@reventlessdev/reventless-aws 3.0.0-alpha.288 → 3.0.0-alpha.291

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -1,12 +1,18 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S from "sury/src/S.res.mjs";
 import * as Nodefs from "node:fs";
 import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
+import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
 import * as Platform_AdminScan_Ops$ReventlessAws from "./Platform_AdminScan_Ops.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 function str(item, key) {
   return Stdlib_Option.flatMap(item[key], Stdlib_JSON.Decode.string);
@@ -224,16 +230,118 @@ function isComplete(event) {
   return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => o["complete"]), Stdlib_JSON.Decode.bool), false);
 }
 
+function structureOf(item, param) {
+  let match = str(item, "name");
+  let match$1 = Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object);
+  if (match === undefined) {
+    return;
+  }
+  if (match$1 === undefined) {
+    return;
+  }
+  let healed = healStructure(match$1);
+  let decoded;
+  try {
+    decoded = S.parseJsonOrThrow(healed, Plugin$Reventless.pluginStructureSchema);
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage(`baked manifest: the structure persisted for "` + match + `" cannot be decoded — it was written by a framework version this platform can no longer read. Redeploy that plugin, or drop it from the include-list.`);
+  }
+  return [
+    match,
+    decoded
+  ];
+}
+
+function bakeSelection(json) {
+  let strings = (o, key) => Stdlib_Option.map(Stdlib_Option.flatMap(o[key], Stdlib_JSON.Decode.array), a => Stdlib_Array.filterMap(a, Stdlib_JSON.Decode.string));
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => Stdlib_Option.map(Stdlib_Option.flatMap(o["plugin"], Stdlib_JSON.Decode.string), plugin => ({
+    plugin: plugin,
+    views: strings(o, "views"),
+    commands: strings(o, "commands")
+  })));
+}
+
+function bakeSelections() {
+  let raw = process.env["BAKE_SELECTIONS"];
+  if (raw === undefined) {
+    return [];
+  }
+  if (raw === "") {
+    return [];
+  }
+  let entries;
+  try {
+    entries = Stdlib_JSON.Decode.array(JSON.parse(raw));
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+  }
+  if (entries !== undefined) {
+    return Stdlib_Array.filterMap(entries, bakeSelection);
+  } else {
+    return [];
+  }
+}
+
+function bakeTargetOf(event) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => {
+    let match = Stdlib_Option.flatMap(o["bake"], Stdlib_JSON.Decode.bool);
+    let match$1 = Stdlib_Option.flatMap(o["bucket"], Stdlib_JSON.Decode.string);
+    if (match !== undefined && match && match$1 !== undefined) {
+      return {
+        bucket: match$1,
+        key: Stdlib_Option.getOr(Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string), Platform_BakedManifest$ReventlessCore.defaultKey)
+      };
+    }
+  });
+}
+
+async function runBake(target, structures) {
+  let selections = bakeSelections();
+  if (selections.length === 0) {
+    Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, so there is nothing to write and a shell pointed at the file would find none.");
+  }
+  let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
+  if (e.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
+  }
+  let body = JSON.stringify(e._0, undefined, 2);
+  await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
+    Bucket: target.bucket,
+    Key: target.key,
+    Body: body,
+    ContentType: "application/json"
+  }));
+  return [Object.fromEntries([
+      [
+        "baked",
+        true
+      ],
+      [
+        "bucket",
+        target.bucket
+      ],
+      [
+        "key",
+        target.key
+      ],
+      [
+        "plugins",
+        selections.length
+      ],
+      [
+        "bytes",
+        body.length
+      ]
+    ])];
+}
+
 async function handler(event) {
   let complete = isComplete(event);
+  let bakeTarget = bakeTargetOf(event);
   let toEntry = (item, name) => toEntryWith(!complete, item, name);
   let admin = Stdlib_Option.mapOr(adminEntry, [], e => [e]);
   let table = process.env["PLUGIN_RM_TABLE"];
-  if (table !== undefined) {
-    if (table === "") {
-      console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
-      return admin;
-    }
+  if (table !== undefined && table !== "") {
     let rawItems = await Platform_AdminScan_Ops$ReventlessAws.scanAll(table, "contains(#status, :connected)", Object.fromEntries([[
         "#status",
         "status"
@@ -244,11 +352,19 @@ async function handler(event) {
     let bucket = Stdlib_Option.getOr(process.env["OFFLOAD_BUCKET"], "");
     let fetch = Offload$Reventless.cachedFetch(key => S3$AwsSdk.GetObjectCommand.getString(bucket, key));
     let items = await Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
+    if (bakeTarget !== undefined) {
+      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), structureOf);
+      return await runBake(bakeTarget, structures);
+    }
     let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), toEntry);
     return admin.concat(userEntries);
   }
   console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
-  return admin;
+  if (bakeTarget !== undefined) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: PLUGIN_RM_TABLE env var not set — the bake would write an empty shop rather than fail.");
+  } else {
+    return admin;
+  }
 }
 
 export {
@@ -266,6 +382,11 @@ export {
   adminEntry,
   resolveStructure,
   isComplete,
+  structureOf,
+  bakeSelection,
+  bakeSelections,
+  bakeTargetOf,
+  runBake,
   handler,
 }
 /* adminEntry Not a pure module */

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -237,6 +237,13 @@ let makeFromCodeAsset: (
   // `Lambda.Function.make` builders apply the identical policy.
   Util_LambdaLogging.applyLogLevelDefault(variables)
 
+  // Same terms, same reason it is here rather than at each builder: the groups
+  // exempt from owner scoping are decided by the deploy program, and the runtime
+  // that stamps a command has no other way to learn them. Without it a runtime
+  // concludes nobody is elevated and stamps an operator's on-behalf write with
+  // the operator's own id.
+  Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at
   // /var/task. --import registers the resolve hook so the ESM entry point (and the

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -24,6 +24,7 @@ import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/sr
 import * as Util_DcbMetrics$ReventlessAws from "../../util/Util_DcbMetrics.res.mjs";
 import * as RuntimeExtension$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/RuntimeExtension/RuntimeExtension.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as Util_OwnerScopeEnv$ReventlessAws from "../../util/Util_OwnerScopeEnv.res.mjs";
 import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
 
 let additionalEnvVars = {};
@@ -102,6 +103,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     variables[key] = value;
   });
   Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
+  Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   if (!RuntimeExtension$ReventlessCore.isEmpty()) {

package/src/util/Util_OwnerScopeEnv.res

@@ -0,0 +1,48 @@
+// Carries the deployment's elevated groups into Lambda runtimes.
+//
+// A cloud deployment is two kinds of process and only one of them is the deploy
+// program: it bakes the owner predicate into generated resolver source, while
+// command stamping (`CommandGenerator_Callback`) and SQL-backed reads
+// (`PgQueryResolver_Lambda`) run later, in function runtimes the deploy never
+// enters. `Reventless.OwnerScope.elevatedGroups()` answers from an explicit
+// `setElevatedGroups` or from the environment, so a value stated in the deploy
+// program reaches those runtimes only if something puts it in their environment.
+//
+// Nothing did, and the two halves fail in opposite directions. A read that
+// believes nobody is elevated shows an operator too little, which is safe and
+// visible. A write that believes it stamps an operator's on-behalf order with
+// the OPERATOR's id — silently, and the row is wrong from then on. The second is
+// why this is a correctness fix rather than a parity one.
+//
+// Scoped deliberately to `RuntimeEnvironment_Lambda.makeFromCodeAsset`, which
+// every command and query runtime is built through. The bespoke builders that
+// append `Util_LambdaLogging.logLevelEntry()` for themselves — dead letters, the
+// state-topic publisher, geocoding, the two upload Lambdas, the platform UI APIs
+// — neither stamp a command nor serve an owner-scoped view, so they sit outside
+// this policy for the same reason they sit outside several others. The
+// serialized-closure `make` path is likewise outside it, and already outside the
+// logging policy.
+
+let key = "REVENTLESS_ELEVATED_GROUPS"
+
+/** The `("REVENTLESS_ELEVATED_GROUPS", "Admin,Support")` entry, or `None` when
+    the deployment named no elevated groups.
+
+    Comma-separated because that is what `OwnerScope.parseElevatedGroups` reads,
+    which trims each part and drops the empties. Absent rather than empty for the
+    empty case: the two mean the same thing there, and writing `""` would suggest
+    a deployment had answered the question when it has not. */
+let entry = (): option<(string, Pulumi.Input.t<string>)> =>
+  switch Reventless.OwnerScope.elevatedGroups() {
+  | [] => None
+  | groups => Some((key, groups->Array.join(",")->Pulumi.Input.make))
+  }
+
+/** Default the elevated groups for a Lambda when the caller has not pinned them.
+    Mutates in place and must run after the caller's own env vars are set, so
+    theirs win — the same contract as `Util_LambdaLogging.applyLogLevelDefault`,
+    which it runs beside. */
+let applyElevatedGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  if variables->Dict.get(key)->Option.isNone {
+    entry()->Option.forEach(((k, v)) => variables->Dict.set(k, v))
+  }

package/src/util/Util_OwnerScopeEnv.res.mjs

@@ -0,0 +1,31 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+
+let key = "REVENTLESS_ELEVATED_GROUPS";
+
+function entry() {
+  let groups = OwnerScope$Reventless.elevatedGroups();
+  if (groups.length !== 0) {
+    return [
+      key,
+      groups.join(",")
+    ];
+  }
+}
+
+function applyElevatedGroupsDefault(variables) {
+  if (Stdlib_Option.isNone(variables[key])) {
+    return Stdlib_Option.forEach(entry(), param => {
+      variables[param[0]] = param[1];
+    });
+  }
+}
+
+export {
+  key,
+  entry,
+  applyElevatedGroupsDefault,
+}
+/* OwnerScope-Reventless Not a pure module */

package/src/util/Util_ShellConfig.res

@@ -32,18 +32,33 @@ The config.json field set.
 
 `computed` arrives in wire order and keeps it. `viewModes` unset ⇒ no
 `viewModes` key and no per-mode key, so a deployment that wants no optional mode
-gets byte-identical output to before this input existed. `shellConfig` merges in
-last; a key it shares with one already present fails the deploy naming it,
-because silently resolving the collision either way produces an app pointed
+gets byte-identical output to before this input existed. `bakedManifest` unset ⇒
+no `manifestUrl`, and every caller keeps the admin discovery path. `shellConfig`
+merges in last; a key it shares with one already present fails the deploy naming
+it, because silently resolving the collision either way produces an app pointed
 somewhere unintended with nothing in the diff to say so.
 */
 let fields = (
   ~computed: array<(string, JSON.t)>,
   ~viewModes: option<array<Platform.viewMode>>=?,
+  ~bakedManifest: option<Platform.bakedManifest>=?,
   ~shellConfig: option<dict<JSON.t>>=?,
 ): dict<JSON.t> => {
   let out = computed->Dict.fromArray
 
+  // A declared bake is what turns the shell's non-elevated audience on: an
+  // operator keeps the admin queries, everyone else discovers from this file.
+  // Computed rather than left to `shellConfig` because the deploy is what
+  // decides where the file goes — a passthrough could point the shell at a key
+  // nothing writes, and a statically-discovered shell has no admin API behind it
+  // to notice.
+  bakedManifest->Option.forEach(bake =>
+    out->Dict.set(
+      "manifestUrl",
+      JSON.Encode.string(ReventlessCore.Platform_BakedManifest.urlForKey(bake.key)),
+    )
+  )
+
   switch viewModes {
   | Some(modes) =>
     out->Dict.set(

package/src/util/Util_ShellConfig.res.mjs

@@ -4,6 +4,7 @@ import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 function modeOptions(mode) {
   if (mode.TAG === "Map") {
@@ -28,8 +29,11 @@ function modeOptions(mode) {
   }
 }
 
-function fields(computed, viewModes, shellConfig) {
+function fields(computed, viewModes, bakedManifest, shellConfig) {
   let out = Object.fromEntries(computed);
+  Stdlib_Option.forEach(bakedManifest, bake => {
+    out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(bake.key);
+  });
   if (viewModes !== undefined) {
     out["viewModes"] = viewModes.map(Platform$ReventlessInfra.viewModeToString);
     viewModes.forEach(m => {

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -176,3 +176,67 @@ describe("toEntryWith carries Internal queryables on the filtered field", () =>
     expect(names)->toEqual([])
   })
 })
+
+// ── Bake mode ────────────────────────────────────────────────────────────────
+// The same scan, written out instead of answered with. Two inputs decide what a
+// bake does and neither is checkable at deploy time: the include-list the
+// platform put in the environment, and the target its caller supplied. Both are
+// pure, so both are assertable without a Lambda.
+
+describe("bakeTargetOf", () => {
+  let target = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeTargetOf(JSON.parseOrThrow(raw))
+
+  // The read paths must stay read paths: an AppSync resolver invokes with
+  // `{}` or `{complete: true}`, and neither may write an object.
+  testSync("a query invocation is not a bake", () => {
+    expect(target(`{}`)->Option.isNone)->toBe(true)
+    expect(target(`{"complete": true}`)->Option.isNone)->toBe(true)
+  })
+
+  // No bucket, no default. Guessing one would write the manifest somewhere
+  // nothing serves it, which reads as a bake that worked.
+  testSync("a bake without a target is not a bake", () =>
+    expect(target(`{"bake": true}`)->Option.isNone)->toBe(true)
+  )
+
+  testSync("defaults the key to the one the deploy tells the shell to fetch", () =>
+    expect(target(`{"bake": true, "bucket": "host-ui"}`)->Option.map(t => t.key))->toEqual(
+      Some("component-manifest.json"),
+    )
+  )
+
+  testSync("takes an explicit key", () =>
+    expect(
+      target(`{"bake": true, "bucket": "host-ui", "key": "storefront.json"}`)->Option.map(t => (
+        t.bucket,
+        t.key,
+      )),
+    )->toEqual(Some(("host-ui", "storefront.json")))
+  )
+})
+
+describe("bakeSelection", () => {
+  let sel = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeSelection(JSON.parseOrThrow(raw))
+
+  // Absent is not empty. `views` absent means every public component of that
+  // plugin; `views: []` means none of them, and a decoder that collapsed the two
+  // would silently bake an empty section.
+  testSync("keeps absent and empty apart", () => {
+    expect(sel(`{"plugin": "Catalog"}`)->Option.flatMap(s => s.views))->toEqual(None)
+    expect(sel(`{"plugin": "Catalog", "views": []}`)->Option.flatMap(s => s.views))->toEqual(
+      Some([]),
+    )
+  })
+
+  testSync("reads the named components", () =>
+    expect(
+      sel(`{"plugin": "Ordering", "views": ["Orders"], "commands": ["PlaceOrder"]}`)->Option.map(
+        s => (s.plugin, s.views, s.commands),
+      ),
+    )->toEqual(Some(("Ordering", Some(["Orders"]), Some(["PlaceOrder"]))))
+  )
+
+  testSync("refuses an entry naming no plugin", () =>
+    expect(sel(`{"views": ["Orders"]}`)->Option.isNone)->toBe(true)
+  )
+})

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -108,6 +108,49 @@ globalThis.describe("toEntryWith carries Internal queryables on the filtered fie
   });
 });
 
+globalThis.describe("bakeTargetOf", () => {
+  globalThis.test("a query invocation is not a bake", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{}`)))).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"complete": true}`)))).toBe(true);
+  });
+  globalThis.test("a bake without a target is not a bake", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true}`)))).toBe(true);
+  });
+  globalThis.test("defaults the key to the one the deploy tells the shell to fetch", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true, "bucket": "host-ui"}`)), t => t.key)).toEqual("component-manifest.json");
+  });
+  globalThis.test("takes an explicit key", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true, "bucket": "host-ui", "key": "storefront.json"}`)), t => [
+      t.bucket,
+      t.key
+    ])).toEqual([
+      "host-ui",
+      "storefront.json"
+    ]);
+  });
+});
+
+globalThis.describe("bakeSelection", () => {
+  globalThis.test("keeps absent and empty apart", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Catalog"}`)), s => s.views)).toEqual(undefined);
+    globalThis.expect(Stdlib_Option.flatMap(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Catalog", "views": []}`)), s => s.views)).toEqual([]);
+  });
+  globalThis.test("reads the named components", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Ordering", "views": ["Orders"], "commands": ["PlaceOrder"]}`)), s => [
+      s.plugin,
+      s.views,
+      s.commands
+    ])).toEqual([
+      "Ordering",
+      ["Orders"],
+      ["PlaceOrder"]
+    ]);
+  });
+  globalThis.test("refuses an entry naming no plugin", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"views": ["Orders"]}`)))).toBe(true);
+  });
+});
+
 export {
   entry,
   members,

package/tests/Util_OwnerScopeEnvTest.res

@@ -0,0 +1,60 @@
+open JestGlobals
+
+// Guards the carrier that tells a Lambda runtime which groups are exempt from
+// owner scoping. The deploy program bakes the read predicate itself, but
+// stamping and SQL-backed reads run in function runtimes it never enters, so
+// without this entry those runtimes conclude nobody is elevated — and an
+// operator's on-behalf write is then stamped with the operator's own id.
+//
+// The encoding is load-bearing in both directions: what is written here is read
+// back by `OwnerScope.parseElevatedGroups`, so the two are asserted together
+// rather than each against a literal.
+
+let withElevated = (groups, f) => {
+  Reventless.OwnerScope.setElevatedGroups(groups)
+  let result = f()
+  Reventless.OwnerScope.clearElevatedGroups()
+  result
+}
+
+describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
+  testSync("writes what OwnerScope reads back", () => {
+    let encoded = withElevated(["Admin", "Support"], () =>
+      switch Util_OwnerScopeEnv.entry() {
+      | Some((_, value)) => value->Obj.magic
+      | None => ""
+      }
+    )
+    // The round trip, not the spelling: a separator change on either side fails.
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual(["Admin", "Support"])
+  })
+
+  testSync("names the variable the runtime actually reads", () => {
+    expect(Util_OwnerScopeEnv.key)->toBe("REVENTLESS_ELEVATED_GROUPS")
+  })
+
+  testSync("no elevated groups means no variable, not an empty one", () => {
+    let entry = withElevated([], () => Util_OwnerScopeEnv.entry())
+    expect(entry->Option.isNone)->toBe(true)
+  })
+
+  testSync("defaults the variable when the caller pinned nothing", () => {
+    let variables = Dict.make()
+    withElevated(["Admin"], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isSome)->toBe(true)
+  })
+
+  testSync("a caller that pinned the variable wins", () => {
+    let variables = Dict.fromArray([(Util_OwnerScopeEnv.key, "Pinned"->Obj.magic)])
+    withElevated(["Admin"], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.getOr(""->Obj.magic)->Obj.magic)->toBe(
+      "Pinned",
+    )
+  })
+
+  testSync("adds nothing when the deployment named no elevated groups", () => {
+    let variables = Dict.make()
+    withElevated([], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isNone)->toBe(true)
+  })
+})

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -0,0 +1,62 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
+
+function withElevated(groups, f) {
+  OwnerScope$Reventless.setElevatedGroups(groups);
+  let result = f();
+  OwnerScope$Reventless.clearElevatedGroups();
+  return result;
+}
+
+globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
+  globalThis.test("writes what OwnerScope reads back", () => {
+    let encoded = withElevated([
+      "Admin",
+      "Support"
+    ], () => {
+      let match = Util_OwnerScopeEnv$ReventlessAws.entry();
+      if (match !== undefined) {
+        return match[1];
+      } else {
+        return "";
+      }
+    });
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([
+      "Admin",
+      "Support"
+    ]);
+  });
+  globalThis.test("names the variable the runtime actually reads", () => {
+    globalThis.expect(Util_OwnerScopeEnv$ReventlessAws.key).toBe("REVENTLESS_ELEVATED_GROUPS");
+  });
+  globalThis.test("no elevated groups means no variable, not an empty one", () => {
+    let entry = withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.entry());
+    globalThis.expect(Stdlib_Option.isNone(entry)).toBe(true);
+  });
+  globalThis.test("defaults the variable when the caller pinned nothing", () => {
+    let variables = {};
+    withElevated(["Admin"], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.isSome(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
+  });
+  globalThis.test("a caller that pinned the variable wins", () => {
+    let variables = Object.fromEntries([[
+        Util_OwnerScopeEnv$ReventlessAws.key,
+        "Pinned"
+      ]]);
+    withElevated(["Admin"], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.getOr(variables[Util_OwnerScopeEnv$ReventlessAws.key], "")).toBe("Pinned");
+  });
+  globalThis.test("adds nothing when the deployment named no elevated groups", () => {
+    let variables = {};
+    withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.isNone(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
+  });
+});
+
+export {
+  withElevated,
+}
+/*  Not a pure module */

package/tests/Util_ShellConfigTest.res

@@ -40,6 +40,47 @@ describe("Util_ShellConfig.fields — viewModes", () => {
   })
 })
 
+describe("Util_ShellConfig.fields — bakedManifest", () => {
+  let bake = (~key: option<string>=?): ReventlessInfra.Platform.bakedManifest => {
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+    key: ?key,
+  }
+
+  testSync("unset ⇒ no manifestUrl, so every caller keeps the admin path", () => {
+    let out = Util_ShellConfig.fields(~computed)
+    expect(out->Dict.get("manifestUrl")->Option.isNone)->toBe(true)
+  })
+
+  testSync("declared ⇒ the URL the deploy writes the file to", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake())
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/component-manifest.json"))
+  })
+
+  // The key and the URL are one string; a renamed bake that kept the default
+  // URL would 404 on a shell with no admin API to fall back to.
+  testSync("follows a renamed bake", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake(~key="storefront.json"))
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/storefront.json"))
+  })
+
+  testSync("a shellConfig manifestUrl fails the deploy rather than redirecting it", () => {
+    let failure = try {
+      let _ = Util_ShellConfig.fields(
+        ~computed,
+        ~bakedManifest=bake(),
+        ~shellConfig=Dict.fromArray([("manifestUrl", JSON.Encode.string("/elsewhere.json"))]),
+      )
+      None
+    } catch {
+    | Failure(message) => Some(message)
+    }
+    switch failure {
+    | Some(message) => expect(message->String.includes("manifestUrl"))->toBe(true)
+    | None => fail("a shellConfig key redirecting the computed manifest must fail the deploy")
+    }
+  })
+})
+
 describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   testSync("shell-owned keys land verbatim, under the computed ones", () => {
     let out = Util_ShellConfig.fields(