@reventlessdev/reventless-aws 3.0.0-alpha.290 → 3.0.0-alpha.292

package/src/util/Util_ShellConfig.res

@@ -32,18 +32,33 @@ The config.json field set.
 
 `computed` arrives in wire order and keeps it. `viewModes` unset ⇒ no
 `viewModes` key and no per-mode key, so a deployment that wants no optional mode
-gets byte-identical output to before this input existed. `shellConfig` merges in
-last; a key it shares with one already present fails the deploy naming it,
-because silently resolving the collision either way produces an app pointed
+gets byte-identical output to before this input existed. `bakedManifest` unset ⇒
+no `manifestUrl`, and every caller keeps the admin discovery path. `shellConfig`
+merges in last; a key it shares with one already present fails the deploy naming
+it, because silently resolving the collision either way produces an app pointed
 somewhere unintended with nothing in the diff to say so.
 */
 let fields = (
   ~computed: array<(string, JSON.t)>,
   ~viewModes: option<array<Platform.viewMode>>=?,
+  ~bakedManifest: option<Platform.bakedManifest>=?,
   ~shellConfig: option<dict<JSON.t>>=?,
 ): dict<JSON.t> => {
   let out = computed->Dict.fromArray
 
+  // A declared bake is what turns the shell's non-elevated audience on: an
+  // operator keeps the admin queries, everyone else discovers from this file.
+  // Computed rather than left to `shellConfig` because the deploy is what
+  // decides where the file goes — a passthrough could point the shell at a key
+  // nothing writes, and a statically-discovered shell has no admin API behind it
+  // to notice.
+  bakedManifest->Option.forEach(bake =>
+    out->Dict.set(
+      "manifestUrl",
+      JSON.Encode.string(ReventlessCore.Platform_BakedManifest.urlForKey(bake.key)),
+    )
+  )
+
   switch viewModes {
   | Some(modes) =>
     out->Dict.set(

package/src/util/Util_ShellConfig.res.mjs

@@ -4,6 +4,7 @@ import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 function modeOptions(mode) {
   if (mode.TAG === "Map") {
@@ -28,8 +29,11 @@ function modeOptions(mode) {
   }
 }
 
-function fields(computed, viewModes, shellConfig) {
+function fields(computed, viewModes, bakedManifest, shellConfig) {
   let out = Object.fromEntries(computed);
+  Stdlib_Option.forEach(bakedManifest, bake => {
+    out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(bake.key);
+  });
   if (viewModes !== undefined) {
     out["viewModes"] = viewModes.map(Platform$ReventlessInfra.viewModeToString);
     viewModes.forEach(m => {

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -176,3 +176,177 @@ describe("toEntryWith carries Internal queryables on the filtered field", () =>
     expect(names)->toEqual([])
   })
 })
+
+// ── Bake mode ────────────────────────────────────────────────────────────────
+// The same scan, written out instead of answered with. Two inputs decide what a
+// bake does and neither is checkable at deploy time: the include-list the
+// platform put in the environment, and the target its caller supplied. Both are
+// pure, so both are assertable without a Lambda.
+
+describe("bakeTargetOf", () => {
+  let target = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeTargetOf(JSON.parseOrThrow(raw))
+
+  // The read paths must stay read paths: an AppSync resolver invokes with
+  // `{}` or `{complete: true}`, and neither may write an object.
+  testSync("a query invocation is not a bake", () => {
+    expect(target(`{}`)->Option.isNone)->toBe(true)
+    expect(target(`{"complete": true}`)->Option.isNone)->toBe(true)
+  })
+
+  // No bucket, no default. Guessing one would write the manifest somewhere
+  // nothing serves it, which reads as a bake that worked.
+  testSync("a bake without a target is not a bake", () =>
+    expect(target(`{"bake": true}`)->Option.isNone)->toBe(true)
+  )
+
+  testSync("defaults the key to the one the deploy tells the shell to fetch", () =>
+    expect(target(`{"bake": true, "bucket": "host-ui"}`)->Option.map(t => t.key))->toEqual(
+      Some("component-manifest.json"),
+    )
+  )
+
+  testSync("takes an explicit key", () =>
+    expect(
+      target(`{"bake": true, "bucket": "host-ui", "key": "storefront.json"}`)->Option.map(t => (
+        t.bucket,
+        t.key,
+      )),
+    )->toEqual(Some(("host-ui", "storefront.json")))
+  )
+})
+
+describe("bakeSelection", () => {
+  let sel = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeSelection(JSON.parseOrThrow(raw))
+
+  // Absent is not empty. `views` absent means every public component of that
+  // plugin; `views: []` means none of them, and a decoder that collapsed the two
+  // would silently bake an empty section.
+  testSync("keeps absent and empty apart", () => {
+    expect(sel(`{"plugin": "Catalog"}`)->Option.flatMap(s => s.views))->toEqual(None)
+    expect(sel(`{"plugin": "Catalog", "views": []}`)->Option.flatMap(s => s.views))->toEqual(
+      Some([]),
+    )
+  })
+
+  testSync("reads the named components", () =>
+    expect(
+      sel(`{"plugin": "Ordering", "views": ["Orders"], "commands": ["PlaceOrder"]}`)->Option.map(
+        s => (s.plugin, s.views, s.commands),
+      ),
+    )->toEqual(Some(("Ordering", Some(["Orders"]), Some(["PlaceOrder"]))))
+  )
+
+  testSync("refuses an entry naming no plugin", () =>
+    expect(sel(`{"views": ["Orders"]}`)->Option.isNone)->toBe(true)
+  )
+})
+
+// The bake reads a read model the deploy updates asynchronously, so "is this the
+// deployment I was asked to bake" is a question it has to be able to answer. The
+// answer is an equality check against the key each plugin stack just wrote.
+describe("pendingRegistrations", () => {
+  let row = (~name, ~key=?, ()) => {
+    let item = Dict.fromArray([("name", JSON.Encode.string(name))])
+    key->Option.forEach(k =>
+      item->Dict.set(
+        "structure",
+        JSON.parseOrThrow(`{"$offload": {"store": "pluginStructures", "key": "${k}"}}`),
+      )
+    )
+    item
+  }
+
+  let pending = (rows, expect) =>
+    Platform_ComponentDefinitions_Lambda_Ops.pendingRegistrations(
+      rows,
+      ~expect=Dict.fromArray(expect),
+    )
+
+  testSync("nothing is pending when every row carries the key the deploy wrote", () =>
+    expect(
+      pending(
+        [row(~name="Catalog", ~key="sha256/a", ()), row(~name="Ordering", ~key="sha256/b", ())],
+        [("Catalog", "sha256/a"), ("Ordering", "sha256/b")],
+      ),
+    )->toEqual([])
+  )
+
+  // The window this exists for: the stack wrote a new structure, the row still
+  // points at the one before it.
+  testSync("names a plugin still carrying the previous structure", () =>
+    expect(
+      pending(
+        [row(~name="Catalog", ~key="sha256/a", ()), row(~name="Ordering", ~key="sha256/old", ())],
+        [("Catalog", "sha256/a"), ("Ordering", "sha256/new")],
+      ),
+    )->toEqual(["Ordering"])
+  )
+
+  // A plugin that has never registered is behind, not absent — baking without it
+  // would ship a shop missing a section.
+  testSync("names a plugin with no row at all", () =>
+    expect(pending([], [("Ordering", "sha256/new")]))->toEqual(["Ordering"])
+  )
+
+  // Deployed before the stack exported its key, or invoked by hand: bake what is
+  // current rather than wait for an expectation nobody stated.
+  testSync("waits for nothing when the caller expects nothing", () =>
+    expect(pending([row(~name="Ordering", ~key="sha256/old", ())], []))->toEqual([])
+  )
+
+  testSync("reads the expectations off the invocation payload", () =>
+    expect(
+      Platform_ComponentDefinitions_Lambda_Ops.bakeExpectations(
+        JSON.parseOrThrow(`{"bake": true, "expect": {"Ordering": "sha256/b"}}`),
+      )->Dict.get("Ordering"),
+    )->toEqual(Some("sha256/b"))
+  )
+})
+
+describe("resolveStructure", () => {
+  let item = (structure: string) =>
+    Dict.fromArray([
+      ("name", JSON.Encode.string("Ordering")),
+      ("structure", JSON.parseOrThrow(structure)),
+    ])
+
+  let offloaded = `{"$offload": {"store": "pluginStructures", "key": "sha256/abc", "bytes": 4}}`
+
+  test("substitutes the fetched bytes for the reference", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.resolve(`{"aggregates": []}`),
+      item(offloaded),
+    )
+    expect(resolved->Dict.get("structure")->Option.map(j => JSON.stringify(j)))->toEqual(
+      Some(`{"aggregates":[]}`),
+    )
+  })
+
+  // One offload bucket serves every plugin, so the S3 error names only the key —
+  // which plugin's row carries the unreadable reference is the part worth having.
+  // A missing object is the shape a deploy leaves behind while the read model
+  // still points at the previous structure.
+  test("names the plugin whose reference cannot be read", async () => {
+    let failed = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.reject(JsExn.anyToExnInternal(JsError.make("AccessDenied"))),
+      item(offloaded),
+    )
+    ->Promise.thenResolve(_ => None)
+    ->Promise.catch(e =>
+      Promise.resolve(e->JsExn.fromException->Option.flatMap(JsExn.message))
+    )
+    expect(failed)->toEqual(
+      Some("offloaded structure for plugin Ordering is unreadable at sha256/abc: AccessDenied"),
+    )
+  })
+
+  test("passes an inline structure through untouched", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.reject(JsExn.anyToExnInternal(JsError.make("must not fetch"))),
+      item(`{"aggregates": []}`),
+    )
+    expect(resolved->Dict.get("structure")->Option.map(j => JSON.stringify(j)))->toEqual(
+      Some(`{"aggregates":[]}`),
+    )
+  })
+})

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -2,7 +2,10 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws from "../src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs";
 
 function entry(filter, structure) {
@@ -108,6 +111,133 @@ globalThis.describe("toEntryWith carries Internal queryables on the filtered fie
   });
 });
 
+globalThis.describe("bakeTargetOf", () => {
+  globalThis.test("a query invocation is not a bake", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{}`)))).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"complete": true}`)))).toBe(true);
+  });
+  globalThis.test("a bake without a target is not a bake", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true}`)))).toBe(true);
+  });
+  globalThis.test("defaults the key to the one the deploy tells the shell to fetch", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true, "bucket": "host-ui"}`)), t => t.key)).toEqual("component-manifest.json");
+  });
+  globalThis.test("takes an explicit key", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeTargetOf(JSON.parse(`{"bake": true, "bucket": "host-ui", "key": "storefront.json"}`)), t => [
+      t.bucket,
+      t.key
+    ])).toEqual([
+      "host-ui",
+      "storefront.json"
+    ]);
+  });
+});
+
+globalThis.describe("bakeSelection", () => {
+  globalThis.test("keeps absent and empty apart", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Catalog"}`)), s => s.views)).toEqual(undefined);
+    globalThis.expect(Stdlib_Option.flatMap(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Catalog", "views": []}`)), s => s.views)).toEqual([]);
+  });
+  globalThis.test("reads the named components", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"plugin": "Ordering", "views": ["Orders"], "commands": ["PlaceOrder"]}`)), s => [
+      s.plugin,
+      s.views,
+      s.commands
+    ])).toEqual([
+      "Ordering",
+      ["Orders"],
+      ["PlaceOrder"]
+    ]);
+  });
+  globalThis.test("refuses an entry naming no plugin", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeSelection(JSON.parse(`{"views": ["Orders"]}`)))).toBe(true);
+  });
+});
+
+globalThis.describe("pendingRegistrations", () => {
+  let row = (name, key, param) => {
+    let item = Object.fromEntries([[
+        "name",
+        name
+      ]]);
+    Stdlib_Option.forEach(key, k => {
+      item["structure"] = JSON.parse(`{"$offload": {"store": "pluginStructures", "key": "` + k + `"}}`);
+    });
+    return item;
+  };
+  globalThis.test("nothing is pending when every row carries the key the deploy wrote", () => {
+    let rows = [
+      row("Catalog", "sha256/a", undefined),
+      row("Ordering", "sha256/b", undefined)
+    ];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([
+      [
+        "Catalog",
+        "sha256/a"
+      ],
+      [
+        "Ordering",
+        "sha256/b"
+      ]
+    ]))).toEqual([]);
+  });
+  globalThis.test("names a plugin still carrying the previous structure", () => {
+    let rows = [
+      row("Catalog", "sha256/a", undefined),
+      row("Ordering", "sha256/old", undefined)
+    ];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([
+      [
+        "Catalog",
+        "sha256/a"
+      ],
+      [
+        "Ordering",
+        "sha256/new"
+      ]
+    ]))).toEqual(["Ordering"]);
+  });
+  globalThis.test("names a plugin with no row at all", () => {
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations([], Object.fromEntries([[
+        "Ordering",
+        "sha256/new"
+      ]]))).toEqual(["Ordering"]);
+  });
+  globalThis.test("waits for nothing when the caller expects nothing", () => {
+    let rows = [row("Ordering", "sha256/old", undefined)];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([]))).toEqual([]);
+  });
+  globalThis.test("reads the expectations off the invocation payload", () => {
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeExpectations(JSON.parse(`{"bake": true, "expect": {"Ordering": "sha256/b"}}`))["Ordering"]).toEqual("sha256/b");
+  });
+});
+
+globalThis.describe("resolveStructure", () => {
+  let item = structure => Object.fromEntries([
+    [
+      "name",
+      "Ordering"
+    ],
+    [
+      "structure",
+      JSON.parse(structure)
+    ]
+  ]);
+  let offloaded = `{"$offload": {"store": "pluginStructures", "key": "sha256/abc", "bytes": 4}}`;
+  globalThis.test("substitutes the fetched bytes for the reference", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.resolve(`{"aggregates": []}`), item(offloaded));
+    globalThis.expect(Stdlib_Option.map(resolved["structure"], j => JSON.stringify(j))).toEqual(`{"aggregates":[]}`);
+  });
+  globalThis.test("names the plugin whose reference cannot be read", async () => {
+    let failed = await Stdlib_Promise.$$catch(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.reject(Primitive_exceptions.internalToException(new Error("AccessDenied"))), item(offloaded)).then(param => {}), e => Promise.resolve(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(e), Stdlib_JsExn.message)));
+    globalThis.expect(failed).toEqual("offloaded structure for plugin Ordering is unreadable at sha256/abc: AccessDenied");
+  });
+  globalThis.test("passes an inline structure through untouched", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.reject(Primitive_exceptions.internalToException(new Error("must not fetch"))), item(`{"aggregates": []}`));
+    globalThis.expect(Stdlib_Option.map(resolved["structure"], j => JSON.stringify(j))).toEqual(`{"aggregates":[]}`);
+  });
+});
+
 export {
   entry,
   members,

package/tests/Util_ShellConfigTest.res

@@ -40,6 +40,47 @@ describe("Util_ShellConfig.fields — viewModes", () => {
   })
 })
 
+describe("Util_ShellConfig.fields — bakedManifest", () => {
+  let bake = (~key: option<string>=?): ReventlessInfra.Platform.bakedManifest => {
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+    key: ?key,
+  }
+
+  testSync("unset ⇒ no manifestUrl, so every caller keeps the admin path", () => {
+    let out = Util_ShellConfig.fields(~computed)
+    expect(out->Dict.get("manifestUrl")->Option.isNone)->toBe(true)
+  })
+
+  testSync("declared ⇒ the URL the deploy writes the file to", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake())
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/component-manifest.json"))
+  })
+
+  // The key and the URL are one string; a renamed bake that kept the default
+  // URL would 404 on a shell with no admin API to fall back to.
+  testSync("follows a renamed bake", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake(~key="storefront.json"))
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/storefront.json"))
+  })
+
+  testSync("a shellConfig manifestUrl fails the deploy rather than redirecting it", () => {
+    let failure = try {
+      let _ = Util_ShellConfig.fields(
+        ~computed,
+        ~bakedManifest=bake(),
+        ~shellConfig=Dict.fromArray([("manifestUrl", JSON.Encode.string("/elsewhere.json"))]),
+      )
+      None
+    } catch {
+    | Failure(message) => Some(message)
+    }
+    switch failure {
+    | Some(message) => expect(message->String.includes("manifestUrl"))->toBe(true)
+    | None => fail("a shellConfig key redirecting the computed manifest must fail the deploy")
+    }
+  })
+})
+
 describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   testSync("shell-owned keys land verbatim, under the computed ones", () => {
     let out = Util_ShellConfig.fields(

package/tests/Util_ShellConfigTest.res.mjs

@@ -22,7 +22,7 @@ function get(out, key) {
 
 globalThis.describe("Util_ShellConfig.fields — viewModes", () => {
   globalThis.test("unset ⇒ no viewModes key and the computed set is untouched", () => {
-    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined);
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined);
     globalThis.expect(Object.keys(out)).toEqual([
       "apiEndpoint",
       "region"
@@ -33,7 +33,7 @@ globalThis.describe("Util_ShellConfig.fields — viewModes", () => {
     let out = Util_ShellConfig$ReventlessAws.fields(computed, [{
         TAG: "Map",
         _0: {}
-      }], undefined);
+      }], undefined, undefined);
     globalThis.expect(get(out, "viewModes")).toEqual(["map"]);
     globalThis.expect(Stdlib_Option.isNone(out["mapStyle"])).toBe(true);
   });
@@ -51,7 +51,7 @@ globalThis.describe("Util_ShellConfig.fields — viewModes", () => {
           layout: "dagre"
         }
       }
-    ], undefined);
+    ], undefined, undefined);
     globalThis.expect(get(out, "viewModes")).toEqual([
       "map",
       "graph"
@@ -61,9 +61,55 @@ globalThis.describe("Util_ShellConfig.fields — viewModes", () => {
   });
 });
 
+globalThis.describe("Util_ShellConfig.fields — bakedManifest", () => {
+  let bake = key => ({
+    components: [{
+        plugin: "Catalog",
+        views: ["Products"],
+        commands: []
+      }],
+    key: key
+  });
+  globalThis.test("unset ⇒ no manifestUrl, so every caller keeps the admin path", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined);
+    globalThis.expect(Stdlib_Option.isNone(out["manifestUrl"])).toBe(true);
+  });
+  globalThis.test("declared ⇒ the URL the deploy writes the file to", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, bake(undefined), undefined);
+    globalThis.expect(get(out, "manifestUrl")).toEqual("/component-manifest.json");
+  });
+  globalThis.test("follows a renamed bake", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, bake("storefront.json"), undefined);
+    globalThis.expect(get(out, "manifestUrl")).toEqual("/storefront.json");
+  });
+  globalThis.test("a shellConfig manifestUrl fails the deploy rather than redirecting it", () => {
+    let failure;
+    try {
+      Util_ShellConfig$ReventlessAws.fields(computed, undefined, bake(undefined), Object.fromEntries([[
+          "manifestUrl",
+          "/elsewhere.json"
+        ]]));
+      failure = undefined;
+    } catch (raw_message) {
+      let message = Primitive_exceptions.internalToException(raw_message);
+      if (message.RE_EXN_ID === "Failure") {
+        failure = message._1;
+      } else {
+        throw message;
+      }
+    }
+    if (failure !== undefined) {
+      globalThis.expect(failure.includes("manifestUrl")).toBe(true);
+      return;
+    } else {
+      return JestGlobals.fail("a shellConfig key redirecting the computed manifest must fail the deploy");
+    }
+  });
+});
+
 globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   globalThis.test("shell-owned keys land verbatim, under the computed ones", () => {
-    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, Object.fromEntries([
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, Object.fromEntries([
       [
         "platformName",
         "Online Shop"
@@ -84,7 +130,7 @@ globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () =>
   globalThis.test("a key the deploy computes fails the deploy, naming it", () => {
     let failure;
     try {
-      Util_ShellConfig$ReventlessAws.fields(computed, undefined, Object.fromEntries([[
+      Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, Object.fromEntries([[
           "apiEndpoint",
           "https://wrong.example/graphql"
         ]]));