@reventlessdev/reventless-aws 3.0.0-alpha.301 → 3.0.0-alpha.302

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.302 (2026-08-15)
+
+### Bug Fixes
+
+* **aws:** let a stream resource answer for its own stream ([4617773](https://github.com/ReventlessDev/reventless-core/commit/461777349f10ebc83085d59907bac5b5537429ed))
+### Features
+
+* **aws:** serve one baked manifest per journey ([16d6307](https://github.com/ReventlessDev/reventless-core/commit/16d63071f059cf1fc7025f9be9206dda51f71053))
+
+
 # 3.0.0-alpha.301 (2026-08-15)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.301",
+  "version": "3.0.0-alpha.302",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.7",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.76",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.235",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.142",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.236",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.99",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.114",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.142"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.100",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.114"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -2221,9 +2221,14 @@ module MakeWithConfig = (
       // target without reading either out of the deploy program.
       switch (componentDefinitions, cfg.bakedManifest) {
       | (Some(fn), Some(bake)) =>
-        let manifestKey = bake.key->Option.getOr(
-          ReventlessCore.Platform_BakedManifest.defaultKey,
-        )
+        // Every file the declaration produces: the default journey's, which is
+        // what the shell's `manifestUrl` points at, and one per declared journey.
+        // Resolved through the same function the bake and `config.json` use, so
+        // a grant cannot be scoped to a key nothing writes.
+        let manifestKeys =
+          ReventlessCore.Platform_BakedManifest.files(~config=bake)->Array.map(((key, _)) => key)
+        let manifestKey =
+          manifestKeys->Array.get(0)->Option.getOr(ReventlessCore.Platform_BakedManifest.defaultKey)
         let _ =
           (fn.roleId, bucketName)
           ->Pulumi.Output.all2
@@ -2239,7 +2244,16 @@ module MakeWithConfig = (
                       sid: "AllowWriteBakedManifest",
                       effect: Allow,
                       actions: Actions(["s3:PutObject"]),
-                      resources: Resource(`arn:aws:s3:::${bucket}/${manifestKey}`),
+                      // A single key stays a bare `Resource` string: the two
+                      // forms mean the same thing to IAM, and a deployment that
+                      // declares no journey should not see its policy rewritten
+                      // for a field it does not use.
+                      resources: switch manifestKeys->Array.map(key =>
+                        `arn:aws:s3:::${bucket}/${key}`
+                      ) {
+                      | [only] => Resource(only)
+                      | arns => Resources(arns)
+                      },
                     },
                   ],
                 )

package/src/Platform.res.mjs

@@ -1210,17 +1210,27 @@ function MakeWithConfig(Config) {
       }
       let match$5 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+        let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
           bucketName
         ]).apply(param => {
+          let bucket = param[1];
+          let arns = manifestKeys.map(key => `arn:aws:s3:::` + bucket + `/` + key);
+          let tmp;
+          if (arns.length !== 1) {
+            tmp = arns;
+          } else {
+            let only = arns[0];
+            tmp = only;
+          }
           new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
             policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
                 Sid: "AllowWriteBakedManifest",
                 Effect: "Allow",
                 Action: ["s3:PutObject"],
-                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+                Resource: tmp
               }])),
             role: param[0]
           });
@@ -2490,17 +2500,27 @@ function Make($star) {
       }
       let match$5 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+        let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
           bucketName
         ]).apply(param => {
+          let bucket = param[1];
+          let arns = manifestKeys.map(key => `arn:aws:s3:::` + bucket + `/` + key);
+          let tmp;
+          if (arns.length !== 1) {
+            tmp = arns;
+          } else {
+            let only = arns[0];
+            tmp = only;
+          }
           new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
             policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
                 Sid: "AllowWriteBakedManifest",
                 Effect: "Allow",
                 Action: ["s3:PutObject"],
-                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+                Resource: tmp
               }])),
             role: param[0]
           });

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -141,10 +141,8 @@ let make = (
   // as a record so the deploy input and the runtime input are the same shape —
   // `views`/`commands` absent means "every public component", which a record
   // with explicit nulls would not say.
-  let bakeSelectionsJson = switch bakedManifest {
-  | None => ""
-  | Some(bake) =>
-    bake.components
+  let encodeSelections = (components: array<ReventlessCore.Platform_BakedManifest.selection>) =>
+    components
     ->Array.map(sel => {
       let entry = Dict.fromArray([("plugin", JSON.Encode.string(sel.plugin))])
       let strings = (key, value) =>
@@ -157,6 +155,39 @@ let make = (
       entry->JSON.Encode.object
     })
     ->JSON.Encode.array
+
+  let bakeSelectionsJson = switch bakedManifest {
+  | None => ""
+  | Some(bake) =>
+    bake.components
+    ->Array.map(ReventlessCore.Platform_BakedManifest.toSelection)
+    ->encodeSelections
+    ->JSON.stringify
+  }
+
+  // The journeys, in a variable of their own rather than folded into the one
+  // above: a deployment that declares none then puts the same string in the same
+  // place it always did, and its function is not replaced for a field it does
+  // not use.
+  //
+  // Each carries the key the DECLARATION resolves to, taken from the function
+  // that also decides the IAM grant and the URL `config.json` publishes. A key
+  // the handler derived for itself would be a fourth derivation of one name, and
+  // the way it fails is a file written where nothing fetches it.
+  let bakeJourneysJson = switch bakedManifest->Option.mapOr([], config =>
+    ReventlessCore.Platform_BakedManifest.journeyFiles(~config)
+  ) {
+  | [] => ""
+  | journeys =>
+    journeys
+    ->Array.map(j =>
+      Dict.fromArray([
+        ("group", JSON.Encode.string(j.group)),
+        ("key", JSON.Encode.string(j.key)),
+        ("components", j.selections->encodeSelections),
+      ])->JSON.Encode.object
+    )
+    ->JSON.Encode.array
     ->JSON.stringify
   }
 
@@ -226,6 +257,10 @@ let make = (
             // An include-list is names only, so it stays far from the 4096-byte
             // total the admin entry already pushed out of this dict.
             ("BAKE_SELECTIONS", bakeSelectionsJson->Pulumi.Input.make),
+            // One curated surface per audience beside the default one. Empty for
+            // a deployment that declares none, which is every deployment that
+            // predates journeys.
+            ("BAKE_JOURNEYS", bakeJourneysJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -13,6 +13,7 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as Platform_ComponentDefinitionsApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_ComponentDefinitionsApi.res.mjs";
 
@@ -77,19 +78,35 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
       role: lambdaRole.id
     }, opts$1);
   });
-  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(bakedManifest.components.map(sel => {
-      let entry = Object.fromEntries([[
-          "plugin",
-          sel.plugin
-        ]]);
-      let strings = (key, value) => Stdlib_Option.forEach(value, names => {
-        entry[key] = names.map(prim => prim);
-      });
-      strings("views", sel.views);
-      strings("commands", sel.commands);
-      strings("derived", sel.derived);
-      return entry;
-    })) : "";
+  let encodeSelections = components => components.map(sel => {
+    let entry = Object.fromEntries([[
+        "plugin",
+        sel.plugin
+      ]]);
+    let strings = (key, value) => Stdlib_Option.forEach(value, names => {
+      entry[key] = names.map(prim => prim);
+    });
+    strings("views", sel.views);
+    strings("commands", sel.commands);
+    strings("derived", sel.derived);
+    return entry;
+  });
+  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(encodeSelections(bakedManifest.components.map(Platform_BakedManifest$ReventlessCore.toSelection))) : "";
+  let journeys = Stdlib_Option.mapOr(bakedManifest, [], Platform_BakedManifest$ReventlessCore.journeyFiles);
+  let bakeJourneysJson = journeys.length !== 0 ? JSON.stringify(journeys.map(j => Object.fromEntries([
+      [
+        "group",
+        j.group
+      ],
+      [
+        "key",
+        j.key
+      ],
+      [
+        "components",
+        encodeSelections(j.selections)
+      ]
+    ]))) : "";
   let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
@@ -128,6 +145,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
           "BAKE_SELECTIONS",
           bakeSelectionsJson
         ],
+        [
+          "BAKE_JOURNEYS",
+          bakeJourneysJson
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -288,6 +288,18 @@ let structureOf = (item: dict<JSON.t>, ~name as _: string): option<(
   | _ => None
   }
 
+// One curated surface per audience, beside the default one. Only what the write
+// needs travels: the file's key, resolved by the deploy so that the grant, the
+// URL in `config.json` and the object written here are one string, and the
+// include-list that decides its contents. The group the journey serves is
+// carried too, purely so the invocation's report names the audience a file was
+// written for.
+type journey = {
+  group: string,
+  key: string,
+  selections: array<ReventlessCore.Platform_BakedManifest.selection>,
+}
+
 let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest.selection> => {
   let strings = (o, key) =>
     o
@@ -309,6 +321,9 @@ let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest
   )
 }
 
+let decodeSelections = (json: JSON.t): array<ReventlessCore.Platform_BakedManifest.selection> =>
+  json->JSON.Decode.array->Option.getOr([])->Array.filterMap(bakeSelection)
+
 // The declaration travels as an env var because it is deploy input — stated once
 // in the platform program, beside the bucket it is written to. The target travels
 // in the invocation payload instead: the bucket only exists inside the host-UI
@@ -319,14 +334,44 @@ let bakeSelections = (): array<ReventlessCore.Platform_BakedManifest.selection>
   switch NodeProcess.env->Dict.get("BAKE_SELECTIONS") {
   | None | Some("") => []
   | Some(raw) =>
-    switch raw->JSON.parseOrThrow->JSON.Decode.array {
-    | Some(entries) => entries->Array.filterMap(bakeSelection)
-    | None => []
+    switch raw->JSON.parseOrThrow {
+    | json => json->decodeSelections
     | exception _ =>
       JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array")
     }
   }
 
+let bakeJourney = (json: JSON.t): option<journey> =>
+  json
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    switch (
+      o->Dict.get("group")->Option.flatMap(JSON.Decode.string),
+      o->Dict.get("key")->Option.flatMap(JSON.Decode.string),
+    ) {
+    | (Some(group), Some(key)) =>
+      Some({
+        group,
+        key,
+        selections: o->Dict.get("components")->Option.mapOr([], decodeSelections),
+      })
+    | _ => None
+    }
+  )
+
+// Absent for every deployment that declares one audience, which is what the
+// declaration meant before journeys existed and what it still means.
+let bakeJourneys = (): array<journey> =>
+  switch NodeProcess.env->Dict.get("BAKE_JOURNEYS") {
+  | None | Some("") => []
+  | Some(raw) =>
+    switch raw->JSON.parseOrThrow->JSON.Decode.array {
+    | Some(entries) => entries->Array.filterMap(bakeJourney)
+    | None => []
+    | exception _ => JsError.throwWithMessage("baked manifest: BAKE_JOURNEYS is not a JSON array")
+    }
+  }
+
 type bakeTarget = {bucket: string, key: string}
 
 let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
@@ -417,27 +462,49 @@ let runBake = async (
       "so there is nothing to write and a shell pointed at the file would find none.",
     )
   }
-  switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
-  | Error(e) =>
-    JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
-  | Ok(manifest) =>
-    let body = JSON.stringify(manifest, ~space=2)
-    let _ = await AwsSdk.S3.PutObjectCommand.make({
-      bucket: target.bucket,
-      key: target.key,
-      body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
-      contentType: "application/json",
-    })->AwsSdk.S3.PutObjectCommand.send
-    [
-      Dict.fromArray([
+  // The default journey first and always — the caller supplies its key, because
+  // the caller is what knows where the shell it configured fetches from — then
+  // one file per declared journey, under the key the deploy resolved.
+  let files = Array.concat(
+    [(None, target.key, selections)],
+    bakeJourneys()->Array.map(j => (Some(j.group), j.key, j.selections)),
+  )
+
+  // Every file is curated before any is written, for the reason the in-memory
+  // platform curates before it writes: a declaration naming a component that
+  // does not exist fails the bake, and failing it halfway would leave the bucket
+  // serving one audience's file beside a stale copy of another's.
+  let curated = files->Array.map(((group, key, selections)) => (
+    group,
+    key,
+    selections,
+    switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
+    | Error(e) => JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
+    | Ok(manifest) => JSON.stringify(manifest, ~space=2)
+    },
+  ))
+
+  await Promise.all(
+    curated->Array.map(async ((group, key, selections, body)) => {
+      let _ = await AwsSdk.S3.PutObjectCommand.make({
+        bucket: target.bucket,
+        key,
+        body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
+        contentType: "application/json",
+      })->AwsSdk.S3.PutObjectCommand.send
+      let report = Dict.fromArray([
         ("baked", JSON.Encode.bool(true)),
         ("bucket", JSON.Encode.string(target.bucket)),
-        ("key", JSON.Encode.string(target.key)),
+        ("key", JSON.Encode.string(key)),
         ("plugins", JSON.Encode.int(selections->Array.length)),
         ("bytes", JSON.Encode.int(body->String.length)),
-      ])->JSON.Encode.object,
-    ]
-  }
+      ])
+      // Only a journey's entry carries the audience it was written for, so the
+      // default one reports exactly what it reported before journeys existed.
+      group->Option.forEach(g => report->Dict.set("group", JSON.Encode.string(g)))
+      report->JSON.Encode.object
+    }),
+  )
 }
 
 let handler = async (event: JSON.t): array<JSON.t> => {

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -268,6 +268,10 @@ function bakeSelection(json) {
   })));
 }
 
+function decodeSelections(json) {
+  return Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(json), []), bakeSelection);
+}
+
 function bakeSelections() {
   let raw = process.env["BAKE_SELECTIONS"];
   if (raw === undefined) {
@@ -276,14 +280,45 @@ function bakeSelections() {
   if (raw === "") {
     return [];
   }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+  }
+  return decodeSelections(json);
+}
+
+function bakeJourney(json) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => {
+    let match = Stdlib_Option.flatMap(o["group"], Stdlib_JSON.Decode.string);
+    let match$1 = Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string);
+    if (match !== undefined && match$1 !== undefined) {
+      return {
+        group: match,
+        key: match$1,
+        selections: Stdlib_Option.mapOr(o["components"], [], decodeSelections)
+      };
+    }
+  });
+}
+
+function bakeJourneys() {
+  let raw = process.env["BAKE_JOURNEYS"];
+  if (raw === undefined) {
+    return [];
+  }
+  if (raw === "") {
+    return [];
+  }
   let entries;
   try {
     entries = Stdlib_JSON.Decode.array(JSON.parse(raw));
   } catch (exn) {
-    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_JOURNEYS is not a JSON array");
   }
   if (entries !== undefined) {
-    return Stdlib_Array.filterMap(entries, bakeSelection);
+    return Stdlib_Array.filterMap(entries, bakeJourney);
   } else {
     return [];
   }
@@ -336,18 +371,37 @@ async function runBake(target, structures) {
   if (selections.length === 0) {
     Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, so there is nothing to write and a shell pointed at the file would find none.");
   }
-  let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
-  if (e.TAG !== "Ok") {
-    return Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
-  }
-  let body = JSON.stringify(e._0, undefined, 2);
-  await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
-    Bucket: target.bucket,
-    Key: target.key,
-    Body: body,
-    ContentType: "application/json"
-  }));
-  return [Object.fromEntries([
+  let files = [[
+      undefined,
+      target.key,
+      selections
+    ]].concat(bakeJourneys().map(j => [
+    j.group,
+    j.key,
+    j.selections
+  ]));
+  let curated = files.map(param => {
+    let selections = param[2];
+    let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
+    let tmp;
+    tmp = e.TAG === "Ok" ? JSON.stringify(e._0, undefined, 2) : Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
+    return [
+      param[0],
+      param[1],
+      selections,
+      tmp
+    ];
+  });
+  return await Promise.all(curated.map(async param => {
+    let body = param[3];
+    let key = param[1];
+    await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
+      Bucket: target.bucket,
+      Key: key,
+      Body: body,
+      ContentType: "application/json"
+    }));
+    let report = Object.fromEntries([
       [
         "baked",
         true
@@ -358,17 +412,22 @@ async function runBake(target, structures) {
       ],
       [
         "key",
-        target.key
+        key
       ],
       [
         "plugins",
-        selections.length
+        param[2].length
       ],
       [
         "bytes",
         body.length
       ]
-    ])];
+    ]);
+    Stdlib_Option.forEach(param[0], g => {
+      report["group"] = g;
+    });
+    return report;
+  }));
 }
 
 async function handler(event) {
@@ -433,7 +492,10 @@ export {
   isComplete,
   structureOf,
   bakeSelection,
+  decodeSelections,
   bakeSelections,
+  bakeJourney,
+  bakeJourneys,
   bakeTargetOf,
   bakeExpectations,
   structureRefKey,

package/src/util/Util_DynamoDbStream.res

@@ -1,13 +1,17 @@
 let toResourceInfo = (table: PulumiAws.DynamoDb.Table.t) =>
   table.streamArn->Pulumi.Output.apply(streamArn => ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn}))
 
+// The table name rides IN the apply rather than being read with `Output.get` on
+// the failure arm: `get` throws "Cannot call '.get' during update or preview" on
+// every deploy, so the arm meant to name the offending table replaced its own
+// message with that one and hid which resource was missing a stream.
 let streamArnFromDynamoDbTableResource = (resource: ReventlessInfra.Adapter.resource) =>
-  resource.resourceInfo->Pulumi.Output.apply(resourceInfo =>
+  (resource.resourceInfo, resource.name)
+  ->Pulumi.Output.all2
+  ->Pulumi.Output.apply(((resourceInfo, tableName)) =>
     switch resourceInfo {
     | StreamSource({sourceUrn}) => sourceUrn
-    | _ =>
-      let tableName = resource.name->Pulumi.Output.get
-      JsError.throwWithMessage("No streamArn field given for table " ++ tableName)
+    | _ => JsError.throwWithMessage("No streamArn field given for table " ++ tableName)
     }
   )
 
@@ -30,6 +34,13 @@ let toStreamResource = (table: ReventlessInfra.Adapter.resource): ReventlessInfr
     ~id=streamArn,
     ~urn=streamArn,
     ~service=table.name->Pulumi.Output.apply(_ => AWS.DynamoDbStream.service),
+    // Carries the same StreamSource the table resource carries, so asking a
+    // stream resource for its ARN answers instead of throwing. The event-topic
+    // resources a publisher exports are these, and `Upload_Claim_S3` asks
+    // exactly that of resources[0].
+    ~resourceInfo=streamArn->Pulumi.Output.apply(sourceUrn => ReventlessInfra.Adapter.StreamSource({
+      sourceUrn: sourceUrn,
+    })),
     ~resourceType="aws:dynamodb:Stream"->Pulumi.Output.make,
   )
 }

package/src/util/Util_DynamoDbStream.res.mjs

@@ -22,12 +22,19 @@ function toResourceInfo(table) {
 }
 
 function streamArnFromDynamoDbTableResource(resource) {
-  return resource.resourceInfo.apply(resourceInfo => {
-    if (typeof resourceInfo === "object" && resourceInfo.TAG === "StreamSource") {
+  return Pulumi.all([
+    resource.resourceInfo,
+    resource.name
+  ]).apply(param => {
+    let tableName = param[1];
+    let resourceInfo = param[0];
+    if (typeof resourceInfo !== "object") {
+      return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
+    } else if (resourceInfo.TAG === "StreamSource") {
       return resourceInfo.sourceUrn;
+    } else {
+      return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
     }
-    let tableName = resource.name.get();
-    return Stdlib_JsError.throwWithMessage("No streamArn field given for table " + tableName);
   });
 }
 
@@ -37,7 +44,10 @@ function toResource(tags, table) {
 
 function toStreamResource(table) {
   let streamArn = streamArnFromDynamoDbTableResource(table);
-  return Adapter$ReventlessInfra.make(table.name, streamArn, streamArn, table.name.apply(param => AWS$ReventlessAws.DynamoDbStream.service), undefined, undefined, undefined, Pulumi.output("aws:dynamodb:Stream"), undefined, undefined);
+  return Adapter$ReventlessInfra.make(table.name, streamArn, streamArn, table.name.apply(param => AWS$ReventlessAws.DynamoDbStream.service), streamArn.apply(sourceUrn => ({
+    TAG: "StreamSource",
+    sourceUrn: sourceUrn
+  })), undefined, undefined, Pulumi.output("aws:dynamodb:Stream"), undefined, undefined);
 }
 
 let log = Logger$ReventlessCore.fromEnv();

package/src/util/Util_ShellConfig.res

@@ -9,6 +9,10 @@
 
 module Platform = ReventlessInfra.Platform
 
+// Where a caller acting as a given role discovers from — a group→url map. Named
+// here as the shell reads it, the same way `manifestUrl` is.
+let journeyManifestsKey = "journeyManifestUrls"
+
 // A mode's options, flattened to the wire shape. They are payloads of their arm
 // on the deploy side (so `mapStyle` with the map off cannot be expressed) and
 // flat siblings of `viewModes` on the wire (because that is where the released
@@ -52,12 +56,28 @@ let fields = (
   // decides where the file goes — a passthrough could point the shell at a key
   // nothing writes, and a statically-discovered shell has no admin API behind it
   // to notice.
-  bakedManifest->Option.forEach(bake =>
+  bakedManifest->Option.forEach(bake => {
     out->Dict.set(
       "manifestUrl",
       JSON.Encode.string(ReventlessCore.Platform_BakedManifest.urlForKey(bake.key)),
     )
-  )
+    // Where a caller acting as a given role discovers from, beside the default
+    // rather than instead of it: `manifestUrl` stays the default journey, which
+    // is what a caller matching no declared group gets. Omitted entirely when
+    // nothing is declared, so a single-audience deployment writes the key set it
+    // always did and a shell that has never heard of journeys sees no new key.
+    switch ReventlessCore.Platform_BakedManifest.journeyUrls(~config=bake) {
+    | [] => ()
+    | urls =>
+      out->Dict.set(
+        journeyManifestsKey,
+        urls
+        ->Array.map(((group, url)) => (group, JSON.Encode.string(url)))
+        ->Dict.fromArray
+        ->JSON.Encode.object,
+      )
+    }
+  })
 
   switch viewModes {
   | Some(modes) =>

package/src/util/Util_ShellConfig.res.mjs

@@ -6,6 +6,8 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
+let journeyManifestsKey = "journeyManifestUrls";
+
 function modeOptions(mode) {
   if (mode.TAG === "Map") {
     let style = mode._0.style;
@@ -33,6 +35,14 @@ function fields(computed, viewModes, bakedManifest, shellConfig) {
   let out = Object.fromEntries(computed);
   Stdlib_Option.forEach(bakedManifest, bake => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(bake.key);
+    let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(bake);
+    if (urls.length !== 0) {
+      out[journeyManifestsKey] = Object.fromEntries(urls.map(param => [
+        param[0],
+        param[1]
+      ]));
+      return;
+    }
   });
   if (viewModes !== undefined) {
     out["viewModes"] = viewModes.map(Platform$ReventlessInfra.viewModeToString);
@@ -58,6 +68,7 @@ let Platform;
 
 export {
   Platform,
+  journeyManifestsKey,
   modeOptions,
   fields,
 }

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -241,6 +241,52 @@ describe("bakeSelection", () => {
   )
 })
 
+// A journey travels from the deploy in the function's environment, exactly as the
+// default include-list does, carrying the key the deploy resolved. Deriving the
+// key a second time here would be a file written where `config.json` does not
+// send anybody, so the handler only reads it.
+describe("bakeJourney", () => {
+  let journey = raw => Platform_ComponentDefinitions_Lambda_Ops.bakeJourney(JSON.parseOrThrow(raw))
+
+  testSync("reads the group, the key and the include-list the deploy encoded", () => {
+    let decoded = journey(`{
+      "group": "Fulfilment",
+      "key": "component-manifest-fulfilment.json",
+      "components": [{"plugin": "Ordering", "views": ["Orders"], "derived": ["lifecycles"]}]
+    }`)
+    expect(decoded->Option.map(j => (j.group, j.key, j.selections->Array.map(s => s.plugin))))->toEqual(
+      Some(("Fulfilment", "component-manifest-fulfilment.json", ["Ordering"])),
+    )
+    expect(
+      decoded->Option.flatMap(j => j.selections->Array.get(0))->Option.flatMap(s => s.derived),
+    )->toEqual(Some(["lifecycles"]))
+  })
+
+  // Absent is not empty here either: a journey whose selection names no `views`
+  // takes every public view of that plugin.
+  testSync("keeps a selection's absent lists absent", () => {
+    let decoded = journey(`{"group": "Shopper", "key": "s.json", "components": [{"plugin": "Catalog"}]}`)
+    expect(
+      decoded->Option.flatMap(j => j.selections->Array.get(0))->Option.flatMap(s => s.views),
+    )->toEqual(None)
+  })
+
+  // Both are what the write needs. A journey missing either would be baked to a
+  // key nobody granted or reported as belonging to no audience.
+  testSync("refuses an entry naming no group or no key", () => {
+    expect(journey(`{"key": "s.json", "components": []}`)->Option.isNone)->toBe(true)
+    expect(journey(`{"group": "Shopper", "components": []}`)->Option.isNone)->toBe(true)
+  })
+
+  // A journey that curates nothing is still a journey — it writes an empty file
+  // rather than falling back to the default one.
+  testSync("a journey with no components decodes to an empty include-list", () =>
+    expect(
+      journey(`{"group": "Shopper", "key": "s.json"}`)->Option.map(j => j.selections->Array.length),
+    )->toEqual(Some(0))
+  )
+})
+
 // The bake reads a read model the deploy updates asynchronously, so "is this the
 // deployment I was asked to bake" is a question it has to be able to answer. The
 // answer is an equality check against the key each plugin stack just wrote.

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -154,6 +154,37 @@ globalThis.describe("bakeSelection", () => {
   });
 });
 
+globalThis.describe("bakeJourney", () => {
+  globalThis.test("reads the group, the key and the include-list the deploy encoded", () => {
+    let decoded = Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{
+      "group": "Fulfilment",
+      "key": "component-manifest-fulfilment.json",
+      "components": [{"plugin": "Ordering", "views": ["Orders"], "derived": ["lifecycles"]}]
+    }`));
+    globalThis.expect(Stdlib_Option.map(decoded, j => [
+      j.group,
+      j.key,
+      j.selections.map(s => s.plugin)
+    ])).toEqual([
+      "Fulfilment",
+      "component-manifest-fulfilment.json",
+      ["Ordering"]
+    ]);
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(decoded, j => j.selections[0]), s => s.derived)).toEqual(["lifecycles"]);
+  });
+  globalThis.test("keeps a selection's absent lists absent", () => {
+    let decoded = Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "key": "s.json", "components": [{"plugin": "Catalog"}]}`));
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(decoded, j => j.selections[0]), s => s.views)).toEqual(undefined);
+  });
+  globalThis.test("refuses an entry naming no group or no key", () => {
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"key": "s.json", "components": []}`)))).toBe(true);
+    globalThis.expect(Stdlib_Option.isNone(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "components": []}`)))).toBe(true);
+  });
+  globalThis.test("a journey with no components decodes to an empty include-list", () => {
+    globalThis.expect(Stdlib_Option.map(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeJourney(JSON.parse(`{"group": "Shopper", "key": "s.json"}`)), j => j.selections.length)).toEqual(0);
+  });
+});
+
 globalThis.describe("pendingRegistrations", () => {
   let row = (name, key, param) => {
     let item = Object.fromEntries([[

package/tests/Util_DynamoDbStreamTest.res

@@ -0,0 +1,43 @@
+open JestGlobals
+
+// Guards that a stream resource describes its own stream.
+//
+// `toStreamResource` used to leave `resourceInfo` at its `NoInfo` default even
+// though it was built FROM a stream ARN. The event-topic resources a DynamoDB
+// stream publisher exports are these, so every reader that asks an event topic
+// for its stream ARN — `Upload_Claim_S3` does, to grant its Lambda
+// `dynamodb:GetRecords` — took the arm that has no ARN to give and failed the
+// deploy. The failure only surfaced once a plugin's first StateChangeSlice
+// declared a `@storageRef` field, which is what registers the claimer at all.
+
+let resolve = (output: Pulumi.Output.t<'a>): promise<'a> =>
+  Promise.make((resolve, _) => {
+    let _ = output->Pulumi.Output.apply(value => resolve(value))
+  })
+
+let streamArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123/stream/2026-01-01T00:00:00.000"
+
+let tableResource = ReventlessInfra.Adapter.make(
+  ~name="CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~id="CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~urn="arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123"->Pulumi.Output.make,
+  ~service=AWS.DynamoDbStream.service->Pulumi.Output.make,
+  ~resourceInfo=ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn})->Pulumi.Output.make,
+)
+
+describe("Util_DynamoDbStream.toStreamResource", () => {
+  test("carries the source stream in resourceInfo", async () => {
+    let stream = tableResource->Util_DynamoDbStream.toStreamResource
+    let resourceInfo = await stream.resourceInfo->resolve
+    expect(resourceInfo)->toEqual(ReventlessInfra.Adapter.StreamSource({sourceUrn: streamArn}))
+  })
+
+  test("answers its own stream ARN", async () => {
+    let arn =
+      await tableResource
+      ->Util_DynamoDbStream.toStreamResource
+      ->Util_DynamoDbStream.streamArnFromDynamoDbTableResource
+      ->resolve
+    expect(arn)->toBe(streamArn)
+  })
+})

package/tests/Util_DynamoDbStreamTest.res.mjs

@@ -0,0 +1,41 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../src/adapter/AWS.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as Util_DynamoDbStream$ReventlessAws from "../src/util/Util_DynamoDbStream.res.mjs";
+
+function resolve(output) {
+  return new Promise((resolve, param) => {
+    output.apply(value => resolve(value));
+  });
+}
+
+let streamArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123/stream/2026-01-01T00:00:00.000";
+
+let tableResource = Adapter$ReventlessInfra.make(Pulumi.output("CatalogDcbEventLog-abc123"), Pulumi.output("CatalogDcbEventLog-abc123"), Pulumi.output("arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-abc123"), Pulumi.output(AWS$ReventlessAws.DynamoDbStream.service), Pulumi.output({
+  TAG: "StreamSource",
+  sourceUrn: streamArn
+}), undefined, undefined, undefined, undefined, undefined);
+
+globalThis.describe("Util_DynamoDbStream.toStreamResource", () => {
+  globalThis.test("carries the source stream in resourceInfo", async () => {
+    let stream = Util_DynamoDbStream$ReventlessAws.toStreamResource(tableResource);
+    let resourceInfo = await resolve(stream.resourceInfo);
+    globalThis.expect(resourceInfo).toEqual({
+      TAG: "StreamSource",
+      sourceUrn: streamArn
+    });
+  });
+  globalThis.test("answers its own stream ARN", async () => {
+    let arn = await resolve(Util_DynamoDbStream$ReventlessAws.streamArnFromDynamoDbTableResource(Util_DynamoDbStream$ReventlessAws.toStreamResource(tableResource)));
+    globalThis.expect(arn).toBe(streamArn);
+  });
+});
+
+export {
+  resolve,
+  streamArn,
+  tableResource,
+}
+/* tableResource Not a pure module */

package/tests/Util_ShellConfigTest.res

@@ -81,6 +81,113 @@ describe("Util_ShellConfig.fields — bakedManifest", () => {
   })
 })
 
+// ── Journeys ──────────────────────────────────────────────────────────────
+//
+// One curated surface per audience, beside the default one. The property under
+// test throughout is that a deployment declaring none is untouched: every
+// deployment that predates journeys has exactly one audience, and its
+// config.json must not grow a key for a feature it does not use.
+describe("Util_ShellConfig.fields — journeys", () => {
+  let withJourneys = (
+    ~journeys: array<ReventlessInfra.Platform.bakedJourney>,
+  ): ReventlessInfra.Platform.bakedManifest => {
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+    journeys,
+  }
+
+  let shopper: ReventlessInfra.Platform.bakedJourney = {
+    group: "Shopper",
+    components: [{plugin: "Catalog", views: ["Products"], commands: []}],
+  }
+
+  let fulfilment: ReventlessInfra.Platform.bakedJourney = {
+    group: "Fulfilment",
+    components: [{plugin: "Ordering", views: ["Orders"], commands: ["ShipOrder"]}],
+    key: "fulfilment.json",
+  }
+
+  testSync("a bake declaring no journeys writes no map", () => {
+    let out = Util_ShellConfig.fields(
+      ~computed,
+      ~bakedManifest={components: [{plugin: "Catalog", views: ["Products"], commands: []}]},
+    )
+    expect(out->Dict.get("journeyManifestUrls")->Option.isNone)->toBe(true)
+  })
+
+  testSync("an empty journeys array is the same as none", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=withJourneys(~journeys=[]))
+    expect(out->Dict.get("journeyManifestUrls")->Option.isNone)->toBe(true)
+  })
+
+  // The default journey keeps `manifestUrl`, so a caller matching no declared
+  // group lands where every caller landed before.
+  testSync("keeps manifestUrl as the default journey", () => {
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=withJourneys(~journeys=[shopper]))
+    expect(out->get("manifestUrl"))->toEqual(JSON.Encode.string("/component-manifest.json"))
+  })
+
+  testSync("maps each declared group to its own file", () => {
+    let out = Util_ShellConfig.fields(
+      ~computed,
+      ~bakedManifest=withJourneys(~journeys=[shopper, fulfilment]),
+    )
+    expect(out->get("journeyManifestUrls"))->toEqual(
+      JSON.Encode.object(
+        Dict.fromArray([
+          // Derived from the group, lower-cased, because a key is part of a URL.
+          ("Shopper", JSON.Encode.string("/component-manifest-shopper.json")),
+          // Named explicitly, and the declaration wins.
+          ("Fulfilment", JSON.Encode.string("/fulfilment.json")),
+        ]),
+      ),
+    )
+  })
+
+  // The URL a shell fetches and the key the bake writes are one string, derived
+  // once — a second derivation is a file written where nothing looks for it. So
+  // every key the bake writes is published, and the default one is published as
+  // `manifestUrl` rather than in the map.
+  testSync("publishes the URL of every key the bake writes, exactly once", () => {
+    let bake = withJourneys(~journeys=[shopper, fulfilment])
+    let out = Util_ShellConfig.fields(~computed, ~bakedManifest=bake)
+    let published = Array.concat(
+      out->get("manifestUrl")->JSON.Decode.string->Option.mapOr([], url => [url]),
+      out
+      ->get("journeyManifestUrls")
+      ->JSON.Decode.object
+      ->Option.getOr(Dict.make())
+      ->Dict.valuesToArray
+      ->Array.filterMap(JSON.Decode.string),
+    )
+    expect(published)->toEqual(
+      ReventlessCore.Platform_BakedManifest.files(~config=bake)->Array.map(((key, _)) =>
+        "/" ++ key
+      ),
+    )
+  })
+
+  // A passthrough cannot redirect a key the deploy computes — the same rule
+  // `manifestUrl` already carries, extended to the map beside it.
+  testSync("a shellConfig journey map fails the deploy rather than redirecting it", () => {
+    let failure = try {
+      let _ = Util_ShellConfig.fields(
+        ~computed,
+        ~bakedManifest=withJourneys(~journeys=[shopper]),
+        ~shellConfig=Dict.fromArray([
+          ("journeyManifestUrls", JSON.Encode.object(Dict.make())),
+        ]),
+      )
+      None
+    } catch {
+    | Failure(message) => Some(message)
+    }
+    switch failure {
+    | Some(message) => expect(message->String.includes("journeyManifestUrls"))->toBe(true)
+    | None => fail("a shellConfig key redirecting the computed journey map must fail the deploy")
+    }
+  })
+})
+
 describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   testSync("shell-owned keys land verbatim, under the computed ones", () => {
     let out = Util_ShellConfig.fields(

package/tests/Util_ShellConfigTest.res.mjs

@@ -1,9 +1,12 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_ShellConfig$ReventlessAws from "../src/util/Util_ShellConfig.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 let computed = [
   [
@@ -107,6 +110,103 @@ globalThis.describe("Util_ShellConfig.fields — bakedManifest", () => {
   });
 });
 
+globalThis.describe("Util_ShellConfig.fields — journeys", () => {
+  let withJourneys = journeys => ({
+    components: [{
+        plugin: "Catalog",
+        views: ["Products"],
+        commands: []
+      }],
+    journeys: journeys
+  });
+  let shopper_components = [{
+      plugin: "Catalog",
+      views: ["Products"],
+      commands: []
+    }];
+  let shopper = {
+    group: "Shopper",
+    components: shopper_components
+  };
+  let fulfilment_components = [{
+      plugin: "Ordering",
+      views: ["Orders"],
+      commands: ["ShipOrder"]
+    }];
+  let fulfilment_key = "fulfilment.json";
+  let fulfilment = {
+    group: "Fulfilment",
+    components: fulfilment_components,
+    key: fulfilment_key
+  };
+  globalThis.test("a bake declaring no journeys writes no map", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, {
+      components: [{
+          plugin: "Catalog",
+          views: ["Products"],
+          commands: []
+        }]
+    }, undefined);
+    globalThis.expect(Stdlib_Option.isNone(out["journeyManifestUrls"])).toBe(true);
+  });
+  globalThis.test("an empty journeys array is the same as none", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, withJourneys([]), undefined);
+    globalThis.expect(Stdlib_Option.isNone(out["journeyManifestUrls"])).toBe(true);
+  });
+  globalThis.test("keeps manifestUrl as the default journey", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, withJourneys([shopper]), undefined);
+    globalThis.expect(get(out, "manifestUrl")).toEqual("/component-manifest.json");
+  });
+  globalThis.test("maps each declared group to its own file", () => {
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, withJourneys([
+      shopper,
+      fulfilment
+    ]), undefined);
+    globalThis.expect(get(out, "journeyManifestUrls")).toEqual(Object.fromEntries([
+      [
+        "Shopper",
+        "/component-manifest-shopper.json"
+      ],
+      [
+        "Fulfilment",
+        "/fulfilment.json"
+      ]
+    ]));
+  });
+  globalThis.test("publishes the URL of every key the bake writes, exactly once", () => {
+    let bake = withJourneys([
+      shopper,
+      fulfilment
+    ]);
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, bake, undefined);
+    let published = Stdlib_Option.mapOr(Stdlib_JSON.Decode.string(get(out, "manifestUrl")), [], url => [url]).concat(Stdlib_Array.filterMap(Object.values(Stdlib_Option.getOr(Stdlib_JSON.Decode.object(get(out, "journeyManifestUrls")), {})), Stdlib_JSON.Decode.string));
+    globalThis.expect(published).toEqual(Platform_BakedManifest$ReventlessCore.files(bake).map(param => "/" + param[0]));
+  });
+  globalThis.test("a shellConfig journey map fails the deploy rather than redirecting it", () => {
+    let failure;
+    try {
+      Util_ShellConfig$ReventlessAws.fields(computed, undefined, withJourneys([shopper]), Object.fromEntries([[
+          "journeyManifestUrls",
+          {}
+        ]]));
+      failure = undefined;
+    } catch (raw_message) {
+      let message = Primitive_exceptions.internalToException(raw_message);
+      if (message.RE_EXN_ID === "Failure") {
+        failure = message._1;
+      } else {
+        throw message;
+      }
+    }
+    if (failure !== undefined) {
+      globalThis.expect(failure.includes("journeyManifestUrls")).toBe(true);
+      return;
+    } else {
+      return JestGlobals.fail("a shellConfig key redirecting the computed journey map must fail the deploy");
+    }
+  });
+});
+
 globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   globalThis.test("shell-owned keys land verbatim, under the computed ones", () => {
     let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, Object.fromEntries([