLambdaArchitecture() {
-        return this.envConfig.lambda.architecture === 'x86_64'
-            ? lambda.Architecture.X86_64
-            : lambda.Architecture.ARM_64;
-    }
-    /**
-     * Recursively discover function files under the functions directory.
-     * Returns an array of { name, handlerFile } where name is the
-     * dash-delimited path (e.g. `order/create-order.ts` → `order-create-order`).
-     */
-    discoverFunctionFiles(dir, baseDir) {
-        const root = baseDir ?? dir;
-        const results = [];
-        if (!fs.existsSync(dir))
-            return results;
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                results.push(...this.discoverFunctionFiles(fullPath, root));
-            }
-            else if (/\.(ts|js)$/.test(entry.name) && !entry.name.endsWith('.d.ts')) {
-                const relativePath = path.relative(root, fullPath);
-                const name = relativePath
-                    .replace(/\.(ts|js)$/, '')
-                    .replace(/[\\/]/g, '-');
-                results.push({ name, handlerFile: fullPath });
-            }
-        }
-        return results;
-    }
-    // ─── Lambda function factories ─────────────────────────────────────
-    /**
-     * Build the `lambda.Code` for a handler file.
-     *
-     * Production path: bundle the handler in-process via esbuild's
-     * synchronous API — see `bundleHandlerCodeWithEsbuild` for the
-     * rationale (no Docker, native Node module resolution, sub-second
-     * per handler).
-     *
-     * Test path (`_skipBundling: true`): return an inline stub so unit
-     * tests can synth Lambdas without invoking esbuild.
-     */
-    bundleHandlerCode(handlerFile) {
-        if (this.skipBundling) {
-            return inlineStubLambdaCode();
-        }
-        return bundleHandlerCodeWithEsbuild(handlerFile, this.projectDir);
-    }
-    /**
-     * Create one Lambda + HTTP API integration + HttpRoute for a discovered
-     * route file.
-     *
-     * Function name: `{project}-{stage}-route-{slug}`. Lambda function names
-     * are capped at 64 chars; we truncate + append a 6-char content hash if
-     * the full name overflows so deeply nested routes
-     * (e.g. `promoter/groups/[id]/images/[imageId]/delete.ts`) still fit.
-     *
-     * Well-Architected: Performance — memory/timeout from preset config
-     * Well-Architected: Sustainability — ARM64 Graviton by default
-     * Well-Architected: Reliability — VPC-attached when DBs exist so routes
-     *   can reach RDS without timing out at the API Gateway 30 s deadline
-     * Well-Architected: Cost — shared role + SG across all route Lambdas
-     *   keeps CFN resource count linear in the number of routes
-     */
-    createRouteFunction(route, projectName, stage, api, role, securityGroup, vpc) {
-        const lambdaConfig = this.envConfig.lambda;
-        // Cap function name at 64 chars (Lambda hard limit). Append a content
-        // hash on overflow so two deeply nested routes that share a prefix
-        // don't collide.
-        const rawName = `${projectName}-${stage}-route-${route.slug}`;
-        const functionName = rawName.length <= 64
-            ? rawName
-            : `${rawName.slice(0, 56)}-${this.shortHash(rawName)}`;
-        const resourceId = `route-${route.slug}`;
-        // Construct ID may collide if two slugs sanitize to the same value,
-        // but `discoverRouteFiles` already enforces filesystem-uniqueness, so
-        // any collision implies a bug in the slug builder — not a runtime
-        // concern.
-        const fn = new lambda.Function(this, resourceId, {
-            functionName,
-            runtime: this.toLambdaRuntime(),
-            architecture: this.toLambdaArchitecture(),
-            handler: 'index.main',
-            code: this.bundleHandlerCode(route.handlerFile),
-            memorySize: lambdaConfig.memoryMb,
-            timeout: cdk.Duration.seconds(lambdaConfig.timeoutSec),
-            description: `${route.method} ${route.apiPath}`,
-            environment: {
-                ...this.ventureBaseEnv,
-                ...lambdaConfig.environmentVariables,
-            },
-            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
-            tracing: lambdaConfig.tracingEnabled
-                ? lambda.Tracing.ACTIVE
-                : lambda.Tracing.DISABLED,
-            reservedConcurrentExecutions: lambdaConfig.reservedConcurrency,
-            role,
-            // Attach to the VPC iff one exists. Route Lambdas without a VPC
-            // can't reach RDS, but the free preset and DB-less projects don't
-            // need one — paying ENI cold-start tax there would be a
-            // regression.
-            ...(vpc && securityGroup
-                ? {
-                    vpc,
-                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    securityGroups: [securityGroup],
-                }
-                : {}),
-        });
-        // Route the matching API Gateway HTTP method + path at the Lambda.
-        // `HttpRouteKey.with` builds the `${METHOD} ${path}` string that API
-        // Gateway uses internally; passing path + method separately keeps us
-        // honest if AWS ever changes the format.
-        new apigatewayv2.HttpRoute(this, `${resourceId}-route`, {
-            httpApi: api,
-            routeKey: apigatewayv2.HttpRouteKey.with(route.apiPath, apigatewayv2.HttpMethod[route.method]),
-            integration: new apigatewayv2Integrations.HttpLambdaIntegration(`${resourceId}-integration`, fn),
-        });
-    }
-    /**
-     * Tiny non-cryptographic 6-char hex hash. Used only to disambiguate
-     * Lambda function names that would otherwise overflow the 64-char
-     * limit; collision risk is acceptable because the truncated prefix
-     * already encodes most of the route path.
-     */
-    shortHash(input) {
-        let h = 5381;
-        for (let i = 0; i < input.length; i++) {
-            h = ((h << 5) + h + input.charCodeAt(i)) | 0;
-        }
-        return (h >>> 0).toString(16).padStart(6, '0').slice(0, 6);
-    }
-    /**
-     * Create a standalone Lambda function.
-     * Naming convention: {project}-{stage}-fn-{name}
-     *
-     * Well-Architected: Performance — memory/timeout from preset config
-     * Well-Architected: Sustainability — ARM64 Graviton by default
-     * Well-Architected: Operational Excellence — structured env vars, log retention from preset
-     * Well-Architected: Security — X-Ray tracing from preset config
-     */
-    createStandaloneFunction(name, handlerFile, projectName, stage, projectDir, intent, role, securityGroup, vpc) {
-        const functionName = `${projectName}-${stage}-fn-${name}`;
-        const resourceId = `fn-${name}`;
-        const lambdaConfig = this.envConfig.lambda;
-        // Auto-DLQ: every async failure goes somewhere you can inspect later.
-        // Lambda retries async invocations twice, then drops the event silently
-        // unless a DLQ is wired. We wire one by default (SQS, 14-day retention,
-        // SQS-managed encryption, same stable logical ID so preset changes don't
-        // replace it). Consumers can inspect failed events via `vk logs dlq` or
-        // directly in the SQS console.
-        const dlq = new sqs.Queue(this, `${resourceId}-dlq`, {
-            queueName: `${projectName}-${stage}-fn-${name}-dlq`,
-            retentionPeriod: cdk.Duration.days(14),
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-        });
-        const fn = new lambda.Function(this, resourceId, {
-            functionName,
-            runtime: this.toLambdaRuntime(),
-            architecture: this.toLambdaArchitecture(),
-            handler: 'index.main',
-            code: this.bundleHandlerCode(handlerFile),
-            // Well-Architected: Performance — memory and timeout from intent or preset
-            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
-            timeout: cdk.Duration.seconds(intent?.timeout ?? lambdaConfig.timeoutSec),
-            description: intent?.description ?? `Standalone function: ${name}`,
-            environment: {
-                ...this.ventureBaseEnv,
-                ...lambdaConfig.environmentVariables,
-            },
-            // Well-Architected: Operational Excellence — log retention from preset
-            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
-            // Well-Architected: Security — X-Ray tracing from preset
-            tracing: lambdaConfig.tracingEnabled
-                ? lambda.Tracing.ACTIVE
-                : lambda.Tracing.DISABLED,
-            // Well-Architected: Performance — reserved concurrency from preset
-            reservedConcurrentExecutions: lambdaConfig.reservedConcurrency,
-            // Well-Architected: Reliability — async failure destination
-            deadLetterQueue: dlq,
-            deadLetterQueueEnabled: true,
-            role,
-            // Well-Architected: Reliability — VPC-attach when a VPC exists so
-            // standalone workers (sagas, processors, dispatchers) can reach
-            // RDS through the shared SG without operators wiring it up.
-            ...(vpc && securityGroup
-                ? {
-                    vpc,
-                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    securityGroups: [securityGroup],
-                }
-                : {}),
-        });
-        new cdk.CfnOutput(this, `${resourceId}-name`, {
-            value: fn.functionName,
-            description: `Lambda function name for ${name}`,
-        });
-        new cdk.CfnOutput(this, `${resourceId}-arn`, {
-            value: fn.functionArn,
-            description: `Lambda function ARN for ${name}`,
-        });
-        new cdk.CfnOutput(this, `${resourceId}-dlq-url`, {
-            value: dlq.queueUrl,
-            description: `Dead-letter queue for ${name} (async invocation failures land here)`,
-        });
-    }
-    /**
-     * Create a queue consumer Lambda function wired to an SQS queue.
-     * Naming convention: {project}-{stage}-queue-{name}
-     *
-     * Well-Architected: Reliability — DLQ on consumer queue, encrypted
-     * Well-Architected: Performance — batch size and visibility timeout
-     */
-    createQueueConsumer(name, handlerFile, projectName, stage, projectDir, intent, role, securityGroup, vpc) {
-        const functionName = `${projectName}-${stage}-queue-${name}`;
-        const resourceId = `queue-consumer-${name}`;
-        const lambdaConfig = this.envConfig.lambda;
-        // Create the SQS queue with DLQ
-        const dlq = new sqs.Queue(this, `${resourceId}-dlq`, {
-            queueName: `${projectName}-${stage}-${name}-dlq`,
-            retentionPeriod: cdk.Duration.days(14),
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-        });
-        const queue = new sqs.Queue(this, `${resourceId}-sqs`, {
-            queueName: `${projectName}-${stage}-${name}`,
-            visibilityTimeout: cdk.Duration.seconds(intent?.visibilityTimeoutSeconds ?? (intent?.timeout ?? 30) * 6),
-            retentionPeriod: cdk.Duration.days(intent?.retentionDays ?? 4),
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-            deadLetterQueue: {
-                queue: dlq,
-                maxReceiveCount: 3,
-            },
-        });
-        const fn = new lambda.Function(this, resourceId, {
-            functionName,
-            runtime: this.toLambdaRuntime(),
-            architecture: this.toLambdaArchitecture(),
-            handler: 'index.main',
-            code: this.bundleHandlerCode(handlerFile),
-            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
-            timeout: cdk.Duration.seconds(intent?.timeout ?? lambdaConfig.timeoutSec),
-            description: intent?.description ?? `Queue consumer: ${name}`,
-            environment: {
-                ...this.ventureBaseEnv,
-                ...lambdaConfig.environmentVariables,
-            },
-            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
-            tracing: lambdaConfig.tracingEnabled
-                ? lambda.Tracing.ACTIVE
-                : lambda.Tracing.DISABLED,
-            role,
-            // Well-Architected: Reliability — VPC-attach so consumers can
-            // reach RDS. SQS itself is reachable from public Internet, but a
-            // queue handler that needs to UPDATE its own DB on success would
-            // otherwise hang forever once a database is provisioned.
-            ...(vpc && securityGroup
-                ? {
-                    vpc,
-                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    securityGroups: [securityGroup],
-                }
-                : {}),
-        });
-        // Wire Lambda to SQS queue
-        fn.addEventSource(new lambdaEventSources.SqsEventSource(queue, {
-            batchSize: intent?.batchSize ?? 10,
-        }));
-        new cdk.CfnOutput(this, `${resourceId}-fn-name`, {
-            value: fn.functionName,
-            description: `Queue consumer Lambda for ${name}`,
-        });
-        new cdk.CfnOutput(this, `${resourceId}-queue-url`, {
-            value: queue.queueUrl,
-            description: `SQS queue URL for ${name}`,
-        });
-    }
-    /**
-     * Create a cron/scheduled task Lambda function wired to an EventBridge rule.
-     * Naming convention: {project}-{stage}-cron-{name}
-     *
-     * Well-Architected: Performance — memory/timeout from preset
-     * Well-Architected: Operational Excellence — log retention, tracing from preset
-     */
-    createCronHandler(name, handlerFile, projectName, stage, projectDir, intent, role, securityGroup, vpc) {
-        const functionName = `${projectName}-${stage}-cron-${name}`;
-        const resourceId = `cron-${name}`;
-        const lambdaConfig = this.envConfig.lambda;
-        // Auto-DLQ for cron handlers. EventBridge delivers events async; without
-        // a DLQ, a broken cron silently stops working after Lambda's 2-retry
-        // budget and you only notice when someone asks "did the nightly job run?"
-        const dlq = new sqs.Queue(this, `${resourceId}-dlq`, {
-            queueName: `${projectName}-${stage}-cron-${name}-dlq`,
-            retentionPeriod: cdk.Duration.days(14),
-            encryption: sqs.QueueEncryption.SQS_MANAGED,
-        });
-        const fn = new lambda.Function(this, resourceId, {
-            functionName,
-            runtime: this.toLambdaRuntime(),
-            architecture: this.toLambdaArchitecture(),
-            handler: 'index.main',
-            code: this.bundleHandlerCode(handlerFile),
-            memorySize: intent?.memorySize ?? lambdaConfig.memoryMb,
-            timeout: cdk.Duration.seconds(intent?.timeout ?? 60),
-            description: intent?.description ?? `Cron handler: ${name}`,
-            environment: {
-                ...this.ventureBaseEnv,
-                ...lambdaConfig.environmentVariables,
-            },
-            logRetention: this.toLogRetention(lambdaConfig.logRetentionDays),
-            tracing: lambdaConfig.tracingEnabled
-                ? lambda.Tracing.ACTIVE
-                : lambda.Tracing.DISABLED,
-            // Well-Architected: Reliability — EventBridge failures land in the DLQ
-            deadLetterQueue: dlq,
-            deadLetterQueueEnabled: true,
-            role,
-            // Well-Architected: Reliability — VPC-attach so nightly jobs that
-            // poll RDS for stale state (cleanup, retries, billing rollups)
-            // don't spin up only to discover they can't reach the database.
-            ...(vpc && securityGroup
-                ? {
-                    vpc,
-                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
-                    securityGroups: [securityGroup],
-                }
-                : {}),
-        });
-        // Wire EventBridge rule if schedule expression is provided
-        if (intent?.schedule) {
-            const scheduleExpr = intent.schedule;
-            const isEnabled = intent.enabled ?? true;
-            let schedule;
-            if ('rate' in scheduleExpr) {
-                schedule = events.Schedule.expression(`rate(${scheduleExpr.rate})`);
-            }
-            else {
-                schedule = events.Schedule.expression(`cron(${scheduleExpr.cron})`);
-            }
-            new events.Rule(this, `${resourceId}-rule`, {
-                ruleName: `${projectName}-${stage}-cron-${name}`,
-                schedule,
-                enabled: isEnabled,
-                targets: [new targets.LambdaFunction(fn)],
-            });
-        }
-        new cdk.CfnOutput(this, `${resourceId}-fn-name`, {
-            value: fn.functionName,
-            description: `Cron handler Lambda for ${name}`,
-        });
-        new cdk.CfnOutput(this, `${resourceId}-fn-arn`, {
-            value: fn.functionArn,
-            description: `Cron handler Lambda ARN for ${name}`,
-        });
-        new cdk.CfnOutput(this, `${resourceId}-dlq-url`, {
-            value: dlq.queueUrl,
-            description: `Dead-letter queue for ${name} (async invocation failures land here)`,
-        });
-    }
-}
-//# sourceMappingURL=stack.js.map