@mettlecast/domain-cdk-packer 0.2.60 → 0.2.62

package/dist/__tests__/domain-stack.test.js

@@ -5,31 +5,61 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { DomainStack } from '../DomainStack.js';
 const DOMAIN_ROOT = path.join(process.cwd(), '.test-domain-cdk-packer');
+// Wave 7 Task 7.3 (#4619): removed the runtime-export probe that used to
+// gate the action-exposure block via `describe.skipIf(...)`. The probe
+// returned `false` whenever the workspace-resolved `@mettlecast/domain-runtime`
+// package lagged behind the integration branch, which silently masked
+// regressions in the route/wrapper wiring that this block exists to catch.
+//
+// Coverage for the adapter-selection logic itself moved to
+// `grouped-lambda-factory.test.ts` (pure, no CDK / esbuild, no dependency
+// on the published runtime state). This file still exercises the
+// end-to-end CDK wiring — route creation, JWT authorizer attachment, and
+// the "no route for internal actions" guard — so the integration-level
+// regressions the probe used to hide are now caught by the narrow unit
+// tests instead.
 const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
-    apis: [
+    // Issue #4689: the canonical HTTP endpoint surface is actions[] with
+    // exposure.type === 'api'. The minimal registry now declares its
+    // single test endpoint as an action; apis is always empty.
+    webhooks: [],
+    subscribers: [],
+    schedules: [],
+    jobs: [],
+    actions: [
         {
             id: 'get-users',
-            kind: 'api',
+            kind: 'action',
             handlerFile: 'src/handlers/get-users.ts',
-            path: '/users',
-            method: 'GET',
-            authType: 'jwt',
+            backendAccess: 'domain',
+            exposure: {
+                type: 'api',
+                path: '/v1/tenants/{tenantId}/users',
+                method: 'GET',
+                auth: 'required',
+                tenancy: 'required',
+            },
+            idempotent: false,
         },
     ],
-    webhooks: [],
-    subscribers: [],
-    schedules: [],
-    jobs: [],
-    actions: [],
     integrations: [],
     events: [],
 };
 const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
 fs.mkdirSync(handlerDir, { recursive: true });
-fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), 'export const getUsers = { versions: { v1: { handler: async () => ({ statusCode: 200 }) } } };\n');
+// Match the grouped-lambda-factory's export-name conversion: kebab-case
+// ids map to camelCase export names (e.g. `get-users` → `getUsers`).
+const toExportName = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+const handlerStub = (id, method, path, auth = 'required', securityException) => `export const ${toExportName(id)} = { id: ${JSON.stringify(id)}, backendAccess: "domain", exposure: { type: "api", path: ${JSON.stringify(path)}, method: ${JSON.stringify(method)}, auth: ${JSON.stringify(auth)}, tenancy: "required"${securityException ? `, securityException: { reason: ${JSON.stringify(securityException)} }` : ''} }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n`;
+fs.writeFileSync(path.join(handlerDir, 'get-users.ts'), handlerStub('get-users', 'GET', '/v1/tenants/{tenantId}/users'));
+fs.writeFileSync(path.join(handlerDir, 'create-user.ts'), handlerStub('create-user', 'POST', '/v1/tenants/{tenantId}/users'));
+fs.writeFileSync(path.join(handlerDir, 'replace-user.ts'), handlerStub('replace-user', 'PUT', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'patch-user.ts'), handlerStub('patch-user', 'PATCH', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'delete-user.ts'), handlerStub('delete-user', 'DELETE', '/v1/tenants/{tenantId}/users/{id}'));
+fs.writeFileSync(path.join(handlerDir, 'list-things.ts'), handlerStub('list-things', 'GET', '/v1/tenants/{tenantId}/things', 'none', 'public read-only listing'));
 afterAll(() => {
     fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
 });
@@ -66,14 +96,22 @@ describe('DomainStack', () => {
             AuthorizerType: 'JWT',
         });
     });
-    it('no authorizer attached when authType is none', () => {
+    it('no authorizer attached when no JWT-protected actions are declared', () => {
         const app = new cdk.App();
         const registryNoAuth = {
             ...minimalRegistry,
-            apis: [
+            // Replace the JWT action with an auth=none + securityException
+            // action so the authorizer is not required.
+            actions: [
                 {
-                    ...minimalRegistry.apis[0],
-                    authType: 'none',
+                    id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET',
+                        auth: 'none', tenancy: 'required',
+                        securityException: { reason: 'public read-only listing' },
+                    },
+                    idempotent: false,
                 },
             ],
         };
@@ -169,4 +207,266 @@ describe('DomainStack', () => {
             template.hasOutput('DomainTenantScopedRoleArn', {});
         });
     });
+    /**
+     * Wave 4 Task 4.1 — fixes the route key bug where every non-GET method was
+     * silently coerced to "POST" and the JWT authorizer was never attached
+     * because the HttpJwtAuthorizer was never bound to a route.
+     */
+    describe('route keys and JWT authorizer wiring (#4619)', () => {
+        const userPoolArn = 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz';
+        const userPoolClientId = 'test-client-id';
+        /**
+         * Build a registry whose API entries cover all HTTP method variants the
+         * route key bug previously broke. Each entry uses `authType: 'jwt'` so
+         * every method exercises the new JWT-wiring path through `addRouteToApi`.
+         */
+        const multiMethodRegistry = {
+            ...minimalRegistry,
+            actions: [
+                {
+                    id: 'get-users', kind: 'action', handlerFile: 'src/handlers/get-users.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'create-user', kind: 'action', handlerFile: 'src/handlers/create-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'POST', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'replace-user', kind: 'action', handlerFile: 'src/handlers/replace-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'PUT', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'patch-user', kind: 'action', handlerFile: 'src/handlers/patch-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'PATCH', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'delete-user', kind: 'action', handlerFile: 'src/handlers/delete-user.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users/{id}', method: 'DELETE', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+                {
+                    id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET', auth: 'none', tenancy: 'required', securityException: { reason: 'public read-only listing' } },
+                    idempotent: false,
+                },
+            ],
+        };
+        it('uses the actual HTTP method for each route key (GET/POST/PUT/PATCH/DELETE)', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackMethods', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            // Every method must round-trip — the previous implementation coerced all
+            // non-GET methods to POST, so PUT/PATCH/DELETE were broken.
+            // Issue #4689: routes now use the action's exposure.path (which
+            // already includes `/v1/tenants/{tenantId}/`) and the canonical
+            // tenant placeholder.
+            expect(routeKeys).toContain('GET /test-domain/v1/tenants/{tenantId}/users');
+            expect(routeKeys).toContain('POST /test-domain/v1/tenants/{tenantId}/users');
+            expect(routeKeys).toContain('PUT /test-domain/v1/tenants/{tenantId}/users/{id}');
+            expect(routeKeys).toContain('PATCH /test-domain/v1/tenants/{tenantId}/users/{id}');
+            expect(routeKeys).toContain('DELETE /test-domain/v1/tenants/{tenantId}/users/{id}');
+        });
+        it('sets AuthorizationType=JWT and AuthorizerId on jwt-auth routes', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackRouteAuth', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const jwtRoutes = Object.values(routes).filter(r => {
+                const key = r.Properties.RouteKey;
+                // Issue #4689: paths now include the tenant placeholder.
+                return key.includes('/users') && !key.includes('Health') && !key.includes('Ready');
+            });
+            // Every jwt-auth route must carry AuthorizationType and AuthorizerId.
+            expect(jwtRoutes.length).toBeGreaterThan(0);
+            for (const r of jwtRoutes) {
+                expect(r.Properties.AuthorizationType).toBe('JWT');
+                const authorizerId = r.Properties.AuthorizerId;
+                expect(authorizerId).toBeDefined();
+            }
+        });
+        it('does not attach authorizer to non-jwt routes (auth=none)', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackUnauthRoute', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                userPoolArn,
+                userPoolClientId,
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const unauthRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'GET /test-domain/v1/tenants/{tenantId}/things');
+            expect(unauthRoute).toBeDefined();
+            expect(unauthRoute.Properties.AuthorizationType).toBeUndefined();
+            expect(unauthRoute.Properties.AuthorizerId).toBeUndefined();
+        });
+        it('emits a synth-time error annotation when JWT route is declared without Cognito config', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackMissingPool', {
+                registry: multiMethodRegistry,
+                eventBusArn,
+                // No userPoolArn / userPoolId / userPoolClientId provided
+            });
+            // `Annotations.of(stack).errors` is not exposed; read the construct's
+            // metadata directly and filter for error-level entries.
+            const metadata = stack.node.metadata;
+            const errorMessages = metadata
+                .filter(m => m.type === 'aws:cdk:error')
+                .map(m => (typeof m.data === 'string' ? m.data : JSON.stringify(m.data)));
+            expect(errorMessages.some(a => a.includes('JWT-protected routes') && a.includes('Cognito'))).toBe(true);
+        });
+        it('does NOT emit the missing-pool error when no JWT-protected actions are present', () => {
+            const app = new cdk.App();
+            const noJwtRegistry = {
+                ...minimalRegistry,
+                // Replace the JWT-protected action with an auth=none + securityException
+                // action so the JWT-needs-pool check does not fire.
+                actions: [
+                    {
+                        id: 'list-things', kind: 'action', handlerFile: 'src/handlers/list-things.ts',
+                        backendAccess: 'domain',
+                        exposure: {
+                            type: 'api', path: '/v1/tenants/{tenantId}/things', method: 'GET',
+                            auth: 'none', tenancy: 'required',
+                            securityException: { reason: 'public read-only listing' },
+                        },
+                        idempotent: false,
+                    },
+                ],
+            };
+            const stack = new DomainStack(app, 'TestDomainStackNoJwtNeeded', {
+                registry: noJwtRegistry,
+                eventBusArn,
+            });
+            const metadata = stack.node.metadata;
+            const errorMessages = metadata
+                .filter(m => m.type === 'aws:cdk:error')
+                .map(m => (typeof m.data === 'string' ? m.data : JSON.stringify(m.data)));
+            expect(errorMessages.some(a => a.includes('JWT-protected routes'))).toBe(false);
+        });
+    });
+    /**
+     * Wave 4 Task 4.1 — generate API Gateway routes for actions whose
+     * `exposure.type === 'api'` and skip `exposure.type === 'internal'`.
+     *
+     * Wave 7 Task 7.3 (#4619) removed the runtime-export probe and the
+     * `describe.skipIf(...)` wrapper. The route-level assertions still need
+     * a full CDK synth so the L1 `CfnRoute` resources can be inspected, but
+     * adapter-selection coverage (the part most likely to regress when the
+     * runtime barrel changes) lives in `grouped-lambda-factory.test.ts`
+     * where it runs as a pure unit test in milliseconds. If the runtime
+     * barrel ever drops an export we expect to see this block fail with a
+     * bundling error rather than be silently skipped.
+     */
+    describe('action exposure routing (#4619)', () => {
+        const actionHandlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
+        fs.mkdirSync(actionHandlerDir, { recursive: true });
+        fs.writeFileSync(path.join(actionHandlerDir, 'list-invoices.ts'), 'export const listInvoices = { id: "list-invoices", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/invoices", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n');
+        fs.writeFileSync(path.join(actionHandlerDir, 'charge-card.ts'), 'export const chargeCard = { id: "charge-card", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/charge", method: "POST", auth: "required", tenancy: "required" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: true, handler: async () => ({ ok: true }) };\n');
+        fs.writeFileSync(path.join(actionHandlerDir, 'internal-helper.ts'), 'export const internalHelper = { id: "internal-helper", backendAccess: "private", exposure: { type: "internal" }, input: { parse: (x: unknown) => x }, output: { parse: (x: unknown) => x }, idempotent: false, handler: async () => ({ ok: true }) };\n');
+        const registryWithActions = {
+            ...minimalRegistry,
+            actions: [
+                {
+                    id: 'list-invoices',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/list-invoices.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/tenants/{tenantId}/invoices',
+                        method: 'GET',
+                        auth: 'required',
+                        tenancy: 'required',
+                    },
+                    idempotent: false,
+                },
+                {
+                    id: 'charge-card',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/charge-card.ts',
+                    backendAccess: 'domain',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/tenants/{tenantId}/charge',
+                        method: 'POST',
+                        auth: 'required',
+                        tenancy: 'required',
+                    },
+                    idempotent: true,
+                },
+                {
+                    id: 'internal-helper',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/internal-helper.ts',
+                    backendAccess: 'private',
+                    exposure: { type: 'internal' },
+                    idempotent: false,
+                },
+            ],
+        };
+        it('synthesises routes for API-exposed actions', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackActionRoutes', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            expect(routeKeys).toContain('GET /test-domain/v1/tenants/{tenantId}/invoices');
+            expect(routeKeys).toContain('POST /test-domain/v1/tenants/{tenantId}/charge');
+        });
+        it('does NOT create a route for internal exposure actions', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackInternalOnly', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const routeKeys = Object.values(routes).map(r => r.Properties.RouteKey);
+            expect(routeKeys.some(k => k.includes('internal-helper'))).toBe(false);
+        });
+        it('attaches JWT authorizer to API-exposed action routes when auth=required', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackActionJwt', {
+                registry: registryWithActions,
+                eventBusArn,
+                userPoolArn: 'arn:aws:cognito-idp:eu-north-1:123456789012:userpool/eu-north-1_abc123xyz',
+                userPoolClientId: 'test-client-id',
+            });
+            const template = Template.fromStack(stack);
+            const routes = template.findResources('AWS::ApiGatewayV2::Route');
+            const actionRoute = Object.values(routes).find(r => r.Properties.RouteKey === 'POST /test-domain/v1/tenants/{tenantId}/charge');
+            expect(actionRoute).toBeDefined();
+            expect(actionRoute.Properties.AuthorizationType).toBe('JWT');
+            expect(actionRoute.Properties.AuthorizerId).toBeDefined();
+        });
+    });
 });

package/dist/__tests__/grouped-lambda-factory-action-wrapper.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Wave 7 Task 7.1 (#4619) — generated dedicated Lambda wrapper tests.
+ *
+ * The dedicated-mode bundler writes an entry module that wires a domain action
+ * export into a runtime adapter. For action adapters the wiring is non-trivial:
+ * `createActionLambdaHandler` takes `(registry, options)` and
+ * `createExposedActionApiHandler` takes `(action, options)`. These assertions
+ * use the pure entry-content helper so they do not race with other tests that
+ * also write `.tib-domain-entries` artifacts.
+ */
+export {};

package/dist/__tests__/grouped-lambda-factory-action-wrapper.test.js

@@ -0,0 +1,47 @@
+/**
+ * Wave 7 Task 7.1 (#4619) — generated dedicated Lambda wrapper tests.
+ *
+ * The dedicated-mode bundler writes an entry module that wires a domain action
+ * export into a runtime adapter. For action adapters the wiring is non-trivial:
+ * `createActionLambdaHandler` takes `(registry, options)` and
+ * `createExposedActionApiHandler` takes `(action, options)`. These assertions
+ * use the pure entry-content helper so they do not race with other tests that
+ * also write `.tib-domain-entries` artifacts.
+ */
+import { describe, it, expect } from 'vitest';
+import { buildDedicatedEntryContent } from '../grouped-lambda-factory.js';
+const DOMAIN_ID = 'billing';
+function render(entry, primitiveType = 'action') {
+    return buildDedicatedEntryContent('./handler.js', entry, primitiveType, DOMAIN_ID);
+}
+describe('grouped-lambda-factory — generated action wrapper (Wave 7 Task 7.1)', () => {
+    it('emits a createActionLambdaHandler(registry, options) wrapper for internal actions', () => {
+        const content = render({ id: 'internal-helper', handlerFile: 'src/actions/internal-helper.ts' });
+        expect(content).toMatch(/import\s*\{\s*createActionLambdaHandler\s*\}\s*from\s*['"]@mettlecast\/domain-runtime['"]/);
+        expect(content).toMatch(/const\s+registry\s*=\s*\{\s*"billing"\s*:\s*\{\s*"internal-helper"\s*:\s*internalHelper\s*\}\s*\}/);
+        expect(content).toMatch(/export\s+const\s+handler\s*=\s*createActionLambdaHandler\(\s*registry\s*,\s*\{/);
+        expect(content).toMatch(/domainId:\s*"billing"/);
+        expect(content).toMatch(/databaseUrl:\s*process\.env\.DATABASE_URL/);
+        expect(content).toMatch(/eventBusName:\s*process\.env\.EVENT_BUS_NAME/);
+        expect(content).toMatch(/idempotencyTableName:\s*process\.env\.IDEMPOTENCY_TABLE/);
+    });
+    it('emits a createExposedActionApiHandler(action, options) wrapper for API-exposed actions', () => {
+        const content = render({
+            id: 'public-charge',
+            handlerFile: 'src/actions/public-charge.ts',
+            adapter: 'createExposedActionApiHandler',
+        });
+        expect(content).toMatch(/import\s*\{\s*createExposedActionApiHandler\s*\}\s*from\s*['"]@mettlecast\/domain-runtime['"]/);
+        expect(content).toMatch(/const\s+actionRegistry\s*=\s*\{\s*"billing"\s*:\s*\{\s*"public-charge"\s*:\s*publicCharge\s*\}\s*\}/);
+        expect(content).toMatch(/export\s+const\s+handler\s*=\s*createExposedActionApiHandler\(\s*publicCharge\s*,\s*\{/);
+        expect(content).toMatch(/definingDomain:\s*"billing"/);
+        expect(content).toMatch(/domainId:\s*"billing"/);
+        expect(content).toMatch(/actionRegistry,/);
+        expect(content).toMatch(/callerDomainId:\s*"billing"/);
+    });
+    it('does NOT emit a bare `${adapter}(${exportName})` shape for any action adapter', () => {
+        const content = render({ id: 'another-internal', handlerFile: 'src/actions/another-internal.ts' });
+        expect(content).not.toMatch(/createActionLambdaHandler\(\s*anotherInternal\s*\)/);
+        expect(content).not.toMatch(/createExposedActionApiHandler\(\s*anotherInternal\s*\)/);
+    });
+});

package/dist/__tests__/grouped-lambda-factory.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/grouped-lambda-factory.test.js

@@ -0,0 +1,146 @@
+import { describe, it, expect } from 'vitest';
+import { buildDedicatedEntryContent, ADAPTER_BY_PRIMITIVE, EXPOSED_ACTION_ADAPTER, } from '../grouped-lambda-factory.js';
+/**
+ * Wave 7 Task 7.3 (#4619) — narrow, pure tests for the dedicated-mode
+ * Lambda entry-content generator.
+ *
+ * These tests pin the adapter-selection logic added in Wave 4 Task 4.1
+ * (API-exposed actions wrap with `createExposedActionApiHandler` while
+ * internal actions keep `createActionLambdaHandler`) WITHOUT spinning up
+ * CDK or esbuild. The previous version of `domain-stack.test.ts` skipped
+ * these assertions via a runtime-export probe because the installed
+ * `@mettlecast/domain-runtime` package sometimes lags behind the
+ * integration branch. Testing the source code we generate — not the
+ * downstream package state — removes that skip and the regression-masking
+ * risk that came with it.
+ *
+ * End-to-end route-creation / authorizer-attachment behaviour is still
+ * covered by `domain-stack.test.ts` (the action-exposure block at the
+ * bottom of that file), but the heavy assertions about WHICH adapter is
+ * wired into WHICH entry now live here where they run in milliseconds.
+ *
+ * Compatibility note (Task 7.1 overlap, #4619): the test surface here
+ * deliberately targets only the parts of `buildDedicatedEntryContent`
+ * that are stable across the Wave 7.1 wrapper fixes (which change the
+ * action-adapter call shape, not the adapter selection logic). When
+ * Task 7.1 lands, this file can grow assertions for the new wrappers
+ * without rewriting the existing ones.
+ */
+describe('buildDedicatedEntryContent (Wave 7 Task 7.3, #4619)', () => {
+    const DOMAIN_ID = 'billing';
+    const entry = (id, adapter) => ({
+        id,
+        handlerFile: `src/handlers/${id}.ts`,
+        ...(adapter !== undefined ? { adapter } : {}),
+    });
+    describe('adapter selection by primitive type (defaults)', () => {
+        const cases = [
+            { primitive: 'subscriber', expectedAdapter: 'createSubscriberLambdaHandler' },
+            { primitive: 'job', expectedAdapter: 'createJobLambdaHandler' },
+            { primitive: 'webhook', expectedAdapter: 'createWebhookLambdaHandler' },
+            { primitive: 'action', expectedAdapter: 'createActionLambdaHandler' },
+        ];
+        for (const { primitive, expectedAdapter } of cases) {
+            it(`imports the default adapter for primitive type "${primitive}"`, () => {
+                const content = buildDedicatedEntryContent('./handler.js', entry('list-things'), primitive, DOMAIN_ID);
+                expect(content).toContain(`import { ${expectedAdapter} } from '@mettlecast/domain-runtime';`);
+                if (primitive === 'action') {
+                    expect(content).toContain(`const registry = { "${DOMAIN_ID}": { "list-things": listThings } };`);
+                    expect(content).toContain('export const handler = createActionLambdaHandler(registry, {');
+                    expect(content).toContain(`domainId: "${DOMAIN_ID}"`);
+                }
+                else {
+                    expect(content).toContain(`export const handler = ${expectedAdapter}(listThings);`);
+                }
+                // Adapter map should agree with what is generated
+                expect(ADAPTER_BY_PRIMITIVE[primitive]).toBe(expectedAdapter);
+            });
+        }
+        it('schedule has no entry in ADAPTER_BY_PRIMITIVE (uses hydrateCtx envelope instead)', () => {
+            // Schedules intentionally fall through to the inline `hydrateCtx`
+            // wrapper path (see buildDedicatedEntryContent's schedule branch).
+            // Pinning that here guards against future refactors silently
+            // promoting schedules into the adapter-map path.
+            const keys = Object.keys(ADAPTER_BY_PRIMITIVE);
+            expect(keys).not.toContain('schedule');
+        });
+    });
+    describe('action adapter override (Wave 4 Task 4.1, #4619)', () => {
+        it('uses createExposedActionApiHandler when entry.adapter is the exposed-action adapter', () => {
+            const apiExposed = entry('list-invoices', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', apiExposed, 'action', DOMAIN_ID);
+            expect(content).toContain(`import { ${EXPOSED_ACTION_ADAPTER} } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain(`const actionRegistry = { "${DOMAIN_ID}": { "list-invoices": listInvoices } };`);
+            expect(content).toContain(`export const handler = ${EXPOSED_ACTION_ADAPTER}(listInvoices, {`);
+            expect(content).toContain(`definingDomain: "${DOMAIN_ID}"`);
+            expect(content).toContain('actionRegistry,');
+            // Must NOT also import the envelope-based adapter — that would be
+            // dead code and risks accidental misuse if the adapter selection ever
+            // regresses.
+            expect(content).not.toContain('createActionLambdaHandler');
+        });
+        it('uses createActionLambdaHandler when no adapter override is supplied (internal action)', () => {
+            const internal = entry('internal-helper');
+            const content = buildDedicatedEntryContent('./handler.js', internal, 'action', DOMAIN_ID);
+            expect(content).toContain(`import { createActionLambdaHandler } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain(`const registry = { "${DOMAIN_ID}": { "internal-helper": internalHelper } };`);
+            expect(content).toContain('export const handler = createActionLambdaHandler(registry, {');
+            expect(content).toContain(`domainId: "${DOMAIN_ID}"`);
+            // Must NOT use the exposed adapter for internal actions.
+            expect(content).not.toContain(EXPOSED_ACTION_ADAPTER);
+        });
+        it('per-entry adapter override takes precedence over the primitive-type default', () => {
+            // Even when an explicit adapter is supplied, the override wins.
+            const overridden = entry('charge-card', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', overridden, 'webhook', DOMAIN_ID);
+            expect(content).toContain(`import { ${EXPOSED_ACTION_ADAPTER} } from '@mettlecast/domain-runtime';`);
+            expect(content).not.toContain('createWebhookLambdaHandler');
+        });
+    });
+    describe('schedule envelope', () => {
+        it('uses hydrateCtx (no per-primitive adapter) for schedules', () => {
+            const schedule = entry('nightly-rollup');
+            const content = buildDedicatedEntryContent('./handler.js', schedule, 'schedule', DOMAIN_ID);
+            expect(content).toContain(`import { hydrateCtx } from '@mettlecast/domain-runtime';`);
+            expect(content).toContain('hydrateCtx(event, {');
+            expect(content).toContain('databaseUrl: process.env.DATABASE_URL');
+            expect(content).toContain('eventBusName: process.env.EVENT_BUS_NAME');
+            expect(content).toContain('try { await ctx.db.release(); } catch {}');
+            // Schedules should NOT use any of the Lambda-handler adapter factories.
+            expect(content).not.toMatch(/import \{ \w+LambdaHandler \}/);
+        });
+        it('does NOT honour entry.adapter for schedules — hydrateCtx is the only path', () => {
+            const schedule = entry('nightly-rollup', EXPOSED_ACTION_ADAPTER);
+            const content = buildDedicatedEntryContent('./handler.js', schedule, 'schedule', DOMAIN_ID);
+            expect(content).toContain(`import { hydrateCtx } from '@mettlecast/domain-runtime';`);
+            expect(content).not.toContain(EXPOSED_ACTION_ADAPTER);
+        });
+    });
+    describe('handler import path wiring', () => {
+        it('uses the caller-supplied relative import path verbatim', () => {
+            const e = entry('list-things');
+            const content = buildDedicatedEntryContent('../../../../src/handlers/list-things.ts', e, 'webhook', DOMAIN_ID);
+            expect(content).toContain(`import { listThings } from '../../../../src/handlers/list-things.ts';`);
+        });
+        it('converts kebab-case handler IDs to camelCase export names', () => {
+            const e = entry('list-invoices-for-tenant');
+            const content = buildDedicatedEntryContent('./handler.js', e, 'action', DOMAIN_ID);
+            expect(content).toMatch(/import \{ listInvoicesForTenant \} from/);
+            expect(content).toContain(`"list-invoices-for-tenant": listInvoicesForTenant`);
+            expect(content).toContain('createActionLambdaHandler(registry, {');
+        });
+        it('emits a single export const handler per entry', () => {
+            const e = entry('list-things');
+            const content = buildDedicatedEntryContent('./handler.js', e, 'webhook', DOMAIN_ID);
+            const matches = content.match(/^export const handler\b/gm) ?? [];
+            expect(matches.length).toBe(1);
+        });
+    });
+    describe('EXPOSED_ACTION_ADAPTER constant', () => {
+        it('matches the Wave 3 / Wave 4 exported name', () => {
+            // Pinning the literal value guards against silent rename during future
+            // refactors of the runtime barrel.
+            expect(EXPOSED_ACTION_ADAPTER).toBe('createExposedActionApiHandler');
+        });
+    });
+});

package/dist/__tests__/lambda-factory.test.js

@@ -5,12 +5,12 @@ import * as lambdaNode from 'aws-cdk-lib/aws-lambda-nodejs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { LambdaFactory } from '../lambda-factory.js';
-const DOMAIN_ROOT = '/tmp/test-domain-cdk-packer';
+const DOMAIN_ROOT = path.join(process.cwd(), '.tmp', 'test-domain-cdk-packer');
 const minimalRegistry = {
     schemaVersion: '1',
     domainRoot: DOMAIN_ROOT,
     domain: { id: 'test-domain', kind: 'domain', name: 'Test Domain', tenancy: 'none' },
-    apis: [], webhooks: [], subscribers: [], schedules: [], jobs: [], actions: [], integrations: [], events: [],
+    webhooks: [], subscribers: [], schedules: [], jobs: [], actions: [], integrations: [], events: [],
 };
 beforeAll(() => {
     const handlerDir = path.join(DOMAIN_ROOT, 'src');
@@ -26,7 +26,7 @@ describe('LambdaFactory', () => {
         const stack = new cdk.Stack(app, 'TestStack');
         const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
         expect(() => {
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
         }).not.toThrow();
     });
     describe('bundling configuration', () => {
@@ -34,7 +34,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackArch');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Architectures: ['arm64'],
@@ -44,7 +44,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackRuntime');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Runtime: 'nodejs22.x',
@@ -54,7 +54,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackSourceMaps');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             const template = Template.fromStack(stack);
             template.hasResourceProperties('AWS::Lambda::Function', {
                 Environment: {
@@ -68,7 +68,7 @@ describe('LambdaFactory', () => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'TestStackDefaults');
             const factory = new LambdaFactory({ scope: stack, registry: minimalRegistry, domainRoot: minimalRegistry.domainRoot });
-            const fn = factory.createFunction({ id: 'test-api', kind: 'api', handlerFile: 'src/api.ts' });
+            const fn = factory.createFunction({ id: 'test-action', kind: 'action', handlerFile: 'src/api.ts' });
             expect(fn).toBeInstanceOf(lambdaNode.NodejsFunction);
             expect(fn.runtime?.name).toContain('nodejs22');
         });