@venturekit/infra 0.0.0-dev.20260515022321 → 0.0.0-dev.20260515033511

package/dist/cdk/stack.d.ts

@@ -1,389 +0,0 @@
-/**
- * VentureStack — CDK Stack for VentureKit applications
- *
- * Translates VentureKit infrastructure intents into CloudFormation resources.
- * This is the single entry point for `vk deploy`.
- *
- * Consumers never see this file — it's invoked by the generated CDK app in .vk/cdk/.
- */
-import * as cdk from 'aws-cdk-lib';
-import { Construct } from 'constructs';
-import type { VentureIntent, EnvConfig } from '@venturekit/core';
-/**
- * One discovered HTTP route, ready to be wired to a Lambda + HttpRoute.
- */
-export interface DiscoveredRoute {
-    /** HTTP method ('GET' / 'POST' / 'PUT' / 'PATCH' / 'DELETE'). */
-    method: string;
-    /**
-     * API Gateway path with `{param}` segments, e.g. `/users/{id}`.
-     * The root route (`src/routes/get.ts`) maps to `/`.
-     */
-    apiPath: string;
-    /**
-     * Stable slug derived from the file path, used for the Lambda's
-     * function name and CDK construct id.
-     *
-     *   src/routes/health/get.ts             → 'health-get'
-     *   src/routes/users/[id]/put.ts         → 'users-id-put'
-     *   src/routes/admin/users/[id]/delete.ts → 'admin-users-id-delete'
-     */
-    slug: string;
-    /** Absolute path to the route handler file (.ts or .js). */
-    handlerFile: string;
-}
-/**
- * Recursively discover HTTP route files under `src/routes/`.
- *
- * Walks the directory tree applying the same filesystem convention as the
- * local dev server:
- *   - File name (without extension) determines the HTTP method via
- *     {@link ROUTE_FILENAME_TO_METHOD}. Files whose name doesn't match a
- *     known method (e.g. `helpers.ts`, `_middleware.ts`) are silently
- *     skipped — they're treated as colocated implementation detail.
- *   - Directory `[param]` becomes `{param}` in the API path and `param`
- *     in the slug. Plain directories appear verbatim in both.
- *   - Test/spec/declaration files (`*.test.ts`, `*.spec.ts`, `*.d.ts`)
- *     are skipped.
- *
- * Exported so unit tests can assert the convention without spinning up a
- * full CDK stack, and so external tooling can reuse it.
- */
-export declare function discoverRouteFiles(routesDir: string): DiscoveredRoute[];
-/**
- * Map a route slug to a nested-stack slot index in `[0, numSlots)`.
- * `numSlots` MUST be a power of two so the bitwise-AND modulo
- * distributes the hash output evenly. Exported for unit tests
- * asserting bucketing stability across route-set changes.
- */
-export declare function stableSlotFor(slug: string, numSlots: number): number;
-export interface VentureStackProps extends cdk.StackProps {
-    projectName: string;
-    stage: string;
-    routesDir: string;
-    /** Directory containing standalone Lambda functions */
-    functionsDir?: string;
-    /** Directory containing queue consumer handlers */
-    queuesDir?: string;
-    /** Directory containing cron/scheduled task handlers */
-    cronsDir?: string;
-    infrastructure?: VentureIntent;
-    projectDir: string;
-    /** Preset name — when 'free', uses only free-tier AWS resources */
-    preset?: string;
-    /**
-     * Pinned `@venturekit/cli` + `@venturekit/data` version installed by the
-     * in-VPC CodeBuild migration runner. Resolved by `cdk-bridge.ts` from the
-     * consumer's `node_modules/@venturekit/cli/package.json` so build-time
-     * behavior matches what the operator tested locally. Falls back to
-     * `'latest'` when unknown (warned at synth time).
-     */
-    vkCliVersion?: string;
-    /**
-     * Fully resolved environment configuration from presets + user overrides.
-     * When provided, all resource sizing is driven by this config.
-     * When absent, falls back to legacy behavior using `preset` string.
-     */
-    envConfig?: EnvConfig;
-    /**
-     * @internal
-     *
-     * Tests-only escape hatch that swaps esbuild bundling for an inline
-     * Lambda stub, so unit tests can synth a stack containing route /
-     * function / queue / cron handlers without invoking esbuild. Never
-     * set this in production CDK apps — the resulting Lambdas would
-     * respond with the stub body, not your handler code.
-     */
-    _skipBundling?: boolean;
-}
-export declare class VentureStack extends cdk.Stack {
-    readonly outputs: Record<string, cdk.CfnOutput>;
-    /** Resolved environment configuration driving all resource sizing */
-    private readonly envConfig;
-    /** Data safety configuration for removal policies */
-    private readonly dataSafetyConfig;
-    /** Whether this is a free-tier deployment */
-    private readonly isFreeTier;
-    /** Standard tags applied to all taggable resources */
-    private readonly standardTags;
-    /**
-     * Per-project HMAC secret used to sign internal Lambda-to-Lambda calls.
-     * Auto-generated on first deploy and preserved across subsequent deploys by
-     * CloudFormation. Injected as `VENTURE_INTERNAL_HMAC_SECRET` into every
-     * Lambda function the stack creates, so `invoke()` callers and handler
-     * receivers share the same key.
-     */
-    private readonly internalHmacSecret;
-    /** Base environment variables applied to every VentureKit Lambda. */
-    private readonly ventureBaseEnv;
-    /** @internal — when true, all Lambda code uses an inline stub instead of Docker bundling. Tests only. */
-    private readonly skipBundling;
-    /**
-     * Absolute path to the consumer project's root (the directory that
-     * holds `package.json` + `node_modules`). Used as the bundling asset
-     * root so esbuild can resolve handler imports against the project's
-     * installed dependencies.
-     */
-    private readonly projectDir;
-    /**
-     * Cognito User Pools created by `createAuth`, kept around so the
-     * shared Lambda execution role can be granted admin actions on them
-     * once the role exists (the role is created later in the constructor,
-     * after every infrastructure intent has been processed).
-     */
-    private readonly userPools;
-    /**
-     * Secrets Manager placeholders provisioned by `createAuth` for
-     * `AuthIntent.federated` providers (Google / Facebook / Apple OAuth
-     * client id + secret). Tracked so the shared Lambda role can be
-     * granted `secretsmanager:GetSecretValue` on each one once the role
-     * exists. The ARNs are also injected as
-     * `COGNITO_FEDERATED_<PROVIDER>_SECRET_ARN` env vars on every Lambda.
-     */
-    private readonly federatedAuthSecrets;
-    /**
-     * S3 buckets created by `createStorage`, kept around so the shared
-     * Lambda execution role can be granted `s3:Get*` / `s3:Put*` on them
-     * once the role exists, and so the *first* bucket's name can be
-     * injected as `VENTURE_STORAGE_BUCKET` for `createStorageClientFromEnv()`.
-     * Without this wiring, every Lambda calling `@venturekit/storage` would
-     * throw `Storage bucket not configured` at runtime even though the
-     * bucket exists in CloudFormation.
-     */
-    private readonly storageBuckets;
-    /**
-     * Notify configurations created by `createNotify`. Tracked so the
-     * shared Lambda role can be granted `ses:SendEmail` on the
-     * configuration set + identity ARNs once the role exists, and so
-     * env vars (`VENTURE_NOTIFY_FROM`, `VENTURE_NOTIFY_CONFIG_SET`, …)
-     * land on every Lambda — `@venturekit/notify`'s
-     * `createSesEmailProvider` reads them at cold start. Also drives
-     * the auto-provisioning of dispatcher + bounce-handler Lambdas
-     * after the rest of the stack is wired (we need the shared role
-     * + VPC + SG to exist first).
-     */
-    private readonly notifyConfigs;
-    /**
-     * Absolute paths to `migrations/` directories shipped by installed
-     * `@venturekit/*` packages (e.g. `@venturekit/notify`,
-     * `@venturekit/auth`). Resolved once at the top of the constructor
-     * via declarative `vk.migrations` discovery so `createDatabase` can
-     * pass the merged list to `MigrationRunner` without re-walking
-     * `node_modules` per database.
-     *
-     * Discovery mirrors the CLI side
-     * (`@venturekit/cli`'s `discoverPackageMigrationDirs`) so a `vk deploy`
-     * and a local `vk migrate` always materialize the same merged schema.
-     * Empty when no installed venturekit package opts in via
-     * `"vk": { "migrations": "<dir>" }` in its `package.json`.
-     */
-    private readonly packageMigrationsDirs;
-    constructor(scope: Construct, id: string, props: VentureStackProps);
-    /**
-     * Well-Architected: Reliability — RDS with stable logical ID so preset
-     * changes (e.g. nano→medium) perform an in-place instance class modify,
-     * not a replacement. Data is preserved because the CloudFormation resource
-     * identity stays the same.
-     *
-     * Well-Architected: Security — encrypted at rest, credentials in Secrets Manager
-     * Well-Architected: Reliability — automated backups, optional multi-AZ
-     * Well-Architected: Performance — instance type driven by intent.size
-     * Well-Architected: Operational Excellence — auto minor version upgrades
-     */
-    private createDatabase;
-    /**
-     * Well-Architected: Security — block public access by default, SSE encryption
-     * Well-Architected: Reliability — versioning for backups, dataSafety removal policy
-     * Well-Architected: Cost — lifecycle rules for logs/backups to reduce storage cost
-     * Well-Architected: Sustainability — intelligent tiering for infrequent access
-     */
-    private createStorage;
-    /**
-     * Well-Architected: Security — Cognito with advanced security features,
-     * stable logical ID for safe preset upgrades.
-     * Well-Architected: Reliability — dataSafety-driven removal policy
-     */
-    private createAuth;
-    /**
-     * Provision SES + outbox infrastructure for one `NotifyIntent`.
-     *
-     * Resources created here:
-     *   - One SES email or domain identity (drives DKIM + verified-from).
-     *   - One SES configuration set with an event destination publishing
-     *     bounce / complaint / delivery / open / click events to an
-     *     SNS topic.
-     *   - The SNS topic itself (`{project}-{stage}-notify-{id}-events`).
-     *   - A Secrets Manager secret for the WhatsApp Cloud API token,
-     *     when `'whatsapp'` is in `channels`. The value is left as a
-     *     placeholder; the operator pastes the Meta token after first
-     *     deploy via the AWS console (the secret rotation knob would be
-     *     a Phase 2 enhancement once token rotation is part of the API).
-     *   - When `domain` AND `hostedZoneId` are both set, Route53 CNAME
-     *     records for the three SES DKIM tokens, plus an MX + TXT record
-     *     on the MAIL FROM subdomain. Without `hostedZoneId`, the
-     *     records are emitted as stack outputs and the operator
-     *     publishes them manually.
-     *
-     * Resources NOT created here: dispatcher cron Lambda, bounce-handler
-     * Lambda, IAM grants on the shared role. Those need the role + VPC
-     * + SG which only exist later in the constructor — see
-     * `provisionNotifyHandlers` below.
-     */
-    private createNotify;
-    /**
-     * Auto-provision the dispatcher cron Lambda + the bounce-handler
-     * Lambda subscribed to the SES events SNS topic, for every notify
-     * intent.
-     *
-     * Implementation notes:
-     *
-     * - The Lambdas import a stub shipped inside `@venturekit/notify`
-     *   (`runtime/dispatcher-stub.ts`, `runtime/bounce-handler-stub.ts`).
-     *   At synth time we copy the stub into the project's `.vk/` dir
-     *   alongside a generated `notify-client-import.ts` shim that
-     *   re-exports the consumer's `notify` instance from
-     *   `VENTURE_NOTIFY_CLIENT_MODULE` (default `src/lib/notify.ts`).
-     *   esbuild then bundles the whole closure into the Lambda — the
-     *   consumer's notify config + every provider + the @venturekit
-     *   runtime, all in one deploy artefact.
-     *
-     * - We re-use the shared Lambda role for these handlers. Permissions:
-     *   - SES + secrets grants are already attached above
-     *     (`provisionNotifyHandlers` is called from the same block).
-     *   - SNS topic subscription + invocation perms are added by CDK
-     *     when we wire `topic.addSubscription(LambdaSubscription)`.
-     *
-     * - VPC attachment: yes, when the project has a VPC. The dispatcher
-     *   needs DB access (Postgres outbox + preferences); the bounce
-     *   handler also writes `notification_event_log`.
-     */
-    private provisionNotifyHandlers;
-    /**
-     * Well-Architected: Reliability — DLQ by default, stable logical ID
-     * Well-Architected: Security — encryption at rest with SQS managed keys
-     * Well-Architected: Performance — visibility timeout derived from handler timeout
-     */
-    private createQueue;
-    /**
-     * Well-Architected: Security — VPC-only access, SG least-privilege
-     * Well-Architected: Performance — cache node type driven by intent.size
-     * Well-Architected: Reliability — encrypted in transit, snapshot retention for prod
-     */
-    private createCache;
-    private createMonitoring;
-    private createSecret;
-    private createDomain;
-    /**
-     * Free-tier alternative to RDS: create a DynamoDB table.
-     * DynamoDB offers 25 GB + 25 RCU/WCU in the always-free tier.
-     *
-     * Well-Architected: Security — encryption at rest (default)
-     * Well-Architected: Reliability — PITR for strict dataSafety
-     * Well-Architected: Cost — PAY_PER_REQUEST for unpredictable workloads
-     */
-    private createDynamoDBTable;
-    /**
-     * Free-tier rate limit table using DynamoDB (always-free tier).
-     * Used by createDefaultRateLimiter() from @venturekit/runtime.
-     */
-    private createRateLimitTable;
-    /**
-     * Map ResourceSize to RDS instance type.
-     * Uses Graviton (T4G) instances for cost efficiency.
-     * Changing size triggers an in-place modify, NOT a replacement.
-     */
-    private sizeToInstanceType;
-    /**
-     * Map ResourceSize to ElastiCache node type.
-     * Uses Graviton (T4G) instances for cost efficiency.
-     * Changing size triggers an in-place modify, NOT a replacement.
-     */
-    private sizeToCacheNodeType;
-    /**
-     * Convert dataSafety config to CDK RemovalPolicy.
-     * Well-Architected: Reliability — prevent accidental data loss.
-     */
-    private toRemovalPolicy;
-    /**
-     * Convert days to CDK logs.RetentionDays enum.
-     * Well-Architected: Cost — don't over-retain logs.
-     */
-    private toLogRetention;
-    /**
-     * Resolve Lambda runtime from preset config.
-     */
-    private toLambdaRuntime;
-    /**
-     * Resolve Lambda architecture from preset config.
-     */
-    private toLambdaArchitecture;
-    /**
-     * Recursively discover function files under the functions directory.
-     * Returns an array of { name, handlerFile } where name is the
-     * dash-delimited path (e.g. `order/create-order.ts` → `order-create-order`).
-     */
-    private discoverFunctionFiles;
-    /**
-     * Build the `lambda.Code` for a handler file.
-     *
-     * Production path: bundle the handler in-process via esbuild's
-     * synchronous API — see `bundleHandlerCodeWithEsbuild` for the
-     * rationale (no Docker, native Node module resolution, sub-second
-     * per handler).
-     *
-     * Test path (`_skipBundling: true`): return an inline stub so unit
-     * tests can synth Lambdas without invoking esbuild.
-     */
-    private bundleHandlerCode;
-    /**
-     * Create one Lambda + HTTP API integration + HttpRoute for a discovered
-     * route file.
-     *
-     * Function name: `{project}-{stage}-route-{slug}`. Lambda function names
-     * are capped at 64 chars; we truncate + append a 6-char content hash if
-     * the full name overflows so deeply nested routes
-     * (e.g. `promoter/groups/[id]/images/[imageId]/delete.ts`) still fit.
-     *
-     * Well-Architected: Performance — memory/timeout from preset config
-     * Well-Architected: Sustainability — ARM64 Graviton by default
-     * Well-Architected: Reliability — VPC-attached when DBs exist so routes
-     *   can reach RDS without timing out at the API Gateway 30 s deadline
-     * Well-Architected: Cost — shared role + SG across all route Lambdas
-     *   keeps CFN resource count linear in the number of routes
-     */
-    private createRouteFunction;
-    /**
-     * Tiny non-cryptographic 6-char hex hash. Used only to disambiguate
-     * Lambda function names that would otherwise overflow the 64-char
-     * limit; collision risk is acceptable because the truncated prefix
-     * already encodes most of the route path.
-     */
-    private shortHash;
-    /**
-     * Create a standalone Lambda function.
-     * Naming convention: {project}-{stage}-fn-{name}
-     *
-     * Well-Architected: Performance — memory/timeout from preset config
-     * Well-Architected: Sustainability — ARM64 Graviton by default
-     * Well-Architected: Operational Excellence — structured env vars, log retention from preset
-     * Well-Architected: Security — X-Ray tracing from preset config
-     */
-    private createStandaloneFunction;
-    /**
-     * Create a queue consumer Lambda function wired to an SQS queue.
-     * Naming convention: {project}-{stage}-queue-{name}
-     *
-     * Well-Architected: Reliability — DLQ on consumer queue, encrypted
-     * Well-Architected: Performance — batch size and visibility timeout
-     */
-    private createQueueConsumer;
-    /**
-     * Create a cron/scheduled task Lambda function wired to an EventBridge rule.
-     * Naming convention: {project}-{stage}-cron-{name}
-     *
-     * Well-Architected: Performance — memory/timeout from preset
-     * Well-Architected: Operational Excellence — log retention, tracing from preset
-     */
-    private createCronHandler;
-}
-//# sourceMappingURL=stack.d.ts.map

package/dist/cdk/stack.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../src/cdk/stack.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AA4BnC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EACV,aAAa,EAKb,SAAS,EAMV,MAAM,kBAAkB,CAAC;AAO1B;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CAyCvE;AAmBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,GAAG,CAAC,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAgUD,qBAAa,YAAa,SAAQ,GAAG,CAAC,KAAK;IACzC,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAM;IAE5D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuE;IACxG,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IACxD,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;IACpE;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAOvB;IAER;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAUtB;IAER;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAgB;gBAE1C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB;IA88BlE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAuMtB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkLrB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA6NlB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,YAAY;IA6OpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,uBAAuB;IAmK/B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IA2DnB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAyDnB,OAAO,CAAC,gBAAgB;IAgExB,OAAO,CAAC,YAAY;IA+CpB,OAAO,CAAC,YAAY;IAkGpB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAuD3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAqD5B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAMvB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAM5B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAyE3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAkFhC;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqF3B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CA6F1B"}