@reventlessdev/reventless-aws 3.0.0-alpha.304 → 3.0.0-alpha.306

package/src/util/Util_LambdaEnvBudget.res

@@ -0,0 +1,74 @@
+// Deploy-time check on a Lambda's environment size.
+//
+// AWS caps the whole environment of a function at 4096 bytes and rejects the
+// UpdateFunctionConfiguration call that exceeds it. That rejection lands in the
+// middle of a `pulumi up`, after the surrounding resources have already moved,
+// so the stack is left half-updated and the message names a byte count rather
+// than the field that grew. This has now bitten three times: `pluginDefinition`
+// inline in HANDLER_CONFIG, the DCB slice registry, and the EventCollector's
+// publishToAggregates map plus the PTA_ vars it names.
+//
+// The check runs where HANDLER_CONFIG is still a plain string — inside the
+// builders' `Pulumi.Output.apply` — because that is the last point anything is
+// measurable. By the time the env reaches `RuntimeEnvironment_Lambda`, the big
+// values are Outputs, and totalling them there would mean a bulk resolve of the
+// very dict `PluginRuntime_Builder` documents as unsafe to resolve in bulk.
+//
+// So the total is part exact, part estimated:
+//   * exact    — the fixed framework vars, HANDLER_CONFIG, and every env var NAME
+//   * estimated — one allowance per Output-valued env var, since the value (an SQS
+//                 URL) is not resolved yet
+//
+// Exceeding the limit on the exact part alone is a certainty, and fails the
+// deploy. Exceeding it only once the allowances are added is a likelihood, and
+// warns: a wrong estimate must not block a deploy that would have succeeded.
+
+let limit = 4096
+
+// Environment, NODE_OPTIONS, ESM_FALLBACK_DIRS, LOG_LEVEL,
+// REVENTLESS_ELEVATED_GROUPS — set for every Lambda by RuntimeEnvironment_Lambda.
+let frameworkVarsBytes = 191
+
+// An SQS queue URL: https://sqs.<region>.amazonaws.com/<account>/<name>[.fifo].
+// Rounded up from the longest in the example platforms, so the estimate errs
+// toward warning early rather than reporting a limit breach as headroom.
+let outputValueAllowance = 100
+
+let log = ReventlessCore.Logger.fromEnv()
+
+/**
+ * Check one Lambda's environment against the 4KB limit.
+ *
+ * `~outputValuedKeys` are env vars whose value is still an unresolved Output —
+ * counted by name plus `outputValueAllowance`. Raises when the exact portion
+ * alone is over the limit; warns when only the estimate is.
+ */
+let check = (
+  ~lambdaName: string,
+  ~handlerConfigJson: string,
+  ~outputValuedKeys: array<string>=[],
+) => {
+  let handlerConfigBytes = String.length("HANDLER_CONFIG") + String.length(handlerConfigJson)
+  let keyBytes = outputValuedKeys->Array.reduce(0, (acc, k) => acc + String.length(k))
+  let exact = frameworkVarsBytes + handlerConfigBytes + keyBytes
+  let estimated = exact + outputValuedKeys->Array.length * outputValueAllowance
+
+  if exact > limit {
+    JsError.throwWithMessage(
+      `${lambdaName}: Lambda environment is ${exact->Int.toString} bytes before the ` ++
+      `${outputValuedKeys->Array.length->Int.toString} queue-URL vars are resolved, over the ` ++
+      `${limit->Int.toString}-byte limit. HANDLER_CONFIG is ${handlerConfigBytes->Int.toString} ` ++
+      `bytes of it — move the term that grows with the plugin into a code-archive asset ` ++
+      `(Util_Bundle.buildCodeArchive ~extraStringAssets), as pluginDefinition.json and ` ++
+      `sliceModules.json already are.`,
+    )
+  } else if estimated > limit {
+    log.warn(
+      ~comp="Util_LambdaEnvBudget",
+      `${lambdaName}: Lambda environment is about ${estimated->Int.toString} bytes ` ++
+      `(${exact->Int.toString} exact + ${outputValuedKeys->Array.length->Int.toString} queue-URL ` ++
+      `vars), at or over the ${limit->Int.toString}-byte limit. The deploy may fail on ` ++
+      `UpdateFunctionConfiguration; move a plugin-sized term out of HANDLER_CONFIG.`,
+    )
+  }
+}

package/src/util/Util_LambdaEnvBudget.res.mjs

@@ -0,0 +1,37 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function check(lambdaName, handlerConfigJson, outputValuedKeysOpt) {
+  let outputValuedKeys = outputValuedKeysOpt !== undefined ? outputValuedKeysOpt : [];
+  let handlerConfigBytes = "HANDLER_CONFIG".length + handlerConfigJson.length | 0;
+  let keyBytes = Stdlib_Array.reduce(outputValuedKeys, 0, (acc, k) => acc + k.length | 0);
+  let exact = (191 + handlerConfigBytes | 0) + keyBytes | 0;
+  let estimated = exact + (outputValuedKeys.length * 100 | 0) | 0;
+  if (exact > 4096) {
+    return Stdlib_JsError.throwWithMessage(lambdaName + `: Lambda environment is ` + exact.toString() + ` bytes before the ` + (outputValuedKeys.length.toString() + ` queue-URL vars are resolved, over the `) + ((4096).toString() + `-byte limit. HANDLER_CONFIG is ` + handlerConfigBytes.toString() + ` `) + `bytes of it — move the term that grows with the plugin into a code-archive asset (Util_Bundle.buildCodeArchive ~extraStringAssets), as pluginDefinition.json and sliceModules.json already are.`);
+  } else if (estimated > 4096) {
+    return log.warn("Util_LambdaEnvBudget", undefined, lambdaName + `: Lambda environment is about ` + estimated.toString() + ` bytes ` + (`(` + exact.toString() + ` exact + ` + outputValuedKeys.length.toString() + ` queue-URL `) + (`vars), at or over the ` + (4096).toString() + `-byte limit. The deploy may fail on `) + `UpdateFunctionConfiguration; move a plugin-sized term out of HANDLER_CONFIG.`);
+  } else {
+    return;
+  }
+}
+
+let limit = 4096;
+
+let frameworkVarsBytes = 191;
+
+let outputValueAllowance = 100;
+
+export {
+  limit,
+  frameworkVarsBytes,
+  outputValueAllowance,
+  log,
+  check,
+}
+/* log Not a pure module */

package/tests/AWS_TagsTest.res

@@ -3,7 +3,7 @@ open JestGlobals
 // Guards the resource-attribution tag schema. A downstream inventory answers
 // "which model component owns this resource, in what role, at what scope" purely
 // from these keys, so the key set and its namespacing are load-bearing.
-// See docs/plans/resource-attribution-tag-schema.md.
+// See docs/plans/done/resource-attribution-tag-schema.md.
 
 module Attribution = ReventlessCore.ResourceAttribution
 
@@ -95,7 +95,7 @@ describe("AWS_Tags — owner overrides the piece adapter's own kind", () => {
   // The piece adapters pass their OWN ComponentType as ~kind, which names the
   // piece and so collapses onto ~role. A QueryDb is instantiated by six different
   // component kinds, so without the owner a reader cannot tell a ReadModel's
-  // table from a StateViewSlice's. See docs/plans/resource-attribution-owner-kind.md.
+  // table from a StateViewSlice's. See docs/plans/done/resource-attribution-owner-kind.md.
   let queryDbTagsFor = (~owner=?) =>
     AWS_Tags.make(
       ~name="ProductsQueryDb",

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -76,6 +76,11 @@ let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
 let lambdaConfigOf = input =>
   input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
 
+/** The `PreTokenGenerationConfig` an attach is expected to write: our ARN, at the
+    only version the trigger handler implements. */
+let v1Config = arn =>
+  Dict.fromArray([("LambdaArn", str(arn)), ("LambdaVersion", str("V1_0"))])->JSON.Encode.object
+
 describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(~preTokenGenerationArn=Some(triggerArn))
 
@@ -192,8 +197,105 @@ describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothin
       ~preTokenGenerationArn=Some(triggerArn),
     )
     expect(lambdaConfigOf(input))->toEqual(
-      Some(Dict.fromArray([("PreTokenGeneration", str(triggerArn))])),
+      Some(
+        Dict.fromArray([
+          ("PreTokenGeneration", str(triggerArn)),
+          ("PreTokenGenerationConfig", v1Config(triggerArn)),
+        ]),
+      ),
+    )
+  })
+})
+
+// 🚨 The pool shape that took the deploy down. Cognito carries this one trigger
+// in two fields, and `UpdateUserPool` rejects the call when both are present
+// naming different functions. Nothing in this suite carried a
+// `PreTokenGenerationConfig` before, which is exactly why it shipped.
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
+
+  let describedWithConfig = (~version) =>
+    Dict.fromArray([
+      ("Name", str("CustomerPool")),
+      (
+        "LambdaConfig",
+        Dict.fromArray([
+          ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+          ("PreTokenGeneration", str(theirArn)),
+          (
+            "PreTokenGenerationConfig",
+            Dict.fromArray([
+              ("LambdaArn", str(theirArn)),
+              ("LambdaVersion", str(version)),
+            ])->JSON.Encode.object,
+          ),
+        ])->JSON.Encode.object,
+      ),
+    ])
+
+  let attachOnto = (~version) =>
+    Attachment.mergedUpdateInput(
+      ~described=describedWithConfig(~version),
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
+    )
+
+  // The property AWS enforces, asserted directly rather than through its error
+  // text: the two fields must name the same function.
+  testSync("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto(~version="V1_0"))
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaArn")),
+    ))->toEqual((Some(str(triggerArn)), Some(str(triggerArn))))
+  })
+
+  // A pool left on V2_0 does not fail — the handler answers in V1_0 shape and
+  // Cognito ignores it, so tokens mint un-narrowed and nothing reports it.
+  testSync("a pool that arrived on V2_0 is pinned back to the version we implement", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V2_0"))
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaVersion")),
+    )->toEqual(Some(str("V1_0")))
+  )
+
+  testSync("the customer's other triggers still survive", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V1_0"))->Option.flatMap(c => c->Dict.get("PreSignUp")),
+    )->toEqual(Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")))
+  )
+
+  testSync("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(
+      Attachment.mergedUpdateInput(
+        ~described=describedWithConfig(~version="V1_0"),
+        ~userPoolId="eu-west-1_abc123",
+        ~preTokenGenerationArn=None,
+      ),
+    )
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig")),
+    ))->toEqual((None, None))
+  })
+
+  // The fixpoint property, and the one that would have caught this: AWS
+  // materialises whichever field the merge did not write, so the merge has to
+  // accept its own output unchanged or a later deploy fails with nothing altered
+  // but the service normalising its own record.
+  testSync("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto(~version="V1_0")
+    let twice = Attachment.mergedUpdateInput(
+      ~described=once,
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
     )
+    expect(lambdaConfigOf(twice))->toEqual(lambdaConfigOf(once))
   })
 })
 
@@ -208,6 +310,43 @@ describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
       None,
     )
   )
+
+  testSync("reads the V2 field on a pool that only carries that one", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([("PreTokenGenerationConfig", v1Config(triggerArn))])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(Some(triggerArn))
+  )
+
+  // Our own ARN, at a version the handler does not speak. Reporting it as
+  // attached would leave a pool minting un-narrowed tokens looking correct
+  // forever; reporting none makes it drift the next `up` repairs.
+  testSync("reports none for our trigger held at a version we do not implement", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([
+              (
+                "PreTokenGenerationConfig",
+                Dict.fromArray([
+                  ("LambdaArn", str(triggerArn)),
+                  ("LambdaVersion", str("V2_0")),
+                ])->JSON.Encode.object,
+              ),
+            ])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(None)
+  )
 })
 
 // The pre-attach check. Its whole job is to keep a trigger that cannot run off a

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -119,6 +119,19 @@ function lambdaConfigOf(input) {
   return Stdlib_Option.flatMap(input["LambdaConfig"], Stdlib_JSON.Decode.object);
 }
 
+function v1Config(arn) {
+  return Object.fromEntries([
+    [
+      "LambdaArn",
+      arn
+    ],
+    [
+      "LambdaVersion",
+      "V1_0"
+    ]
+  ]);
+}
+
 globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(triggerArn);
   globalThis.test("MFA stays on rather than defaulting off", () => {
@@ -200,10 +213,84 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool
         "Name",
         "Bare"
       ]]), "eu-west-1_bare", triggerArn);
-    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([[
+    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([
+      [
         "PreTokenGeneration",
         triggerArn
-      ]]));
+      ],
+      [
+        "PreTokenGenerationConfig",
+        v1Config(triggerArn)
+      ]
+    ]));
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken";
+  let describedWithConfig = version => Object.fromEntries([
+    [
+      "Name",
+      "CustomerPool"
+    ],
+    [
+      "LambdaConfig",
+      Object.fromEntries([
+        [
+          "PreSignUp",
+          "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp"
+        ],
+        [
+          "PreTokenGeneration",
+          theirArn
+        ],
+        [
+          "PreTokenGenerationConfig",
+          Object.fromEntries([
+            [
+              "LambdaArn",
+              theirArn
+            ],
+            [
+              "LambdaVersion",
+              version
+            ]
+          ])
+        ]
+      ])
+    ]
+  ]);
+  let attachOnto = version => Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig(version), "eu-west-1_abc123", triggerArn);
+  globalThis.test("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto("V1_0"));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaArn"])
+    ]).toEqual([
+      triggerArn,
+      triggerArn
+    ]);
+  });
+  globalThis.test("a pool that arrived on V2_0 is pinned back to the version we implement", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V2_0")), c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaVersion"])).toEqual("V1_0");
+  });
+  globalThis.test("the customer's other triggers still survive", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V1_0")), c => c["PreSignUp"])).toEqual("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp");
+  });
+  globalThis.test("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig("V1_0"), "eu-west-1_abc123", undefined));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"])
+    ]).toEqual([
+      undefined,
+      undefined
+    ]);
+  });
+  globalThis.test("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto("V1_0");
+    let twice = Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(once, "eu-west-1_abc123", triggerArn);
+    globalThis.expect(lambdaConfigOf(twice)).toEqual(lambdaConfigOf(once));
   });
 });
 
@@ -217,6 +304,33 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
         "Bare"
       ]]))).toEqual(undefined);
   });
+  globalThis.test("reads the V2 field on a pool that only carries that one", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            v1Config(triggerArn)
+          ]])
+      ]]))).toEqual(triggerArn);
+  });
+  globalThis.test("reports none for our trigger held at a version we do not implement", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            Object.fromEntries([
+              [
+                "LambdaArn",
+                triggerArn
+              ],
+              [
+                "LambdaVersion",
+                "V2_0"
+              ]
+            ])
+          ]])
+      ]]))).toEqual(undefined);
+  });
 });
 
 globalThis.describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
@@ -259,5 +373,6 @@ export {
   merged,
   triggerArn,
   lambdaConfigOf,
+  v1Config,
 }
 /*  Not a pure module */

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -440,7 +440,7 @@ describe("Runtime.buildConditionalTransactItems — composite partition fences o
   // pluginName}. The read is one exact `tag_composite` match, so the fence must be
   // a SINGLE composite-key fence — not one per member. Per-member fencing made the
   // low-cardinality prefix (`environment`, `platformName`) hot under a deploy
-  // fan-out. Plan: docs/plans/Backlog/dcb-hot-tag-fence-contention.md.
+  // fan-out. Plan: docs/plans/done/dcb-hot-tag-fence-contention.md.
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,
     data: JSON.Object(Dict.make()),
@@ -563,7 +563,7 @@ describe("Runtime.toItem — an empty tag value skips its GSI attribute", () =>
   // `tag_<key>` is a GSI hash key, and DynamoDB rejects an empty string for a key
   // attribute — writing one fails the whole append. An empty value is legitimate
   // (an absent composite-partition member), so the attribute is skipped and that
-  // index goes sparse. See docs/plans/dcb-empty-tag-values-break-append.md.
+  // index goes sparse. See docs/plans/done/dcb-empty-tag-values-break-append.md.
   let tagOf = (key, value): Reventless.DcbTag.tag => {key, value}
   let tags = [tagOf("environment", "prod"), tagOf("componentName", "")]
   let storedEvent: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {

package/tests/EventCollectorEntryPoint_OpsTest.res

@@ -107,7 +107,6 @@ let minimalConfig = (extras: array<(string, JSON.t)>): string =>
       ("schedulerQueueName", str("")),
       ("extensionPoints", JSON.Encode.array([])),
       ("extensions", JSON.Encode.array([])),
-      ("publishToAggregates", obj([])),
     ],
     extras,
   )
@@ -139,7 +138,6 @@ describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
     let c = EventCollectorEntryPoint_Ops.parseHandlerConfig(minimalConfig([]))
     expect(c.queueUrl)->toBe("q-url")
     expect(c.connectExtension->Option.isNone)->toBe(true) // absent → None
-    expect(c.readModelQueueUrls->Dict.keysToArray->Array.length)->toBe(0)
     expect(c.readModelNamesForSourceName->Dict.keysToArray->Array.length)->toBe(0)
   })
 
@@ -198,7 +196,6 @@ describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
             ]),
           ]),
         ),
-        ("publishToAggregates", obj([("Plugin", str("PTA_Plugin_QUEUE_URL"))])),
         (
           "readModelNamesForSourceName",
           obj([("Ordering.Orders", JSON.Encode.array([str("ProductDemands")]))]),
@@ -208,9 +205,21 @@ describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
     let ep = c.extensionPoints->Array.getUnsafe(0)
     expect(ep.eventTopicArn)->toBe("arn:ep")
     expect(ep.aggregateNames)->toEqual(["Plugin"])
-    expect(c.publishToAggregates->Dict.get("Plugin"))->toEqual(Some("PTA_Plugin_QUEUE_URL"))
     expect(c.readModelNamesForSourceName->Dict.get("Ordering.Orders"))->toEqual(
       Some(["ProductDemands"]),
     )
   })
+
+  // The target→env-var maps left HANDLER_CONFIG for queueUrls.json, so a config
+  // still carrying them must parse rather than trip the required-field check —
+  // that is what a Lambda running an older archive sends.
+  testSync("ignores publishToAggregates left over in HANDLER_CONFIG", () => {
+    let c = EventCollectorEntryPoint_Ops.parseHandlerConfig(
+      minimalConfig([
+        ("publishToAggregates", obj([("Plugin", str("PTA_Plugin_QUEUE_URL"))])),
+        ("readModelQueueUrls", obj([("ProductDemands", str("PRM_ProductDemands_QUEUE_URL"))])),
+      ]),
+    )
+    expect(c.queueUrl)->toBe("q-url")
+  })
 })

package/tests/EventCollectorEntryPoint_OpsTest.res.mjs

@@ -210,10 +210,6 @@ function minimalConfig(extras) {
     [
       "extensions",
       []
-    ],
-    [
-      "publishToAggregates",
-      Object.fromEntries([])
     ]
   ].concat(extras)));
 }
@@ -238,7 +234,6 @@ globalThis.describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
     let c = EventCollectorEntryPoint_Ops$ReventlessAws.parseHandlerConfig(minimalConfig([]));
     globalThis.expect(c.queueUrl).toBe("q-url");
     globalThis.expect(Stdlib_Option.isNone(c.connectExtension)).toBe(true);
-    globalThis.expect(Object.keys(c.readModelQueueUrls).length).toBe(0);
     globalThis.expect(Object.keys(c.readModelNamesForSourceName).length).toBe(0);
   });
   globalThis.test("connectExtension: JSON null (admin) maps to None; a record decodes", () => {
@@ -304,13 +299,6 @@ globalThis.describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
             ]
           ])]
       ],
-      [
-        "publishToAggregates",
-        Object.fromEntries([[
-            "Plugin",
-            "PTA_Plugin_QUEUE_URL"
-          ]])
-      ],
       [
         "readModelNamesForSourceName",
         Object.fromEntries([[
@@ -322,9 +310,27 @@ globalThis.describe("EventCollectorEntryPoint_Ops.parseHandlerConfig", () => {
     let ep = c.extensionPoints[0];
     globalThis.expect(ep.eventTopicArn).toBe("arn:ep");
     globalThis.expect(ep.aggregateNames).toEqual(["Plugin"]);
-    globalThis.expect(c.publishToAggregates["Plugin"]).toEqual("PTA_Plugin_QUEUE_URL");
     globalThis.expect(c.readModelNamesForSourceName["Ordering.Orders"]).toEqual(["ProductDemands"]);
   });
+  globalThis.test("ignores publishToAggregates left over in HANDLER_CONFIG", () => {
+    let c = EventCollectorEntryPoint_Ops$ReventlessAws.parseHandlerConfig(minimalConfig([
+      [
+        "publishToAggregates",
+        Object.fromEntries([[
+            "Plugin",
+            "PTA_Plugin_QUEUE_URL"
+          ]])
+      ],
+      [
+        "readModelQueueUrls",
+        Object.fromEntries([[
+            "ProductDemands",
+            "PRM_ProductDemands_QUEUE_URL"
+          ]])
+      ]
+    ]));
+    globalThis.expect(c.queueUrl).toBe("q-url");
+  });
 });
 
 let project = EventCollectorEntryPoint_Ops$ReventlessAws.projectPluginRow;

package/tests/EventLogStorage_DynamoDb_RuntimeTest.res

@@ -57,7 +57,7 @@ describe("Runtime.buildTransactItems", () => {
   })
 })
 
-// ─── Aggregate snapshots (docs/plans/aggregate-snapshotting.md) ───
+// ─── Aggregate snapshots (docs/plans/done/aggregate-snapshotting.md) ───
 
 describe("Runtime.replayQueryInput", () => {
   testSync("default bounds cover exactly the zero-padded event range", () => {

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,6 +1,6 @@
 open JestGlobals
 
-// Regression guard for docs/plans/platform-plugins-admin-connection-null-rows.md:
+// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
 // the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
 // (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
 // The auto-generated Connection Scan must exclude them, or `name: String!` resolves
@@ -39,7 +39,7 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/aws-scan-connection-cursor-roundtrip.md. The Scan
+// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
 // resolver's cursor must round-trip DynamoDB's own continuation token, not a
 // synthetic index — every list past page 1 was unreachable before this.
 describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {

package/tests/Util_BundleEsmLoaderTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // load-bearing contract: every code archive that ships the loader files MUST set
 // NODE_OPTIONS=--import pointing at the shipped register-hook.mjs, and the two
 // files must keep cross-referencing each other by the exact filenames used here.
-// See docs/plans/deployed-lambda-esm-self-containment.md.
+// See docs/plans/done/deployed-lambda-esm-self-containment.md.
 
 describe("Util_Bundle ESM loader — env-var contract", () => {
   testSync("NODE_OPTIONS --imports the shipped register-hook file by name", () => {

package/tests/Util_BundleRuntimeExtensionTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // packages its runtime import graph reaches (`companionModuleUrls`), the
 // bundler carries them into the archive, and the archive build fails loudly on
 // any statically imported package that would not resolve at cold start. See
-// docs/plans/runtime-extension-companion-packages.md.
+// docs/plans/done/runtime-extension-companion-packages.md.
 
 // realpath because macOS hands out /var/... symlinks for tmpdir while the
 // package-root walk reports paths as given.