@reventlessdev/reventless-aws 3.0.0-alpha.232 → 3.0.0-alpha.234

package/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs

@@ -0,0 +1,183 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as DynamoDb_Util_Helpers$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_Util_Helpers.res.mjs";
+import * as AppSyncEventsSigner_Ops$ReventlessAws from "../Api/AppSyncEventsSigner_Ops.res.mjs";
+
+let endpoint = Stdlib_Option.getOr(process.env["APPSYNC_ENDPOINT"], "");
+
+let obj = Stdlib_JSON.Decode.object(JSON.parse(Stdlib_Option.getOr(process.env["STATE_TOPIC_MAP"], "{}")));
+
+let topicMap = obj !== undefined ? Object.fromEntries(Stdlib_Array.filterMap(Object.entries(obj), param => {
+    let k = param[0];
+    return Stdlib_Option.map(Stdlib_JSON.Decode.string(param[1]), s => [
+      k,
+      s
+    ]);
+  })) : ({});
+
+function topicRootFromEventSourceArn(arn) {
+  let parts = arn.split("/");
+  let match = parts[0];
+  let match$1 = parts[1];
+  let match$2 = parts[2];
+  if (match !== undefined && match$1 !== undefined && match$2 !== undefined && match$2 === "stream" && match.endsWith(":table")) {
+    return Stdlib_Option.map(topicMap[match$1], AppSyncEventsSigner_Ops$ReventlessAws.pathSegment);
+  }
+}
+
+function jsonToString(j) {
+  if (j === null) {
+    return "null";
+  }
+  if (Array.isArray(j)) {
+    return JSON.stringify(j);
+  }
+  switch (typeof j) {
+    case "boolean" :
+      if (j) {
+        return "true";
+      } else {
+        return "false";
+      }
+    case "string" :
+      return j;
+    case "number" :
+      return j.toString();
+    case "object" :
+      return JSON.stringify(j);
+  }
+}
+
+function entityKeyFromRecord(dynamodb) {
+  let keys = DynamoDb_Util_Helpers$AwsSdk.unmarshallDict(undefined, dynamodb.Keys);
+  let id = keys["id"];
+  if (id === undefined) {
+    return Object.keys(keys).toSorted(Primitive_string.compare).map(n => Stdlib_Option.mapOr(keys[n], "", jsonToString)).join("-");
+  }
+  let subIdName = Object.keys(keys).find(k => k !== "id");
+  if (subIdName !== undefined) {
+    return jsonToString(id) + "-" + Stdlib_Option.mapOr(keys[subIdName], "", jsonToString);
+  } else {
+    return jsonToString(id);
+  }
+}
+
+function changeKindFor(eventName) {
+  switch (eventName) {
+    case "INSERT" :
+      return "Added";
+    case "REMOVE" :
+      return "Removed";
+    default:
+      return "Updated";
+  }
+}
+
+function pickSortKeyValue(image) {
+  let v = Stdlib_Option.flatMap(image["updatedAt"], Stdlib_JSON.Decode.string);
+  if (v !== undefined) {
+    return v;
+  } else {
+    return Stdlib_Option.flatMap(image["createdAt"], Stdlib_JSON.Decode.string);
+  }
+}
+
+async function processRecord(record, region, creds) {
+  let topicRoot = topicRootFromEventSourceArn(record.eventSourceARN);
+  if (topicRoot !== undefined) {
+    let dynamodb = record.dynamodb;
+    if (dynamodb === undefined) {
+      return;
+    }
+    let image = record.eventName === "REMOVE" ? dynamodb.OldImage : dynamodb.NewImage;
+    if (image === undefined) {
+      return;
+    }
+    let entityKey = entityKeyFromRecord(dynamodb);
+    let channel = `/default/` + topicRoot + `/` + AppSyncEventsSigner_Ops$ReventlessAws.pathSegment(entityKey);
+    let unmarshalled = DynamoDb_Util_Helpers$AwsSdk.unmarshallDict(undefined, image);
+    let descriptor = {};
+    descriptor["changeKind"] = changeKindFor(record.eventName);
+    descriptor["id"] = entityKey;
+    Stdlib_Option.forEach(pickSortKeyValue(unmarshalled), v => {
+      descriptor["sortKeyValue"] = v;
+    });
+    let body = JSON.stringify(Object.fromEntries([
+      [
+        "id",
+        record.eventID
+      ],
+      [
+        "channel",
+        channel
+      ],
+      [
+        "events",
+        [JSON.stringify(descriptor)]
+      ]
+    ]));
+    try {
+      let res = await AppSyncEventsSigner_Ops$ReventlessAws.postEvent(endpoint, region, new Date().toISOString(), creds, body);
+      if (res.ok) {
+        return;
+      }
+      let status = res.status;
+      let txt = await res.text();
+      let isTransient = status >= 500;
+      let tag = isTransient ? "transient" : "permanent";
+      console.error(`STATE_TOPIC_PUBLISH_FAILED type=` + tag + ` status=` + status.toString() + ` channel=` + channel + ` body=` + txt.slice(0, 500));
+      if (isTransient) {
+        return `StateTopic publish failed: ` + status.toString();
+      } else {
+        return;
+      }
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "");
+      console.error(`STATE_TOPIC_PUBLISH_FAILED type=transient status=network channel=` + channel + ` err=` + msg);
+      return msg === "" ? "StateTopic network error" : msg;
+    }
+  } else {
+    console.warn("StateTopic: unknown table for ARN", record.eventSourceARN);
+    return;
+  }
+}
+
+async function handler(event) {
+  let region = AppSyncEventsSigner_Ops$ReventlessAws.region();
+  let creds = AppSyncEventsSigner_Ops$ReventlessAws.envCreds();
+  let transientErr = {
+    contents: undefined
+  };
+  await Stdlib_Array.reduce(event.Records, Promise.resolve(), (acc, record) => acc.then(async () => {
+    let msg = await processRecord(record, region, creds);
+    if (msg !== undefined) {
+      transientErr.contents = msg;
+      return;
+    }
+  }));
+  let msg = transientErr.contents;
+  if (msg !== undefined) {
+    return Stdlib_JsError.throwWithMessage(msg);
+  }
+}
+
+export {
+  endpoint,
+  topicMap,
+  topicRootFromEventSourceArn,
+  jsonToString,
+  entityKeyFromRecord,
+  changeKindFor,
+  pickSortKeyValue,
+  processRecord,
+  handler,
+}
+/* endpoint Not a pure module */

package/src/components/AutomationSlice_Builder.res

@@ -40,8 +40,10 @@ module Make = (Api: {
       EventCollectorRuntimeBuilder.registerAutomationSlice(
         ~name=Spec.name,
         ~specModulePath=Util_Bundle.getModuleSpecifier(Spec.moduleUrl),
+        ~bodyModulePath=Util_Bundle.getModuleSpecifier(Automation.moduleUrl),
         ~callbackType="automation",
         ~queryDbTableName,
+        ~context,
       )
 
       as_

package/src/components/AutomationSlice_Builder.res.mjs

@@ -41,7 +41,7 @@ function Make(Api) {
       let queryDbOutputs = Component$ReventlessCore.outputs(as_).queryDb;
       let tableResource = queryDbOutputs.resources[0];
       let queryDbTableName = tableResource.name;
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), "automation", queryDbTableName);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, context);
       return as_;
     };
     return {

package/src/components/OutboundTranslationSlice_Builder.res

@@ -48,6 +48,7 @@ module Make = (Api: {
       AutomationSliceRuntime_Builder_Single.registerAutomationSlice(
         ~name=Spec.name,
         ~specModulePath=Util_Bundle.getModuleSpecifier(Spec.moduleUrl),
+        ~bodyModulePath=Util_Bundle.getModuleSpecifier(Translation.moduleUrl),
         ~callbackType="outbound",
         ~queryDbTableName,
       )

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -48,7 +48,7 @@ function Make(Api) {
       let queryDbOutputs = Component$ReventlessCore.outputs(ots).queryDb;
       let tableResource = queryDbOutputs.resources[0];
       let queryDbTableName = tableResource.name;
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), "outbound", queryDbTableName);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, undefined);
       return ots;
     };
     return {

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -56,7 +56,13 @@ let registerStateChangeSliceSpec = (~specPath: string, ~behaviorPath: string) =>
 type inboundSliceReg = {
   specPath: string,
   translationPath: string,
-  mutable auditTableName: option<Pulumi.Output.t<string>>,
+  // Plain `Pulumi.Output.t<string>`, never `option<Pulumi.Output.t<string>>`:
+  // any generic `Option.*` call over an Output runs `valFromOption`, whose
+  // `.BS_PRIVATE_NESTED_SOME_NONE` probe hits the Output proxy (every property
+  // access returns a truthy Output), mis-classifies it as a nested-option and
+  // corrupts it into `{BS_PRIVATE_NESTED_SOME_NONE:0}`. The empty-string Output
+  // is the "no audit table" sentinel (serialized as `null` downstream).
+  mutable auditTableName: Pulumi.Output.t<string>,
 }
 let registeredInboundSlices: dict<inboundSliceReg> = Dict.make()
 
@@ -68,16 +74,19 @@ let registerInboundTranslationSliceSpec = (
   switch registeredInboundSlices->Dict.get(specName) {
   | Some(reg) => registeredInboundSlices->Dict.set(specName, {...reg, specPath, translationPath})
   | None =>
-    registeredInboundSlices->Dict.set(specName, {specPath, translationPath, auditTableName: None})
+    registeredInboundSlices->Dict.set(
+      specName,
+      {specPath, translationPath, auditTableName: Pulumi.Output.make("")},
+    )
   }
 
 let registerInboundAuditTableName = (~specName: string, tableName: Pulumi.Output.t<string>) =>
   switch registeredInboundSlices->Dict.get(specName) {
-  | Some(reg) => reg.auditTableName = Some(tableName)
+  | Some(reg) => reg.auditTableName = tableName
   | None =>
     registeredInboundSlices->Dict.set(
       specName,
-      {specPath: "", translationPath: "", auditTableName: Some(tableName)},
+      {specPath: "", translationPath: "", auditTableName: tableName},
     )
   }
 

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -65,7 +65,7 @@ function registerInboundTranslationSliceSpec(specName, specPath, translationPath
     registeredInboundSlices[specName] = {
       specPath: specPath,
       translationPath: translationPath,
-      auditTableName: undefined
+      auditTableName: Pulumi.output("")
     };
   }
 }

package/tests/AppSyncEventsSigner_OpsTest.res

@@ -0,0 +1,75 @@
+// Byte-parity guard for the AppSync Events SigV4 signer port.
+//
+// AppSyncEventsSigner_Ops.signedHeaders is a ReScript port of the hand-rolled
+// SigV4 the two stream-relay Lambdas used to carry as inline JS. A one-character
+// drift in the canonical request or the signing-key chain silently produces a
+// 403 from AppSync and stops live event delivery — invisible until a deploy.
+// This asserts the port is byte-identical to the preserved original
+// (AppSyncEventsSigner_ParityFixture.mjs) across a range of inputs.
+
+open JestGlobals
+
+type jsCreds = {accessKeyId: string, secretAccessKey: string, sessionToken?: string}
+@module("./AppSyncEventsSigner_ParityFixture.mjs")
+external signedHeadersJs: (
+  ~host: string,
+  ~path: string,
+  ~body: string,
+  ~region: string,
+  ~isoNow: string,
+  ~creds: jsCreds,
+) => dict<string> = "signedHeadersJs"
+
+let get = (d, k) => d->Dict.get(k)->Option.getOr("<missing>")
+
+// Compare the ReScript signer to the JS reference for one input tuple.
+let assertParity = (~host, ~path, ~body, ~region, ~isoNow, ~accessKeyId, ~secretAccessKey, ~sessionToken) => {
+  let creds: AppSyncEventsSigner_Ops.creds = {accessKeyId, secretAccessKey, sessionToken}
+  let mine = AppSyncEventsSigner_Ops.signedHeaders(~host, ~path, ~body, ~region, ~isoNow, ~creds)
+  let jsCreds: jsCreds = {accessKeyId, secretAccessKey, sessionToken: ?sessionToken}
+  let ref = signedHeadersJs(~host, ~path, ~body, ~region, ~isoNow, ~creds=jsCreds)
+  expect(mine->get("Authorization"))->toBe(ref->get("Authorization"))
+  expect(mine->get("x-amz-date"))->toBe(ref->get("x-amz-date"))
+  expect(mine->get("host"))->toBe(ref->get("host"))
+}
+
+describe("AppSyncEventsSigner_Ops.signedHeaders parity with the original JS", () => {
+  testSync("session-token present", () => {
+    assertParity(
+      ~host="abc123.appsync-api.eu-west-1.amazonaws.com",
+      ~path="/event",
+      ~body=`{"id":"m-1","channel":"/default/Catalog","events":["{\\"position\\":\\"1\\"}"]}`,
+      ~region="eu-west-1",
+      ~isoNow="2026-07-27T13:45:07.123Z",
+      ~accessKeyId="ASIAEXAMPLE",
+      ~secretAccessKey="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+      ~sessionToken=Some("FQoGZXIvYXdzEXAMPLESESSIONTOKEN=="),
+    )
+  })
+
+  testSync("no session token (short-lived / role creds without token)", () => {
+    assertParity(
+      ~host="xyz.appsync-api.us-east-1.amazonaws.com",
+      ~path="/event",
+      ~body=`{"id":"e-42","channel":"/default/Orders/o-9","events":["{\\"changeKind\\":\\"Added\\"}"]}`,
+      ~region="us-east-1",
+      ~isoNow="2026-01-02T00:00:00.000Z",
+      ~accessKeyId="AKIAEXAMPLE2",
+      ~secretAccessKey="anotherSecretKeyValue1234567890abcdef",
+      ~sessionToken=None,
+    )
+  })
+
+  testSync("different region + midnight-adjacent timestamp", () => {
+    assertParity(
+      ~host="host.appsync-api.ap-southeast-2.amazonaws.com",
+      ~path="/event",
+      ~body="{}",
+      ~region="ap-southeast-2",
+      ~isoNow="2026-12-31T23:59:59.999Z",
+      ~accessKeyId="AKIA3",
+      ~secretAccessKey="k3",
+      ~sessionToken=Some("tok3"),
+    )
+  })
+})

package/tests/AppSyncEventsSigner_OpsTest.res.mjs

@@ -0,0 +1,44 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as AppSyncEventsSigner_Ops$ReventlessAws from "../src/adapter/Api/AppSyncEventsSigner_Ops.res.mjs";
+import * as AppSyncEventsSigner_ParityFixtureMjs from "./AppSyncEventsSigner_ParityFixture.mjs";
+
+function signedHeadersJs(prim0, prim1, prim2, prim3, prim4, prim5) {
+  return AppSyncEventsSigner_ParityFixtureMjs.signedHeadersJs(prim0, prim1, prim2, prim3, prim4, prim5);
+}
+
+function get(d, k) {
+  return Stdlib_Option.getOr(d[k], "<missing>");
+}
+
+function assertParity(host, path, body, region, isoNow, accessKeyId, secretAccessKey, sessionToken) {
+  let creds = {
+    accessKeyId: accessKeyId,
+    secretAccessKey: secretAccessKey,
+    sessionToken: sessionToken
+  };
+  let mine = AppSyncEventsSigner_Ops$ReventlessAws.signedHeaders(host, path, body, region, isoNow, creds);
+  let jsCreds = {
+    accessKeyId: accessKeyId,
+    secretAccessKey: secretAccessKey,
+    sessionToken: sessionToken
+  };
+  let ref = signedHeadersJs(host, path, body, region, isoNow, jsCreds);
+  globalThis.expect(get(mine, "Authorization")).toBe(get(ref, "Authorization"));
+  globalThis.expect(get(mine, "x-amz-date")).toBe(get(ref, "x-amz-date"));
+  globalThis.expect(get(mine, "host")).toBe(get(ref, "host"));
+}
+
+globalThis.describe("AppSyncEventsSigner_Ops.signedHeaders parity with the original JS", () => {
+  globalThis.test("session-token present", () => assertParity("abc123.appsync-api.eu-west-1.amazonaws.com", "/event", `{"id":"m-1","channel":"/default/Catalog","events":["{\\"position\\":\\"1\\"}"]}`, "eu-west-1", "2026-07-27T13:45:07.123Z", "ASIAEXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "FQoGZXIvYXdzEXAMPLESESSIONTOKEN=="));
+  globalThis.test("no session token (short-lived / role creds without token)", () => assertParity("xyz.appsync-api.us-east-1.amazonaws.com", "/event", `{"id":"e-42","channel":"/default/Orders/o-9","events":["{\\"changeKind\\":\\"Added\\"}"]}`, "us-east-1", "2026-01-02T00:00:00.000Z", "AKIAEXAMPLE2", "anotherSecretKeyValue1234567890abcdef", undefined));
+  globalThis.test("different region + midnight-adjacent timestamp", () => assertParity("host.appsync-api.ap-southeast-2.amazonaws.com", "/event", "{}", "ap-southeast-2", "2026-12-31T23:59:59.999Z", "AKIA3", "k3", "tok3"));
+});
+
+export {
+  signedHeadersJs,
+  get,
+  assertParity,
+}
+/*  Not a pure module */

package/tests/AppSyncEventsSigner_ParityFixture.mjs

@@ -0,0 +1,36 @@
+// Golden reference for the AppSync Events SigV4 signer parity test.
+//
+// This is the EXACT hand-rolled `signedHeaders` that lived in the inline JS
+// handler strings of EventLogSubscription_AppSync.res and StateTopic_AppSync.res
+// before those handlers were ported to ReScript (AppSyncEventsSigner_Ops.res).
+// Preserved verbatim except: `new Date()` becomes `new Date(isoNow)` and the
+// credentials are passed in rather than read from process.env — so the signer is
+// deterministic and comparable. AppSyncEventsSigner_OpsTest asserts the ReScript
+// port produces byte-identical output to this reference, guarding against any
+// drift in the canonical-request construction or the HMAC signing-key chain.
+
+import { createHmac, createHash } from "node:crypto";
+
+function sha256hex(data) {
+  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
+}
+function hmacBuf(key, data) {
+  return createHmac("sha256", key).update(data).digest();
+}
+
+export function signedHeadersJs(host, path, body, region, isoNow, creds) {
+  const { accessKeyId, secretAccessKey, sessionToken } = creds;
+  const now = new Date(isoNow);
+  const amzDate = now.toISOString().replace(/[:\-]|\..../g, "").slice(0, 15) + "Z";
+  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
+  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
+  const canonH = Object.entries(headers).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}:${v}\n`).join("");
+  const signH = Object.keys(headers).sort().join(";");
+  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\n");
+  const scope = `${dateStamp}/${region}/appsync/aws4_request`;
+  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\n");
+  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
+  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, region), "appsync"), "aws4_request");
+  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
+  return { ...headers, Authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signH}, Signature=${sig}` };
+}

package/tests/AutomationSliceEntryPoint_OpsTest.res

@@ -0,0 +1,165 @@
+// Guards the typed cold-start core hoisted out of AutomationSliceEntryPoint.mjs
+// — the entry point whose former shell had silently drifted from the reworked
+// callback functors (single-applied curried Make, `todoItems.contents`, wrong
+// phase1 shape) and threw on its first event:
+//   - parseHandlerConfig — incl. the new `bodyModule` + `context` fields the
+//     repaired wiring depends on.
+//   - makeAutomationJsonEventsHandler — raw envelope JSONs + context into
+//     phase 1, sync → awaited phase 2 → sync ordering.
+//   - makeOutboundJsonEventsHandler — tolerant DcbDecode of the inner `event`
+//     payload (non-consumed event types dropped silently), decoded events into
+//     phase 1.
+
+open JestGlobals
+
+let str = JSON.Encode.string
+let obj = pairs => JSON.Encode.object(Dict.fromArray(pairs))
+
+describe("AutomationSliceEntryPoint_Ops.parseHandlerConfig", () => {
+  testSync("empty raw config yields no handlers", () => {
+    expect(AutomationSliceEntryPoint_Ops.parseHandlerConfig("")->Array.length)->toBe(0)
+  })
+
+  testSync("decodes a full entry incl. bodyModule and context", () => {
+    let config = obj([
+      (
+        "handlers",
+        JSON.Encode.array([
+          obj([
+            ("specModule", str("@x/plugin/src/Order/AutomationSlice/Restock.res.mjs")),
+            ("bodyModule", str("@x/plugin/src/Order/AutomationSlice/Restock_Automation.res.mjs")),
+            ("callbackType", str("automation")),
+            ("queryDbTableName", str("RestockTodo-abc")),
+            ("dcbQueueUrl", str("https://sqs/queue.fifo")),
+            ("sourceUrn", str("arn:aws:dynamodb:eu-west-1:1:table/log/stream/x")),
+            (
+              "context",
+              obj([
+                ("environment", str("alpha")),
+                ("platformName", str("OnlineShop")),
+                ("pluginName", str("Ordering")),
+                ("sliceName", str("Restock")),
+              ]),
+            ),
+          ]),
+        ]),
+      ),
+    ])->JSON.stringify
+    let entries = AutomationSliceEntryPoint_Ops.parseHandlerConfig(config)
+    expect(entries->Array.length)->toBe(1)
+    let e = entries->Array.getUnsafe(0)
+    expect(e.bodyModule)->toBe("@x/plugin/src/Order/AutomationSlice/Restock_Automation.res.mjs")
+    expect(e.callbackType)->toBe("automation")
+    expect(e.dcbQueueUrl)->toBe("https://sqs/queue.fifo")
+    switch e.context {
+    | Some(ctx) => {
+        expect(ctx.environment)->toBe("alpha")
+        expect(ctx.platformName)->toBe("OnlineShop")
+        expect(ctx.pluginName)->toBe("Ordering")
+        expect(ctx.sliceName)->toBe("Restock")
+      }
+    | None => JsError.throwWithMessage("expected Some(context)")
+    }
+  })
+
+  testSync("a stale entry without bodyModule/context decodes with defaults", () => {
+    let config = obj([
+      (
+        "handlers",
+        JSON.Encode.array([
+          obj([
+            ("specModule", str("a.res.mjs")),
+            ("callbackType", str("outbound")),
+            ("queryDbTableName", str("t")),
+            ("dcbQueueUrl", str("u")),
+            ("sourceUrn", str("arn")),
+          ]),
+        ]),
+      ),
+    ])->JSON.stringify
+    let e = AutomationSliceEntryPoint_Ops.parseHandlerConfig(config)->Array.getUnsafe(0)
+    expect(e.bodyModule)->toBe("")
+    expect(e.context->Option.isNone)->toBe(true)
+  })
+})
+
+// Shared stubs — the pipelines only touch phase1/phase2 plus the injected
+// sync/publish, so the callback records carry empty TODO dicts.
+let noopPublish: ReventlessCore.CommandTopic.publishJsons = async _ => ()
+
+describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandler", () => {
+  test("passes raw envelope JSONs + context to phase 1; sync → phase 2 → sync", async () => {
+    let steps = []
+    let receivedJsons = ref([])
+    let receivedCtx = ref(None)
+    let callback: AutomationSliceEntryPoint_Ops.automationCallback = {
+      todoItems: Dict.make(),
+      phase1: (jsons, ctx) => {
+        receivedJsons := jsons
+        receivedCtx := Some(ctx)
+        steps->Array.push("phase1")
+      },
+      phase2: async _publish => steps->Array.push("phase2"),
+    }
+    let context: Reventless.AutomationSlice.context = {
+      environment: "test",
+      platformName: "P",
+      pluginName: "Pl",
+      sliceName: "S",
+    }
+    let handler = AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandler(
+      ~context,
+      ~callback,
+      ~publishJsons=noopPublish,
+      ~syncTodoItems=async () => steps->Array.push("sync"),
+    )
+    let envelope = obj([("meta", obj([("service", str("Order"))])), ("event", str("Placed"))])
+    await Stream.fromIterable([envelope, str("bare")])->handler->Effect.runPromise
+    // Raw JSONs — the callback unwraps envelopes itself.
+    expect(receivedJsons.contents)->toEqual([envelope, str("bare")])
+    expect(receivedCtx.contents->Option.map(c => c.Reventless.AutomationSlice.sliceName))->toEqual(
+      Some("S"),
+    )
+    expect(steps)->toEqual(["phase1", "sync", "phase2", "sync"])
+  })
+})
+
+// Consumed-event fixture for the outbound decode: one consumed variant with a
+// payload, one payload-less, decoded from a source that also emits types this
+// slice does not consume.
+@schema
+type outboundEvent =
+  | OrderPlaced({orderId: string})
+  | OrderArchived
+
+describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler", () => {
+  test("decodes inner event payloads, drops non-consumed types silently", async () => {
+    let steps = []
+    let received = ref([])
+    let callback: AutomationSliceEntryPoint_Ops.outboundCallback<outboundEvent> = {
+      todoItems: Dict.make(),
+      phase1: events => {
+        received := events
+        steps->Array.push("phase1")
+      },
+      phase2: async _publish => steps->Array.push("phase2"),
+    }
+    let handler = AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler(
+      ~consumedEventSchema=outboundEventSchema,
+      ~callback,
+      ~publishJsons=noopPublish,
+      ~syncTodoItems=async () => steps->Array.push("sync"),
+    )
+    let placed = obj([
+      ("meta", obj([("service", str("Order"))])),
+      ("event", obj([("TAG", str("OrderPlaced")), ("orderId", str("ord-1"))])),
+    ])
+    // Not consumed by this slice — dropped without an error.
+    let ignored = obj([("event", obj([("TAG", str("OrderShipped")), ("orderId", str("ord-1"))]))])
+    // Bare payload-less variant, no envelope.
+    let archived = str("OrderArchived")
+    await Stream.fromIterable([placed, ignored, archived])->handler->Effect.runPromise
+    expect(received.contents)->toEqual([OrderPlaced({orderId: "ord-1"}), OrderArchived])
+    expect(steps)->toEqual(["phase1", "sync", "phase2", "sync"])
+  })
+})