@reventlessdev/reventless-aws 3.0.0-alpha.333 → 3.0.0-alpha.335

package/src/capability/Capability_Messaging_Ses.res

@@ -1,10 +1,11 @@
-// A verified SES sender identity, provisioned with the framework's house
-// conventions applied — the backing for the messaging capability's email channel.
+// A verified SES sender identity — the email channel's real transport.
 //
-// The identity is the whole of the provisioning: SES sends from a verified
-// address, and everything else a send needs travels on the message. So this
-// helper exists to make the sender a deploy-time decision with one owner rather
-// than an environment variable each stack spells for itself.
+// Provisioning only. Which transport a deployment uses, and what address it
+// sends from, are read by `Capability_Messaging`, which is the entry point a
+// platform root calls; this module receives a resolved address and creates the
+// identity for it. Split that way because a deployment can choose *not* to have
+// an SES identity, and a module that read its own config could not be left
+// uncalled without also leaving the config unread.
 //
 // **Verification is not instant and not automatic.** Creating the identity asks
 // AWS to send a confirmation mail to the address; until somebody follows it, SES
@@ -18,14 +19,26 @@
 
 open PulumiAws
 
-/** Declare the sender address and hand back the platform's messaging handle.
-    `~email` is the `From:` every message this deployment sends carries. */
-let make = (
+/**
+Create the identity and hand back the `From:` it sends as.
+
+`~name` is the Pulumi resource name — a URN rather than a setting, so it stays in
+code: moving it to config would replace the resource whenever a stack spelled it
+differently.
+
+The identity is created for the bare address, because SES verifies an address and
+not a header; the display name is applied afterwards, to the value the send path
+reads. Applied over the identity's own output rather than over the configured
+string, so the sender a Lambda is handed still depends on the resource existing.
+*/
+let emailSender = (
   ~name: string,
-  ~email: string,
+  ~address: string,
+  ~displayName: option<string>,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
-): ReventlessInfra.Platform.messagingSender => {
-  let identity = SES.EmailIdentity.make(~name, ~args={email: email}, ~opts?)
-
-  {emailSender: identity.email->Pulumi.Output.asInput}
+): Pulumi.Input.t<string> => {
+  let identity = SES.EmailIdentity.make(~name, ~args={email: address}, ~opts?)
+  identity.email
+  ->Pulumi.Output.apply(verified => Reventless.Messaging.fromHeader(~displayName, ~address=verified))
+  ->Pulumi.Output.asInput
 }

package/src/capability/Capability_Messaging_Ses.res.mjs

@@ -2,17 +2,16 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Messaging$Reventless from "@reventlessdev/reventless-spec/src/semantic/Messaging.res.mjs";
 
-function make(name, email, opts) {
+function emailSender(name, address, displayName, opts) {
   let identity = new (Aws.ses.EmailIdentity)(name, {
-    email: email
+    email: address
   }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
-  return {
-    emailSender: identity.email
-  };
+  return identity.email.apply(verified => Messaging$Reventless.fromHeader(displayName, verified));
 }
 
 export {
-  make,
+  emailSender,
 }
 /* @pulumi/aws Not a pure module */

package/src/util/Util_Bundle.res

@@ -349,6 +349,126 @@ let isRuntimeProvided = (specifier: string, ~pkgName: string): bool =>
     }
   )
 
+// Memo for isFrameworkPackage — one require.resolve per package name per deploy.
+let frameworkPackageCache: dict<bool> = Dict.make()
+
+/**
+ * Whether the framework's own module resolution reaches this package: the
+ * deploy-time stand-in for "the Lambda layer already carries it", since the
+ * layer is built from reventless-aws's dependency closure.
+ *
+ * Deliberately framework-rooted only — no Pulumi-project fallback. The question
+ * here is the opposite of `resolvePackageRoot`'s: a package the *project*
+ * resolves but the framework does not is precisely a user package, which is
+ * what the closure walk below must treat as a starting point rather than as
+ * something the runtime provides.
+ */
+let isFrameworkPackage = (pkgName: string): bool =>
+  switch frameworkPackageCache->Dict.get(pkgName) {
+  | Some(known) => known
+  | None =>
+    let known = try {
+      let _ = localRequire->NodeModule.requireResolve(pkgName ++ "/package.json")
+      true
+    } catch {
+    | _ => false
+    }
+    frameworkPackageCache->Dict.set(pkgName, known)
+    known
+  }
+
+// The distinct bare packages a package's own bundled files import, memoised per
+// package root: the same file set the archive carries, so what is scanned is
+// what is deployed.
+let importedPackagesCache: dict<array<string>> = Dict.make()
+let importedPackages = (packageRoot: string): array<string> =>
+  switch importedPackagesCache->Dict.get(packageRoot) {
+  | Some(names) => names
+  | None =>
+    let assets: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+    let paths: array<(string, string)> = []
+    walkDir(~dir=packageRoot, ~prefix="", ~assets, ~paths)
+    let names: array<string> = []
+    paths->Array.forEach(((relPath, absPath)) =>
+      if relPath->String.endsWith(".mjs") || relPath->String.endsWith(".js") {
+        NodeFs.readFileSync(absPath)
+        ->staticImportSpecifiers
+        ->Array.forEach(specifier =>
+          if isBareSpecifier(specifier) {
+            let name = extractPackageName(specifier)
+            if !(names->Array.includes(name)) {
+              names->Array.push(name)
+            }
+          }
+        )
+      }
+    )
+    importedPackagesCache->Dict.set(packageRoot, names)
+    names
+  }
+
+/**
+ * Resolve a package root as the importing package would — from that package's
+ * own directory. Under pnpm a plugin's dependency is reachable only from the
+ * plugin, never from the framework or the Pulumi project, so this is the one
+ * rooting that finds it. `None` when nothing is installed there: the archive
+ * cannot carry what is not on disk, and a package the code truly imported at
+ * runtime would already be failing today.
+ */
+let resolvePackageRootFrom = (~fromRoot: string, pkgName: string): option<string> =>
+  try {
+    Some(
+      NodePath.dirname(
+        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))
+        ->NodeModule.requireResolve(pkgName ++ "/package.json"),
+      ),
+    )
+  } catch {
+  | _ => None
+  }
+
+/**
+ * Carry every package a bundled *user* package imports into the archive, and
+ * every package those import in turn.
+ *
+ * A plugin package rides in `/var/task/node_modules/<plugin>`, but its own
+ * dependencies do not: the layer holds reventless-aws's closure, which a domain
+ * trait or any other plugin-level library is by definition outside of. The
+ * import then fails at the first command the slice handles — a green deploy and
+ * a `Cannot find package` at runtime.
+ *
+ * Framework packages are the starting points that are skipped, not walked:
+ * their closure is the layer's, and their sources reach deploy-time-only
+ * imports (the @pulumi bindings) that no Lambda loads — walking them would add
+ * tens of megabytes to every archive.
+ */
+let addImportedPackageClosure = (packageDirs: dict<string>): unit => {
+  let pending =
+    packageDirs->Dict.toArray->Array.filter(((pkgName, _)) => !isFrameworkPackage(pkgName))
+  let next = ref(0)
+  while next.contents < pending->Array.length {
+    let (_, pkgRoot) = pending->Array.getUnsafe(next.contents)
+    next := next.contents + 1
+    importedPackages(pkgRoot)->Array.forEach(dep =>
+      if (
+        !(packageDirs->Dict.has(dep)) &&
+        !(dep->String.startsWith("node:")) &&
+        !(nodeBuiltins->Set.has(dep)) &&
+        !(dep->String.startsWith("@aws-sdk/")) &&
+        !(dep->String.startsWith("@smithy/")) &&
+        !isFrameworkPackage(dep)
+      ) {
+        switch resolvePackageRootFrom(~fromRoot=pkgRoot, dep) {
+        | Some(depRoot) =>
+          packageDirs->Dict.set(dep, depRoot)
+          pending->Array.push((dep, depRoot))
+        | None => ()
+        }
+      }
+    )
+  }
+}
+
 /**
  * Deploy-time guard: every bare package statically imported by a bundled
  * runtime-extension (or companion) package must either be in the archive
@@ -451,7 +571,12 @@ let buildCodeArchive = (
   // deploy whose extensions are silently skipped.
   if bundleRuntimeExtensions {
     let extensionPackages = allPackageDirs->addRuntimeExtensionPackages
+    // The closure runs first so a companion package that is simply a static
+    // import of the extension is already bundled by the time the guard looks.
+    allPackageDirs->addImportedPackageClosure
     assertRuntimeExtensionImportsResolvable(~extensionPackages, ~bundledPackages=allPackageDirs)
+  } else {
+    allPackageDirs->addImportedPackageClosure
   }
   let packageContentHashes: ref<array<string>> = ref([])
   allPackageDirs->Dict.forEachWithKey((pkgRoot, pkgName) => {

package/src/util/Util_Bundle.res.mjs

@@ -232,6 +232,87 @@ function isRuntimeProvided(specifier, pkgName) {
   }
 }
 
+let frameworkPackageCache = {};
+
+function isFrameworkPackage(pkgName) {
+  let known = frameworkPackageCache[pkgName];
+  if (known !== undefined) {
+    return known;
+  }
+  let known$1;
+  try {
+    localRequire.resolve(pkgName + "/package.json");
+    known$1 = true;
+  } catch (exn) {
+    known$1 = false;
+  }
+  frameworkPackageCache[pkgName] = known$1;
+  return known$1;
+}
+
+let importedPackagesCache = {};
+
+function importedPackages(packageRoot) {
+  let names = importedPackagesCache[packageRoot];
+  if (names !== undefined) {
+    return names;
+  }
+  let assets = {};
+  let paths = [];
+  walkDir(packageRoot, "", assets, paths);
+  let names$1 = [];
+  paths.forEach(param => {
+    let relPath = param[0];
+    if (relPath.endsWith(".mjs") || relPath.endsWith(".js")) {
+      staticImportSpecifiers(Nodefs.readFileSync(param[1], "utf8")).forEach(specifier => {
+        if (!isBareSpecifier(specifier)) {
+          return;
+        }
+        let name = extractPackageName(specifier);
+        if (!names$1.includes(name)) {
+          names$1.push(name);
+          return;
+        }
+      });
+      return;
+    }
+  });
+  importedPackagesCache[packageRoot] = names$1;
+  return names$1;
+}
+
+function resolvePackageRootFrom(fromRoot, pkgName) {
+  try {
+    return Nodepath.dirname(Nodemodule.createRequire(Nodepath.join(fromRoot, "index.js")).resolve(pkgName + "/package.json"));
+  } catch (exn) {
+    return;
+  }
+}
+
+function addImportedPackageClosure(packageDirs) {
+  let pending = Object.entries(packageDirs).filter(param => !isFrameworkPackage(param[0]));
+  let next = 0;
+  while (next < pending.length) {
+    let match = pending[next];
+    let pkgRoot = match[1];
+    next = next + 1 | 0;
+    importedPackages(pkgRoot).forEach(dep => {
+      if (dep in packageDirs || dep.startsWith("node:") || nodeBuiltins.has(dep) || dep.startsWith("@aws-sdk/") || dep.startsWith("@smithy/") || isFrameworkPackage(dep)) {
+        return;
+      }
+      let depRoot = resolvePackageRootFrom(pkgRoot, dep);
+      if (depRoot !== undefined) {
+        packageDirs[dep] = depRoot;
+        pending.push([
+          dep,
+          depRoot
+        ]);
+        return;
+      }
+    });
+  };
+}
+
 function assertRuntimeExtensionImportsResolvable(extensionPackages, bundledPackages) {
   Stdlib_Dict.forEachWithKey(extensionPackages, (pkgRoot, pkgName) => {
     let assets = {};
@@ -275,7 +356,10 @@ function buildCodeArchive(entryPointModule, packageDirs, extraStringAssetsOpt, b
   }
   if (bundleRuntimeExtensions) {
     let extensionPackages = addRuntimeExtensionPackages(allPackageDirs);
+    addImportedPackageClosure(allPackageDirs);
     assertRuntimeExtensionImportsResolvable(extensionPackages, allPackageDirs);
+  } else {
+    addImportedPackageClosure(allPackageDirs);
   }
   let packageContentHashes = {
     contents: []
@@ -326,6 +410,12 @@ export {
   isBareSpecifier,
   nodeBuiltins,
   isRuntimeProvided,
+  frameworkPackageCache,
+  isFrameworkPackage,
+  importedPackagesCache,
+  importedPackages,
+  resolvePackageRootFrom,
+  addImportedPackageClosure,
   assertRuntimeExtensionImportsResolvable,
   buildCodeArchive,
 }

package/tests/Capability_MessagingTest.res

@@ -0,0 +1,100 @@
+open JestGlobals
+
+// Which transport a stack mails through, and who it sends as. There is no
+// default address: a placeholder would provision an identity nobody can verify,
+// so "unset" has to survive the whole way to the deploy gate as absence rather
+// than as an address.
+
+module Messaging = Capability_Messaging
+
+let withEnv = (key, value, f) => {
+  Dict.set(NodeProcess.env, key, value)
+  let result = f()
+  Dict.delete(NodeProcess.env, key)
+  result
+}
+
+describe("Capability_Messaging — reading a configured value", () => {
+  // Only the env-var rung is reachable here: the rungs below it end at
+  // `Pulumi.Config`, which needs a deploy-time runtime this suite does not have.
+  // `configured` returns before touching it whenever the variable is set.
+  testSync("an address set in the environment is the sender", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "mail@shop.test", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(Some("mail@shop.test"))
+  })
+
+  // A stray `REVENTLESS_MESSAGING_EMAIL_SENDER=` in CI, or a blank line in the
+  // sidecar. Reading it as an address asks SES for an identity with none.
+  testSync("an empty value is not an address", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(None)
+  })
+
+  // The one that is not obviously empty: a key left with a space after the colon.
+  // It reached SES as an identity request for " " before this was trimmed.
+  testSync("a whitespace-only value is not an address either", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "   ", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(None)
+  })
+
+  testSync("a surviving value is the trimmed one", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "  mail@shop.test  ", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(Some("mail@shop.test"))
+  })
+
+  testSync("the sms sender reads off its own key", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_SMS_SENDER", "+15550100", () =>
+      Messaging.configured(Messaging.smsSenderKey)
+    )
+    expect(sender)->toEqual(Some("+15550100"))
+  })
+})
+
+describe("Capability_Messaging — choosing a transport", () => {
+  testSync("ses and log are the two a stack can name", () => {
+    let pair: (Messaging.emailProvider, Messaging.emailProvider) = (Ses, Log)
+    expect((Messaging.parseEmailProvider("ses"), Messaging.parseEmailProvider("log")))->toEqual(pair)
+  })
+
+  // Config files are written by hand; a capitalised or padded value means what it
+  // says, and refusing it would be pedantry rather than safety.
+  testSync("the value is read case- and whitespace-insensitively", () => {
+    expect(Messaging.parseEmailProvider("  LOG "))->toEqual(Messaging.Log)
+  })
+
+  // The one that matters: defaulting a typo to SES would provision a real
+  // identity for a stack that asked to only log.
+  testSync("an unrecognised transport is refused, not defaulted", () => {
+    let outcome = try {
+      let _ = Messaging.parseEmailProvider("smtp")
+      None
+    } catch {
+    | JsExn(e) => e->JsExn.message
+    }
+    expect(outcome->Option.getOr("")->String.includes("is not an email provider"))->toBe(true)
+  })
+
+  // SES is the default so that a deployment saying nothing still mails: a stack
+  // that means not to send says so, rather than silence meaning it.
+  testSync("a named transport wins over the default", () => {
+    let chosen = withEnv("REVENTLESS_MESSAGING_EMAIL_PROVIDER", "log", () => Messaging.emailProvider())
+    let expected: Messaging.emailProvider = Log
+    expect(chosen)->toEqual(expected)
+  })
+})
+
+describe("Capability_Messaging — the log transport's default sender", () => {
+  // Hard-coded where the SES address is required, because a logged message
+  // reaches nobody. `.test` can never resolve, so it cannot be a real inbox.
+  testSync("is a reserved address", () => {
+    expect(Messaging.logDefaultAddress->String.endsWith(".test"))->toBe(true)
+  })
+})

package/tests/Capability_MessagingTest.res.mjs

@@ -0,0 +1,85 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Capability_Messaging$ReventlessAws from "../src/capability/Capability_Messaging.res.mjs";
+
+function withEnv(key, value, f) {
+  process.env[key] = value;
+  let result = f();
+  Stdlib_Dict.$$delete(process.env, key);
+  return result;
+}
+
+globalThis.describe("Capability_Messaging — reading a configured value", () => {
+  globalThis.test("an address set in the environment is the sender", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "mail@shop.test", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual("mail@shop.test");
+  });
+  globalThis.test("an empty value is not an address", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual(undefined);
+  });
+  globalThis.test("a whitespace-only value is not an address either", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "   ", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual(undefined);
+  });
+  globalThis.test("a surviving value is the trimmed one", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "  mail@shop.test  ", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual("mail@shop.test");
+  });
+  globalThis.test("the sms sender reads off its own key", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_SMS_SENDER", "+15550100", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.smsSenderKey));
+    globalThis.expect(sender).toEqual("+15550100");
+  });
+});
+
+globalThis.describe("Capability_Messaging — choosing a transport", () => {
+  globalThis.test("ses and log are the two a stack can name", () => {
+    globalThis.expect([
+      Capability_Messaging$ReventlessAws.parseEmailProvider("ses"),
+      Capability_Messaging$ReventlessAws.parseEmailProvider("log")
+    ]).toEqual([
+      "Ses",
+      "Log"
+    ]);
+  });
+  globalThis.test("the value is read case- and whitespace-insensitively", () => {
+    globalThis.expect(Capability_Messaging$ReventlessAws.parseEmailProvider("  LOG ")).toEqual("Log");
+  });
+  globalThis.test("an unrecognised transport is refused, not defaulted", () => {
+    let outcome;
+    try {
+      Capability_Messaging$ReventlessAws.parseEmailProvider("smtp");
+      outcome = undefined;
+    } catch (raw_e) {
+      let e = Primitive_exceptions.internalToException(raw_e);
+      if (e.RE_EXN_ID === "JsExn") {
+        outcome = Stdlib_JsExn.message(e._1);
+      } else {
+        throw e;
+      }
+    }
+    globalThis.expect(Stdlib_Option.getOr(outcome, "").includes("is not an email provider")).toBe(true);
+  });
+  globalThis.test("a named transport wins over the default", () => {
+    let chosen = withEnv("REVENTLESS_MESSAGING_EMAIL_PROVIDER", "log", () => Capability_Messaging$ReventlessAws.emailProvider());
+    globalThis.expect(chosen).toEqual("Log");
+  });
+});
+
+globalThis.describe("Capability_Messaging — the log transport's default sender", () => {
+  globalThis.test("is a reserved address", () => {
+    globalThis.expect(Capability_Messaging$ReventlessAws.logDefaultAddress.endsWith(".test")).toBe(true);
+  });
+});
+
+let Messaging;
+
+export {
+  Messaging,
+  withEnv,
+}
+/*  Not a pure module */

package/tests/Util_BundleDependencyClosureTest.res

@@ -0,0 +1,111 @@
+open JestGlobals
+
+// A plugin package rides in the code archive, but its own dependencies used to
+// stay behind: the layer carries reventless-aws's closure, and a domain trait
+// (or any other plugin-level library) is outside it. The archive build now
+// walks what a bundled user package actually imports.
+
+let mkTmpRoot = (prefix: string) =>
+  NodeFs.realpathSync(NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), prefix])))
+
+let writePkg = (~root: string, ~name: string, files: array<(string, string)>): string => {
+  NodeFs.mkdirSync(root, {recursive: true})
+  NodeFs.writeFileSync(
+    NodePath.join([root, "package.json"]),
+    `{"name":"${name}","version":"1.0.0"}`,
+  )
+  files->Array.forEach(((relPath, content)) => {
+    let abs = NodePath.join([root, relPath])
+    NodeFs.mkdirSync(NodePath.dirname(abs), {recursive: true})
+    NodeFs.writeFileSync(abs, content)
+  })
+  root
+}
+
+// A user package whose slice imports a trait, the trait imports a rules
+// package, and both are installed only under the user package — the pnpm shape,
+// where nothing but the importer can resolve them.
+let hostName = "@fixture/closure-host"
+let traitName = "@fixture/closure-trait"
+let rulesName = "@fixture/closure-rules"
+
+let hostRoot = mkTmpRoot("bundle-closure-")
+let traitRoot = NodePath.join([hostRoot, "node_modules", traitName])
+let rulesRoot = NodePath.join([hostRoot, "node_modules", rulesName])
+
+let _ = writePkg(
+  ~root=hostRoot,
+  ~name=hostName,
+  [
+    (
+      "src/Slice.res.mjs",
+      `import * as Trait from "${traitName}";
+import * as Sury from "sury";
+import * as Fs from "node:fs";
+import * as Path from "path";
+import * as Ddb from "@aws-sdk/client-dynamodb";
+import * as Missing from "@fixture/never-installed";
+export const handle = () => Trait.rule(Sury, Fs, Path, Ddb, Missing);
+`,
+    ),
+  ],
+)
+let _ = writePkg(
+  ~root=traitRoot,
+  ~name=traitName,
+  [
+    (
+      "src/Trait.res.mjs",
+      `import * as Rules from "${rulesName}";
+export const rule = () => Rules.check();
+`,
+    ),
+  ],
+)
+let _ = writePkg(~root=rulesRoot, ~name=rulesName, [("src/Rules.res.mjs", `export const check = () => true;
+`)])
+
+let closureOf = (packageDirs: dict<string>) => {
+  Util_Bundle.addImportedPackageClosure(packageDirs)
+  packageDirs
+}
+
+describe("Util_Bundle — bundled user packages carry their imports", () => {
+  afterAll(() => NodeFs.rmSync(hostRoot, {recursive: true, force: true}))
+
+  testSync("a dependency only the importing package can resolve is added", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    expect(closureOf(packageDirs)->Dict.get(traitName))->toEqual(Some(traitRoot))
+  })
+
+  testSync("the walk is transitive — the dependency's own imports come too", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    expect(closureOf(packageDirs)->Dict.get(rulesName))->toEqual(Some(rulesRoot))
+  })
+
+  testSync("packages the deployed runtime provides are left out", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    let bundled = closureOf(packageDirs)->Dict.keysToArray
+    // sury rides in the layer (framework-resolvable); node builtins and the
+    // @aws-sdk scope resolve from the runtime's own dirs.
+    expect(bundled->Array.includes("sury"))->toBe(false)
+    expect(bundled->Array.includes("fs"))->toBe(false)
+    expect(bundled->Array.includes("path"))->toBe(false)
+    expect(bundled->Array.includes("@aws-sdk/client-dynamodb"))->toBe(false)
+  })
+
+  testSync("an import that resolves nowhere is skipped, not thrown on", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    let bundled = closureOf(packageDirs)->Dict.keysToArray
+    expect(bundled->Array.includes("@fixture/never-installed"))->toBe(false)
+  })
+
+  testSync("framework packages are starting points, not walked", () => {
+    // Walking reventless-aws would reach its deploy-time-only imports (the
+    // @pulumi bindings) and add tens of megabytes to every archive.
+    let packageDirs = Dict.fromArray([
+      ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+    ])
+    expect(closureOf(packageDirs)->Dict.keysToArray->Array.length)->toBe(1)
+  })
+})