# SAM infrastructure (test / production)

API Gateway HTTP API → Nitro `aws_lambda` (`nodejs24.x`) → DynamoDB, plus CDN for hashed static assets (`NUXT_APP_CDN_URL`).

**Test CDN:** shared HyperActivity/portfolio stack `shared-cdn-test` (`https://d3sr1gndi209fc.cloudfront.net`, bucket `shared-cdn-test-assets-305052780274`, sync **without** `--delete`). See [shared CDN note](#shared-test-cdn-hyperactivity--portfolio) below.

**Production CDN:** stack-owned private S3 + CloudFront (OAC) until a shared production cutover is requested.

**Operations (install SAM CLI, deploy, Windows notes):** [`infra/sam/README.md`](https://github.com/tamaramack/portfolio/blob/development/infra/sam/README.md)

**CI/CD:** [cicd.md](./cicd.md) · **CDN behavior:** [web/features/cdn-guide.md](./web/features/cdn-guide.md) · **Dry-run public sync:** `npm run sam:sync:dryrun` / `--shared`

## Layout

| Path                                  | Role                                       |
| ------------------------------------- | ------------------------------------------ |
| `infra/sam/template.yaml`             | Lambda, HTTP API, DynamoDB, S3, CloudFront |
| `infra/sam/samconfig.toml`            | `test` / `prod` profiles                   |
| `infra/sam/.aws-sam/build-src/server` | Staged Nitro server (Lambda `CodeUri`)     |
| `infra/sam/.aws-sam/build-src/public` | Staged `.output/public` (S3 sync / CDN)    |

Website HTML/API and CDN assets **do not share a host**: pages hit `execute-api`; hashed files and `favicon.ico` hit `*.cloudfront.net`. Lambda **does not** ship `.output/public` (`nitro.serveStatic: false` on `aws_lambda`). SAM stages `build-src/server` (CodeUri) and `build-src/public` (S3 sync) separately; GET/HEAD for static extensions on the API host **302** to the CDN origin.

### Shared test CDN (HyperActivity + portfolio)

Cutover (2026-08-21): test `NUXT_APP_CDN_URL` / sync target is the shared CloudFormation stack owned in HyperActivity (`infra/sam/shared-cdn.yaml`). No per-project prefix. Do not destroy `shared-cdn-test` from this repo. Do not `aws s3 sync --delete` that bucket. Production stays on `portfolio-prod` CDN.

Historical agent brief: [agents/shared-cdn-handoff.md](./agents/shared-cdn-handoff.md).

## Commands

```bash
npm run sam:build
npm run sam:sync:dryrun
npm run sam:deploy:test
npm run sam:deploy:prod
```

Region: see `samconfig.toml` (currently `us-west-2`). GitHub CD uses OIDC (`AWS_ROLE_ARN`) and Environments `test` / `production`.