serverless-ircd 0.9.0 → 0.10.0

package/apps/aws-stack/bin/aws.ts

@@ -5,11 +5,13 @@
  * CDK CLI's default account/region when those env vars are set; otherwise
  * the stack is environment-agnostic (suitable for `cdk synth` and localstack).
  *
- * Per-environment isolation is driven by the `environmentName` CDK context
- * variable (`-c environmentName=staging`). It defaults to `staging` so the
- * existing deploy pipeline stays green without changes, and it is folded
- * into the CloudFormation stack id (`IrcAwsStack-<environmentName>`) so
- * parallel envs coexist in one account+region.
+ * There is a single deploy target per platform (the staging/prod split was
+ * collapsed). This app synthesizes exactly one stack named `IrcAwsStack`;
+ * staging vs production isolation is driven by which AWS account and region
+ * the deploy credentials target, not by stack-name templating. Server
+ * identity (`serverName`, `networkName`, `motd`) and the optional TCP+TLS
+ * domain are read from CDK context so deploys can override them without
+ * editing source.
  */
 
 import { App } from 'aws-cdk-lib';
@@ -20,8 +22,6 @@ const app = new App();
 
 const account = process.env.CDK_DEFAULT_ACCOUNT;
 const region = process.env.CDK_DEFAULT_REGION;
-const environmentName =
-  (app.node.tryGetContext('environmentName') as string | undefined) ?? 'staging';
 
 // Server identity is read from CDK context so deploys can override it
 // without editing source (`-c serverName=…`, `-c networkName=…`,
@@ -44,13 +44,86 @@ const motdLines = Array.isArray(rawMotd)
 // docs/AWS-TCP-Deployment.md.
 const tcpTlsDomainName = app.node.tryGetContext('tcpTlsDomainName') as string | undefined;
 
+// `$connect` Origin allowlist (CSWSH defence). Opt-in: only provisioned
+// when this context var is supplied as a non-empty string. Comma-separated
+// origin list (e.g. `'https://app.example.com, https://staging.app.example.com'`).
+// When omitted, the `$connect` handler skips the Origin check entirely
+// (existing AWS deployments without a web frontend are unchanged).
+const webOrigins = app.node.tryGetContext('webOrigins') as string | undefined;
+
+// API Gateway full-frame body tracing (`DataTraceEnabled`). Safe-by-default:
+// omitted → `false` (no IRC frame bodies logged). Re-enabling requires BOTH
+// `-c allowDataTrace=true` AND `-c iUnderstandThisLeaksCredentials=true`; the
+// stack REFUSES synth with a credential-leak error if only the first is set.
+// Since the staging/prod split was collapsed every synth is effectively a
+// prod synth, so there is no quiet "non-prod" path — use ONLY in a throwaway
+// sandbox for live debugging. See docs/AWS-Deployment.md (§7.6).
+const allowDataTrace = app.node.tryGetContext('allowDataTrace') as boolean | string | undefined;
+const iUnderstandThisLeaksCredentials = app.node.tryGetContext('iUnderstandThisLeaksCredentials') as
+  | boolean
+  | string
+  | undefined;
+
+// CDK context vars arrive as strings; normalise the booleans so the stack's
+// guard sees real booleans (and `--c allowDataTrace=false` stays false-y).
+const allowDataTraceBool = parseContextBool(allowDataTrace);
+const acknowledgeLeakBool = parseContextBool(iUnderstandThisLeaksCredentials);
+
+// Web client hosting (S3 + CloudFront + OAC) is opt-in. Supplying
+// `webSiteCustomDomain` provisions the static-site construct; prod passes
+// the custom domain + cert + hosted zone, staging leaves them unset to use
+// the default `*.cloudfront.net` URL. See docs/AWS-Deployment.md (web section).
+const webSiteCustomDomain = app.node.tryGetContext('webSiteCustomDomain') as string | undefined;
+const webSiteCertificateArn = app.node.tryGetContext('webSiteCertificateArn') as string | undefined;
+const webSiteHostedZoneName = app.node.tryGetContext('webSiteHostedZoneName') as string | undefined;
+const webSiteHostedZoneId = app.node.tryGetContext('webSiteHostedZoneId') as string | undefined;
+const webSite =
+  webSiteCustomDomain !== undefined
+    ? {
+        customDomain: webSiteCustomDomain,
+        ...(webSiteCertificateArn !== undefined ? { certificateArn: webSiteCertificateArn } : {}),
+        ...(webSiteHostedZoneName !== undefined ? { hostedZoneName: webSiteHostedZoneName } : {}),
+        ...(webSiteHostedZoneId !== undefined ? { hostedZoneId: webSiteHostedZoneId } : {}),
+      }
+    : undefined;
+
 const stackProps: IrcStackProps = {
-  environmentName,
   ...(serverName !== undefined ? { serverName } : {}),
   ...(networkName !== undefined ? { networkName } : {}),
   ...(motdLines !== undefined ? { motdLines } : {}),
   ...(tcpTlsDomainName !== undefined ? { tcpTlsDomainName } : {}),
+  ...(webOrigins !== undefined && webOrigins.length > 0 ? { webOrigins } : {}),
+  ...(webSite !== undefined ? { webSite } : {}),
+  ...(allowDataTraceBool !== undefined ? { allowDataTrace: allowDataTraceBool } : {}),
+  ...(acknowledgeLeakBool !== undefined
+    ? { iUnderstandThisLeaksCredentials: acknowledgeLeakBool }
+    : {}),
   ...(account && region ? { env: { account, region } } : {}),
 };
 
-new IrcAwsStack(app, `IrcAwsStack-${environmentName}`, stackProps);
+new IrcAwsStack(app, 'IrcAwsStack', stackProps);
+
+/**
+ * Normalises a CDK context value (`-c key=value`) into a boolean.
+ * CDK passes context values as strings, so `'true'` / `'false'` are
+ * parsed; anything else (including `undefined`) returns `undefined` so
+ * the downstream optional prop is simply omitted. The data-trace guard
+ * in `IrcAwsStack` is strict-equality-checked against `true`, so a stray
+ * string here would otherwise defeat the opt-in.
+ */
+function parseContextBool(value: boolean | string | undefined): boolean | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  const normalised = value.trim().toLowerCase();
+  if (normalised === 'true') {
+    return true;
+  }
+  if (normalised === 'false') {
+    return false;
+  }
+  return undefined;
+}

package/apps/aws-stack/cdk.json

@@ -1,8 +1,5 @@
 {
   "app": "tsx bin/aws.ts",
-  "context": {
-    "environmentName": "staging"
-  },
   "watch": {
     "include": ["src/**", "bin/**"],
     "exclude": ["tests/**", "dist/**", "node_modules/**"]

package/apps/aws-stack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/aws-stack",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "AWS CDK v2 stack: API Gateway v2 WebSocket API, Lambda, DynamoDB tables, least-privilege IAM",
   "license": "BSD-3-Clause",
@@ -14,9 +14,8 @@
     "clean": "rimraf dist coverage .tsbuildinfo .turbo cdk.out",
     "cdk": "cdk",
     "cdk:synth": "cdk synth",
-    "deploy:staging": "cdk deploy --all --require-approval never",
-    "deploy:prod": "cdk deploy --all --require-approval never",
-    "smoke:staging": "node scripts/smoke.mjs"
+    "deploy": "cdk deploy --all --require-approval never",
+    "smoke": "node scripts/smoke.mjs"
   },
   "devDependencies": {
     "aws-cdk": "^2.262.0",

package/apps/aws-stack/src/aws-stack.ts

@@ -2,7 +2,7 @@
  * `apps/aws-stack` CDK stack — the AWS substrate for ServerlessIRCd (PLAN §6.2).
  *
  *   • 5 DynamoDB tables sourced from `@serverless-ircd/aws-adapter/cdk-table-defs`
- *     (Connections, ChannelMeta, ChannelMembers, Nicks, Accounts).
+ *     (Connections, ChannelMeta, ChannelMembers, Nicks, Services).
  *   • ONE Node 24 `NodejsFunction` bundling the AWS Lambda handler
  *     (`$connect` / `$disconnect` / `$default` dispatched on
  *     `event.requestContext.routeKey`).
@@ -51,6 +51,7 @@ import { Code, Function as Lambda, Runtime } from 'aws-cdk-lib/aws-lambda';
 import { NodejsFunction, type NodejsFunctionProps } from 'aws-cdk-lib/aws-lambda-nodejs';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import type { Construct } from 'constructs';
+import { StaticSite, type StaticSiteProps } from './static-site.js';
 
 /** Stage name served by the auto-deploying WebSocket stage. */
 const STAGE_NAME = 'prod';
@@ -68,13 +69,6 @@ const SWEEPER_SCHEDULE_RATE = Duration.minutes(5);
  */
 const PING_CHECKER_SCHEDULE_RATE = Duration.minutes(1);
 
-/**
- * Environment assumed when {@link IrcStackProps.environmentName} is
- * omitted. Keeps the existing deploy pipeline green without requiring
- * callers to pass the flag.
- */
-const DEFAULT_ENVIRONMENT_NAME = 'staging';
-
 /**
  * Fallback server identity, used when the corresponding prop is omitted.
  * Deliberately not `irc.example.com` (the retired placeholder) so a
@@ -109,21 +103,10 @@ const TEST_NO_BUNDLE_FLAG = 'IRC_AWS_STACK_TEST_NO_BUNDLE';
 
 /**
  * Construct props for {@link IrcAwsStack}. Acts as the single
- * configuration bag extended by deploy-time knobs (environment name,
- * server identity, …) so the prop surface grows in one place.
+ * configuration bag extended by deploy-time knobs (server identity, …)
+ * so the prop surface grows in one place.
  */
 export interface IrcStackProps extends StackProps {
-  /**
-   * Logical deployment environment (e.g. `staging`, `production`).
-   *
-   * Prefixes every physical DynamoDB table name
-   * (`<Env><LogicalId>` — first letter capitalised, e.g.
-   * `StagingConnections`) and is intended to be folded into the
-   * CloudFormation stack id by the caller
-   * (`IrcAwsStack-<environmentName>`). Defaults to `staging`.
-   */
-  readonly environmentName?: string;
-
   /**
    * Server name advertised to clients (`SERVER_NAME` / the `001`
    * welcome source). Falls back to `irc.localhost` when omitted; production
@@ -158,13 +141,89 @@ export interface IrcStackProps extends StackProps {
    * (WebSocket) transport is deployed.
    */
   readonly tcpTlsDomainName?: string;
+
+  /**
+   * Web client hosting substrate (S3 + CloudFront + OAC).
+   *
+   * When provided, the stack provisions a {@link StaticSite} that serves
+   * the shared `apps/web/dist` build artifact over CloudFront. The S3
+   * origin bucket is private and grants the distribution via Origin
+   * Access Control (never public-read); SPA client-side routing under
+   * `/app/*` is handled by a CloudFront custom error response mapping
+   * 403/404 → `200 /app/index.html`. Pure infrastructure — the per-env
+   * config bake and the s3-sync deploy pipeline are separate. Pass the
+   * custom-domain fields for prod; omit them for the default
+   * `*.cloudfront.net` URL (staging). When omitted entirely, no web
+   * hosting resources are provisioned.
+   */
+  readonly webSite?: StaticSiteProps;
+
+  /**
+   * Comma-separated allowlist of web origins permitted to open
+   * WebSocket upgrades (CSWSH defence — API Gateway WebSocket has no
+   * built-in Origin check). Mirrors the CF Worker's `WEB_ORIGINS` env.
+   *
+   * When provided (non-empty), the value is injected as the
+   * `WEB_ORIGINS` Lambda env var on the wss `$connect` handler. The
+   * `$connect` Lambda then denies any browser-sent `Origin` not in
+   * the list with `403`, so API Gateway closes the upgrade. Unset /
+   * empty (the default) disables the check — existing deployments
+   * without a web frontend are unchanged on upgrade. Non-browser
+   * clients (curl, WeeChat, the `tcp-ws-forwarder`, NLB TCP+TLS)
+   * never send `Origin` and pass through regardless.
+   *
+   * Example: `'https://app.example.com, https://staging.app.example.com'`
+   */
+  readonly webOrigins?: string;
+
+  /**
+   * Escape hatch that re-enables API Gateway full-frame body tracing
+   * (`DataTraceEnabled = true`) on the WebSocket stage. Defaults to
+   * `false` (safe: no frame bodies are logged).
+   *
+   * ⚠️ Setting this to `true` alone REFUSES synthesis — it must be
+   * accompanied by {@link iUnderstandThisLeaksCredentials} = `true`.
+   * This double opt-in is deliberate: since the staging/prod split was
+   * collapsed (every synth is effectively a prod synth; there is no
+   * `environmentName` context), there is no longer a "non-prod" branch
+   * to quietly enable tracing on. The only safe default is OFF, and the
+   * only way back on is an explicit, two-step acknowledgement.
+   *
+   * For a WebSocket IRC endpoint, body tracing writes the FULL payload
+   * of every frame — `PASS <password>`, `AUTHENTICATE <base64-SASL-PLAIN>`,
+   * `JOIN #chan <channel-key>`, and every `PRIVMSG`/`NOTICE` — to the
+   * APIGW execution-log CloudWatch group. Anyone with `logs:GetLogEvents`
+   * (operators, SREs, Logpush destinations, compromised CI creds)
+   * recovers IRC credentials verbatim. Use ONLY in a throwaway sandbox
+   * account for live debugging, and tear it down immediately after.
+   *
+   * Set via CDK context: `-c allowDataTrace=true`.
+   */
+  readonly allowDataTrace?: boolean;
+
+  /**
+   * Mandatory confirmation that accompanies {@link allowDataTrace} = `true`.
+   * Has NO effect on its own; it only unlocks the `allowDataTrace` escape
+   * hatch. Defaults to `false`. The awkward name is intentional: it cannot
+   * be set by accident, and a synth error names this prop when it is
+   * missing so the operator is forced to read the credential-leak warning.
+   *
+   * Set via CDK context: `-c iUnderstandThisLeaksCredentials=true`.
+   */
+  readonly iUnderstandThisLeaksCredentials?: boolean;
 }
 
 export class IrcAwsStack extends Stack {
   constructor(scope: Construct, id: string, props: IrcStackProps = {}) {
     super(scope, id, props);
 
-    const environmentName = props.environmentName ?? DEFAULT_ENVIRONMENT_NAME;
+    // Fail-fast on the credential-leak escape hatch BEFORE any resource is
+    // constructed: if `allowDataTrace` was requested without the explicit
+    // `iUnderstandThisLeaksCredentials` confirmation, refuse synthesis here so
+    // the operator sees the credential-leak error immediately (and so the
+    // throw is not masked by downstream asset bundling). The resolved value
+    // is threaded into `defaultRouteSettings.dataTraceEnabled` below.
+    const dataTraceEnabled = resolveDataTraceEnabled(props);
 
     // Server identity is exposed as CloudFormation Parameters so it can be
     // overridden at deploy time (`cdk deploy --parameters ServerName=...`,
@@ -238,15 +297,16 @@ export class IrcAwsStack extends Stack {
       default: Schedule.rate(PING_CHECKER_SCHEDULE_RATE).expressionString,
     });
 
-    // Prefix every physical table name with the environment so parallel
-    // envs (staging + production) cannot collide in one account+region.
-    // The first letter is capitalised to compose cleanly with the
-    // PascalCase logical ids (`staging` → `StagingConnections`).
+    // DynamoDB table names are the bare logical ids (`Connections`,
+    // `Nicks`, …). There is a single deploy target per platform (the
+    // staging/prod split was collapsed); staging vs production isolation
+    // is driven by which AWS account + region the deploy credentials
+    // target, not by table-name prefixing.
     const tables = Object.fromEntries(
       Object.entries(TABLE_DEFS).map(([logicalId, tableProps]) => {
         const table = new Table(this, logicalId, {
           ...tableProps,
-          tableName: prefixedTableName(environmentName, logicalId),
+          tableName: logicalId,
           removalPolicy: RemovalPolicy.DESTROY,
         });
         return [logicalId, table];
@@ -414,13 +474,19 @@ export class IrcAwsStack extends Stack {
         sourceIp: '$context.sourceIp',
       }),
     };
-    // Execution logging: the parameter drives LoggingLevel (OFF/INFO/ERROR);
-    // DataTraceEnabled logs full request/response bodies when a level is
-    // active. This is the layer that shows whether APIGW received and routed
-    // a client frame or dropped it pre-Lambda.
+    // Execution logging: the parameter drives LoggingLevel (OFF/INFO/ERROR).
+    // `DataTraceEnabled` is hard-locked to `false` here. For a WebSocket IRC
+    // endpoint, body tracing writes the FULL payload of every frame —
+    // `PASS <password>`, `AUTHENTICATE <base64-SASL-PLAIN>`,
+    // `JOIN #chan <channel-key>`, and every `PRIVMSG`/`NOTICE` — to the
+    // APIGW execution-log CloudWatch group (AWS/ApiGateway…). Anyone with
+    // `logs:GetLogEvents` recovers IRC credentials verbatim. The logging
+    // LEVEL (INFO request/response metadata without bodies) is enough to
+    // diagnose frame-routing drops; the only way to re-enable full-body
+    // tracing is the explicit, double-opt-in escape hatch asserted below.
     cfnStage.defaultRouteSettings = {
       loggingLevel: apiLoggingLevelParam.valueAsString,
-      dataTraceEnabled: true,
+      dataTraceEnabled,
     };
 
     stage.grantManagementApiAccess(handler);
@@ -430,16 +496,15 @@ export class IrcAwsStack extends Stack {
 
     // Inject each table's physical name as an env var so every Lambda can
     // construct a `TablesConfig` at cold start via `buildDepsFromEnv`. The
-    // env-var value is the environment-prefixed physical name (computed
-    // through the same helper as the Table construct so they match
-    // exactly), NOT a CloudFormation Ref — the runtime needs the literal
-    // per-env table name to target the correct table.
+    // env-var value is the literal physical table name (the bare logical
+    // id, computed through the same mapping as the Table construct so they
+    // match exactly), NOT a CloudFormation Ref — the runtime needs the
+    // literal name to target the correct table.
     for (const logicalId of Object.keys(TABLE_DEFS)) {
       const envName = `${logicalId.toUpperCase()}_TABLE`;
-      const physicalName = prefixedTableName(environmentName, logicalId);
-      handler.addEnvironment(envName, physicalName);
-      sweeper.addEnvironment(envName, physicalName);
-      pingChecker.addEnvironment(envName, physicalName);
+      handler.addEnvironment(envName, logicalId);
+      sweeper.addEnvironment(envName, logicalId);
+      pingChecker.addEnvironment(envName, logicalId);
     }
 
     // Server identity is injected into the handler, ping checker, AND the
@@ -461,6 +526,16 @@ export class IrcAwsStack extends Stack {
     sweeper.addEnvironment('NETWORK_NAME', networkName);
     sweeper.addEnvironment('MOTD', motd);
 
+    // CSWSH defence — opt-in `WEB_ORIGINS` allowlist on the `$connect`
+    // handler. Only the wss handler runs `$connect`, so only it needs
+    // the env var (the sweeper, ping-checker, and NLB handler never see
+    // an `event.headers.Origin`). When the prop is unset/empty the env
+    // var is omitted entirely and the handler's defence is disabled —
+    // existing deployments without a web frontend are unchanged.
+    if (props.webOrigins !== undefined && props.webOrigins.length > 0) {
+      handler.addEnvironment('WEB_ORIGINS', props.webOrigins);
+    }
+
     // EventBridge schedule → sweeper Lambda. The schedule expression comes
     // from a CloudFormation Parameter (see above), so it can be overridden
     // at deploy time; the sweeper is self-throttling
@@ -526,7 +601,7 @@ export class IrcAwsStack extends Stack {
       // Inject the same table names, server identity, and management URL.
       for (const logicalId of Object.keys(TABLE_DEFS)) {
         const envName = `${logicalId.toUpperCase()}_TABLE`;
-        nlbHandler.addEnvironment(envName, prefixedTableName(environmentName, logicalId));
+        nlbHandler.addEnvironment(envName, logicalId);
       }
       nlbHandler.addEnvironment('SERVER_NAME', serverName);
       nlbHandler.addEnvironment('NETWORK_NAME', networkName);
@@ -571,6 +646,39 @@ export class IrcAwsStack extends Stack {
       description: 'HTTPS management endpoint for ApiGatewayManagementApi.postToConnection.',
       value: stage.callbackUrl,
     });
+
+    // -------------------------------------------------------------------------
+    // Web client hosting substrate (S3 + CloudFront + OAC).
+    //
+    // Serves the shared `apps/web/dist` artifact (Kiwi SPA + landing page)
+    // exclusively over CloudFront. The S3 origin bucket is private; CloudFront
+    // reads it via Origin Access Control (the modern replacement for OAI).
+    // Only provisioned when `webSite` is supplied — staging defaults to the
+    // `*.cloudfront.net` URL, prod passes the custom-domain fields. Pure
+    // infrastructure; the per-env config bake and the s3-sync deploy pipeline
+    // are separate.
+    // -------------------------------------------------------------------------
+    if (props.webSite !== undefined) {
+      const site = new StaticSite(this, 'StaticSite', props.webSite);
+      // Expose the deploy-pipeline-relevant resource IDs at the PARENT-stack
+      // level (stable logical IDs — no CDK hashing, which only kicks in for
+      // outputs nested under child constructs). `scripts/deploy-web-aws.mjs`
+      // reads these via `aws cloudformation describe-stacks --query` to drive
+      // `s3 sync apps/web/dist s3://<bucket> --delete` and
+      // `cloudfront create-invalidation --distribution-id <id> --paths /*`.
+      // `ConnectUrl` (above) supplies the wss URL that the same script bakes
+      // into the SPA's config.json via `build.mjs --api-url`.
+      new CfnOutput(this, 'WebsiteBucketName', {
+        description:
+          'S3 origin bucket holding the web client build artifact (apps/web/dist). The deploy pipeline runs `aws s3 sync apps/web/dist s3://<this-bucket> --delete`.',
+        value: site.bucket.bucketName,
+      });
+      new CfnOutput(this, 'WebsiteDistributionId', {
+        description:
+          'CloudFront distribution ID serving the web client. The deploy pipeline runs `aws cloudfront create-invalidation --distribution-id <this-id> --paths /*` after each s3 sync.',
+        value: site.distribution.distributionId,
+      });
+    }
   }
 }
 
@@ -582,6 +690,34 @@ function handlerEntry(): string {
   return resolve(HERE, '..', '..', '..', 'packages', 'aws-adapter', 'src', 'handlers', 'index.ts');
 }
 
+/**
+ * Resolves the API Gateway `DataTraceEnabled` flag for the stage from the
+ * construct props. Safe-by-default: returns `false` unless the explicit,
+ * documented escape hatch is invoked. See {@link IrcStackProps.allowDataTrace}.
+ *
+ * Post-T170 (staging/prod collapse) every synth is effectively a prod synth,
+ * so there is no "non-prod" branch to quietly enable tracing on. The guard
+ * therefore refuses synthesis the moment `allowDataTrace` is requested
+ * without the explicit `iUnderstandThisLeaksCredentials` acknowledgement —
+ * forcing the operator to read the credential-leak warning.
+ */
+function resolveDataTraceEnabled(props: IrcStackProps): boolean {
+  if (props.allowDataTrace === true) {
+    if (props.iUnderstandThisLeaksCredentials === true) {
+      return true;
+    }
+    throw new Error(
+      'Refusing to enable API Gateway DataTraceEnabled: for a WebSocket IRC ' +
+        'endpoint this logs the FULL body of every frame (PASS <password>, ' +
+        'AUTHENTICATE <base64-SASL-PLAIN>, JOIN #chan <channel-key>, every ' +
+        'PRIVMSG/NOTICE) to the APIGW CloudWatch log group, leaking IRC ' +
+        'credentials to anyone with logs:GetLogEvents. To override in a ' +
+        'throwaway sandbox ONLY, also pass iUnderstandThisLeaksCredentials=true.',
+    );
+  }
+  return false;
+}
+
 /**
  * Internal Lambda-construct props: `NodejsFunctionProps` narrowed so the
  * runtime and handler are required. Every call site in the stack already
@@ -623,14 +759,3 @@ function makeLambda(scope: Construct, id: string, props: StrictLambdaProps): Lam
   }
   return new NodejsFunction(scope, id, props);
 }
-
-/**
- * Builds the physical DynamoDB table name for a logical id under the
- * given environment. Capitalises the environment's first letter so it
- * composes cleanly with PascalCase logical ids
- * (`staging` + `Connections` → `StagingConnections`).
- */
-function prefixedTableName(environmentName: string, logicalId: string): string {
-  const cap = environmentName.charAt(0).toUpperCase() + environmentName.slice(1);
-  return `${cap}${logicalId}`;
-}