@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/src/util/Util_StoreLayout.res.mjs

@@ -3,6 +3,8 @@
 import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as StoreLayout$ReventlessCore from "@reventlessdev/reventless-core/src/util/StoreLayout.res.mjs";
 
 let defaultEphemeralPrefixes = ["pr-"];
@@ -15,15 +17,20 @@ function layoutFor(stack, prodStacks) {
   }
 }
 
-function protectionFor(stack, ephemeralPrefixesOpt) {
+function protectionFor(stack, disposableOpt, ephemeralPrefixesOpt) {
+  let disposable = disposableOpt !== undefined ? disposableOpt : false;
   let ephemeralPrefixes = ephemeralPrefixesOpt !== undefined ? ephemeralPrefixesOpt : defaultEphemeralPrefixes;
-  if (ephemeralPrefixes.some(p => stack.startsWith(p))) {
+  if (disposable || ephemeralPrefixes.some(p => stack.startsWith(p))) {
     return "Unprotected";
   } else {
     return "Protected";
   }
 }
 
+function protectionOfDeployedStack() {
+  return protectionFor(Pulumi.getStack(), Primitive_object.equal(new Pulumi.Config("reventless").get("disposable"), "true"), undefined);
+}
+
 function bucketNameFor(layout, stack, plugin, store) {
   if (layout === "PerStore") {
     return plugin + `-` + store;
@@ -84,10 +91,11 @@ export {
   defaultEphemeralPrefixes,
   layoutFor,
   protectionFor,
+  protectionOfDeployedStack,
   bucketNameFor,
   keyPrefixFor,
   servingFor,
   coverageFor,
   pendingExpiryFor,
 }
-/* No side effect */
+/* @pulumi/pulumi Not a pure module */

package/tests/AppSync_AdapterTest.res

@@ -276,6 +276,89 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     }
   })
 
+  // ── AllowAnonymous is refused, not silently downgraded ────────────────────
+  //
+  // The defect these cover: `AllowAnonymous` shared `AllowAuthenticated`'s arm
+  // and emitted the same group-less directive, which on this Cognito-primary
+  // API means *any authenticated caller* — the inverse of the declaration. It
+  // deployed green, passed `assertGateable`, and worked on the local platform,
+  // whose resolvers call `Authorization.isAllowed` and honour the rule. It
+  // failed closed, so no deployment ever reported it.
+
+  let refuses = (run: unit => 'a): bool =>
+    switch run() {
+    | _ => false
+    | exception _ => true
+    }
+
+  let messageOf = (run: unit => 'a): string =>
+    switch run() {
+    | _ => ""
+    | exception JsExn(err) => JsExn.message(err)->Option.getOr("")
+    | exception _ => ""
+    }
+
+  let anonymousMutation = (~fieldNames) => {
+    let fp =
+      fieldNames
+      ->Array.map(n => (n, Reventless.Authorization.AllowAnonymous))
+      ->Dict.fromArray
+    let entry = mutationEntry(~fieldNames, ~fieldPermissions=fp)
+    let frag = makeFragment(fieldNames->Array.map(n => `${n}(id: ID!): String`), [])
+    () => AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+  }
+
+  testSync("AllowAnonymous on a mutation fails the deploy", () => {
+    expect(refuses(anonymousMutation(~fieldNames=["p_Register"])))->toBe(true)
+  })
+
+  // The whole point of the change: two distinct permissions must not produce
+  // one outcome. Asserting only "it throws" would still pass if a later edit
+  // re-collapsed the arms and dropped the refusal, so pin the contrast.
+  testSync("AllowAnonymous and AllowAuthenticated do not behave alike", () => {
+    let authenticated = {
+      let fp = Dict.fromArray([("p_Register", Reventless.Authorization.AllowAuthenticated)])
+      let entry = mutationEntry(~fieldNames=["p_Register"], ~fieldPermissions=fp)
+      let frag = makeFragment(["p_Register(id: ID!): String"], [])
+      () => AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    }
+    expect(refuses(authenticated))->toBe(false)
+    expect(refuses(anonymousMutation(~fieldNames=["p_Register"])))->toBe(true)
+  })
+
+  testSync("the refusal names the offending field, so it can be found", () => {
+    let msg = messageOf(anonymousMutation(~fieldNames=["p_Register"]))
+    expect(msg)->toContain("p_Register")
+    expect(msg)->toContain("AllowAnonymous")
+  })
+
+  // One deploy should report every offending field. Reporting the first one
+  // turns a batch of them into as many failed deploys as there are fields.
+  testSync("every offending field is reported, not just the first", () => {
+    let msg = messageOf(anonymousMutation(~fieldNames=["p_Register", "p_Confirm"]))
+    expect(msg)->toContain("p_Register")
+    expect(msg)->toContain("p_Confirm")
+  })
+
+  testSync("AllowAnonymous on a query names BOTH derived field names", () => {
+    let entry = queryEntry(
+      ~single="p_Item",
+      ~list="p_Items",
+      ~permission=Some(Reventless.Authorization.AllowAnonymous),
+    )
+    let frag = makeFragment(
+      [],
+      ["p_Item(id: ID!): Item", "p_Items(first: Int, after: String): ItemConnection!"],
+    )
+    let run = () => AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[entry])
+    expect(refuses(run))->toBe(true)
+    let msg = messageOf(run)
+    // The spec declares one permission and the generator emits two fields from
+    // it; naming one would send the author hunting a declaration that is not there.
+    expect(msg)->toContain("p_Item")
+    expect(msg)->toContain("p_Items")
+  })
+
   testSync("Spec-level permission wins over legacy authorization field", () => {
     // Legacy {tableName, group} says "Admin"; spec-level says "Manager".
     // Spec-level must win.

package/tests/AppSync_AdapterTest.res.mjs

@@ -245,6 +245,75 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       return Stdlib_JsError.throwWithMessage("missing query fields");
     }
   });
+  let refuses = run => {
+    try {
+      run();
+      return false;
+    } catch (exn) {
+      return true;
+    }
+  };
+  let messageOf = run => {
+    try {
+      run();
+      return "";
+    } catch (raw_err) {
+      let err = Primitive_exceptions.internalToException(raw_err);
+      if (err.RE_EXN_ID === "JsExn") {
+        return Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "");
+      } else {
+        return "";
+      }
+    }
+  };
+  let anonymousMutation = fieldNames => {
+    let fp = Object.fromEntries(fieldNames.map(n => [
+      n,
+      "AllowAnonymous"
+    ]));
+    let entry = mutationEntry(fieldNames, fp);
+    let frag = makeFragment(fieldNames.map(n => n + `(id: ID!): String`), []);
+    return () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+  };
+  globalThis.test("AllowAnonymous on a mutation fails the deploy", () => {
+    globalThis.expect(refuses(anonymousMutation(["p_Register"]))).toBe(true);
+  });
+  globalThis.test("AllowAnonymous and AllowAuthenticated do not behave alike", () => {
+    let fp = Object.fromEntries([[
+        "p_Register",
+        "AllowAuthenticated"
+      ]]);
+    let entry = mutationEntry(["p_Register"], fp);
+    let frag = makeFragment(["p_Register(id: ID!): String"], []);
+    let authenticated = () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    globalThis.expect(refuses(authenticated)).toBe(false);
+    globalThis.expect(refuses(anonymousMutation(["p_Register"]))).toBe(true);
+  });
+  globalThis.test("the refusal names the offending field, so it can be found", () => {
+    let msg = messageOf(anonymousMutation(["p_Register"]));
+    globalThis.expect(msg).toContain("p_Register");
+    globalThis.expect(msg).toContain("AllowAnonymous");
+  });
+  globalThis.test("every offending field is reported, not just the first", () => {
+    let msg = messageOf(anonymousMutation([
+      "p_Register",
+      "p_Confirm"
+    ]));
+    globalThis.expect(msg).toContain("p_Register");
+    globalThis.expect(msg).toContain("p_Confirm");
+  });
+  globalThis.test("AllowAnonymous on a query names BOTH derived field names", () => {
+    let entry = queryEntry("p_Item", "p_Items", "AllowAnonymous");
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let run = () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    globalThis.expect(refuses(run)).toBe(true);
+    let msg = messageOf(run);
+    globalThis.expect(msg).toContain("p_Item");
+    globalThis.expect(msg).toContain("p_Items");
+  });
   globalThis.test("Spec-level permission wins over legacy authorization field", () => {
     let fp = Object.fromEntries([[
         "p_X",

package/tests/Auth_LoginIdentifierTest.res

@@ -0,0 +1,51 @@
+open JestGlobals
+
+// The sign-in attribute is the one pool setting no later deploy can correct, so
+// what these cover is the parse: absent must mean today's behaviour, and a
+// spelling this build does not know must refuse rather than default.
+
+module LoginIdentifier = Auth_LoginIdentifier
+
+describe("Auth_LoginIdentifier.parse", () => {
+  testSync("absent is email, so an existing stack redeploys unchanged", () =>
+    expect(LoginIdentifier.parse(None))->toEqual(Ok(LoginIdentifier.Email))
+  )
+
+  testSync("every spelling round-trips through its config name", () =>
+    expect(
+      LoginIdentifier.all->Array.map(i => LoginIdentifier.parse(Some(LoginIdentifier.toString(i)))),
+    )->toEqual(LoginIdentifier.all->Array.map(i => Ok(i)))
+  )
+
+  // 🚨 A typo that defaulted would create a pool signing in on the wrong
+  // attribute, and correcting that means replacing the pool and re-registering
+  // every account in it.
+  testSync("an unrecognised spelling refuses", () =>
+    expect(LoginIdentifier.parse(Some("e-mail"))->Result.isError)->toBe(true)
+  )
+
+  testSync("the refusal names what was accepted instead", () =>
+    expect(
+      switch LoginIdentifier.parse(Some("e-mail")) {
+      | Error(message) => message->String.includes("emailOrPhone")
+      | Ok(_) => false
+      },
+    )->toBe(true)
+  )
+
+  // Case matters: Cognito's own attribute names are lowercase, and accepting
+  // "Email" here would leave two spellings meaning one pool.
+  testSync("a differently-cased spelling is not silently accepted", () =>
+    expect(LoginIdentifier.parse(Some("Email"))->Result.isError)->toBe(true)
+  )
+})
+
+describe("Auth_LoginIdentifier.usernameAttributes", () => {
+  testSync("maps onto the attribute names Cognito takes at creation", () =>
+    expect(LoginIdentifier.all->Array.map(LoginIdentifier.usernameAttributes))->toEqual([
+      ["email"],
+      ["phone_number"],
+      ["email", "phone_number"],
+    ])
+  )
+})

package/tests/Auth_LoginIdentifierTest.res.mjs

@@ -0,0 +1,51 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
+
+globalThis.describe("Auth_LoginIdentifier.parse", () => {
+  globalThis.test("absent is email, so an existing stack redeploys unchanged", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.parse(undefined)).toEqual({
+      TAG: "Ok",
+      _0: "Email"
+    });
+  });
+  globalThis.test("every spelling round-trips through its config name", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.all.map(i => Auth_LoginIdentifier$ReventlessAws.parse(Auth_LoginIdentifier$ReventlessAws.toString(i)))).toEqual(Auth_LoginIdentifier$ReventlessAws.all.map(i => ({
+      TAG: "Ok",
+      _0: i
+    })));
+  });
+  globalThis.test("an unrecognised spelling refuses", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_LoginIdentifier$ReventlessAws.parse("e-mail"))).toBe(true);
+  });
+  globalThis.test("the refusal names what was accepted instead", () => {
+    let message = Auth_LoginIdentifier$ReventlessAws.parse("e-mail");
+    let tmp;
+    tmp = message.TAG === "Ok" ? false : message._0.includes("emailOrPhone");
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("a differently-cased spelling is not silently accepted", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_LoginIdentifier$ReventlessAws.parse("Email"))).toBe(true);
+  });
+});
+
+globalThis.describe("Auth_LoginIdentifier.usernameAttributes", () => {
+  globalThis.test("maps onto the attribute names Cognito takes at creation", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.all.map(Auth_LoginIdentifier$ReventlessAws.usernameAttributes)).toEqual([
+      ["email"],
+      ["phone_number"],
+      [
+        "email",
+        "phone_number"
+      ]
+    ]);
+  });
+});
+
+let LoginIdentifier;
+
+export {
+  LoginIdentifier,
+}
+/*  Not a pure module */

package/tests/Auth_SignUpModeTest.res

@@ -0,0 +1,56 @@
+open JestGlobals
+
+// Sign-up mode is correctable on a live pool, unlike the sign-in attribute, so
+// what these cover is not permanence but silence: absent must mean today's
+// behaviour, an unknown spelling must refuse rather than quietly close the pool,
+// and the mapping onto Cognito's inverted field must not be readable backwards.
+
+module SignUpMode = Auth_SignUpMode
+
+describe("Auth_SignUpMode.parse", () => {
+  testSync("absent is adminOnly, so an existing stack redeploys unchanged", () =>
+    expect(SignUpMode.parse(None))->toEqual(Ok(SignUpMode.AdminOnly))
+  )
+
+  testSync("every spelling round-trips through its config name", () =>
+    expect(SignUpMode.all->Array.map(m => SignUpMode.parse(Some(SignUpMode.toString(m)))))->toEqual(
+      SignUpMode.all->Array.map(m => Ok(m)),
+    )
+  )
+
+  // 🚨 Defaulting past a typo fails CLOSED, which is safe and invisible: the
+  // deploy is green, the config reads as though registration is open, and the
+  // only symptom is every registration being refused — far from the cause.
+  testSync("an unrecognised spelling refuses", () =>
+    expect(SignUpMode.parse(Some("self-service"))->Result.isError)->toBe(true)
+  )
+
+  testSync("the refusal names what was accepted instead", () =>
+    expect(
+      switch SignUpMode.parse(Some("self-service")) {
+      | Error(message) => message->String.includes("selfService")
+      | Ok(_) => false
+      },
+    )->toBe(true)
+  )
+
+  testSync("a differently-cased spelling is not silently accepted", () =>
+    expect(SignUpMode.parse(Some("SelfService"))->Result.isError)->toBe(true)
+  )
+})
+
+describe("Auth_SignUpMode.allowAdminCreateUserOnly", () => {
+  // Cognito asks the opposite of what this type asks. Pinning both arms is the
+  // point: an inverted mapping would open a pool meant to stay closed, and on a
+  // shared pool it would open it for every stack using it.
+  testSync("inverts the question Cognito's field asks", () =>
+    expect((
+      SignUpMode.AdminOnly->SignUpMode.allowAdminCreateUserOnly,
+      SignUpMode.SelfService->SignUpMode.allowAdminCreateUserOnly,
+    ))->toEqual((true, false))
+  )
+
+  testSync("the default leaves the pool admin-create-only", () =>
+    expect(SignUpMode.default->SignUpMode.allowAdminCreateUserOnly)->toBe(true)
+  )
+})

package/tests/Auth_SignUpModeTest.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
+
+globalThis.describe("Auth_SignUpMode.parse", () => {
+  globalThis.test("absent is adminOnly, so an existing stack redeploys unchanged", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.parse(undefined)).toEqual({
+      TAG: "Ok",
+      _0: "AdminOnly"
+    });
+  });
+  globalThis.test("every spelling round-trips through its config name", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.all.map(m => Auth_SignUpMode$ReventlessAws.parse(Auth_SignUpMode$ReventlessAws.toString(m)))).toEqual(Auth_SignUpMode$ReventlessAws.all.map(m => ({
+      TAG: "Ok",
+      _0: m
+    })));
+  });
+  globalThis.test("an unrecognised spelling refuses", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_SignUpMode$ReventlessAws.parse("self-service"))).toBe(true);
+  });
+  globalThis.test("the refusal names what was accepted instead", () => {
+    let message = Auth_SignUpMode$ReventlessAws.parse("self-service");
+    let tmp;
+    tmp = message.TAG === "Ok" ? false : message._0.includes("selfService");
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("a differently-cased spelling is not silently accepted", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_SignUpMode$ReventlessAws.parse("SelfService"))).toBe(true);
+  });
+});
+
+globalThis.describe("Auth_SignUpMode.allowAdminCreateUserOnly", () => {
+  globalThis.test("inverts the question Cognito's field asks", () => {
+    globalThis.expect([
+      Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly("AdminOnly"),
+      Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly("SelfService")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+  globalThis.test("the default leaves the pool admin-create-only", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(Auth_SignUpMode$ReventlessAws.default)).toBe(true);
+  });
+});
+
+let SignUpMode;
+
+export {
+  SignUpMode,
+}
+/*  Not a pure module */

package/tests/BakeManifestTest.res

@@ -0,0 +1,204 @@
+open JestGlobals
+
+// What the command decides without AWS: which stacks it reads, what it asks the
+// bake function, how it reads the answer, and when it stops asking.
+
+module Bake = BakeManifest
+
+let json = text => JSON.parseOrThrow(text)
+
+describe("DeployManifest", () => {
+  let text = `
+region: eu-west-1
+platform:
+  path: platform-aws
+  name: shop-platform
+  stack-defaults:
+    platform:messagingEmailProvider: log
+plugins:
+  - name: catalog
+    path: catalog-aws
+    depends-on: []
+  - name: ordering
+    path: ordering-aws
+`
+
+  testSync("resolves every folder against the manifest's own folder", () => {
+    let resolved =
+      DeployManifest.parseString(text)->Result.map(
+        m => m->DeployManifest.resolve(~file="/repo/shop/deploy-manifest.yaml"),
+      )
+    expect(resolved)->toEqual(
+      Ok({
+        DeployManifest.file: "/repo/shop/deploy-manifest.yaml",
+        region: Some("eu-west-1"),
+        platform: {
+          name: "shop-platform",
+          dir: "/repo/shop/platform-aws",
+          stackDefaults: Dict.fromArray([("platform:messagingEmailProvider", "log")]),
+        },
+        plugins: [
+          {name: "catalog", dir: "/repo/shop/catalog-aws", stackDefaults: Dict.make()},
+          {name: "ordering", dir: "/repo/shop/ordering-aws", stackDefaults: Dict.make()},
+        ],
+      }),
+    )
+  })
+
+  testSync("refuses a manifest without a platform", () =>
+    expect(DeployManifest.parseString("plugins: []")->Result.isError)->toBe(true)
+  )
+})
+
+describe("BakeManifest.parseArgs", () => {
+  testSync("reads the stack, the manifest and the deploy's start", () =>
+    expect(
+      Bake.parseArgs([
+        "--stack",
+        "alpha",
+        "--manifest",
+        "m.yaml",
+        "--since",
+        "2026-09-16T10:00:00Z",
+      ]),
+    )->toEqual(
+      Ok({
+        Bake.manifest: Some("m.yaml"),
+        stack: Some("alpha"),
+        since: Some("2026-09-16T10:00:00Z"),
+        help: false,
+      }),
+    )
+  )
+
+  // CI passes the start through an output that is empty on a hand-run workflow.
+  testSync("an empty --since is no instant", () =>
+    expect(Bake.parseArgs(["--since", ""])->Result.map(a => a.since))->toEqual(Ok(None))
+  )
+
+  testSync("an unknown flag refuses", () =>
+    expect(Bake.parseArgs(["--stak", "alpha"]))->toEqual(Error(`unknown argument "--stak"`))
+  )
+})
+
+describe("BakeManifest reads the stacks", () => {
+  testSync("a platform without a bake function declares no bake", () =>
+    expect(
+      Bake.targetOf(
+        json(`{"bakedManifestBucket": "b", "bakedManifestFunction": ""}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(None)
+  )
+
+  testSync("a platform with one names the function, bucket and key", () =>
+    expect(
+      Bake.targetOf(
+        json(`{"bakedManifestFunction": "fn", "bakedManifestBucket": "b", "bakedManifestKey": "manifest.json"}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(Some({Bake.functionName: "fn", bucket: "b", key: "manifest.json"}))
+  )
+
+  testSync("a plugin stack's structure key is read from pluginStructureRef", () =>
+    expect(
+      Bake.structureRefOf(
+        json(`{"pluginStructureRef": {"plugin": "Catalog", "key": "sha256/abc"}}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(Some(("Catalog", "sha256/abc")))
+  )
+
+  testSync("the payload carries the deploy's start only when there is one", () => {
+    let target = {Bake.functionName: "fn", bucket: "b", key: "k"}
+    let expect_ = Dict.fromArray([("Catalog", "sha256/abc")])
+    expect(
+      Bake.payload(~target, ~expect=expect_, ~since=None)->JSON.stringify,
+    )->toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"}}`)
+    expect(
+      Bake.payload(~target, ~expect=expect_, ~since=Some("2026-09-16T10:00:00Z"))->JSON.stringify,
+    )->toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"},"since":"2026-09-16T10:00:00Z"}`)
+  })
+})
+
+let pending = state =>
+  json(
+    `[{"baked": false, "pending": ["Catalog"], "registrations": [
+    {"plugin": "Catalog", "state": "${state}", "expected": "sha256/new", "found": "sha256/old", "writtenAt": null}
+  ]}]`,
+  )
+
+let baked = json(`[
+  {"baked": true, "bucket": "b", "key": "manifest.json", "plugins": 2, "bytes": 512},
+  {"summary": true, "plugins": 1, "registered": 1, "unchanged": 0, "matched": 0, "registrations": [
+    {"plugin": "Catalog", "state": "registered", "expected": "sha256/new", "found": "sha256/new", "writtenAt": "2026-09-16T10:01:00Z"}
+  ]}
+]`)
+
+describe("BakeManifest.readAnswer", () => {
+  testSync("a written manifest reports its files and what convergence proved", () =>
+    switch Bake.readAnswer(baked) {
+    | Ok(Baked({written, summary})) =>
+      expect((
+        written->Array.map(w => (w.key, w.bytes)),
+        summary->Option.map(s => s.registered),
+      ))->toEqual(([("manifest.json", 512)], Some(1)))
+    | _ => expect("not baked")->toBe("baked")
+    }
+  )
+
+  testSync("a pending answer names the plugins not yet arrived", () =>
+    switch Bake.readAnswer(pending("behind")) {
+    | Ok(Pending({pending})) => expect(pending)->toEqual(["Catalog"])
+    | _ => expect("not pending")->toBe("pending")
+    }
+  )
+
+  testSync("the report line carries both keys and the row's date", () =>
+    expect(
+      Bake.registrationLine({
+        plugin: "Catalog",
+        state: "missing",
+        expected: "sha256/new",
+        found: None,
+        writtenAt: None,
+      }),
+    )->toBe("  Catalog: missing — expected sha256/new, row holds no row (written never)")
+  )
+})
+
+describe("BakeManifest.converge", () => {
+  let run = async (answers: array<JSON.t>, ~attempts) => {
+    let asked = ref(0)
+    let invoke = async () => {
+      let answer = answers->Array.getUnsafe(Math.Int.min(asked.contents, answers->Array.length - 1))
+      asked := asked.contents + 1
+      Ok(answer)
+    }
+    let outcome = await Bake.converge(~invoke, ~sleep=async () => (), ~log=_ => (), ~attempts)
+    (outcome->Result.isOk, asked.contents)
+  }
+
+  test("asks again while a plugin is behind, then succeeds", async () =>
+    expect(await run([pending("behind"), pending("behind"), baked], ~attempts=5))->toEqual((
+      true,
+      3,
+    ))
+  )
+
+  // A first deploy has no row for any plugin until its registration lands.
+  test("waits for a missing registration", async () =>
+    expect(await run([pending("missing"), baked], ~attempts=5))->toEqual((true, 2))
+  )
+
+  test("stops at once on a registration that diverged", async () =>
+    expect(await run([pending("diverged"), baked], ~attempts=5))->toEqual((false, 1))
+  )
+
+  test("gives up when the attempts run out", async () =>
+    expect(await run([pending("behind")], ~attempts=3))->toEqual((false, 3))
+  )
+})