@reventlessdev/reventless-aws 3.0.0-alpha.219 → 3.0.0-alpha.221

package/src/util/Util_CognitoGroupUser.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 
 function addUserGroup(name, userPoolId) {
@@ -21,7 +22,8 @@ function makeAddRemoveUserToGroupPolicy(name, userPoolArn, opts) {
           "cognito-idp:AdminRemoveUserFromGroup"
         ],
         Resource: userPoolArn
-      }]))
+      }])),
+    tags: AWS_Tags$ReventlessAws.make(name + "AddRemoveUserToGroup", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined)
   }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined));
 }
 

package/src/util/Util_DeadLetterQueue.res

@@ -26,6 +26,12 @@ let opts = {Pulumi.CustomResourceOptions.parent: queue->PulumiAws.SQS.Queue.toRe
 let lambdaRole = IAM.Role.makeWithDefaultPolicy(
   ~name,
   ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+  ~tags=AWS.Tags.make(
+    ~name,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=Identity,
+    ~scope=Plugin,
+  ),
   ~opts,
 )
 
@@ -58,7 +64,7 @@ let handler = Lambda.Function.make(
     memorySize: 128->Pulumi.Input.make,
     timeout: 30->Pulumi.Input.make,
     layers,
-    tags: AWS.Tags.make(~name, ReventlessCore.CommandTopic.componentType),
+    tags: AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Plugin, ~role=DeadLetter, ~scope=Plugin),
     environment: (
       {
         Lambda.Function.variables: Dict.fromArray([
@@ -77,7 +83,7 @@ ReventlessCore.Monitoring.notify(
   ~name,
   ~component=Util_Lambda.functionToResource(
     handler,
-    ~tags=AWS.Tags.make(~name, ReventlessCore.CommandTopic.componentType)->Pulumi.Output.fromInput,
+    ~tags=AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Plugin, ~role=DeadLetter, ~scope=Plugin)->Pulumi.Output.fromInput,
   ),
 )
 

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -11,7 +11,6 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Monitoring$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Monitoring/Monitoring.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "./Util_Lambda.res.mjs";
-import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "./Util_EventSourceMapping.res.mjs";
 
 let name = "DeadLetterQueue";
@@ -36,7 +35,7 @@ let opts = {
   parent: opts_parent
 };
 
-let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), opts);
+let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Plugin", "Identity", "Plugin", undefined, undefined, undefined, undefined), opts);
 
 let entryPointCode = `export const handler = async (event) => {
   console.error("DEAD LETTER ITEM:", JSON.stringify(event));
@@ -60,7 +59,7 @@ let handler = new (Aws.lambda.Function)(name, {
   memorySize: 128,
   timeout: 30,
   layers: layers,
-  tags: AWS_Tags$ReventlessAws.make(name, CommandTopic$ReventlessCore.componentType),
+  tags: AWS_Tags$ReventlessAws.make(name, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined),
   environment: {
     variables: Object.fromEntries([[
         "Environment",
@@ -70,7 +69,7 @@ let handler = new (Aws.lambda.Function)(name, {
   sourceCodeHash: sourceCodeHash
 }, opts);
 
-Monitoring$ReventlessCore.notify("DeadLetterSink", name, Util_Lambda$ReventlessAws.functionToResource(AWS_Tags$ReventlessAws.make(name, CommandTopic$ReventlessCore.componentType), handler));
+Monitoring$ReventlessCore.notify("DeadLetterSink", name, Util_Lambda$ReventlessAws.functionToResource(AWS_Tags$ReventlessAws.make(name, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined), handler));
 
 let lambda = Pulumi.output(handler);
 

package/src/util/Util_LogAttribution.res

@@ -0,0 +1,31 @@
+// Deploy-time log attribution baked into HANDLER_CONFIG.
+//
+// The deployed entry points annotate each invocation with `comp` and `plugin`
+// (HandlerFactoryHelpers.runEffect). `comp` a shell can usually derive itself
+// from the spec name it loads; `plugin` it cannot — resolution goes through
+// LogPrefix's component→plugin registry, which `Plugin_Builder.construct`
+// populates at **deploy** time and which is empty inside a Lambda. And the
+// Lambda-name fallback (`derivePluginFromLambdaName`) only works for Lambdas
+// named `<Plugin>Plugin<Suffix>`: it yields nothing for a shared multi-plugin
+// Lambda (`AllAggregatesCmdHandler`, `AllReadModels`) or a per-component one
+// (`<Aggregate>Aggr`) — exactly the cases where the field matters most.
+//
+// So resolve it here, where the registry exists, and ship it in the config.
+// See docs/plans/entrypoint-dispatch-parity-and-latency-fields.md.
+
+/** `,"plugin":"<Name>"` for a HANDLER_CONFIG entry, or `""` when the comp
+    resolves to no plugin (the shell then falls back to the Lambda name). */
+let pluginFragment = (~comp: string): string =>
+  switch ReventlessCore.Logger.resolvePlugin(~comp, ()) {
+  | Some(plugin) => `,"plugin":${plugin->JSON.Encode.string->JSON.stringify}`
+  | None => ""
+  }
+
+/** `,"comp":"<Kind(Name)>"` for a HANDLER_CONFIG entry. For the shells that
+    cannot name the element themselves — a read model or side-effect handler is
+    known to its shell only by module path, while the aggregate/slice shells read
+    the name off the spec they load. */
+let compFragment = (~comp: string): string => `,"comp":${comp->JSON.Encode.string->JSON.stringify}`
+
+/** Both fragments, in the order the entry points expect. */
+let fragments = (~comp: string): string => compFragment(~comp) ++ pluginFragment(~comp)

package/src/util/Util_LogAttribution.res.mjs

@@ -0,0 +1,27 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+
+function pluginFragment(comp) {
+  let plugin = Logger$ReventlessCore.resolvePlugin(comp, undefined);
+  if (plugin !== undefined) {
+    return `,"plugin":` + JSON.stringify(plugin);
+  } else {
+    return "";
+  }
+}
+
+function compFragment(comp) {
+  return `,"comp":` + JSON.stringify(comp);
+}
+
+function fragments(comp) {
+  return compFragment(comp) + pluginFragment(comp);
+}
+
+export {
+  pluginFragment,
+  compFragment,
+  fragments,
+}
+/* Logger-ReventlessCore Not a pure module */

package/tests/AWS_TagsTest.res

@@ -0,0 +1,236 @@
+open JestGlobals
+
+// Guards the resource-attribution tag schema. A downstream inventory answers
+// "which model component owns this resource, in what role, at what scope" purely
+// from these keys, so the key set and its namespacing are load-bearing.
+// See docs/plans/resource-attribution-tag-schema.md.
+
+module Attribution = ReventlessCore.ResourceAttribution
+
+// Pulumi.Input.make is %identity, so the tags value is the underlying dict.
+external toDict: Pulumi.Input.t<dict<string>> => dict<string> = "%identity"
+
+let tagsFor = (
+  ~name,
+  ~kind,
+  ~role,
+  ~scope: Attribution.Scope.t=Component,
+  ~component=?,
+  ~plugin=?,
+  ~platform=?,
+) =>
+  AWS_Tags.make(~name, ~kind, ~role, ~scope, ~component?, ~plugin?, ~platform?)->toDict
+
+describe("AWS_Tags — key set", () => {
+  testSync("emits every reventless: fact exactly once, plus the bare Name", () => {
+    let keys =
+      tagsFor(
+        ~name="ProductsQueryDb",
+        ~kind=ReventlessCore.ComponentType.ReadModel,
+        ~role=QueryDb,
+        ~plugin="Catalog",
+        ~platform="online-shop",
+      )
+      ->Dict.keysToArray
+      ->Array.toSorted(String.compare)
+    expect(keys)->toEqual([
+      "Name",
+      "reventless:component",
+      "reventless:environment",
+      "reventless:kind",
+      "reventless:platform",
+      "reventless:plugin",
+      "reventless:role",
+      "reventless:scope",
+    ])
+  })
+
+  testSync("the dropped bare duplicates stay dropped", () => {
+    // `Type` and `Plugin` were exact duplicates of reventless:kind / :plugin, and
+    // `Environment` was a framework fact wearing an un-namespaced name. One
+    // authoritative name per fact — `Name` is the sole bare key, because the AWS
+    // console reads that literal spelling for its resource-name column.
+    let tags = tagsFor(~name="Products", ~kind=ReventlessCore.ComponentType.ReadModel, ~role=QueryDb)
+    expect(tags->Dict.get("Type"))->toEqual(None)
+    expect(tags->Dict.get("Plugin"))->toEqual(None)
+    expect(tags->Dict.get("Environment"))->toEqual(None)
+    expect(tags->Dict.get("Name"))->toEqual(Some("Products"))
+  })
+})
+
+describe("AWS_Tags — role and kind are independent facts", () => {
+  testSync("one component kind spans several piece roles", () => {
+    let kind = ReventlessCore.ComponentType.Aggregate
+    let eventLog = tagsFor(~name="OrderEventLog", ~kind, ~role=EventLog)
+    let commandTopic = tagsFor(~name="OrderCmdTopic", ~kind, ~role=CommandTopic)
+    expect(eventLog->Dict.get("reventless:kind"))->toEqual(Some("Aggregate"))
+    expect(commandTopic->Dict.get("reventless:kind"))->toEqual(Some("Aggregate"))
+    expect(eventLog->Dict.get("reventless:role"))->toEqual(Some("EventLog"))
+    expect(commandTopic->Dict.get("reventless:role"))->toEqual(Some("CommandTopic"))
+  })
+
+  testSync("one piece role spans several component kinds — the Lambda mis-tag", () => {
+    // Regression guard for the defect this schema exists to fix: every runtime
+    // Lambda used to report kind=role=CommandTopic regardless of what it ran.
+    let aggregate = tagsFor(
+      ~name="AllAggregatesCmdHandler",
+      ~kind=ReventlessCore.ComponentType.Aggregate,
+      ~role=Runtime,
+    )
+    let projection = tagsFor(
+      ~name="ProductsProjection",
+      ~kind=ReventlessCore.ComponentType.StateViewSlice,
+      ~role=Runtime,
+    )
+    expect(aggregate->Dict.get("reventless:role"))->toEqual(Some("Runtime"))
+    expect(projection->Dict.get("reventless:role"))->toEqual(Some("Runtime"))
+    expect(aggregate->Dict.get("reventless:kind"))->toEqual(Some("Aggregate"))
+    expect(projection->Dict.get("reventless:kind"))->toEqual(Some("StateViewSlice"))
+    // …and neither reports the old hardcoded lie.
+    expect(aggregate->Dict.get("reventless:kind") == Some("CommandTopic"))->toBe(false)
+  })
+})
+
+describe("AWS_Tags — owner overrides the piece adapter's own kind", () => {
+  // The piece adapters pass their OWN ComponentType as ~kind, which names the
+  // piece and so collapses onto ~role. A QueryDb is instantiated by six different
+  // component kinds, so without the owner a reader cannot tell a ReadModel's
+  // table from a StateViewSlice's. See docs/plans/resource-attribution-owner-kind.md.
+  let queryDbTagsFor = (~owner=?) =>
+    AWS_Tags.make(
+      ~name="ProductsQueryDb",
+      ~kind=ReventlessCore.ComponentType.QueryDb,
+      ~role=QueryDb,
+      ~owner?,
+    )->toDict
+
+  testSync("without an owner, kind still names the piece", () => {
+    let tags = queryDbTagsFor()
+    expect(tags->Dict.get("reventless:kind"))->toEqual(Some("QueryDB"))
+    expect(tags->Dict.get("reventless:role"))->toEqual(Some("QueryDb"))
+  })
+
+  testSync("two QueryDb tables under different owners differ in kind", () => {
+    let readModel = queryDbTagsFor(
+      ~owner={kind: ReventlessCore.ComponentType.ReadModel, name: "Products"},
+    )
+    let stateView = queryDbTagsFor(
+      ~owner={kind: ReventlessCore.ComponentType.StateViewSlice, name: "ProductAvailability"},
+    )
+    expect(readModel->Dict.get("reventless:kind"))->toEqual(Some("ReadModel"))
+    expect(stateView->Dict.get("reventless:kind"))->toEqual(Some("StateViewSlice"))
+    // …while both still report the same piece role.
+    expect(readModel->Dict.get("reventless:role"))->toEqual(Some("QueryDb"))
+    expect(stateView->Dict.get("reventless:role"))->toEqual(Some("QueryDb"))
+  })
+
+  testSync("the owner also supplies the component stem, not the resource name", () => {
+    let tags = queryDbTagsFor(
+      ~owner={kind: ReventlessCore.ComponentType.ReadModel, name: "Products"},
+    )
+    expect(tags->Dict.get("Name"))->toEqual(Some("ProductsQueryDb"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some("Products"))
+  })
+
+  testSync("a Plugin-kinded owner attributes substrate to the plugin", () => {
+    // A plugin IS a model element, so shared substrate is owned by it rather than
+    // by nothing. The owner implies plugin scope even though the piece adapter
+    // passed no ~scope, and it names the plugin.
+    let tags =
+      AWS_Tags.make(
+        ~name="OrderingDcbEventTopic",
+        ~kind=ReventlessCore.ComponentType.EventTopic,
+        ~role=EventTopic,
+        ~owner={kind: ReventlessCore.ComponentType.Plugin, name: "Ordering"},
+      )->toDict
+    expect(tags->Dict.get("reventless:kind"))->toEqual(Some("Plugin"))
+    expect(tags->Dict.get("reventless:scope"))->toEqual(Some("plugin"))
+    expect(tags->Dict.get("reventless:plugin"))->toEqual(Some("Ordering"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some(""))
+    // …and the piece it plays is still legible.
+    expect(tags->Dict.get("reventless:role"))->toEqual(Some("EventTopic"))
+  })
+
+  testSync("an owner does not leak a component onto plugin substrate", () => {
+    let tags =
+      AWS_Tags.make(
+        ~name="OrderingDcbEventLog",
+        ~kind=ReventlessCore.ComponentType.DcbEventLog,
+        ~role=DcbEventLog,
+        ~scope=Plugin,
+        ~owner={kind: ReventlessCore.ComponentType.Aggregate, name: "Order"},
+      )->toDict
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some(""))
+  })
+})
+
+describe("AWS_Tags — scope", () => {
+  testSync("component scope names the component, defaulting to the resource name", () => {
+    let tags = tagsFor(~name="Products", ~kind=ReventlessCore.ComponentType.ReadModel, ~role=QueryDb)
+    expect(tags->Dict.get("reventless:scope"))->toEqual(Some("component"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some("Products"))
+  })
+
+  testSync("an explicit component stem survives a suffixed resource name", () => {
+    let tags = tagsFor(
+      ~name="ProductsStateTopic",
+      ~kind=ReventlessCore.ComponentType.ReadModel,
+      ~role=StateTopic,
+      ~component="Products",
+    )
+    expect(tags->Dict.get("Name"))->toEqual(Some("ProductsStateTopic"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some("Products"))
+  })
+
+  testSync("plugin substrate carries no component, but keeps its plugin", () => {
+    let tags = tagsFor(
+      ~name="OrderingDcbEventLog",
+      ~kind=ReventlessCore.ComponentType.DcbEventLog,
+      ~role=DcbEventLog,
+      ~scope=Plugin,
+      ~plugin="Ordering",
+    )
+    expect(tags->Dict.get("reventless:scope"))->toEqual(Some("plugin"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some(""))
+    expect(tags->Dict.get("reventless:plugin"))->toEqual(Some("Ordering"))
+  })
+
+  testSync("platform substrate carries neither component nor plugin", () => {
+    let tags = tagsFor(
+      ~name="UIFragmentsLambda",
+      ~kind=ReventlessCore.ComponentType.ReadModel,
+      ~role=Runtime,
+      ~scope=Platform,
+      ~plugin="Ordering",
+      ~platform="online-shop",
+    )
+    expect(tags->Dict.get("reventless:scope"))->toEqual(Some("platform"))
+    expect(tags->Dict.get("reventless:component"))->toEqual(Some(""))
+    expect(tags->Dict.get("reventless:plugin"))->toEqual(Some(""))
+    expect(tags->Dict.get("reventless:platform"))->toEqual(Some("online-shop"))
+  })
+})
+
+describe("AWS_Tags — plugin attribution", () => {
+  testSync("falls back to the ambient plugin published by Plugin_Builder", () => {
+    // Adapters sit far below the builder that knows the plugin name, so the
+    // ambient context is how a DynamoDB table learns it belongs to Ordering.
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Ordering")
+    let tags = tagsFor(~name="OrderEventLog", ~kind=ReventlessCore.ComponentType.Aggregate, ~role=EventLog)
+    Attribution.restore(previous)
+    expect(tags->Dict.get("reventless:plugin"))->toEqual(Some("Ordering"))
+    expect(tags->Dict.get("reventless:platform"))->toEqual(Some("online-shop"))
+  })
+
+  testSync("an explicit plugin beats the ambient one", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Ordering")
+    let tags = tagsFor(
+      ~name="CatalogTable",
+      ~kind=ReventlessCore.ComponentType.ReadModel,
+      ~role=QueryDb,
+      ~plugin="Catalog",
+    )
+    Attribution.restore(previous)
+    expect(tags->Dict.get("reventless:plugin"))->toEqual(Some("Catalog"))
+  })
+})

package/tests/AWS_TagsTest.res.mjs

@@ -0,0 +1,153 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as AWS_Tags$ReventlessAws from "../src/adapter/AWS_Tags.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
+
+function tagsFor(name, kind, role, scopeOpt, component, plugin, platform) {
+  let scope = scopeOpt !== undefined ? scopeOpt : "Component";
+  return AWS_Tags$ReventlessAws.make(name, kind, role, scope, component, undefined, plugin, platform);
+}
+
+globalThis.describe("AWS_Tags — key set", () => {
+  globalThis.test("emits every reventless: fact exactly once, plus the bare Name", () => {
+    let keys = Object.keys(tagsFor("ProductsQueryDb", "ReadModel", "QueryDb", undefined, undefined, "Catalog", "online-shop")).toSorted(Primitive_string.compare);
+    globalThis.expect(keys).toEqual([
+      "Name",
+      "reventless:component",
+      "reventless:environment",
+      "reventless:kind",
+      "reventless:platform",
+      "reventless:plugin",
+      "reventless:role",
+      "reventless:scope"
+    ]);
+  });
+  globalThis.test("the dropped bare duplicates stay dropped", () => {
+    let tags = tagsFor("Products", "ReadModel", "QueryDb", undefined, undefined, undefined, undefined);
+    globalThis.expect(tags["Type"]).toEqual(undefined);
+    globalThis.expect(tags["Plugin"]).toEqual(undefined);
+    globalThis.expect(tags["Environment"]).toEqual(undefined);
+    globalThis.expect(tags["Name"]).toEqual("Products");
+  });
+});
+
+globalThis.describe("AWS_Tags — role and kind are independent facts", () => {
+  globalThis.test("one component kind spans several piece roles", () => {
+    let eventLog = tagsFor("OrderEventLog", "Aggregate", "EventLog", undefined, undefined, undefined, undefined);
+    let commandTopic = tagsFor("OrderCmdTopic", "Aggregate", "CommandTopic", undefined, undefined, undefined, undefined);
+    globalThis.expect(eventLog["reventless:kind"]).toEqual("Aggregate");
+    globalThis.expect(commandTopic["reventless:kind"]).toEqual("Aggregate");
+    globalThis.expect(eventLog["reventless:role"]).toEqual("EventLog");
+    globalThis.expect(commandTopic["reventless:role"]).toEqual("CommandTopic");
+  });
+  globalThis.test("one piece role spans several component kinds — the Lambda mis-tag", () => {
+    let aggregate = tagsFor("AllAggregatesCmdHandler", "Aggregate", "Runtime", undefined, undefined, undefined, undefined);
+    let projection = tagsFor("ProductsProjection", "StateViewSlice", "Runtime", undefined, undefined, undefined, undefined);
+    globalThis.expect(aggregate["reventless:role"]).toEqual("Runtime");
+    globalThis.expect(projection["reventless:role"]).toEqual("Runtime");
+    globalThis.expect(aggregate["reventless:kind"]).toEqual("Aggregate");
+    globalThis.expect(projection["reventless:kind"]).toEqual("StateViewSlice");
+    globalThis.expect(Primitive_object.equal(aggregate["reventless:kind"], "CommandTopic")).toBe(false);
+  });
+});
+
+globalThis.describe("AWS_Tags — owner overrides the piece adapter's own kind", () => {
+  let queryDbTagsFor = owner => AWS_Tags$ReventlessAws.make("ProductsQueryDb", "QueryDb", "QueryDb", undefined, undefined, owner, undefined, undefined);
+  globalThis.test("without an owner, kind still names the piece", () => {
+    let tags = queryDbTagsFor(undefined);
+    globalThis.expect(tags["reventless:kind"]).toEqual("QueryDB");
+    globalThis.expect(tags["reventless:role"]).toEqual("QueryDb");
+  });
+  globalThis.test("two QueryDb tables under different owners differ in kind", () => {
+    let readModel = queryDbTagsFor({
+      kind: "ReadModel",
+      name: "Products"
+    });
+    let stateView = queryDbTagsFor({
+      kind: "StateViewSlice",
+      name: "ProductAvailability"
+    });
+    globalThis.expect(readModel["reventless:kind"]).toEqual("ReadModel");
+    globalThis.expect(stateView["reventless:kind"]).toEqual("StateViewSlice");
+    globalThis.expect(readModel["reventless:role"]).toEqual("QueryDb");
+    globalThis.expect(stateView["reventless:role"]).toEqual("QueryDb");
+  });
+  globalThis.test("the owner also supplies the component stem, not the resource name", () => {
+    let tags = queryDbTagsFor({
+      kind: "ReadModel",
+      name: "Products"
+    });
+    globalThis.expect(tags["Name"]).toEqual("ProductsQueryDb");
+    globalThis.expect(tags["reventless:component"]).toEqual("Products");
+  });
+  globalThis.test("a Plugin-kinded owner attributes substrate to the plugin", () => {
+    let tags = AWS_Tags$ReventlessAws.make("OrderingDcbEventTopic", "EventTopic", "EventTopic", undefined, undefined, {
+      kind: "Plugin",
+      name: "Ordering"
+    }, undefined, undefined);
+    globalThis.expect(tags["reventless:kind"]).toEqual("Plugin");
+    globalThis.expect(tags["reventless:scope"]).toEqual("plugin");
+    globalThis.expect(tags["reventless:plugin"]).toEqual("Ordering");
+    globalThis.expect(tags["reventless:component"]).toEqual("");
+    globalThis.expect(tags["reventless:role"]).toEqual("EventTopic");
+  });
+  globalThis.test("an owner does not leak a component onto plugin substrate", () => {
+    let tags = AWS_Tags$ReventlessAws.make("OrderingDcbEventLog", "DcbEventLog", "DcbEventLog", "Plugin", undefined, {
+      kind: "Aggregate",
+      name: "Order"
+    }, undefined, undefined);
+    globalThis.expect(tags["reventless:component"]).toEqual("");
+  });
+});
+
+globalThis.describe("AWS_Tags — scope", () => {
+  globalThis.test("component scope names the component, defaulting to the resource name", () => {
+    let tags = tagsFor("Products", "ReadModel", "QueryDb", undefined, undefined, undefined, undefined);
+    globalThis.expect(tags["reventless:scope"]).toEqual("component");
+    globalThis.expect(tags["reventless:component"]).toEqual("Products");
+  });
+  globalThis.test("an explicit component stem survives a suffixed resource name", () => {
+    let tags = tagsFor("ProductsStateTopic", "ReadModel", "StateTopic", undefined, "Products", undefined, undefined);
+    globalThis.expect(tags["Name"]).toEqual("ProductsStateTopic");
+    globalThis.expect(tags["reventless:component"]).toEqual("Products");
+  });
+  globalThis.test("plugin substrate carries no component, but keeps its plugin", () => {
+    let tags = tagsFor("OrderingDcbEventLog", "DcbEventLog", "DcbEventLog", "Plugin", undefined, "Ordering", undefined);
+    globalThis.expect(tags["reventless:scope"]).toEqual("plugin");
+    globalThis.expect(tags["reventless:component"]).toEqual("");
+    globalThis.expect(tags["reventless:plugin"]).toEqual("Ordering");
+  });
+  globalThis.test("platform substrate carries neither component nor plugin", () => {
+    let tags = tagsFor("UIFragmentsLambda", "ReadModel", "Runtime", "Platform", undefined, "Ordering", "online-shop");
+    globalThis.expect(tags["reventless:scope"]).toEqual("platform");
+    globalThis.expect(tags["reventless:component"]).toEqual("");
+    globalThis.expect(tags["reventless:plugin"]).toEqual("");
+    globalThis.expect(tags["reventless:platform"]).toEqual("online-shop");
+  });
+});
+
+globalThis.describe("AWS_Tags — plugin attribution", () => {
+  globalThis.test("falls back to the ambient plugin published by Plugin_Builder", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Ordering");
+    let tags = tagsFor("OrderEventLog", "Aggregate", "EventLog", undefined, undefined, undefined, undefined);
+    ResourceAttribution$ReventlessCore.restore(previous);
+    globalThis.expect(tags["reventless:plugin"]).toEqual("Ordering");
+    globalThis.expect(tags["reventless:platform"]).toEqual("online-shop");
+  });
+  globalThis.test("an explicit plugin beats the ambient one", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Ordering");
+    let tags = tagsFor("CatalogTable", "ReadModel", "QueryDb", undefined, undefined, "Catalog", undefined);
+    ResourceAttribution$ReventlessCore.restore(previous);
+    globalThis.expect(tags["reventless:plugin"]).toEqual("Catalog");
+  });
+});
+
+let Attribution;
+
+export {
+  Attribution,
+  tagsFor,
+}
+/*  Not a pure module */

package/tests/AppSync_SourceApiAssociation_RetryingTest.res

@@ -110,3 +110,29 @@ describe("AppSync_SourceApiAssociation_Retrying.idsFromComposite", () => {
     expect(Assoc.idsFromComposite("just-one-value")->Option.isNone)->toBe(true)
   })
 })
+
+// pulumi.dynamic.Resource defines a resource property per KEY of the props
+// object, so the output-only fields must be present (with an undefined value)
+// or `association.associationId` is a bare `undefined` and the merge gate
+// calls GetSourceApiAssociation without an id.
+describe("AppSync_SourceApiAssociation_Retrying.resourcePropsOf", () => {
+  let keysOf: Assoc.resourceProps => array<string> = p => Object.keysToArray(Obj.magic(p))
+  let props = Assoc.resourcePropsOf({
+    mergedApiIdentifier: Obj.magic("merged-arn"),
+    sourceApiIdentifier: Obj.magic("src123"),
+    mergeType: Obj.magic("AUTO_MERGE"),
+  })
+
+  testSync("declares arn + associationId as output-only keys", () => {
+    expect(props->keysOf->Array.includes("arn"))->toBe(true)
+    expect(props->keysOf->Array.includes("associationId"))->toBe(true)
+    expect(props.arn->Nullable.toOption->Option.isNone)->toBe(true)
+    expect(props.associationId->Nullable.toOption->Option.isNone)->toBe(true)
+  })
+
+  testSync("passes the three real inputs through", () => {
+    expect((props.mergedApiIdentifier->Obj.magic: string))->toBe("merged-arn")
+    expect((props.sourceApiIdentifier->Obj.magic: string))->toBe("src123")
+    expect((props.mergeType->Obj.magic: string))->toBe("AUTO_MERGE")
+  })
+})

package/tests/AppSync_SourceApiAssociation_RetryingTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as AppSync_SourceApiAssociation_Retrying$ReventlessAws from "../src/adapter/Api/AppSync_SourceApiAssociation_Retrying.res.mjs";
 
 function mkErr(name, message) {
@@ -124,6 +125,25 @@ globalThis.describe("AppSync_SourceApiAssociation_Retrying.idsFromComposite", ()
   });
 });
 
+globalThis.describe("AppSync_SourceApiAssociation_Retrying.resourcePropsOf", () => {
+  let props = AppSync_SourceApiAssociation_Retrying$ReventlessAws.resourcePropsOf({
+    mergedApiIdentifier: "merged-arn",
+    sourceApiIdentifier: "src123",
+    mergeType: "AUTO_MERGE"
+  });
+  globalThis.test("declares arn + associationId as output-only keys", () => {
+    globalThis.expect(Object.keys(props).includes("arn")).toBe(true);
+    globalThis.expect(Object.keys(props).includes("associationId")).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Primitive_option.fromNullable(props.arn))).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Primitive_option.fromNullable(props.associationId))).toBe(true);
+  });
+  globalThis.test("passes the three real inputs through", () => {
+    globalThis.expect(props.mergedApiIdentifier).toBe("merged-arn");
+    globalThis.expect(props.sourceApiIdentifier).toBe("src123");
+    globalThis.expect(props.mergeType).toBe("AUTO_MERGE");
+  });
+});
+
 let Assoc;
 
 export {