@reventlessdev/reventless-aws 3.0.0-alpha.300 → 3.0.0-alpha.302

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res

@@ -50,16 +50,25 @@ token they hold no longer mentions the role they are asking for. This is the sam
 trap the local path documents on `LocalAuth.Login.reissue`, where membership is
 re-read from the user store rather than from the token's own record of it.
 
+🚨 **Addressed by username, not by `sub`.** `AdminListGroupsForUser` takes a
+`Username`, and a `sub` is only accepted there when the pool makes it one — a
+pool with `UsernameAttributes` (email or phone sign-in), where the generated
+username *is* the subject. On a plain username pool the same call answers
+`UserNotFoundException: User does not exist.`, which fails the whole mutation
+before it reaches the subset check: not "you may not act as that role" but "you
+do not exist", for a caller who is signed in and holds the role. The row is still
+keyed on `sub` — this parameter names the user to Cognito, nothing else.
+
 Paginated deliberately: `AdminListGroupsForUser` caps a page at 60 groups, and a
 truncated read would silently refuse a role the caller genuinely holds.
 */
-let membershipOf = async (~sub: string, ~poolId: string): array<string> => {
+let membershipOf = async (~username: string, ~poolId: string): array<string> => {
   let collected = []
   let nextToken = ref(None)
   let more = ref(true)
   while more.contents {
     let page = await CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.make({
-      username: sub,
+      username,
       userPoolId: poolId,
       nextToken: ?nextToken.contents,
     })->CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.send
@@ -89,13 +98,33 @@ let mayActAs = (~membership: array<string>, ~requested: string): bool =>
 
 // ── AppSync resolver event / result shapes ──────────────────────────────────
 
-type identity = {sub?: string}
+type identity = {sub?: string, username?: Nullable.t<string>}
 type activeRoleArgs = {activeRole?: Nullable.t<string>}
 type appSyncEvent = {
   arguments?: activeRoleArgs,
   identity?: identity,
 }
 
+/**
+The name to address this caller by when asking Cognito what groups they are in.
+
+The username when the authorizer supplied one, the subject otherwise. The
+fallback is not a guess at a username: it is the behaviour this handler had
+before the username was forwarded, kept for the pool shapes where it is correct —
+one whose username *is* the subject — rather than turning a working deployment
+into a hard failure on an absent field. Pure so the choice can be tested without
+a pool.
+*/
+let cognitoLookupName = (~identity: identity): option<string> =>
+  switch identity.username {
+  | Some(Value(name)) if name->String.trim != "" => Some(name)
+  | _ =>
+    switch identity.sub {
+    | Some("") | None => None
+    | Some(sub) => Some(sub)
+    }
+  }
+
 let result = (~activeRole: option<string>, ~availableRoles: array<string>): JSON.t =>
   Dict.fromArray([
     ("activeRole", activeRole->Option.mapOr(JSON.Null, JSON.Encode.string)),
@@ -111,8 +140,14 @@ let handler = async (event: appSyncEvent): JSON.t => {
     // unauthenticated path from ever writing a row keyed on the empty subject.
     JsError.throwWithMessage("unauthenticated")
   }
+  // Two names for one caller, and they are not interchangeable: `sub` keys the
+  // row, the lookup name addresses Cognito. See `membershipOf`.
+  let lookupName = switch event.identity->Option.flatMap(i => cognitoLookupName(~identity=i)) {
+  | Some(name) => name
+  | None => JsError.throwWithMessage("unauthenticated")
+  }
   let table = tableName()
-  let membership = await membershipOf(~sub, ~poolId=userPoolId())
+  let membership = await membershipOf(~username=lookupName, ~poolId=userPoolId())
 
   // An absent argument and an explicit `null` mean the same thing — clear the
   // preference and go back to full membership on the next refresh. That is not an

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs

@@ -33,13 +33,13 @@ function userPoolId() {
   }
 }
 
-async function membershipOf(sub, poolId) {
+async function membershipOf(username, poolId) {
   let collected = [];
   let nextToken;
   let more = true;
   while (more) {
     let page = await CognitoIdentityServiceProvider$AwsSdk.AdminListGroupsForUserCommand.send(new ClientCognitoIdentityProvider.AdminListGroupsForUserCommand({
-      Username: sub,
+      Username: username,
       UserPoolId: poolId,
       NextToken: nextToken
     }));
@@ -60,6 +60,22 @@ function mayActAs(membership, requested) {
   return membership.includes(requested);
 }
 
+function cognitoLookupName(identity) {
+  let match = identity.username;
+  if (match !== undefined) {
+    let name = Primitive_option.valFromOption(match);
+    if (name == null) {
+      name === null;
+    } else if (name.trim() !== "") {
+      return name;
+    }
+  }
+  let sub = identity.sub;
+  if (sub !== undefined && sub !== "") {
+    return sub;
+  }
+}
+
 function result(activeRole, availableRoles) {
   return Object.fromEntries([
     [
@@ -78,8 +94,10 @@ async function handler(event) {
   if (sub === "") {
     Stdlib_JsError.throwWithMessage("unauthenticated");
   }
+  let name = Stdlib_Option.flatMap(event.identity, cognitoLookupName);
+  let lookupName = name !== undefined ? name : Stdlib_JsError.throwWithMessage("unauthenticated");
   let table = tableName();
-  let membership = await membershipOf(sub, userPoolId());
+  let membership = await membershipOf(lookupName, userPoolId());
   let match = Stdlib_Option.flatMap(event.arguments, a => a.activeRole);
   let requested;
   if (match !== undefined) {
@@ -122,6 +140,7 @@ export {
   userPoolId,
   membershipOf,
   mayActAs,
+  cognitoLookupName,
   result,
   handler,
 }

package/src/util/Util_DynamoDbStream.res

@@ -1,13 +1,17 @@
 let toResourceInfo = (table: PulumiAws.DynamoDb.Table.t) =>
   table.streamArn->Pulumi.Output.apply(streamArn => ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn}))
 
+// The table name rides IN the apply rather than being read with `Output.get` on
+// the failure arm: `get` throws "Cannot call '.get' during update or preview" on
+// every deploy, so the arm meant to name the offending table replaced its own
+// message with that one and hid which resource was missing a stream.
 let streamArnFromDynamoDbTableResource = (resource: ReventlessInfra.Adapter.resource) =>
-  resource.resourceInfo->Pulumi.Output.apply(resourceInfo =>
+  (resource.resourceInfo, resource.name)
+  ->Pulumi.Output.all2
+  ->Pulumi.Output.apply(((resourceInfo, tableName)) =>
     switch resourceInfo {
     | StreamSource({sourceUrn}) => sourceUrn
-    | _ =>
-      let tableName = resource.name->Pulumi.Output.get
-      JsError.throwWithMessage("No streamArn field given for table " ++ tableName)
+    | _ => JsError.throwWithMessage("No streamArn field given for table " ++ tableName)
     }
   )
 
@@ -30,6 +34,13 @@ let toStreamResource = (table: ReventlessInfra.Adapter.resource): ReventlessInfr
     ~id=streamArn,
     ~urn=streamArn,
     ~service=table.name->Pulumi.Output.apply(_ => AWS.DynamoDbStream.service),
+    // Carries the same StreamSource the table resource carries, so asking a
+    // stream resource for its ARN answers instead of throwing. The event-topic
+    // resources a publisher exports are these, and `Upload_Claim_S3` asks
+    // exactly that of resources[0].
+    ~resourceInfo=streamArn->Pulumi.Output.apply(sourceUrn => ReventlessInfra.Adapter.StreamSource({
+      sourceUrn: sourceUrn,
+    })),
     ~resourceType="aws:dynamodb:Stream"->Pulumi.Output.make,
   )
 }

package/src/util/Util_DynamoDbStream.res.mjs

@@ -22,12 +22,19 @@ function toResourceInfo(table) {
 }
 
 function streamArnFromDynamoDbTableResource(resource) {
-  return resource.resourceInfo.apply(resourceInfo => {
-    if (typeof resourceInfo === "object" && resourceInfo.TAG === "StreamSource") {
+  return Pulumi.all([
+    resource.resourceInfo,
+    resource.name
+  ]).apply(param => {
+    let tableName = param[1];
+    let resourceInfo = param[0];
+    if (typeof resourceInfo !== "object") {
+      return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
+    } else if (resourceInfo.TAG === "StreamSource") {
       return resourceInfo.sourceUrn;
+    } else {
+      return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
     }
-    let tableName = resource.name.get();
-    return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
   });
 }
 
@@ -37,7 +44,10 @@ function toResource(tags, table) {
 
 function toStreamResource(table) {
   let streamArn = streamArnFromDynamoDbTableResource(table);
-  return Adapter$ReventlessInfra.make(table.name, streamArn, streamArn, table.name.apply(param => AWS$ReventlessAws.DynamoDbStream.service), undefined, undefined, undefined, Pulumi.output("aws:dynamodb:Stream"), undefined, undefined);
+  return Adapter$ReventlessInfra.make(table.name, streamArn, streamArn, table.name.apply(param => AWS$ReventlessAws.DynamoDbStream.service), streamArn.apply(sourceUrn => ({
+    TAG: "StreamSource",
+    sourceUrn: sourceUrn
+  })), undefined, undefined, Pulumi.output("aws:dynamodb:Stream"), undefined, undefined);
 }
 
 let log = Logger$ReventlessCore.fromEnv();

package/src/util/Util_ShellConfig.res

@@ -9,6 +9,10 @@
 
 module Platform = ReventlessInfra.Platform
 
+// Where a caller acting as a given role discovers from — a group→url map. Named
+// here as the shell reads it, the same way `manifestUrl` is.
+let journeyManifestsKey = "journeyManifestUrls"
+
 // A mode's options, flattened to the wire shape. They are payloads of their arm
 // on the deploy side (so `mapStyle` with the map off cannot be expressed) and
 // flat siblings of `viewModes` on the wire (because that is where the released
@@ -52,12 +56,28 @@ let fields = (
   // decides where the file goes — a passthrough could point the shell at a key
   // nothing writes, and a statically-discovered shell has no admin API behind it
   // to notice.
-  bakedManifest->Option.forEach(bake =>
+  bakedManifest->Option.forEach(bake => {
     out->Dict.set(
       "manifestUrl",
       JSON.Encode.string(ReventlessCore.Platform_BakedManifest.urlForKey(bake.key)),
     )
-  )
+    // Where a caller acting as a given role discovers from, beside the default
+    // rather than instead of it: `manifestUrl` stays the default journey, which
+    // is what a caller matching no declared group gets. Omitted entirely when
+    // nothing is declared, so a single-audience deployment writes the key set it
+    // always did and a shell that has never heard of journeys sees no new key.
+    switch ReventlessCore.Platform_BakedManifest.journeyUrls(~config=bake) {
+    | [] => ()
+    | urls =>
+      out->Dict.set(
+        journeyManifestsKey,
+        urls
+        ->Array.map(((group, url)) => (group, JSON.Encode.string(url)))
+        ->Dict.fromArray
+        ->JSON.Encode.object,
+      )
+    }
+  })
 
   switch viewModes {
   | Some(modes) =>

package/src/util/Util_ShellConfig.res.mjs

@@ -6,6 +6,8 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
+let journeyManifestsKey = "journeyManifestUrls";
+
 function modeOptions(mode) {
   if (mode.TAG === "Map") {
     let style = mode._0.style;
@@ -33,6 +35,14 @@ function fields(computed, viewModes, bakedManifest, shellConfig) {
   let out = Object.fromEntries(computed);
   Stdlib_Option.forEach(bakedManifest, bake => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(bake.key);
+    let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(bake);
+    if (urls.length !== 0) {
+      out[journeyManifestsKey] = Object.fromEntries(urls.map(param => [
+        param[0],
+        param[1]
+      ]));
+      return;
+    }
   });
   if (viewModes !== undefined) {
     out["viewModes"] = viewModes.map(Platform$ReventlessInfra.viewModeToString);
@@ -58,6 +68,7 @@ let Platform;
 
 export {
   Platform,
+  journeyManifestsKey,
   modeOptions,
   fields,
 }

package/tests/Auth_ActiveRoleStoreTest.res

@@ -40,3 +40,35 @@ describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
     expect(Ops.mayActAs(~membership=[], ~requested="Shopper"))->toBe(false)
   )
 })
+
+// Which name goes to Cognito. `sub` keys the row and `AdminListGroupsForUser`
+// takes a username, and a pool that makes neither an alias of the other answers
+// `UserNotFoundException` when handed the wrong one — a signed-in caller holding
+// the role they asked for, told they do not exist.
+describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
+  testSync("the username is what addresses Cognito when the authorizer sent one", () =>
+    expect(
+      Ops.cognitoLookupName(~identity={sub: "d265d464-2091-706a-e5f9-3afafe7be29c", username: Value("merch")}),
+    )->toEqual(Some("merch"))
+  )
+
+  testSync("an absent username falls back to the subject, as before it was forwarded", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1"}))->toEqual(Some("sub-1"))
+  )
+
+  // The resolver sends `id.username ?? null`, so null is the shape an authorizer
+  // that names no username actually produces — not a missing field.
+  testSync("an explicitly null username falls back too", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1", username: Null}))->toEqual(Some("sub-1"))
+  )
+
+  testSync("a blank username is not a name to look anyone up by", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1", username: Value("   ")}))->toEqual(
+      Some("sub-1"),
+    )
+  )
+
+  testSync("neither name means there is nobody to ask about", () =>
+    expect(Ops.cognitoLookupName(~identity={}))->toEqual(None)
+  )
+})

package/tests/Auth_ActiveRoleStoreTest.res.mjs

@@ -30,6 +30,35 @@ globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () =
   });
 });
 
+globalThis.describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
+  globalThis.test("the username is what addresses Cognito when the authorizer sent one", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "d265d464-2091-706a-e5f9-3afafe7be29c",
+      username: "merch"
+    })).toEqual("merch");
+  });
+  globalThis.test("an absent username falls back to the subject, as before it was forwarded", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1"
+    })).toEqual("sub-1");
+  });
+  globalThis.test("an explicitly null username falls back too", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1",
+      username: null
+    })).toEqual("sub-1");
+  });
+  globalThis.test("a blank username is not a name to look anyone up by", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1",
+      username: "   "
+    })).toEqual("sub-1");
+  });
+  globalThis.test("neither name means there is nobody to ask about", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({})).toEqual(undefined);
+  });
+});
+
 let Ops;
 
 let Contract;

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -241,6 +241,52 @@ describe("bakeSelection", () => {
   )
 })
 
+// A journey travels from the deploy in the function's environment, exactly as the
+// default include-list does, carrying the key the deploy resolved. Deriving the
+// key a second time here would be a file written where `config.json` does not
+// send anybody, so the handler only reads it.
+describe("bakeJourney", () => {
+  let journey = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeJourney(JSON.parseOrThrow(raw))
+
+  testSync("reads the group, the key and the include-list the deploy encoded", () => {
+    let decoded = journey(`{
+      "group": "Fulfilment",
+      "key": "component-manifest-fulfilment.json",
+      "components": [{"plugin": "Ordering", "views": ["Orders"], "derived": ["lifecycles"]}]
+    }`)
+    expect(decoded->Option.map(j => (j.group, j.key, j.selections->Array.map(s => s.plugin))))->toEqual(
+      Some(("Fulfilment", "component-manifest-fulfilment.json", ["Ordering"])),
+    )
+    expect(
+      decoded->Option.flatMap(j => j.selections->Array.get(0))->Option.flatMap(s => s.derived),
+    )->toEqual(Some(["lifecycles"]))
+  })
+
+  // Absent is not empty here either: a journey whose selection names no `views`
+  // takes every public view of that plugin.
+  testSync("keeps a selection's absent lists absent", () => {
+    let decoded = journey(`{"group": "Shopper", "key": "s.json", "components": [{"plugin": "Catalog"}]}`)
+    expect(
+      decoded->Option.flatMap(j => j.selections->Array.get(0))->Option.flatMap(s => s.views),
+    )->toEqual(None)
+  })
+
+  // Both are what the write needs. A journey missing either would be baked to a
+  // key nobody granted or reported as belonging to no audience.
+  testSync("refuses an entry naming no group or no key", () => {
+    expect(journey(`{"key": "s.json", "components": []}`)->Option.isNone)->toBe(true)
+    expect(journey(`{"group": "Shopper", "components": []}`)->Option.isNone)->toBe(true)
+  })
+
+  // A journey that curates nothing is still a journey — it writes an empty file
+  // rather than falling back to the default one.
+  testSync("a journey with no components decodes to an empty include-list", () =>
+    expect(
+      journey(`{"group": "Shopper", "key": "s.json"}`)->Option.map(j => j.selections->Array.length),
+    )->toEqual(Some(0))
+  )
+})
+
 // The bake reads a read model the deploy updates asynchronously, so "is this the
 // deployment I was asked to bake" is a question it has to be able to answer. The
 // answer is an equality check against the key each plugin stack just wrote.

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -154,6 +154,37 @@ globalThis.describe("bakeSelection", () => {
   });
 });
 
+globalThis.describe("bakeJourney", () => {
+  globalThis.test("reads the group, the key and the include-list the deploy encoded", () => {
+    let decoded = Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{
+      "group": "Fulfilment",
+      "key": "component-manifest-fulfilment.json",
+      "components": [{"plugin": "Ordering", "views": ["Orders"], "derived": ["lifecycles"]}]
+    }`));
+    globalThis.expect(Stdlib_Option.map(decoded, j => [
+      j.group,
+      j.key,
+      j.selections.map(s => s.plugin)
+    ])).toEqual([
+      "Fulfilment",
+      "component-manifest-fulfilment.json",
+      ["Ordering"]
+    ]);
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(decoded, j => j.selections[0]), s => s.derived)).toEqual(["lifecycles"]);
+  });
+  globalThis.test("keeps a selection's absent lists absent", () => {
+    let decoded = Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "key": "s.json", "components": [{"plugin": "Catalog"}]}`));
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(decoded, j => j.selections[0]), s => s.views)).toEqual(undefined);
+  });
+  globalThis.test("refuses an entry naming no group or no key", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"key": "s.json", "components": []}`)))).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "components": []}`)))).toBe(true);
+  });
+  globalThis.test("a journey with no components decodes to an empty include-list", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "key": "s.json"}`)), j => j.selections.length)).toEqual(0);
+  });
+});
+
 globalThis.describe("pendingRegistrations", () => {
   let row = (name, key, param) => {
     let item = Object.fromEntries([[

package/tests/Util_DynamoDbStreamTest.res

@@ -0,0 +1,43 @@
+open JestGlobals
+
+// Guards that a stream resource describes its own stream.
+//
+// `toStreamResource` used to leave `resourceInfo` at its `NoInfo` default even
+// though it was built FROM a stream ARN. The event-topic resources a DynamoDB
+// stream publisher exports are these, so every reader that asks an event topic
+// for its stream ARN — `Upload_Claim_S3` does, to grant its Lambda
+// `dynamodb:GetRecords` — took the arm that has no ARN to give and failed the
+// deploy. The failure only surfaced once a plugin's first StateChangeSlice
+// declared a `@storageRef` field, which is what registers the claimer at all.
+
+let resolve = (output: Pulumi.Output.t<'a>): promise<'a> =>
+  Promise.make((resolve, _) => {
+    let _ = output->Pulumi.Output.apply(value => resolve(value))
+  })
+
+let streamArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123/stream/2026-01-01T00:00:00.000"
+
+let tableResource = ReventlessInfra.Adapter.make(
+  ~name="CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~id="CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~urn="arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~service=AWS.DynamoDbStream.service->Pulumi.Output.make,
+  ~resourceInfo=ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn})->Pulumi.Output.make,
+)
+
+describe("Util_DynamoDbStream.toStreamResource", () => {
+  test("carries the source stream in resourceInfo", async () => {
+    let stream = tableResource->Util_DynamoDbStream.toStreamResource
+    let resourceInfo = await stream.resourceInfo->resolve
+    expect(resourceInfo)->toEqual(ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn}))
+  })
+
+  test("answers its own stream ARN", async () => {
+    let arn =
+      await tableResource
+      ->Util_DynamoDbStream.toStreamResource
+      ->Util_DynamoDbStream.streamArnFromDynamoDbTableResource
+      ->resolve
+    expect(arn)->toBe(streamArn)
+  })
+})

package/tests/Util_DynamoDbStreamTest.res.mjs

@@ -0,0 +1,41 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../src/adapter/AWS.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as Util_DynamoDbStream$ReventlessAws from "../src/util/Util_DynamoDbStream.res.mjs";
+
+function resolve(output) {
+  return new Promise((resolve, param) => {
+    output.apply(value => resolve(value));
+  });
+}
+
+let streamArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123/stream/2026-01-01T00:00:00.000";
+
+let tableResource = Adapter$ReventlessInfra.make(Pulumi.output("CatalogDcbEventLog-abc123"), Pulumi.output("CatalogDcbEventLog-abc123"), Pulumi.output("arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123"), Pulumi.output(AWS$ReventlessAws.DynamoDbStream.service), Pulumi.output({
+  TAG: "StreamSource",
+  sourceUrn: streamArn
+}), undefined, undefined, undefined, undefined, undefined);
+
+globalThis.describe("Util_DynamoDbStream.toStreamResource", () => {
+  globalThis.test("carries the source stream in resourceInfo", async () => {
+    let stream = Util_DynamoDbStream$ReventlessAws.toStreamResource(tableResource);
+    let resourceInfo = await resolve(stream.resourceInfo);
+    globalThis.expect(resourceInfo).toEqual({
+      TAG: "StreamSource",
+      sourceUrn: streamArn
+    });
+  });
+  globalThis.test("answers its own stream ARN", async () => {
+    let arn = await resolve(Util_DynamoDbStream$ReventlessAws.streamArnFromDynamoDbTableResource(Util_DynamoDbStream$ReventlessAws.toStreamResource(tableResource)));
+    globalThis.expect(arn).toBe(streamArn);
+  });
+});
+
+export {
+  resolve,
+  streamArn,
+  tableResource,
+}
+/* tableResource Not a pure module */

package/tests/Util_ShellConfigTest.res

@@ -81,6 +81,113 @@ describe("Util_ShellConfig.fields — bakedManifest", () => {
   })
 })
 
+// ── Journeys ──────────────────────────────────────────────────────────────
+//
+// One curated surface per audience, beside the default one. The property under
+// test throughout is that a deployment declaring none is untouched: every
+// deployment that predates journeys has exactly one audience, and its
+// config.json must not grow a key for a feature it does not use.
+describe("Util_ShellConfig.fields — journeys", () => {
+  let withJourneys = (
+    ~journeys: array<ReventlessInfra.Platform.bakedJourney>,
+  ): ReventlessInfra.Platform.bakedManifest => {
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+    journeys,
+  }
+
+  let shopper: ReventlessInfra.Platform.bakedJourney = {
+    group: "Shopper",
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+  }
+
+  let fulfilment: ReventlessInfra.Platform.bakedJourney = {
+    group: "Fulfilment",
+    components: [{plugin: "Ordering", views: ["Orders"], commands: ["ShipOrder"]}],
+    key: "fulfilment.json",
+  }
+
+  testSync("a bake declaring no journeys writes no map", () => {
+    let out = Util_ShellConfig.fields(
+      ~computed,
+      ~bakedManifest={components: [{plugin: "Catalog", views: ["Products"], commands: []}]},
+    )
+    expect(out->Dict.get("journeyManifestUrls")->Option.isNone)->toBe(true)
+  })
+
+  testSync("an empty journeys array is the same as none", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=withJourneys(~journeys=[]))
+    expect(out->Dict.get("journeyManifestUrls")->Option.isNone)->toBe(true)
+  })
+
+  // The default journey keeps `manifestUrl`, so a caller matching no declared
+  // group lands where every caller landed before.
+  testSync("keeps manifestUrl as the default journey", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=withJourneys(~journeys=[shopper]))
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/component-manifest.json"))
+  })
+
+  testSync("maps each declared group to its own file", () => {
+    let out = Util_ShellConfig.fields(
+      ~computed,
+      ~bakedManifest=withJourneys(~journeys=[shopper, fulfilment]),
+    )
+    expect(out->get("journeyManifestUrls"))->toEqual(
+      JSON.Encode.object(
+        Dict.fromArray([
+          // Derived from the group, lower-cased, because a key is part of a URL.
+          ("Shopper", JSON.Encode.string("/component-manifest-shopper.json")),
+          // Named explicitly, and the declaration wins.
+          ("Fulfilment", JSON.Encode.string("/fulfilment.json")),
+        ]),
+      ),
+    )
+  })
+
+  // The URL a shell fetches and the key the bake writes are one string, derived
+  // once — a second derivation is a file written where nothing looks for it. So
+  // every key the bake writes is published, and the default one is published as
+  // `manifestUrl` rather than in the map.
+  testSync("publishes the URL of every key the bake writes, exactly once", () => {
+    let bake = withJourneys(~journeys=[shopper, fulfilment])
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake)
+    let published = Array.concat(
+      out->get("manifestUrl")->JSON.Decode.string->Option.mapOr([], url => [url]),
+      out
+      ->get("journeyManifestUrls")
+      ->JSON.Decode.object
+      ->Option.getOr(Dict.make())
+      ->Dict.valuesToArray
+      ->Array.filterMap(JSON.Decode.string),
+    )
+    expect(published)->toEqual(
+      ReventlessCore.Platform_BakedManifest.files(~config=bake)->Array.map(((key, _)) =>
+        "/" ++ key
+      ),
+    )
+  })
+
+  // A passthrough cannot redirect a key the deploy computes — the same rule
+  // `manifestUrl` already carries, extended to the map beside it.
+  testSync("a shellConfig journey map fails the deploy rather than redirecting it", () => {
+    let failure = try {
+      let _ = Util_ShellConfig.fields(
+        ~computed,
+        ~bakedManifest=withJourneys(~journeys=[shopper]),
+        ~shellConfig=Dict.fromArray([
+          ("journeyManifestUrls", JSON.Encode.object(Dict.make())),
+        ]),
+      )
+      None
+    } catch {
+    | Failure(message) => Some(message)
+    }
+    switch failure {
+    | Some(message) => expect(message->String.includes("journeyManifestUrls"))->toBe(true)
+    | None => fail("a shellConfig key redirecting the computed journey map must fail the deploy")
+    }
+  })
+})
+
 describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   testSync("shell-owned keys land verbatim, under the computed ones", () => {
     let out = Util_ShellConfig.fields(