@venturekit/infra 0.0.0-dev.20260701100017 → 0.0.0-dev.20260704225856

package/README.md

@@ -29,13 +29,11 @@ Create a `vk.config.ts` at your project root:
 ```typescript
 import { defineVenture } from '@venturekit/infra';
 import { base } from './config/base';
-import { security } from './config/security';
 import { dev } from './config/dev';
 import { prod } from './config/prod';
 
 export default defineVenture({
   base,
-  security,
   envs: { dev, prod },
   routesDir: 'src/routes',
 });
@@ -46,7 +44,6 @@ export default defineVenture({
 ```typescript
 export default defineVenture({
   base,
-  security,
   envs: { dev, prod },
   routesDir: 'src/routes',
   infrastructure: {
@@ -213,12 +210,11 @@ VPC itself is not replaced and all other resources stay put.
 Creates a VentureKit application from a `VentureDefinition`:
 
 - `base` — `BaseConfig` (project identity)
-- `security` — `SecurityConfig` (scopes, clients)
 - `envs` — `{ dev?, stage?, prod? }` environment configurations
 - `routesDir` — path to file-based routes directory
 - `infrastructure?` — `VentureIntent` for declarative infrastructure
 
-### `getResolvedConfig(base, security, envInput)`
+### `getResolvedConfig(base, envInput)`
 
 Returns the fully resolved `ResolvedConfig` for the current environment. Useful for accessing config values in handler code.
 

package/dist/cdk/app-stack.d.ts

@@ -126,6 +126,21 @@ export interface AppStackImports {
     storageBucketNamesById?: Map<string, string>;
     /** SQS queue ARNs per `queues` intent — for grant + ESM source. */
     queueArnsById?: Map<string, string>;
+    /**
+     * EventBridge bus names per OWNED `events` intent. Injected into the
+     * Lambda environment as `EVENT_BUS_<ID>_NAME` (+ `VENTURE_EVENT_BUS_NAME`
+     * for the primary) so `@venturekit/runtime`'s `publishEvent()` resolves
+     * the bus without an SSM read. Subscriber-only intents (those with
+     * `external.busName`) are NOT in this map — they reference the bus by
+     * name on the rule side and never publish.
+     */
+    eventBusNamesById?: Map<string, string>;
+    /**
+     * EventBridge bus ARNs per OWNED `events` intent — the `events:PutEvents`
+     * IAM scoping target on the shared Lambda role, and the handle the app
+     * stack re-imports to attach owned-bus subscription rules.
+     */
+    eventBusArnsById?: Map<string, string>;
     /** SNS notify events topic ARNs per `notify` intent. */
     notifyEventsTopicArnsById?: Map<string, string>;
     /** CloudFront CDN domain per storage intent that has `cdn:true`. */
@@ -389,6 +404,79 @@ export declare class VentureAppStack extends cdk.Stack {
      * directly to the caller, where they belong.
      */
     private createStandaloneFunction;
+    /**
+     * Materialise every `events[]` intent's subscriptions as EventBridge
+     * `Rule`s on the target bus. Each rule routes events matching its
+     * pattern (source + detail-type) to ONE in-venture target — an SQS
+     * queue (delivered as a message its `queueBatchHandler` consumer
+     * reads, at-least-once) or a Lambda (invoked async).
+     *
+     * Bus resolution:
+     *   - OWNED bus → re-imported from the messaging tier by ARN
+     *     (`imports.eventBusArnsById`).
+     *   - `external.busName` → imported by name (`fromEventBusName`);
+     *     same account + region, owner venture deployed first. This is how
+     *     a vertical venture attaches a rule to the control-plane
+     *     venture's bus without either calling the other.
+     */
+    private createEventSubscriptions;
+    /**
+     * One EventBridge `Rule` on `bus` for subscription `sub`. The pattern
+     * defaults to `{ source: [busSource], detailType: sub.detailTypes }`,
+     * with `sub.sources` / `sub.pattern` overriding (the raw `pattern`
+     * escape hatch is shallow-merged LAST so it always wins). CDK's target
+     * constructs add the resource policy that lets EventBridge invoke the
+     * Lambda / send to the queue — for a cross-stack imported queue that
+     * is an `AWS::SQS::QueuePolicy` in this app stack, leaving the
+     * messaging-tier queue untouched.
+     */
+    private createEventRule;
+    /**
+     * Render declared `monitoring` intents into CloudWatch alarms
+     * (REQUIREMENTS §7.4). Until this existed a `MonitoringIntent` in
+     * vk.config.ts was a SILENT NO-OP — the intent reached the stack but
+     * nothing materialised a `cloudwatch.Alarm`.
+     *
+     * Each `AlarmIntent` becomes one `cloudwatch.Alarm` over a
+     * `cloudwatch.Metric` built verbatim from the intent (namespace /
+     * metric / statistic / period / threshold / comparison /
+     * evaluationPeriods / dimensions). When the parent `MonitoringIntent`
+     * carries a `notificationArn`, the alarm's ALARM action publishes to
+     * that (imported) SNS topic.
+     *
+     * # Dimension ergonomics
+     *
+     * Lambda function names and EventBridge rule names are clamped /
+     * prefixed at synth (`clampLambdaFunctionName`,
+     * `${project}-${stage}-cron-${name}`), so a consumer can't predict
+     * them in vk.config.ts. To keep the §7.4 Lambda-error / cron-failure
+     * alarms declarable, two dimension keys accept a LOGICAL handler name
+     * and are resolved here to the physical name:
+     *   - `FunctionName` — matched against every Lambda this stack created
+     *     (route slug, queue / cron / standalone handler name, notify
+     *     dispatcher/bounce id) → the CDK `functionName` token.
+     *   - `RuleName` — matched against declared cron handler names →
+     *     `${project}-${stage}-cron-${name}`.
+     * Any other dimension value (an explicit physical name, an RDS
+     * `DBInstanceIdentifier`, a custom-metric dimension) passes through
+     * verbatim. (RDS identifiers live in the data stack, so they're not
+     * auto-resolvable here — supply the physical id, or see the
+     * cross-stack follow-up.)
+     */
+    private createMonitoring;
+    /**
+     * Resolve an AlarmIntent's dimensions, mapping the logical
+     * `FunctionName` / `RuleName` conventions to physical names (see
+     * `createMonitoring`). Returns a fresh object; never mutates input.
+     */
+    private resolveAlarmDimensions;
+    /**
+     * Find a Lambda this stack created by its LOGICAL name — a route
+     * slug, a queue / cron / standalone handler name, or a notify intent
+     * id. Returns undefined when nothing matches (the caller then treats
+     * the value as an explicit physical name).
+     */
+    private findLambdaByLogicalName;
     /**
      * Attach IAM grants to the shared Lambda role for every imported
      * resource. Called once during construction, before any Lambda is

package/dist/cdk/app-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/app-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAMjD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAI7D,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAiB1B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AAkCzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAEf;;;;OAIG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElE,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD,+CAA+C;IAC/C,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CACjE,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAC3B,MAAM,EACN;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAC1C,CAAC;CACH;AAED,MAAM,WAAW,oBAAqB,SAAQ,GAAG,CAAC,UAAU;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IAErB,4EAA4E;IAC5E,cAAc,EAAE,aAAa,CAAC;IAE9B,yEAAyE;IACzE,OAAO,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAgB,SAAQ,GAAG,CAAC,KAAK;IAC5C,4DAA4D;IAC5D,SAAgB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IAErC,yEAAyE;IACzE,SAAgB,mBAAmB,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;IAExD,oEAAoE;IACpE,SAAgB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC;IAE1D;;;;;;OAMG;IACH,SAAgB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpD,mEAAmE;IACnE,SAAgB,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5C,kCAAkC;IAClC,SAAgB,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAE/B;;;;;;OAMG;IACH,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,oDAAoD;IACpD,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,sDAAsD;IACtD,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,wEAAwE;IACxE,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,2DAA2D;IAC3D,SAAgB,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAElF,+DAA+D;IAC/D,SAAgB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE9E;;;;;OAKG;IACH,SAAgB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IAshBrE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqG3B;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IA4CnB;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAsD7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IAyBhC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAmH3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;CAuKhC"}
+{"version":3,"file":"app-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/app-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAMjD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAM7D,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAiB1B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AA6CzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAEf;;;;OAIG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElE,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD,+CAA+C;IAC/C,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CACjE,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAC3B,MAAM,EACN;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAC1C,CAAC;CACH;AAED,MAAM,WAAW,oBAAqB,SAAQ,GAAG,CAAC,UAAU;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IAErB,4EAA4E;IAC5E,cAAc,EAAE,aAAa,CAAC;IAE9B,yEAAyE;IACzE,OAAO,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAgB,SAAQ,GAAG,CAAC,KAAK;IAC5C,4DAA4D;IAC5D,SAAgB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IAErC,yEAAyE;IACzE,SAAgB,mBAAmB,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;IAExD,oEAAoE;IACpE,SAAgB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC;IAE1D;;;;;;OAMG;IACH,SAAgB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpD,mEAAmE;IACnE,SAAgB,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5C,kCAAkC;IAClC,SAAgB,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAE/B;;;;;;OAMG;IACH,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,oDAAoD;IACpD,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,sDAAsD;IACtD,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,wEAAwE;IACxE,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,2DAA2D;IAC3D,SAAgB,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAElF,+DAA+D;IAC/D,SAAgB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE9E;;;;;OAKG;IACH,SAAgB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IAukBrE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqG3B;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IA4CnB;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAsD7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IAyBhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAqChC;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IA8DvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,gBAAgB;IA2DxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAsI3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;CAuKhC"}

package/dist/cdk/app-stack.js

@@ -79,6 +79,8 @@ import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import * as apigatewayv2Integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import * as sns from 'aws-cdk-lib/aws-sns';
 import * as snsSubscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
+import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
+import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import { DATA_SAFETY_CONFIG, } from '@venturekit/core';
@@ -88,6 +90,16 @@ import { bundleHandlerCodeWithEsbuild, inlineStubLambdaCode, toLambdaArchitectur
 import { discoverRouteFiles, } from './shared/route-discovery.js';
 import { discoverWsRoutes } from './shared/ws-discovery.js';
 import { attachWebSocketApi, } from './shared/websocket-construct.js';
+/**
+ * Provider-agnostic `AlarmIntent.comparison` → CloudWatch operator.
+ * Defined once at module scope so `createMonitoring` stays a lookup.
+ */
+const ALARM_COMPARISON = {
+    gt: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+    gte: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    lt: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
+    lte: cloudwatch.ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD,
+};
 /**
  * Convert an intent id (e.g. `user-uploads`) to upper-snake-case
  * (`USER_UPLOADS`) suitable for use in env-var names. Without this,
@@ -284,6 +296,19 @@ export class VentureAppStack extends cdk.Stack {
         // coordinated Lambda rollout anyway. RETAIN under strict isn't
         // appropriate; on a stack delete we're tearing down every Lambda
         // that uses the key, so retaining the key alone serves no purpose.
+        //
+        // # Rotation runbook (S5 — manual, dual-secret verify window)
+        // This key is symmetric, so it cannot use Secrets Manager's
+        // built-in (asymmetric DB-credential) rotation. Rotate WITHOUT
+        // downtime via a two-key overlap:
+        //   1. Add a SECOND secret (`…/internal-hmac-next`) and roll it to
+        //      all functions as a fallback VERIFY key (sign with old, accept
+        //      either) — a brief deploy where verification accepts both.
+        //   2. Flip signing to the new key; keep accepting the old one until
+        //      every in-flight token (state tokens are short-lived) expires.
+        //   3. Remove the old key and the dual-verify fallback.
+        // Because issued tokens are short-lived, the overlap window can be
+        // minutes. Until tooling automates this, treat it as an ops task.
         this.internalHmacSecret = new secretsmanager.Secret(this, 'internalHmacSecret', {
             secretName: `venturekit/${projectName}/${stage}/internal-hmac`,
             description: 'VentureKit internal Lambda-to-Lambda HMAC signing key. Auto-generated.',
@@ -435,6 +460,18 @@ export class VentureAppStack extends cdk.Stack {
                 }
             }
         }
+        // ─── Event-bus env injection (owned `events` intents) ──────
+        // `publishEvent()` resolves the destination bus from
+        // `EVENT_BUS_<ID>_NAME`, falling back to `VENTURE_EVENT_BUS_NAME`
+        // (the FIRST declared owned bus). Subscriber-only intents
+        // (`external.busName`) never publish and so are absent from the map.
+        if (imports.eventBusNamesById && imports.eventBusNamesById.size > 0) {
+            const [, primaryBusName] = imports.eventBusNamesById.entries().next().value;
+            this.baseEnvVars['VENTURE_EVENT_BUS_NAME'] = primaryBusName;
+            for (const [id, busName] of imports.eventBusNamesById) {
+                this.baseEnvVars[`EVENT_BUS_${upperSnake(id)}_NAME`] = busName;
+            }
+        }
         // ─── IAM grants on the shared Lambda role ──────────────────
         // Every grant attached to `this.lambdaRole` benefits every
         // Lambda in the stack (routes, queue consumers, schedules,
@@ -653,6 +690,24 @@ export class VentureAppStack extends cdk.Stack {
                 this.provisionNotifyHandlers(infrastructure.notify, props.projectDir, imports);
             }
         }
+        // ─── EventBridge subscriptions (events[] rules → targets) ──
+        // Outside the `projectDir` guard above (like monitoring below) so a
+        // queue-target subscription — whose target ARN comes from imports,
+        // not handler discovery — still renders for projects that ship no
+        // handler code. Placed AFTER the guard so `{ function }` targets
+        // resolve to Lambdas discovered above. Owner-side bus creation lives
+        // in the messaging stack; here we only attach the rules + targets.
+        if (infrastructure.events && infrastructure.events.length > 0) {
+            this.createEventSubscriptions(infrastructure.events, imports);
+        }
+        // ─── CloudWatch alarms (monitoring) ───────────────────────
+        // Outside the `projectDir` guard above so data-only projects
+        // (custom-namespace or RDS alarms) still render; placed last so
+        // the FunctionName / RuleName dimension resolution can see every
+        // Lambda + cron rule created above.
+        if (infrastructure.monitoring && infrastructure.monitoring.length > 0) {
+            this.createMonitoring(infrastructure.monitoring);
+        }
     }
     /**
      * Build the Lambda code asset for a handler file. Production path:
@@ -913,6 +968,227 @@ export class VentureAppStack extends cdk.Stack {
         });
         this.functionLambdas.set(name, fn);
     }
+    /**
+     * Materialise every `events[]` intent's subscriptions as EventBridge
+     * `Rule`s on the target bus. Each rule routes events matching its
+     * pattern (source + detail-type) to ONE in-venture target — an SQS
+     * queue (delivered as a message its `queueBatchHandler` consumer
+     * reads, at-least-once) or a Lambda (invoked async).
+     *
+     * Bus resolution:
+     *   - OWNED bus → re-imported from the messaging tier by ARN
+     *     (`imports.eventBusArnsById`).
+     *   - `external.busName` → imported by name (`fromEventBusName`);
+     *     same account + region, owner venture deployed first. This is how
+     *     a vertical venture attaches a rule to the control-plane
+     *     venture's bus without either calling the other.
+     */
+    createEventSubscriptions(eventsIntents, imports) {
+        for (const intent of eventsIntents) {
+            const subs = intent.subscriptions ?? [];
+            if (subs.length === 0)
+                continue;
+            let bus;
+            if (intent.external?.busName) {
+                bus = events.EventBus.fromEventBusName(this, `events-${intent.id}-imported`, intent.external.busName);
+            }
+            else {
+                const busArn = imports.eventBusArnsById?.get(intent.id);
+                if (!busArn) {
+                    throw new Error(`[venturekit] app stack: events intent '${intent.id}' has ` +
+                        `subscriptions but no bus to attach them to. Either the ` +
+                        `messaging stack must create the bus (CLI passes its ARN via ` +
+                        `imports.eventBusArnsById) or the intent must set ` +
+                        `'external.busName' to attach rules to a bus owned by another ` +
+                        `venture.`);
+                }
+                bus = events.EventBus.fromEventBusArn(this, `events-${intent.id}-owned`, busArn);
+            }
+            const defaultSource = intent.source ?? this.projectName;
+            for (const sub of subs) {
+                this.createEventRule(intent, sub, bus, defaultSource, imports);
+            }
+        }
+    }
+    /**
+     * One EventBridge `Rule` on `bus` for subscription `sub`. The pattern
+     * defaults to `{ source: [busSource], detailType: sub.detailTypes }`,
+     * with `sub.sources` / `sub.pattern` overriding (the raw `pattern`
+     * escape hatch is shallow-merged LAST so it always wins). CDK's target
+     * constructs add the resource policy that lets EventBridge invoke the
+     * Lambda / send to the queue — for a cross-stack imported queue that
+     * is an `AWS::SQS::QueuePolicy` in this app stack, leaving the
+     * messaging-tier queue untouched.
+     */
+    createEventRule(intent, sub, bus, defaultSource, imports) {
+        const resourceId = `events-${intent.id}-${sub.id}`;
+        const pattern = {
+            source: sub.sources ?? [defaultSource],
+            ...(sub.detailTypes ? { detailType: sub.detailTypes } : {}),
+            ...(sub.pattern ?? {}),
+        };
+        let target;
+        if (sub.target?.queue) {
+            const queueArn = imports.queueArnsById?.get(sub.target.queue);
+            if (!queueArn) {
+                throw new Error(`[venturekit] app stack: events subscription '${intent.id}/${sub.id}' ` +
+                    `targets queue '${sub.target.queue}' but no such queue is declared. ` +
+                    `Add a queues[] intent with id='${sub.target.queue}'.`);
+            }
+            const queue = sqs.Queue.fromQueueArn(this, `${resourceId}-queue`, queueArn);
+            // Deliver ONLY the event `detail` as the SQS body (not the full
+            // EventBridge envelope). This matches VentureKit's queue
+            // convention — a `queueBatchHandler` consumer's `body` is the
+            // payload — so subscribing a queue to an event is indistinguishable
+            // from `sendMessage(queueId, detail)`. The publisher bakes
+            // `__trace` INTO the detail, so trace propagation survives.
+            target = new eventsTargets.SqsQueue(queue, {
+                message: events.RuleTargetInput.fromEventPath('$.detail'),
+            });
+        }
+        else if (sub.target?.function) {
+            const fn = this.findLambdaByLogicalName(sub.target.function);
+            if (!fn) {
+                throw new Error(`[venturekit] app stack: events subscription '${intent.id}/${sub.id}' ` +
+                    `targets function '${sub.target.function}' but no such Lambda was ` +
+                    `created. Add a handler at src/functions/${sub.target.function}.ts.`);
+            }
+            target = new eventsTargets.LambdaFunction(fn);
+        }
+        else {
+            throw new Error(`[venturekit] app stack: events subscription '${intent.id}/${sub.id}' ` +
+                `must declare a target: { queue: '<id>' } or { function: '<id>' }.`);
+        }
+        new events.Rule(this, `${resourceId}-rule`, {
+            ruleName: clampLambdaFunctionName(`${this.projectName}-${this.stage}-events-${intent.id}-${sub.id}`),
+            eventBus: bus,
+            eventPattern: pattern,
+            targets: [target],
+        });
+    }
+    /**
+     * Render declared `monitoring` intents into CloudWatch alarms
+     * (REQUIREMENTS §7.4). Until this existed a `MonitoringIntent` in
+     * vk.config.ts was a SILENT NO-OP — the intent reached the stack but
+     * nothing materialised a `cloudwatch.Alarm`.
+     *
+     * Each `AlarmIntent` becomes one `cloudwatch.Alarm` over a
+     * `cloudwatch.Metric` built verbatim from the intent (namespace /
+     * metric / statistic / period / threshold / comparison /
+     * evaluationPeriods / dimensions). When the parent `MonitoringIntent`
+     * carries a `notificationArn`, the alarm's ALARM action publishes to
+     * that (imported) SNS topic.
+     *
+     * # Dimension ergonomics
+     *
+     * Lambda function names and EventBridge rule names are clamped /
+     * prefixed at synth (`clampLambdaFunctionName`,
+     * `${project}-${stage}-cron-${name}`), so a consumer can't predict
+     * them in vk.config.ts. To keep the §7.4 Lambda-error / cron-failure
+     * alarms declarable, two dimension keys accept a LOGICAL handler name
+     * and are resolved here to the physical name:
+     *   - `FunctionName` — matched against every Lambda this stack created
+     *     (route slug, queue / cron / standalone handler name, notify
+     *     dispatcher/bounce id) → the CDK `functionName` token.
+     *   - `RuleName` — matched against declared cron handler names →
+     *     `${project}-${stage}-cron-${name}`.
+     * Any other dimension value (an explicit physical name, an RDS
+     * `DBInstanceIdentifier`, a custom-metric dimension) passes through
+     * verbatim. (RDS identifiers live in the data stack, so they're not
+     * auto-resolvable here — supply the physical id, or see the
+     * cross-stack follow-up.)
+     */
+    createMonitoring(monitoring) {
+        for (const intent of monitoring) {
+            const alarms = intent.alarms ?? [];
+            if (alarms.length === 0 && !intent.dashboard)
+                continue;
+            // Import the notification topic ONCE per intent — a per-alarm
+            // import would collide on the construct id.
+            const topic = intent.notificationArn
+                ? sns.Topic.fromTopicArn(this, `alarm-topic-${intent.id}`, intent.notificationArn)
+                : undefined;
+            const createdAlarms = [];
+            for (const a of alarms) {
+                const alarm = new cloudwatch.Alarm(this, `alarm-${intent.id}-${a.name}`, {
+                    alarmName: `${this.projectName}-${this.stage}-${a.name}`,
+                    alarmDescription: a.description,
+                    metric: new cloudwatch.Metric({
+                        namespace: a.namespace ?? 'AWS/Lambda',
+                        metricName: a.metric,
+                        statistic: a.statistic ?? 'Average',
+                        period: cdk.Duration.seconds(a.periodSeconds ?? 300),
+                        dimensionsMap: this.resolveAlarmDimensions(a.dimensions),
+                    }),
+                    threshold: a.threshold,
+                    comparisonOperator: ALARM_COMPARISON[a.comparison] ??
+                        cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+                    evaluationPeriods: a.evaluationPeriods ?? 1,
+                    // Failure/error alarms stay green when the metric simply
+                    // hasn't reported (no invocations = no errors).
+                    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+                });
+                if (topic) {
+                    alarm.addAlarmAction(new cloudwatchActions.SnsAction(topic));
+                }
+                createdAlarms.push(alarm);
+            }
+            if (intent.dashboard) {
+                const dashboard = new cloudwatch.Dashboard(this, `dashboard-${intent.id}`, {
+                    dashboardName: `${this.projectName}-${this.stage}-${intent.id}`,
+                });
+                if (createdAlarms.length > 0) {
+                    dashboard.addWidgets(new cloudwatch.AlarmStatusWidget({
+                        title: `${intent.id} alarms`,
+                        alarms: createdAlarms,
+                        width: 24,
+                    }));
+                }
+            }
+        }
+    }
+    /**
+     * Resolve an AlarmIntent's dimensions, mapping the logical
+     * `FunctionName` / `RuleName` conventions to physical names (see
+     * `createMonitoring`). Returns a fresh object; never mutates input.
+     */
+    resolveAlarmDimensions(dimensions) {
+        if (!dimensions)
+            return {};
+        const resolved = {};
+        for (const [key, value] of Object.entries(dimensions)) {
+            if (key === 'FunctionName') {
+                const fn = this.findLambdaByLogicalName(value);
+                // `fn.functionName` renders as an in-stack CFN `Ref`, but a
+                // CloudWatch dimension needs the LITERAL name the metric is
+                // published under. Every Lambda is built with an explicit
+                // physical name (see `buildLambda`), so read it off the L1.
+                const cfnFn = fn?.node.defaultChild;
+                resolved[key] = cfnFn?.functionName ?? value;
+            }
+            else if (key === 'RuleName' && this.scheduleLambdas.has(value)) {
+                resolved[key] = `${this.projectName}-${this.stage}-cron-${value}`;
+            }
+            else {
+                resolved[key] = value;
+            }
+        }
+        return resolved;
+    }
+    /**
+     * Find a Lambda this stack created by its LOGICAL name — a route
+     * slug, a queue / cron / standalone handler name, or a notify intent
+     * id. Returns undefined when nothing matches (the caller then treats
+     * the value as an explicit physical name).
+     */
+    findLambdaByLogicalName(name) {
+        return (this.routeLambdas.get(name) ??
+            this.scheduleLambdas.get(name) ??
+            this.queueLambdas.get(name) ??
+            this.functionLambdas.get(name) ??
+            this.notifyDispatcherLambdas.get(name) ??
+            this.notifyBounceLambdas.get(name));
+    }
     /**
      * Attach IAM grants to the shared Lambda role for every imported
      * resource. Called once during construction, before any Lambda is
@@ -1020,6 +1296,22 @@ export class VentureAppStack extends cdk.Stack {
                 }));
             }
         }
+        // ── EventBridge PutEvents on OWNED buses ─────────────────
+        // Scoped to the ARNs of the buses this venture owns, so a handler
+        // can `publishEvent()` to them but not to arbitrary buses. Pure
+        // subscribers (external.busName) own no bus and get no grant — they
+        // only RECEIVE via rules, which EventBridge delivers under its own
+        // service principal, not the Lambda role.
+        if (imports.eventBusArnsById) {
+            const busArns = [...imports.eventBusArnsById.values()];
+            if (busArns.length > 0) {
+                this.lambdaRole.addToPrincipalPolicy(new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: ['events:PutEvents'],
+                    resources: busArns,
+                }));
+            }
+        }
     }
     /**
      * Provision dispatcher + bounce-handler Lambdas per declared