@mettlecast/domain-cdk-packer 0.2.59 → 0.2.61

package/dist/DomainStack.js

@@ -1,7 +1,5 @@
 import * as cdk from 'aws-cdk-lib';
 import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
-import * as apigwv2integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
-import * as apigwv2Authorizers from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
 import * as events from 'aws-cdk-lib/aws-events';
 import * as eventsTargets from 'aws-cdk-lib/aws-events-targets';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
@@ -20,12 +18,9 @@ import { WafConstruct } from './constructs/waf-construct.js';
 import { AlarmConstruct } from './constructs/alarm-construct.js';
 import { CanaryConstruct } from './constructs/canary-construct.js';
 import { domainResourceName } from './naming.js';
-/**
- * Top-level CDK Stack that composes all domain constructs from a single DomainRegistry input.
- * Uses grouped Lambdas for each primitive type to reduce deployment artifact size.
- */
+import { SecurityAssertionAspect } from './aspects/security-assertion-aspect.js';
 /** L1 helper: adds a CfnRoute + CfnIntegration to an existing HTTP API. */
-function addRouteToApi(scope, fn, path, methods, apiId) {
+function addRouteToApi(scope, fn, path, methods, apiId, auth) {
     const id = path.replace(/[^a-zA-Z0-9]/g, '_').replace(/^_/, 'api') + '_' + methods[0].toLowerCase();
     const integ = new apigwv2.CfnIntegration(scope, 'Integ_' + id, {
         apiId,
@@ -37,12 +32,24 @@ function addRouteToApi(scope, fn, path, methods, apiId) {
         principal: new iam.ServicePrincipal('apigateway.amazonaws.com'),
         sourceArn: 'arn:aws:execute-api:' + cdk.Aws.REGION + ':' + cdk.Aws.ACCOUNT_ID + ':' + apiId + '/*',
     });
-    const routeKey = methods[0] === apigwv2.HttpMethod.GET ? 'GET ' + path : 'POST ' + path;
-    new apigwv2.CfnRoute(scope, 'Route_' + id, {
-        apiId,
-        routeKey,
-        target: 'integrations/' + integ.ref,
-    });
+    // Use the actual HTTP method (supports GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS/ANY).
+    // Previous implementation only handled GET vs POST and silently coerced every
+    // other method to POST, breaking PUT/PATCH/DELETE routes.
+    const routeKey = `${methods[0]} ${path}`;
+    const routeProps = auth
+        ? {
+            apiId,
+            routeKey,
+            target: 'integrations/' + integ.ref,
+            authorizationType: auth.authorizationType,
+            authorizerId: auth.authorizerId,
+        }
+        : {
+            apiId,
+            routeKey,
+            target: 'integrations/' + integ.ref,
+        };
+    new apigwv2.CfnRoute(scope, 'Route_' + id, routeProps);
 }
 export class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */
@@ -88,15 +95,50 @@ export class DomainStack extends cdk.Stack {
                 ...(allowCredentials ? { allowCredentials: true } : {}),
             },
         });
-        // Wire Cognito JWT authorizer when user pool is provided
+        // Wire Cognito JWT authorizer when user pool is provided.
+        //
+        // We use the L2 `HttpAuthorizer` (not `HttpJwtAuthorizer`) because it eagerly
+        // creates the underlying `CfnAuthorizer` and exposes `authorizerId` as a
+        // concrete string. `HttpJwtAuthorizer` lazily binds through `bind()` and
+        // throws if `authorizerId` is read before binding — that prevented the
+        // existing L1 `addRouteToApi` from ever attaching an authorizer, which is
+        // the bug Wave 4 Task 4.1 fixes.
         let jwtAuthorizer;
         if ((userPoolId || userPoolArn) && userPoolClientId) {
             const region = cdk.Stack.of(this).region;
             const resolvedUserPoolId = userPoolId ?? cdk.Fn.select(1, cdk.Fn.split('/', userPoolArn));
-            jwtAuthorizer = new apigwv2Authorizers.HttpJwtAuthorizer('CognitoAuthorizer', `https://cognito-idp.${region}.amazonaws.com/${resolvedUserPoolId}`, {
+            jwtAuthorizer = new apigwv2.HttpAuthorizer(this, 'CognitoAuthorizer', {
+                httpApi: this.httpApi,
+                authorizerName: 'CognitoAuthorizer',
+                type: apigwv2.HttpAuthorizerType.JWT,
+                identitySource: ['$request.header.Authorization'],
                 jwtAudience: [userPoolClientId],
+                jwtIssuer: `https://cognito-idp.${region}.amazonaws.com/${resolvedUserPoolId}`,
             });
         }
+        // Pre-resolve authorizer metadata for `addRouteToApi` — `CfnRoute` consumes
+        // a concrete `{ authorizerId, authorizationType }` tuple, not the L2 authorizer.
+        const jwtAuth = jwtAuthorizer
+            ? { authorizerId: jwtAuthorizer.authorizerId, authorizationType: apigwv2.HttpAuthorizerType.JWT }
+            : undefined;
+        // Determine whether any route in this domain requires a JWT authorizer.
+        // If so and `jwtAuth` is undefined, emit a synth-time error so missing Cognito
+        // configuration fails fast instead of producing an unauthenticated route.
+        const apiNeedsJwt = registry.apis.some(api => api.authType === 'jwt');
+        const actionNeedsJwt = registry.actions.some(a => a.exposure?.type === 'api' && a.exposure.auth === 'required');
+        const anyRouteRequiresJwt = apiNeedsJwt || actionNeedsJwt;
+        if (anyRouteRequiresJwt && !jwtAuth) {
+            cdk.Annotations.of(this).addError(`[DomainStack] Domain "${domainId}" declares one or more JWT-protected routes ` +
+                `(api.authType='jwt' or action.exposure.auth='required') but no Cognito user pool is ` +
+                `configured. Provide userPoolArn/userPoolId AND userPoolClientId to DomainStackProps.`);
+        }
+        // Issue #4662 Task D — deployment-time security assertions. The aspect
+        // walks the synthesised tree after the stack has been assembled and
+        // re-validates the same invariants the CLI checks at build time. It
+        // catches regressions where a route was silently synthesised without
+        // an authorizer (e.g. a feature flag skipped the wiring), or where an
+        // action Lambda was attached to a Function URL outside the registry.
+        cdk.Aspects.of(this).add(new SecurityAssertionAspect({ registry }));
         // Optional WAF
         if (enableWaf) {
             new WafConstruct(this, 'Waf', { domainId, namePrefix: resourceBaseName, httpApi: this.httpApi });
@@ -138,12 +180,31 @@ export class DomainStack extends cdk.Stack {
             const lambdas = [];
             const byId = new Map();
             for (const group of splitByOutboundAccess(entries)) {
-                const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated') || primitiveType === 'api';
+                // Force dedicated mode for action groups that contain any API-exposed
+                // action — the per-entry adapter override only takes effect in
+                // dedicated mode (grouped mode uses a single TIB_HANDLER_MAP dispatcher
+                // which assumes a uniform adapter across all entries). We detect
+                // api-exposed actions by their `adapter` override (set by the caller
+                // in the action block below), since the entry shape is intentionally
+                // primitive-agnostic.
+                const hasApiExposedAction = primitiveType === 'action'
+                    && group.entries.some(e => e.adapter === 'createExposedActionApiHandler');
+                const dedicated = group.entries.some(entry => entry.deployment?.isolation === 'dedicated')
+                    || primitiveType === 'api'
+                    || hasApiExposedAction;
                 const groupLambdas = createGroupedLambdas(this, {
                     domainId,
                     domainRoot: registry.domainRoot,
                     primitiveType,
-                    handlerEntries: group.entries.map(entry => ({ id: entry.id, handlerFile: entry.handlerFile })),
+                    handlerEntries: group.entries.map(entry => {
+                        const handlerEntry = {
+                            id: entry.id,
+                            handlerFile: entry.handlerFile,
+                        };
+                        if (entry.adapter)
+                            handlerEntry.adapter = entry.adapter;
+                        return handlerEntry;
+                    }),
                     environment,
                     eventBusArn,
                     dedicated,
@@ -234,23 +295,11 @@ export class DomainStack extends cdk.Stack {
             // Add routes for each API entry
             for (const api of registry.apis) {
                 const fn = apiLambdaById.get(api.id);
-                const apiRouteBase = {
-                    path: api.path,
-                    methods: [toHttpMethod(api.method)],
-                    integration: new apigwv2integrations.HttpLambdaIntegration(`Apis${toPascalCase(api.id)}Integration`, fn),
-                };
-                let apiRoute;
-                if (api.authType === 'jwt' && jwtAuthorizer) {
-                    apiRoute = { ...apiRouteBase, authorizer: jwtAuthorizer };
-                }
-                else if (api.authType === 'api-key') {
+                if (api.authType === 'api-key') {
                     cdk.Annotations.of(this).addWarning(`[DomainStack] API "${api.id}" uses authType "api-key" which is not supported on HTTP API v2 — route is UNAUTHENTICATED. Switch to "jwt" or implement a Lambda authorizer.`);
-                    apiRoute = apiRouteBase;
-                }
-                else {
-                    apiRoute = apiRouteBase;
                 }
-                addRouteToApi(this, fn, `/${domainId}${api.path}`, [toHttpMethod(api.method)], this.httpApi.httpApiId);
+                const routeAuth = api.authType === 'jwt' ? jwtAuth : undefined;
+                addRouteToApi(this, fn, `/${domainId}${api.path}`, [toHttpMethod(api.method)], this.httpApi.httpApiId, routeAuth);
             }
         }
         // Deploy webhooks as grouped Lambdas
@@ -420,7 +469,27 @@ export class DomainStack extends cdk.Stack {
         }
         // Deploy callable actions as grouped Lambdas
         if (registry.actions.length > 0) {
-            const actionHandlers = createPrimitiveHandlers(registry.actions, 'action');
+            // Map action entries to NetworkedRegistryEntry so we can attach a per-entry
+            // adapter override. API-exposed actions must use `createExposedActionApiHandler`
+            // because they receive raw HTTP API v2 events; internal actions use the
+            // default `createActionLambdaHandler` (envelope-based invocation through
+            // `ctx.actions`).
+            const actionEntries = registry.actions.map((action) => {
+                const entry = {
+                    id: action.id,
+                    handlerFile: action.handlerFile,
+                };
+                if (action.outboundAccess !== undefined)
+                    entry.outboundAccess = action.outboundAccess;
+                if (action.deployment !== undefined)
+                    entry.deployment = action.deployment;
+                if (action.exposure?.type === 'api') {
+                    entry.adapter = 'createExposedActionApiHandler';
+                }
+                return entry;
+            });
+            const actionHandlers = createPrimitiveHandlers(actionEntries, 'action');
+            const actionLambdaById = actionHandlers.byId;
             actionLambdas = actionHandlers.lambdas;
             this.lambdaArns[`${domainId}-action`] = actionLambdas[0].functionArn;
             const iamPolicies = iamBuilder.forAction([
@@ -436,6 +505,18 @@ export class DomainStack extends cdk.Stack {
                     resources: [dbSecretArn],
                 })));
             }
+            // Generate API Gateway routes for actions whose exposure is `api`.
+            //
+            // `exposure.type === 'internal'` actions are intentionally NOT routed —
+            // they are reachable only through `ctx.actions` and exposing them would
+            // silently bypass the `backendAccess` permission gate.
+            for (const action of registry.actions) {
+                if (action.exposure?.type !== 'api')
+                    continue;
+                const fn = actionLambdaById.get(action.id);
+                const routeAuth = action.exposure.auth === 'required' ? jwtAuth : undefined;
+                addRouteToApi(this, fn, `/${domainId}${action.exposure.path}`, [toHttpMethod(action.exposure.method)], this.httpApi.httpApiId, routeAuth);
+            }
         }
         // Grant all domain Lambdas read/write access to the per-domain table and bucket
         const allDomainLambdas = [

package/dist/__tests__/action-construct.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/action-construct.test.js

@@ -0,0 +1,159 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ActionConstruct } from '../constructs/action-construct.js';
+import { LambdaFactory } from '../lambda-factory.js';
+import { IamPolicyBuilder } from '../iam/iam-policy-builder.js';
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-action-construct');
+const baseRegistry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
+    apis: [], webhooks: [], subscribers: [], schedules: [], jobs: [],
+    actions: [], integrations: [], events: [],
+};
+beforeAll(() => {
+    const handlerDir = path.join(DOMAIN_ROOT, 'src', 'actions');
+    fs.mkdirSync(handlerDir, { recursive: true });
+    fs.writeFileSync(path.join(handlerDir, 'noop.ts'), 'export const handler = async () => ({ statusCode: 200 });\n');
+    fs.writeFileSync(path.join(handlerDir, 'workspace.ts'), 'export const handler = async () => ({ statusCode: 200 });\n');
+});
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+});
+/**
+ * Wave 4 Task 4.2 (#4619):
+ *   Action Lambdas must never be exposed directly through a Lambda Function URL.
+ *   External reachability is granted ONLY via API Gateway routes synthesized from
+ *   the action's `exposure` field. Function URLs with `authType: NONE` would
+ *   create public, unauthenticated endpoints that bypass auth and tenancy.
+ */
+describe('ActionConstruct (Wave 4 Task 4.2 — no public Function URLs)', () => {
+    const buildStack = (actions) => {
+        const app = new cdk.App();
+        const stack = new cdk.Stack(app, 'TestActionStack');
+        const registry = { ...baseRegistry, actions };
+        const factory = new LambdaFactory({ scope: stack, registry, domainRoot: registry.domainRoot });
+        const iamBuilder = new IamPolicyBuilder();
+        const construct = new ActionConstruct(stack, 'Actions', { registry, lambdaFactory: factory, iamBuilder });
+        return { stack, template: Template.fromStack(stack), construct };
+    };
+    it('synthesises one Lambda per action', () => {
+        const { template } = buildStack([
+            { id: 'noop', kind: 'action', handlerFile: 'src/actions/noop.ts', backendAccess: 'domain', exposure: { type: 'internal' }, idempotent: false },
+        ]);
+        const lambdas = Object.entries(template.findResources('AWS::Lambda::Function'))
+            .filter(([id]) => !id.startsWith('LogRetention'));
+        expect(lambdas).toHaveLength(1);
+        expect(lambdas[0][0]).toContain('NoopFn');
+    });
+    it('does NOT create a Lambda::Url resource for any action', () => {
+        const { template } = buildStack([
+            { id: 'noop', kind: 'action', handlerFile: 'src/actions/noop.ts', backendAccess: 'domain', exposure: { type: 'internal' }, idempotent: false },
+        ]);
+        template.resourceCountIs('AWS::Lambda::Url', 0);
+    });
+    it('does NOT create a Lambda::Url even when legacy visibility === "workspace"', () => {
+        // Legacy entries with the deprecated `visibility: 'workspace'` must NOT
+        // resurrect Function URL exposure now that the action-first migration is in place.
+        const { template } = buildStack([
+            {
+                id: 'workspace-action',
+                kind: 'action',
+                handlerFile: 'src/actions/workspace.ts',
+                backendAccess: 'domain',
+                exposure: { type: 'internal' },
+                idempotent: false,
+                visibility: 'workspace',
+            },
+        ]);
+        template.resourceCountIs('AWS::Lambda::Url', 0);
+        const lambdas = Object.entries(template.findResources('AWS::Lambda::Function'))
+            .filter(([id]) => !id.startsWith('LogRetention'));
+        expect(lambdas).toHaveLength(1);
+        expect(lambdas[0][0]).toContain('WorkspaceActionFn');
+    });
+    it('does NOT create a Lambda::Url when an action exposes via API Gateway (exposure.type === "api")', () => {
+        // API-exposed actions are routed by DomainStack via API Gateway, not by Function URL.
+        const { template } = buildStack([
+            {
+                id: 'api-action',
+                kind: 'action',
+                handlerFile: 'src/actions/noop.ts',
+                backendAccess: 'domain',
+                exposure: { type: 'api', path: '/v1/example', method: 'POST', auth: 'required', tenancy: 'required' },
+                idempotent: false,
+            },
+        ]);
+        template.resourceCountIs('AWS::Lambda::Url', 0);
+    });
+    it('does NOT attach any Lambda::Permission that allows public (apigateway) principal invocation', () => {
+        // Defensive: even without a Function URL, the construct must not add
+        // resource-based Lambda permissions that would let API Gateway invoke
+        // the function without going through the synthesized routes in DomainStack.
+        const { template, construct } = buildStack([
+            { id: 'noop', kind: 'action', handlerFile: 'src/actions/noop.ts', backendAccess: 'domain', exposure: { type: 'internal' }, idempotent: false },
+        ]);
+        expect(construct.functions.size).toBe(1);
+        template.resourceCountIs('AWS::Lambda::Url', 0);
+        const permissions = Object.values(template.findResources('AWS::Lambda::Permission'));
+        // No Function URL permission allowed
+        const hasUrlPermission = permissions.some(p => p.Properties.FunctionUrlAuthType !== undefined);
+        expect(hasUrlPermission).toBe(false);
+    });
+});
+/**
+ * Tenant-scoped storage IAM (defence-in-depth, Wave 4 Task 4.2).
+ *
+ * Verifies the IamPolicyBuilder.forTenantScopedStorage output uses
+ * PrincipalTag conditions to restrict DynamoDB LeadingKeys and S3 object
+ * prefixes to the calling session's tenantId.
+ */
+describe('IamPolicyBuilder.forTenantScopedStorage (defence-in-depth)', () => {
+    const params = {
+        tableArn: 'arn:aws:dynamodb:eu-north-1:123456789012:table/test-domain',
+        bucketArn: 'arn:aws:s3:::test-domain',
+    };
+    it('restricts DynamoDB LeadingKeys to ${aws:PrincipalTag/tenantId}', () => {
+        const builder = new IamPolicyBuilder();
+        const statements = builder.forTenantScopedStorage(params);
+        const ddb = statements.find(s => (s.actions ?? []).some(a => a.startsWith('dynamodb:')));
+        expect(ddb).toBeDefined();
+        expect(ddb.resources).toContain(params.tableArn);
+        const leadingKeys = ddb.conditions?.['ForAllValues:StringEquals']?.['dynamodb:LeadingKeys'];
+        expect(leadingKeys).toEqual(['${aws:PrincipalTag/tenantId}']);
+    });
+    it('restricts S3 object operations to ${aws:PrincipalTag/tenantId}/* prefix', () => {
+        const builder = new IamPolicyBuilder();
+        const statements = builder.forTenantScopedStorage(params);
+        const s3Objects = statements.find(s => (s.actions ?? []).some(a => a === 's3:GetObject' || a === 's3:PutObject' || a === 's3:DeleteObject'));
+        expect(s3Objects).toBeDefined();
+        expect(s3Objects.resources).toEqual([
+            `${params.bucketArn}/\${aws:PrincipalTag/tenantId}/*`,
+        ]);
+    });
+    it('restricts S3:ListBucket to the current tenant prefix via s3:prefix condition', () => {
+        const builder = new IamPolicyBuilder();
+        const statements = builder.forTenantScopedStorage(params);
+        const listBucket = statements.find(s => (s.actions ?? []).includes('s3:ListBucket'));
+        expect(listBucket).toBeDefined();
+        expect(listBucket.resources).toEqual([params.bucketArn]);
+        const prefixCondition = listBucket.conditions
+            ?.StringLike?.['s3:prefix'];
+        expect(prefixCondition).toEqual(['${aws:PrincipalTag/tenantId}/*']);
+    });
+    it('does NOT grant bucket-wide S3 access (no unconditional ${bucketArn} resource for object ops)', () => {
+        const builder = new IamPolicyBuilder();
+        const statements = builder.forTenantScopedStorage(params);
+        for (const s of statements) {
+            const acts = (s.actions ?? []);
+            const isObjectOp = acts.some(a => a === 's3:GetObject' || a === 's3:PutObject' || a === 's3:DeleteObject');
+            if (isObjectOp) {
+                // The only resource granted must be the tenant-scoped prefix, not the bare bucket.
+                expect(s.resources).not.toContain(params.bucketArn);
+            }
+        }
+    });
+});

package/dist/__tests__/domain-stack.test.js

@@ -5,6 +5,19 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { DomainStack } from '../DomainStack.js';
 const DOMAIN_ROOT = path.join(process.cwd(), '.test-domain-cdk-packer');
+// Wave 7 Task 7.3 (#4619): removed the runtime-export probe that used to
+// gate the action-exposure block via `describe.skipIf(...)`. The probe
+// returned `false` whenever the workspace-resolved `@mettlecast/domain-runtime`
+// package lagged behind the integration branch, which silently masked
+// regressions in the route/wrapper wiring that this block exists to catch.
+//
+// Coverage for the adapter-selection logic itself moved to
+// `grouped-lambda-factory.test.ts` (pure, no CDK / esbuild, no dependency
+// on the published runtime state). This file still exercises the
+// end-to-end CDK wiring — route creation, JWT authorizer attachment, and
+// the "no route for internal actions" guard — so the integration-level
+// regressions the probe used to hide are now caught by the narrow unit
+// tests instead.
 const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
@@ -29,7 +42,12 @@ const minimalRegistry = {
 };
 const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
 fs.mkdirSync(handlerDir, { recursive: true });
-fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const getUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n');
+fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const getUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
+    'export const createUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
+    'export const replaceUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
+    'export const patchUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
+    'export const deleteUser = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n' +
+    'export const listThings = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n');
 afterAll(() => {
     fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
 });
@@ -169,4 +187,219 @@ describe('DomainStack', () => {
             template.hasOutput('DomainTenantScopedRoleArn', {});
         });
     });
+    /**
+     * Wave 4 Task 4.1 — fixes the route key bug where every non-GET method was
+     * silently coerced to "POST" and the JWT authorizer was never attached
+     * because the HttpJwtAuthorizer was never bound to a route.
+     */
+    describe('route keys and JWT authorizer wiring (#4619)', () => {
+        const userPoolArn = 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz';
+        const userPoolClientId = 'test-client-id';
+        /**
+         * Build a registry whose API entries cover all HTTP method variants the
+         * route key bug previously broke. Each entry uses `authType: 'jwt'` so
+         * every method exercises the new JWT-wiring path through `addRouteToApi`.
+         */
+        const multiMethodRegistry = {
+            ...minimalRegistry,
+            apis: [
+                { ...minimalRegistry.apis[0], id: 'get-users', path: '/users', method: 'GET', authType: 'jwt' },
+                { ...minimalRegistry.apis[0], id: 'create-user', path: '/users', method: 'POST', authType: 'jwt' },
+                { ...minimalRegistry.apis[0], id: 'replace-user', path: '/users/{id}', method: 'PUT', authType: 'jwt' },
+                { ...minimalRegistry.apis[0], id: 'patch-user', path: '/users/{id}', method: 'PATCH', authType: 'jwt' },
+                { ...minimalRegistry.apis[0], id: 'delete-user', path: '/users/{id}', method: 'DELETE', authType: 'jwt' },
+                { ...minimalRegistry.apis[0], id: 'list-things', path: '/things', method: 'GET', authType: 'none' },
+            ],
+        };
+        it('uses the actual HTTP method for each route key (GET/POST/PUT/PATCH/DELETE)', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackMethods', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            // Every method must round-trip — the previous implementation coerced all
+            // non-GET methods to POST, so PUT/PATCH/DELETE were broken.
+            expect(routeKeys).toContain('GET /test-domain/users');
+            expect(routeKeys).toContain('POST /test-domain/users');
+            expect(routeKeys).toContain('PUT /test-domain/users/{id}');
+            expect(routeKeys).toContain('PATCH /test-domain/users/{id}');
+            expect(routeKeys).toContain('DELETE /test-domain/users/{id}');
+        });
+        it('sets AuthorizationType=JWT and AuthorizerId on jwt-auth routes', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackRouteAuth', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const jwtRoutes = Object.values(routes).filter(r => {
+                const key = r.Properties.RouteKey;
+                return key.endsWith('/users') || key.endsWith('/users/{id}');
+            });
+            // Every jwt-auth route must carry AuthorizationType and AuthorizerId.
+            expect(jwtRoutes.length).toBeGreaterThan(0);
+            for (const r of jwtRoutes) {
+                expect(r.Properties.AuthorizationType).toBe('JWT');
+                const authorizerId = r.Properties.AuthorizerId;
+                expect(authorizerId).toBeDefined();
+            }
+        });
+        it('does not attach authorizer to non-jwt routes (authType=none)', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackUnauthRoute', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const unauthRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'GET /test-domain/things');
+            expect(unauthRoute).toBeDefined();
+            expect(unauthRoute.Properties.AuthorizationType).toBeUndefined();
+            expect(unauthRoute.Properties.AuthorizerId).toBeUndefined();
+        });
+        it('emits a synth-time error annotation when JWT route is declared without Cognito config', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackMissingPool', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                // No userPoolArn / userPoolId / userPoolClientId provided
+            });
+            // `Annotations.of(stack).errors` is not exposed; read the construct's
+            // metadata directly and filter for error-level entries.
+            const metadata = stack.node.metadata;
+            const errorMessages = metadata
+                .filter(m => m.type === 'aws:cdk:error')
+                .map(m => (typeof m.data === 'string' ? m.data : JSON.stringify(m.data)));
+            expect(errorMessages.some(a => a.includes('JWT-protected routes') && a.includes('Cognito'))).toBe(true);
+        });
+        it('does NOT emit the missing-pool error when authType=none', () => {
+            const app = new cdk.App();
+            const noJwtRegistry = {
+                ...minimalRegistry,
+                apis: [{ ...minimalRegistry.apis[0], authType: 'none' }],
+            };
+            const stack = new DomainStack(app, 'TestDomainStackNoJwtNeeded', {
+                registry: noJwtRegistry,
+                eventBusArn,
+            });
+            const metadata = stack.node.metadata;
+            const errorMessages = metadata
+                .filter(m => m.type === 'aws:cdk:error')
+                .map(m => (typeof m.data === 'string' ? m.data : JSON.stringify(m.data)));
+            expect(errorMessages.some(a => a.includes('JWT-protected routes'))).toBe(false);
+        });
+    });
+    /**
+     * Wave 4 Task 4.1 — generate API Gateway routes for actions whose
+     * `exposure.type === 'api'` and skip `exposure.type === 'internal'`.
+     *
+     * Wave 7 Task 7.3 (#4619) removed the runtime-export probe and the
+     * `describe.skipIf(...)` wrapper. The route-level assertions still need
+     * a full CDK synth so the L1 `CfnRoute` resources can be inspected, but
+     * adapter-selection coverage (the part most likely to regress when the
+     * runtime barrel changes) lives in `grouped-lambda-factory.test.ts`
+     * where it runs as a pure unit test in milliseconds. If the runtime
+     * barrel ever drops an export we expect to see this block fail with a
+     * bundling error rather than be silently skipped.
+     */
+    describe('action exposure routing (#4619)', () => {
+        const actionHandlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
+        fs.mkdirSync(actionHandlerDir, { recursive: true });
+        fs.writeFileSync(path.join(actionHandlerDir, 'list-invoices.ts'), 'export const listInvoices = { id: "list-invoices", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/invoices", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n');
+        fs.writeFileSync(path.join(actionHandlerDir, 'charge-card.ts'), 'export const chargeCard = { id: "charge-card", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/charge", method: "POST", auth: "required", tenancy: "required" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: true, handler: async () => ({ ok: true }) };\n');
+        fs.writeFileSync(path.join(actionHandlerDir, 'internal-helper.ts'), 'export const internalHelper = { id: "internal-helper", backendAccess: "private", exposure: { type: "internal" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n');
+        const registryWithActions = {
+            ...minimalRegistry,
+            actions: [
+                {
+                    id: 'list-invoices',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/list-invoices.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/tenants/{tenantId}/invoices',
+                        method: 'GET',
+                        auth: 'required',
+                        tenancy: 'required',
+                    },
+                    idempotent: false,
+                },
+                {
+                    id: 'charge-card',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/charge-card.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/tenants/{tenantId}/charge',
+                        method: 'POST',
+                        auth: 'required',
+                        tenancy: 'required',
+                    },
+                    idempotent: true,
+                },
+                {
+                    id: 'internal-helper',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/internal-helper.ts',
+                    backendAccess: 'private',
+                    exposure: { type: 'internal' },
+                    idempotent: false,
+                },
+            ],
+        };
+        it('synthesises routes for API-exposed actions', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackActionRoutes', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            expect(routeKeys).toContain('GET /test-domain/v1/tenants/{tenantId}/invoices');
+            expect(routeKeys).toContain('POST /test-domain/v1/tenants/{tenantId}/charge');
+        });
+        it('does NOT create a route for internal exposure actions', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackInternalOnly', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            expect(routeKeys.some(k => k.includes('internal-helper'))).toBe(false);
+        });
+        it('attaches JWT authorizer to API-exposed action routes when auth=required', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackActionJwt', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const actionRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'POST /test-domain/v1/tenants/{tenantId}/charge');
+            expect(actionRoute).toBeDefined();
+            expect(actionRoute.Properties.AuthorizationType).toBe('JWT');
+            expect(actionRoute.Properties.AuthorizerId).toBeDefined();
+        });
+    });
 });

package/dist/__tests__/grouped-lambda-factory-action-wrapper.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Wave 7 Task 7.1 (#4619) — generated dedicated Lambda wrapper tests.
+ *
+ * The dedicated-mode bundler writes an entry module that wires a domain action
+ * export into a runtime adapter. For action adapters the wiring is non-trivial:
+ * `createActionLambdaHandler` takes `(registry, options)` and
+ * `createExposedActionApiHandler` takes `(action, options)`. These assertions
+ * use the pure entry-content helper so they do not race with other tests that
+ * also write `.tib-domain-entries` artifacts.
+ */
+export {};