@mettlecast/domain-cdk-packer 0.2.60 → 0.2.61

package/dist/__tests__/grouped-lambda-factory-action-wrapper.test.js

@@ -0,0 +1,47 @@
+/**
+ * Wave 7 Task 7.1 (#4619) — generated dedicated Lambda wrapper tests.
+ *
+ * The dedicated-mode bundler writes an entry module that wires a domain action
+ * export into a runtime adapter. For action adapters the wiring is non-trivial:
+ * `createActionLambdaHandler` takes `(registry, options)` and
+ * `createExposedActionApiHandler` takes `(action, options)`. These assertions
+ * use the pure entry-content helper so they do not race with other tests that
+ * also write `.tib-domain-entries` artifacts.
+ */
+import { describe, it, expect } from 'vitest';
+import { buildDedicatedEntryContent } from '../grouped-lambda-factory.js';
+const DOMAIN_ID = 'billing';
+function render(entry, primitiveType = 'action') {
+    return buildDedicatedEntryContent('./handler.js', entry, primitiveType, DOMAIN_ID);
+}
+describe('grouped-lambda-factory — generated action wrapper (Wave 7 Task 7.1)', () => {
+    it('emits a createActionLambdaHandler(registry, options) wrapper for internal actions', () => {
+        const content = render({ id: 'internal-helper', handlerFile: 'src/actions/internal-helper.ts' });
+        expect(content).toMatch(/import\s*\{\s*createActionLambdaHandler\s*\}\s*from\s*['"]@mettlecast\/domain-runtime['"]/);
+        expect(content).toMatch(/const\s+registry\s*=\s*\{\s*"billing"\s*:\s*\{\s*"internal-helper"\s*:\s*internalHelper\s*\}\s*\}/);
+        expect(content).toMatch(/export\s+const\s+handler\s*=\s*createActionLambdaHandler\(\s*registry\s*,\s*\{/);
+        expect(content).toMatch(/domainId:\s*"billing"/);
+        expect(content).toMatch(/databaseUrl:\s*process\.env\.DATABASE_URL/);
+        expect(content).toMatch(/eventBusName:\s*process\.env\.EVENT_BUS_NAME/);
+        expect(content).toMatch(/idempotencyTableName:\s*process\.env\.IDEMPOTENCY_TABLE/);
+    });
+    it('emits a createExposedActionApiHandler(action, options) wrapper for API-exposed actions', () => {
+        const content = render({
+            id: 'public-charge',
+            handlerFile: 'src/actions/public-charge.ts',
+            adapter: 'createExposedActionApiHandler',
+        });
+        expect(content).toMatch(/import\s*\{\s*createExposedActionApiHandler\s*\}\s*from\s*['"]@mettlecast\/domain-runtime['"]/);
+        expect(content).toMatch(/const\s+actionRegistry\s*=\s*\{\s*"billing"\s*:\s*\{\s*"public-charge"\s*:\s*publicCharge\s*\}\s*\}/);
+        expect(content).toMatch(/export\s+const\s+handler\s*=\s*createExposedActionApiHandler\(\s*publicCharge\s*,\s*\{/);
+        expect(content).toMatch(/definingDomain:\s*"billing"/);
+        expect(content).toMatch(/domainId:\s*"billing"/);
+        expect(content).toMatch(/actionRegistry,/);
+        expect(content).toMatch(/callerDomainId:\s*"billing"/);
+    });
+    it('does NOT emit a bare `${adapter}(${exportName})` shape for any action adapter', () => {
+        const content = render({ id: 'another-internal', handlerFile: 'src/actions/another-internal.ts' });
+        expect(content).not.toMatch(/createActionLambdaHandler\(\s*anotherInternal\s*\)/);
+        expect(content).not.toMatch(/createExposedActionApiHandler\(\s*anotherInternal\s*\)/);
+    });
+});

package/dist/__tests__/grouped-lambda-factory.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/grouped-lambda-factory.test.js

@@ -0,0 +1,147 @@
+import { describe, it, expect } from 'vitest';
+import { buildDedicatedEntryContent, ADAPTER_BY_PRIMITIVE, EXPOSED_ACTION_ADAPTER, } from '../grouped-lambda-factory.js';
+/**
+ * Wave 7 Task 7.3 (#4619) — narrow, pure tests for the dedicated-mode
+ * Lambda entry-content generator.
+ *
+ * These tests pin the adapter-selection logic added in Wave 4 Task 4.1
+ * (API-exposed actions wrap with `createExposedActionApiHandler` while
+ * internal actions keep `createActionLambdaHandler`) WITHOUT spinning up
+ * CDK or esbuild. The previous version of `domain-stack.test.ts` skipped
+ * these assertions via a runtime-export probe because the installed
+ * `@mettlecast/domain-runtime` package sometimes lags behind the
+ * integration branch. Testing the source code we generate — not the
+ * downstream package state — removes that skip and the regression-masking
+ * risk that came with it.
+ *
+ * End-to-end route-creation / authorizer-attachment behaviour is still
+ * covered by `domain-stack.test.ts` (the action-exposure block at the
+ * bottom of that file), but the heavy assertions about WHICH adapter is
+ * wired into WHICH entry now live here where they run in milliseconds.
+ *
+ * Compatibility note (Task 7.1 overlap, #4619): the test surface here
+ * deliberately targets only the parts of `buildDedicatedEntryContent`
+ * that are stable across the Wave 7.1 wrapper fixes (which change the
+ * action-adapter call shape, not the adapter selection logic). When
+ * Task 7.1 lands, this file can grow assertions for the new wrappers
+ * without rewriting the existing ones.
+ */
+describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
+    const DOMAIN_ID = 'billing';
+    const entry = (id, adapter) => ({
+        id,
+        handlerFile: `src/handlers/${id}.ts`,
+        ...(adapter !== undefined ? { adapter } : {}),
+    });
+    describe('adapter selection by primitive type (defaults)', () => {
+        const cases = [
+            { primitive: 'api', expectedAdapter: 'createApiLambdaHandler' },
+            { primitive: 'subscriber', expectedAdapter: 'createSubscriberLambdaHandler' },
+            { primitive: 'job', expectedAdapter: 'createJobLambdaHandler' },
+            { primitive: 'webhook', expectedAdapter: 'createWebhookLambdaHandler' },
+            { primitive: 'action', expectedAdapter: 'createActionLambdaHandler' },
+        ];
+        for (const { primitive, expectedAdapter } of cases) {
+            it(`imports the default adapter for primitive type "${primitive}"`, () => {
+                const content = buildDedicatedEntryContent('./handler.js', entry('list-things'), primitive, DOMAIN_ID);
+                expect(content).toContain(`import { ${expectedAdapter} } from '@mettlecast/domain-runtime';`);
+                if (primitive === 'action') {
+                    expect(content).toContain(`const registry = { "${DOMAIN_ID}": { "list-things": listThings } };`);
+                    expect(content).toContain('export const handler = createActionLambdaHandler(registry, {');
+                    expect(content).toContain(`domainId: "${DOMAIN_ID}"`);
+                }
+                else {
+                    expect(content).toContain(`export const handler = ${expectedAdapter}(listThings);`);
+                }
+                // Adapter map should agree with what is generated
+                expect(ADAPTER_BY_PRIMITIVE[primitive]).toBe(expectedAdapter);
+            });
+        }
+        it('schedule has no entry in ADAPTER_BY_PRIMITIVE (uses hydrateCtx envelope instead)', () => {
+            // Schedules intentionally fall through to the inline `hydrateCtx`
+            // wrapper path (see buildDedicatedEntryContent's schedule branch).
+            // Pinning that here guards against future refactors silently
+            // promoting schedules into the adapter-map path.
+            const keys = Object.keys(ADAPTER_BY_PRIMITIVE);
+            expect(keys).not.toContain('schedule');
+        });
+    });
+    describe('action adapter override (Wave 4 Task 4.1, #4619)', () => {
+        it('uses createExposedActionApiHandler when entry.adapter is the exposed-action adapter', () => {
+            const apiExposed = entry('list-invoices', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', apiExposed, 'action', DOMAIN_ID);
+            expect(content).toContain(`import { ${EXPOSED_ACTION_ADAPTER} } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain(`const actionRegistry = { "${DOMAIN_ID}": { "list-invoices": listInvoices } };`);
+            expect(content).toContain(`export const handler = ${EXPOSED_ACTION_ADAPTER}(listInvoices, {`);
+            expect(content).toContain(`definingDomain: "${DOMAIN_ID}"`);
+            expect(content).toContain('actionRegistry,');
+            // Must NOT also import the envelope-based adapter — that would be
+            // dead code and risks accidental misuse if the adapter selection ever
+            // regresses.
+            expect(content).not.toContain('createActionLambdaHandler');
+        });
+        it('uses createActionLambdaHandler when no adapter override is supplied (internal action)', () => {
+            const internal = entry('internal-helper');
+            const content = buildDedicatedEntryContent('./handler.js', internal, 'action', DOMAIN_ID);
+            expect(content).toContain(`import { createActionLambdaHandler } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain(`const registry = { "${DOMAIN_ID}": { "internal-helper": internalHelper } };`);
+            expect(content).toContain('export const handler = createActionLambdaHandler(registry, {');
+            expect(content).toContain(`domainId: "${DOMAIN_ID}"`);
+            // Must NOT use the exposed adapter for internal actions.
+            expect(content).not.toContain(EXPOSED_ACTION_ADAPTER);
+        });
+        it('per-entry adapter override takes precedence over the primitive-type default', () => {
+            // Even if primitiveType were 'api', an explicit adapter override wins.
+            const overridden = entry('charge-card', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', overridden, 'api', DOMAIN_ID);
+            expect(content).toContain(`import { ${EXPOSED_ACTION_ADAPTER} } from '@mettlecast/domain-runtime';`);
+            expect(content).not.toContain('createApiLambdaHandler');
+        });
+    });
+    describe('schedule envelope', () => {
+        it('uses hydrateCtx (no per-primitive adapter) for schedules', () => {
+            const schedule = entry('nightly-rollup');
+            const content = buildDedicatedEntryContent('./handler.js', schedule, 'schedule', DOMAIN_ID);
+            expect(content).toContain(`import { hydrateCtx } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain('hydrateCtx(event, {');
+            expect(content).toContain('databaseUrl: process.env.DATABASE_URL');
+            expect(content).toContain('eventBusName: process.env.EVENT_BUS_NAME');
+            expect(content).toContain('try { await ctx.db.release(); } catch {}');
+            // Schedules should NOT use any of the Lambda-handler adapter factories.
+            expect(content).not.toMatch(/import \{ \w+LambdaHandler \}/);
+        });
+        it('does NOT honour entry.adapter for schedules — hydrateCtx is the only path', () => {
+            const schedule = entry('nightly-rollup', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', schedule, 'schedule', DOMAIN_ID);
+            expect(content).toContain(`import { hydrateCtx } from '@mettlecast/domain-runtime';`);
+            expect(content).not.toContain(EXPOSED_ACTION_ADAPTER);
+        });
+    });
+    describe('handler import path wiring', () => {
+        it('uses the caller-supplied relative import path verbatim', () => {
+            const e = entry('list-things');
+            const content = buildDedicatedEntryContent('../../../../src/handlers/list-things.ts', e, 'api', DOMAIN_ID);
+            expect(content).toContain(`import { listThings } from '../../../../src/handlers/list-things.ts';`);
+        });
+        it('converts kebab-case handler IDs to camelCase export names', () => {
+            const e = entry('list-invoices-for-tenant');
+            const content = buildDedicatedEntryContent('./handler.js', e, 'action', DOMAIN_ID);
+            expect(content).toMatch(/import \{ listInvoicesForTenant \} from/);
+            expect(content).toContain(`"list-invoices-for-tenant": listInvoicesForTenant`);
+            expect(content).toContain('createActionLambdaHandler(registry, {');
+        });
+        it('emits a single export const handler per entry', () => {
+            const e = entry('list-things');
+            const content = buildDedicatedEntryContent('./handler.js', e, 'api', DOMAIN_ID);
+            const matches = content.match(/^export const handler\b/gm) ?? [];
+            expect(matches.length).toBe(1);
+        });
+    });
+    describe('EXPOSED_ACTION_ADAPTER constant', () => {
+        it('matches the Wave 3 / Wave 4 exported name', () => {
+            // Pinning the literal value guards against silent rename during future
+            // refactors of the runtime barrel.
+            expect(EXPOSED_ACTION_ADAPTER).toBe('createExposedActionApiHandler');
+        });
+    });
+});

package/dist/__tests__/registry.test.js

@@ -32,3 +32,111 @@ describe('DomainRegistry type', () => {
         }
     });
 });
+/**
+ * Action-first migration (#4619, Wave 1 Task 1.2):
+ *
+ * ActionRegistryEntry must surface `backendAccess` and `exposure` so the
+ * registry builder can carry them through to CDK/contract generation.
+ * The legacy `visibility` field stays optional during the migration window.
+ */
+describe('ActionRegistryEntry type (action-first migration)', () => {
+    it('requires backendAccess and exposure on every action entry', () => {
+        const entry = {
+            id: 'charge-card',
+            kind: 'action',
+            handlerFile: 'src/actions/charge-card.ts',
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: true,
+        };
+        expect(entry.backendAccess).toBe('domain');
+        expect(entry.exposure).toEqual({ type: 'internal' });
+    });
+    it('accepts the full backendAccess scope union', () => {
+        const scopes = ['private', 'domain', 'platform'];
+        for (const backendAccess of scopes) {
+            const entry = {
+                id: `a-${backendAccess}`,
+                kind: 'action',
+                handlerFile: 'a.ts',
+                backendAccess,
+                exposure: { type: 'internal' },
+                idempotent: false,
+            };
+            expect(entry.backendAccess).toBe(backendAccess);
+        }
+    });
+    it('accepts an api exposure with all optional metadata', () => {
+        const exposure = {
+            type: 'api',
+            path: '/v1/tenants/{tenantId}/billing/invoices',
+            method: 'POST',
+            auth: 'required',
+            tenancy: 'required',
+            roles: ['billing-admin'],
+            securityException: { reason: 'bootstrap path before tenant exists' },
+        };
+        const entry = {
+            id: 'create-invoice',
+            kind: 'action',
+            handlerFile: 'src/actions/create-invoice.ts',
+            backendAccess: 'domain',
+            exposure,
+            idempotent: true,
+        };
+        expect(entry.exposure.type).toBe('api');
+        if (entry.exposure.type === 'api') {
+            expect(entry.exposure.path).toContain('{tenantId}');
+            expect(entry.exposure.method).toBe('POST');
+            expect(entry.exposure.auth).toBe('required');
+            expect(entry.exposure.tenancy).toBe('required');
+            expect(entry.exposure.roles).toEqual(['billing-admin']);
+            expect(entry.exposure.securityException?.reason).toMatch(/bootstrap/);
+        }
+    });
+    it('discriminates the ActionExposure union by type', () => {
+        const samples = [
+            { type: 'internal' },
+            { type: 'api', path: '/v1/x', method: 'GET', auth: 'none', tenancy: 'none' },
+        ];
+        for (const exposure of samples) {
+            if (exposure.type === 'api') {
+                expect(exposure.path).toBeDefined();
+                expect(exposure.method).toBe('GET');
+            }
+            else {
+                expect(exposure.type).toBe('internal');
+            }
+        }
+    });
+    it('keeps legacy visibility as an optional field during the migration', () => {
+        // The legacy field must remain present-but-optional on the type so
+        // existing CDK constructs (e.g. action-construct.ts) keep compiling
+        // until they are updated to consume backendAccess directly.
+        const entry = {
+            id: 'legacy',
+            kind: 'action',
+            handlerFile: 'src/actions/legacy.ts',
+            backendAccess: 'private',
+            exposure: { type: 'internal' },
+            visibility: 'workspace',
+            idempotent: false,
+        };
+        expect(entry.visibility).toBe('workspace');
+        expect(entry.backendAccess).toBe('private');
+    });
+    it('preserves input/output schema snapshot fields', () => {
+        const entry = {
+            id: 'with-schemas',
+            kind: 'action',
+            handlerFile: 'src/actions/with-schemas.ts',
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: false,
+            inputSchema: { type: 'object', properties: { amount: { type: 'number' } } },
+            outputSchema: { type: 'object', properties: { id: { type: 'string' } } },
+        };
+        expect(entry.inputSchema).toBeDefined();
+        expect(entry.outputSchema).toBeDefined();
+    });
+});

package/dist/__tests__/security-assertion-aspect.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/security-assertion-aspect.test.js

@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-security-aspect');
+const baseRegistry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: { id: 'sec-domain', kind: 'domain', name: 'Sec Domain', tenancy: 'none' },
+    apis: [],
+    webhooks: [],
+    subscribers: [],
+    schedules: [],
+    jobs: [],
+    actions: [],
+    integrations: [],
+    events: [],
+};
+/**
+ * Build a stack, force synth, and return its error annotations so each
+ * test can assert specifically on the codes emitted by
+ * `SecurityAssertionAspect`. CDK aspects only run during synth, so the
+ * helper must call `app.synth()`. Annotations attached by aspects to
+ * child constructs (e.g. a `CfnRoute`) live on the child's metadata,
+ * not the stack's — we walk the construct tree to aggregate them.
+ */
+function buildStackAndGetErrors(registry) {
+    const app = new cdk.App();
+    const stack = new DomainStack(app, 'SecAspectStack', {
+        registry,
+        eventBusArn: 'arn:aws:events:eu-north-1:123456789012:event-bus/tib-event-bus',
+    });
+    // Force synthesis so the aspect's visit() fires.
+    try {
+        app.synth();
+    }
+    catch {
+        // Synth may throw when the aspect emits a hard error; we still want
+        // to read the metadata so the assertion can find the error code.
+    }
+    const errorMessages = [];
+    const collect = (construct) => {
+        for (const m of construct.node.metadata) {
+            if (m.type === 'aws:cdk:error') {
+                errorMessages.push(typeof m.data === 'string' ? m.data : JSON.stringify(m.data));
+            }
+        }
+        for (const child of construct.node.children) {
+            collect(child);
+        }
+    };
+    collect(stack);
+    return { stack, errorMessages };
+}
+beforeAll(() => {
+    const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
+    fs.mkdirSync(handlerDir, { recursive: true });
+    // The CDK grouped-lambda-factory derives the named export from the
+    // entry id (`list-users` -> `listUsers`). We provide every named export
+    // the security-aspect test uses so each test can pick the same handler
+    // file regardless of which entry id it instantiates.
+    fs.writeFileSync(path.join(handlerDir, 'noop.ts'), [
+        'export const listUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };',
+        'export const listAll = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };',
+        'export const noopAction = { id: "noop-action", backendAccess: "private", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
+    ].join('\n') + '\n');
+});
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+});
+/**
+ * Issue #4662 Task D — deployment-time assertions. The CDK aspect is the
+ * last line of defence: it walks the synthesised tree and verifies the
+ * invariants the CLI validator already enforces. These tests pin each
+ * invariant independently so a regression in any single check is caught.
+ */
+describe('SecurityAssertionAspect (#4662 Task D)', () => {
+    it('does not emit errors for an empty registry', () => {
+        const { errorMessages } = buildStackAndGetErrors(baseRegistry);
+        // The base stack emits zero routes / zero Function URLs, so the aspect
+        // should have nothing to complain about.
+        const aspectCodes = ['SECURITY_MISSING_JWT_AUTHORIZER', 'SECURITY_MISSING_TENANT_PATH', 'SECURITY_ACTION_FUNCTION_URL', 'SECURITY_MISSING_SECURITY_EXCEPTION'];
+        expect(errorMessages.filter(m => aspectCodes.some(c => m.includes(c)))).toHaveLength(0);
+    });
+    it('emits SECURITY_MISSING_TENANT_PATH when an API path lacks the tenant placeholder', () => {
+        const registry = {
+            ...baseRegistry,
+            apis: [
+                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/users', method: 'GET', authType: 'jwt' },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH') && m.includes('list-users'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_TENANT_PATH when the path includes the placeholder', () => {
+        const registry = {
+            ...baseRegistry,
+            apis: [
+                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/v1/tenants/{tenantId}/users', method: 'GET', authType: 'jwt' },
+            ],
+        };
+        // We expect the JWT authorizer error (because no Cognito is provided),
+        // but NOT the tenant path error.
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH'))).toBe(false);
+    });
+    it('emits SECURITY_MISSING_JWT_AUTHORIZER when JWT API is declared without Cognito config', () => {
+        const registry = {
+            ...baseRegistry,
+            apis: [
+                { id: 'list-users', kind: 'api', handlerFile: 'src/handlers/noop.ts', path: '/v1/tenants/{tenantId}/users', method: 'GET', authType: 'jwt' },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_JWT_AUTHORIZER') || m.includes('JWT-protected routes'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_SECURITY_EXCEPTION when authType is none but the route is the health probe', () => {
+        // The DomainStack installs the health/ready probes as `authType: 'none'` routes.
+        // Because they are special-cased in the aspect (and CLI validator
+        // ignores them), the aspect must NOT fire for them.
+        const registry = {
+            ...baseRegistry,
+            apis: [],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_SECURITY_EXCEPTION'))).toBe(false);
+    });
+    it('does NOT emit Function URL error for the existing health/ready probes', () => {
+        // HealthConstruct attaches `Lambda::Url` to its functions. The aspect
+        // exempts them via fn-name regex; we must not regress that exemption.
+        const registry = { ...baseRegistry };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        // HealthConstruct uses NodejsFunction which DOES NOT create Lambda::Url
+        // (URLs are only created when fn.addFunctionUrl is called). So there
+        // should be no Function URL errors at all on the base stack.
+        expect(errorMessages.some(m => m.includes('SECURITY_ACTION_FUNCTION_URL'))).toBe(false);
+    });
+    it('emits SECURITY_MISSING_TENANT_PATH for an action exposure with tenancy=required but bad path', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-all',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/admin/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH') && m.includes('list-all'))).toBe(true);
+    });
+    it('emits SECURITY_MISSING_JWT_AUTHORIZER for an action exposure with auth=required but no Cognito', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-users',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_JWT_AUTHORIZER') && m.includes('list-users'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_SECURITY_EXCEPTION for an action with auth=none AND securityException.reason', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'noop-action',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'platform',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/health',
+                        method: 'GET',
+                        auth: 'none',
+                        tenancy: 'none',
+                        securityException: { reason: 'public liveness probe; ticket OPS-123' },
+                    },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        // Note: the CLI validator's AUTH_NONE_REQUIRES_EXCEPTION rule mirrors
+        // this; we only check that the *aspect* does not block a well-formed
+        // action.
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_SECURITY_EXCEPTION'))).toBe(false);
+    });
+});

package/dist/aspects/index.d.ts

@@ -3,3 +3,7 @@ export type { TibTaggingAspectProps } from './tagging-aspect.js';
 export { LogRetentionAspect } from './log-retention-aspect.js';
 export { IamBoundariesAspect } from './iam-boundaries-aspect.js';
 export type { IamBoundariesAspectProps } from './iam-boundaries-aspect.js';
+export { SecurityAssertionAspect } from './security-assertion-aspect.js';
+export type { SecurityAssertionAspectProps } from './security-assertion-aspect.js';
+export { SECURITY_ASSERTION_CODES } from './security-assertion-aspect.js';
+export type { SecurityAssertionCode } from './security-assertion-aspect.js';

package/dist/aspects/index.js

@@ -1,3 +1,5 @@
 export { TibTaggingAspect } from './tagging-aspect.js';
 export { LogRetentionAspect } from './log-retention-aspect.js';
 export { IamBoundariesAspect } from './iam-boundaries-aspect.js';
+export { SecurityAssertionAspect } from './security-assertion-aspect.js';
+export { SECURITY_ASSERTION_CODES } from './security-assertion-aspect.js';