@reventlessdev/reventless-aws 3.0.0-alpha.346 → 3.0.0-alpha.347

package/src/util/Util_StoreLayout.res.mjs

@@ -3,6 +3,8 @@
 import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as StoreLayout$ReventlessCore from "@reventlessdev/reventless-core/src/util/StoreLayout.res.mjs";
 
 let defaultEphemeralPrefixes = ["pr-"];
@@ -15,15 +17,20 @@ function layoutFor(stack, prodStacks) {
   }
 }
 
-function protectionFor(stack, ephemeralPrefixesOpt) {
+function protectionFor(stack, disposableOpt, ephemeralPrefixesOpt) {
+  let disposable = disposableOpt !== undefined ? disposableOpt : false;
   let ephemeralPrefixes = ephemeralPrefixesOpt !== undefined ? ephemeralPrefixesOpt : defaultEphemeralPrefixes;
-  if (ephemeralPrefixes.some(p => stack.startsWith(p))) {
+  if (disposable || ephemeralPrefixes.some(p => stack.startsWith(p))) {
     return "Unprotected";
   } else {
     return "Protected";
   }
 }
 
+function protectionOfDeployedStack() {
+  return protectionFor(Pulumi.getStack(), Primitive_object.equal(new Pulumi.Config("reventless").get("disposable"), "true"), undefined);
+}
+
 function bucketNameFor(layout, stack, plugin, store) {
   if (layout === "PerStore") {
     return plugin + `-` + store;
@@ -84,10 +91,11 @@ export {
   defaultEphemeralPrefixes,
   layoutFor,
   protectionFor,
+  protectionOfDeployedStack,
   bucketNameFor,
   keyPrefixFor,
   servingFor,
   coverageFor,
   pendingExpiryFor,
 }
-/* No side effect */
+/* @pulumi/pulumi Not a pure module */

package/tests/BakeManifestTest.res

@@ -0,0 +1,204 @@
+open JestGlobals
+
+// What the command decides without AWS: which stacks it reads, what it asks the
+// bake function, how it reads the answer, and when it stops asking.
+
+module Bake = BakeManifest
+
+let json = text => JSON.parseOrThrow(text)
+
+describe("DeployManifest", () => {
+  let text = `
+region: eu-west-1
+platform:
+  path: platform-aws
+  name: shop-platform
+  stack-defaults:
+    platform:messagingEmailProvider: log
+plugins:
+  - name: catalog
+    path: catalog-aws
+    depends-on: []
+  - name: ordering
+    path: ordering-aws
+`
+
+  testSync("resolves every folder against the manifest's own folder", () => {
+    let resolved =
+      DeployManifest.parseString(text)->Result.map(
+        m => m->DeployManifest.resolve(~file="/repo/shop/deploy-manifest.yaml"),
+      )
+    expect(resolved)->toEqual(
+      Ok({
+        DeployManifest.file: "/repo/shop/deploy-manifest.yaml",
+        region: Some("eu-west-1"),
+        platform: {
+          name: "shop-platform",
+          dir: "/repo/shop/platform-aws",
+          stackDefaults: Dict.fromArray([("platform:messagingEmailProvider", "log")]),
+        },
+        plugins: [
+          {name: "catalog", dir: "/repo/shop/catalog-aws", stackDefaults: Dict.make()},
+          {name: "ordering", dir: "/repo/shop/ordering-aws", stackDefaults: Dict.make()},
+        ],
+      }),
+    )
+  })
+
+  testSync("refuses a manifest without a platform", () =>
+    expect(DeployManifest.parseString("plugins: []")->Result.isError)->toBe(true)
+  )
+})
+
+describe("BakeManifest.parseArgs", () => {
+  testSync("reads the stack, the manifest and the deploy's start", () =>
+    expect(
+      Bake.parseArgs([
+        "--stack",
+        "alpha",
+        "--manifest",
+        "m.yaml",
+        "--since",
+        "2026-09-16T10:00:00Z",
+      ]),
+    )->toEqual(
+      Ok({
+        Bake.manifest: Some("m.yaml"),
+        stack: Some("alpha"),
+        since: Some("2026-09-16T10:00:00Z"),
+        help: false,
+      }),
+    )
+  )
+
+  // CI passes the start through an output that is empty on a hand-run workflow.
+  testSync("an empty --since is no instant", () =>
+    expect(Bake.parseArgs(["--since", ""])->Result.map(a => a.since))->toEqual(Ok(None))
+  )
+
+  testSync("an unknown flag refuses", () =>
+    expect(Bake.parseArgs(["--stak", "alpha"]))->toEqual(Error(`unknown argument "--stak"`))
+  )
+})
+
+describe("BakeManifest reads the stacks", () => {
+  testSync("a platform without a bake function declares no bake", () =>
+    expect(
+      Bake.targetOf(
+        json(`{"bakedManifestBucket": "b", "bakedManifestFunction": ""}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(None)
+  )
+
+  testSync("a platform with one names the function, bucket and key", () =>
+    expect(
+      Bake.targetOf(
+        json(`{"bakedManifestFunction": "fn", "bakedManifestBucket": "b", "bakedManifestKey": "manifest.json"}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(Some({Bake.functionName: "fn", bucket: "b", key: "manifest.json"}))
+  )
+
+  testSync("a plugin stack's structure key is read from pluginStructureRef", () =>
+    expect(
+      Bake.structureRefOf(
+        json(`{"pluginStructureRef": {"plugin": "Catalog", "key": "sha256/abc"}}`)
+        ->JSON.Decode.object
+        ->Option.getOr(Dict.make()),
+      ),
+    )->toEqual(Some(("Catalog", "sha256/abc")))
+  )
+
+  testSync("the payload carries the deploy's start only when there is one", () => {
+    let target = {Bake.functionName: "fn", bucket: "b", key: "k"}
+    let expect_ = Dict.fromArray([("Catalog", "sha256/abc")])
+    expect(
+      Bake.payload(~target, ~expect=expect_, ~since=None)->JSON.stringify,
+    )->toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"}}`)
+    expect(
+      Bake.payload(~target, ~expect=expect_, ~since=Some("2026-09-16T10:00:00Z"))->JSON.stringify,
+    )->toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"},"since":"2026-09-16T10:00:00Z"}`)
+  })
+})
+
+let pending = state =>
+  json(
+    `[{"baked": false, "pending": ["Catalog"], "registrations": [
+    {"plugin": "Catalog", "state": "${state}", "expected": "sha256/new", "found": "sha256/old", "writtenAt": null}
+  ]}]`,
+  )
+
+let baked = json(`[
+  {"baked": true, "bucket": "b", "key": "manifest.json", "plugins": 2, "bytes": 512},
+  {"summary": true, "plugins": 1, "registered": 1, "unchanged": 0, "matched": 0, "registrations": [
+    {"plugin": "Catalog", "state": "registered", "expected": "sha256/new", "found": "sha256/new", "writtenAt": "2026-09-16T10:01:00Z"}
+  ]}
+]`)
+
+describe("BakeManifest.readAnswer", () => {
+  testSync("a written manifest reports its files and what convergence proved", () =>
+    switch Bake.readAnswer(baked) {
+    | Ok(Baked({written, summary})) =>
+      expect((
+        written->Array.map(w => (w.key, w.bytes)),
+        summary->Option.map(s => s.registered),
+      ))->toEqual(([("manifest.json", 512)], Some(1)))
+    | _ => expect("not baked")->toBe("baked")
+    }
+  )
+
+  testSync("a pending answer names the plugins not yet arrived", () =>
+    switch Bake.readAnswer(pending("behind")) {
+    | Ok(Pending({pending})) => expect(pending)->toEqual(["Catalog"])
+    | _ => expect("not pending")->toBe("pending")
+    }
+  )
+
+  testSync("the report line carries both keys and the row's date", () =>
+    expect(
+      Bake.registrationLine({
+        plugin: "Catalog",
+        state: "missing",
+        expected: "sha256/new",
+        found: None,
+        writtenAt: None,
+      }),
+    )->toBe("  Catalog: missing — expected sha256/new, row holds no row (written never)")
+  )
+})
+
+describe("BakeManifest.converge", () => {
+  let run = async (answers: array<JSON.t>, ~attempts) => {
+    let asked = ref(0)
+    let invoke = async () => {
+      let answer = answers->Array.getUnsafe(Math.Int.min(asked.contents, answers->Array.length - 1))
+      asked := asked.contents + 1
+      Ok(answer)
+    }
+    let outcome = await Bake.converge(~invoke, ~sleep=async () => (), ~log=_ => (), ~attempts)
+    (outcome->Result.isOk, asked.contents)
+  }
+
+  test("asks again while a plugin is behind, then succeeds", async () =>
+    expect(await run([pending("behind"), pending("behind"), baked], ~attempts=5))->toEqual((
+      true,
+      3,
+    ))
+  )
+
+  // A first deploy has no row for any plugin until its registration lands.
+  test("waits for a missing registration", async () =>
+    expect(await run([pending("missing"), baked], ~attempts=5))->toEqual((true, 2))
+  )
+
+  test("stops at once on a registration that diverged", async () =>
+    expect(await run([pending("diverged"), baked], ~attempts=5))->toEqual((false, 1))
+  )
+
+  test("gives up when the attempts run out", async () =>
+    expect(await run([pending("behind")], ~attempts=3))->toEqual((false, 3))
+  )
+})

package/tests/BakeManifestTest.res.mjs

@@ -0,0 +1,259 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as BakeManifest$ReventlessAws from "../scripts/BakeManifest.res.mjs";
+import * as DeployManifest$ReventlessAws from "../scripts/DeployManifest.res.mjs";
+
+function json(text) {
+  return JSON.parse(text);
+}
+
+globalThis.describe("DeployManifest", () => {
+  globalThis.test("resolves every folder against the manifest's own folder", () => {
+    let resolved = Stdlib_Result.map(DeployManifest$ReventlessAws.parseString(`
+region: eu-west-1
+platform:
+  path: platform-aws
+  name: shop-platform
+  stack-defaults:
+    platform:messagingEmailProvider: log
+plugins:
+  - name: catalog
+    path: catalog-aws
+    depends-on: []
+  - name: ordering
+    path: ordering-aws
+`), m => DeployManifest$ReventlessAws.resolve(m, "/repo/shop/deploy-manifest.yaml"));
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: {
+        file: "/repo/shop/deploy-manifest.yaml",
+        region: "eu-west-1",
+        platform: {
+          name: "shop-platform",
+          dir: "/repo/shop/platform-aws",
+          stackDefaults: Object.fromEntries([[
+              "platform:messagingEmailProvider",
+              "log"
+            ]])
+        },
+        plugins: [
+          {
+            name: "catalog",
+            dir: "/repo/shop/catalog-aws",
+            stackDefaults: {}
+          },
+          {
+            name: "ordering",
+            dir: "/repo/shop/ordering-aws",
+            stackDefaults: {}
+          }
+        ]
+      }
+    });
+  });
+  globalThis.test("refuses a manifest without a platform", () => {
+    globalThis.expect(Stdlib_Result.isError(DeployManifest$ReventlessAws.parseString("plugins: []"))).toBe(true);
+  });
+});
+
+globalThis.describe("BakeManifest.parseArgs", () => {
+  globalThis.test("reads the stack, the manifest and the deploy's start", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.parseArgs([
+      "--stack",
+      "alpha",
+      "--manifest",
+      "m.yaml",
+      "--since",
+      "2026-09-16T10:00:00Z"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        manifest: "m.yaml",
+        stack: "alpha",
+        since: "2026-09-16T10:00:00Z",
+        help: false
+      }
+    });
+  });
+  globalThis.test("an empty --since is no instant", () => {
+    globalThis.expect(Stdlib_Result.map(BakeManifest$ReventlessAws.parseArgs([
+      "--since",
+      ""
+    ]), a => a.since)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("an unknown flag refuses", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.parseArgs([
+      "--stak",
+      "alpha"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--stak"`
+    });
+  });
+});
+
+globalThis.describe("BakeManifest reads the stacks", () => {
+  globalThis.test("a platform without a bake function declares no bake", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.targetOf(Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(`{"bakedManifestBucket": "b", "bakedManifestFunction": ""}`)), {}))).toEqual(undefined);
+  });
+  globalThis.test("a platform with one names the function, bucket and key", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.targetOf(Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(`{"bakedManifestFunction": "fn", "bakedManifestBucket": "b", "bakedManifestKey": "manifest.json"}`)), {}))).toEqual({
+      functionName: "fn",
+      bucket: "b",
+      key: "manifest.json"
+    });
+  });
+  globalThis.test("a plugin stack's structure key is read from pluginStructureRef", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.structureRefOf(Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(`{"pluginStructureRef": {"plugin": "Catalog", "key": "sha256/abc"}}`)), {}))).toEqual([
+      "Catalog",
+      "sha256/abc"
+    ]);
+  });
+  globalThis.test("the payload carries the deploy's start only when there is one", () => {
+    let target = {
+      functionName: "fn",
+      bucket: "b",
+      key: "k"
+    };
+    let expect_ = Object.fromEntries([[
+        "Catalog",
+        "sha256/abc"
+      ]]);
+    globalThis.expect(JSON.stringify(BakeManifest$ReventlessAws.payload(target, expect_, undefined))).toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"}}`);
+    globalThis.expect(JSON.stringify(BakeManifest$ReventlessAws.payload(target, expect_, "2026-09-16T10:00:00Z"))).toBe(`{"bake":true,"bucket":"b","key":"k","expect":{"Catalog":"sha256/abc"},"since":"2026-09-16T10:00:00Z"}`);
+  });
+});
+
+function pending(state) {
+  return JSON.parse(`[{"baked": false, "pending": ["Catalog"], "registrations": [
+    {"plugin": "Catalog", "state": "` + state + `", "expected": "sha256/new", "found": "sha256/old", "writtenAt": null}
+  ]}]`);
+}
+
+let baked = JSON.parse(`[
+  {"baked": true, "bucket": "b", "key": "manifest.json", "plugins": 2, "bytes": 512},
+  {"summary": true, "plugins": 1, "registered": 1, "unchanged": 0, "matched": 0, "registrations": [
+    {"plugin": "Catalog", "state": "registered", "expected": "sha256/new", "found": "sha256/new", "writtenAt": "2026-09-16T10:01:00Z"}
+  ]}
+]`);
+
+globalThis.describe("BakeManifest.readAnswer", () => {
+  globalThis.test("a written manifest reports its files and what convergence proved", () => {
+    let match = BakeManifest$ReventlessAws.readAnswer(baked);
+    if (match.TAG === "Ok") {
+      let match$1 = match._0;
+      if (match$1.TAG === "Baked") {
+        globalThis.expect([
+          match$1.written.map(w => [
+            w.key,
+            w.bytes
+          ]),
+          Stdlib_Option.map(match$1.summary, s => s.registered)
+        ]).toEqual([
+          [[
+              "manifest.json",
+              512
+            ]],
+          1
+        ]);
+        return;
+      }
+      globalThis.expect("not baked").toBe("baked");
+      return;
+    }
+    globalThis.expect("not baked").toBe("baked");
+  });
+  globalThis.test("a pending answer names the plugins not yet arrived", () => {
+    let match = BakeManifest$ReventlessAws.readAnswer(pending("behind"));
+    if (match.TAG === "Ok") {
+      let match$1 = match._0;
+      if (match$1.TAG === "Baked") {
+        globalThis.expect("not pending").toBe("pending");
+        return;
+      }
+      globalThis.expect(match$1.pending).toEqual(["Catalog"]);
+      return;
+    }
+    globalThis.expect("not pending").toBe("pending");
+  });
+  globalThis.test("the report line carries both keys and the row's date", () => {
+    globalThis.expect(BakeManifest$ReventlessAws.registrationLine({
+      plugin: "Catalog",
+      state: "missing",
+      expected: "sha256/new",
+      found: undefined,
+      writtenAt: undefined
+    })).toBe("  Catalog: missing — expected sha256/new, row holds no row (written never)");
+  });
+});
+
+globalThis.describe("BakeManifest.converge", () => {
+  let run = async (answers, attempts) => {
+    let asked = {
+      contents: 0
+    };
+    let invoke = async () => {
+      let answer = answers[Math.min(asked.contents, answers.length - 1 | 0)];
+      asked.contents = asked.contents + 1 | 0;
+      return {
+        TAG: "Ok",
+        _0: answer
+      };
+    };
+    let outcome = await BakeManifest$ReventlessAws.converge(invoke, async () => {}, param => {}, attempts);
+    return [
+      Stdlib_Result.isOk(outcome),
+      asked.contents
+    ];
+  };
+  globalThis.test("asks again while a plugin is behind, then succeeds", async () => {
+    globalThis.expect(await run([
+      pending("behind"),
+      pending("behind"),
+      baked
+    ], 5)).toEqual([
+      true,
+      3
+    ]);
+  });
+  globalThis.test("waits for a missing registration", async () => {
+    globalThis.expect(await run([
+      pending("missing"),
+      baked
+    ], 5)).toEqual([
+      true,
+      2
+    ]);
+  });
+  globalThis.test("stops at once on a registration that diverged", async () => {
+    globalThis.expect(await run([
+      pending("diverged"),
+      baked
+    ], 5)).toEqual([
+      false,
+      1
+    ]);
+  });
+  globalThis.test("gives up when the attempts run out", async () => {
+    globalThis.expect(await run([pending("behind")], 3)).toEqual([
+      false,
+      3
+    ]);
+  });
+});
+
+let Bake;
+
+export {
+  Bake,
+  json,
+  pending,
+  baked,
+}
+/*  Not a pure module */

package/tests/DcbColdStartPartitionTest.res

@@ -0,0 +1,32 @@
+// The DCB command Lambda refuses to start when its partition keys cannot be
+// derived, and says why on every invocation.
+//
+// Deploy derives the same keys from the same slices, so this only fails when the
+// framework in the Lambda layer differs from the one deploy used. Carrying on
+// would file events under the wrong keys; refusing sends messages to the DLQ.
+
+open JestGlobals
+
+type afterFailedStartup = {messages: array<string>, unhandled: array<string>}
+
+@module("./dcbColdStartPartition.mjs")
+external invokeAfterFailedStartup: unit => promise<afterFailedStartup> = "invokeAfterFailedStartup"
+
+@module("./dcbColdStartPartition.mjs")
+external startWithUnresolvedSlice: unit => promise<string> = "startWithUnresolvedSlice"
+
+describe("DcbCommandTopicEntryPoint cold start", () => {
+  test("a slice whose partition cannot be inferred stops startup, naming it", async () => {
+    let message = await startWithUnresolvedSlice()
+    expect(message->String.includes("LinkGadget"))->toBe(true)
+    expect(message->String.includes("@partitionTag"))->toBe(true)
+  })
+
+  test("after a failed startup every invocation rethrows the same error", async () => {
+    let {messages, unhandled} = await invokeAfterFailedStartup()
+    expect(messages->Array.length)->toBe(2)
+    expect(messages->Array.includes("resolved"))->toBe(false)
+    expect(messages->Array.getUnsafe(0))->toBe(messages->Array.getUnsafe(1))
+    expect(unhandled)->toEqual([])
+  })
+})

package/tests/DcbColdStartPartitionTest.res.mjs

@@ -0,0 +1,33 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as DcbColdStartPartitionMjs from "./dcbColdStartPartition.mjs";
+
+function invokeAfterFailedStartup(prim) {
+  return DcbColdStartPartitionMjs.invokeAfterFailedStartup();
+}
+
+function startWithUnresolvedSlice(prim) {
+  return DcbColdStartPartitionMjs.startWithUnresolvedSlice();
+}
+
+globalThis.describe("DcbCommandTopicEntryPoint cold start", () => {
+  globalThis.test("a slice whose partition cannot be inferred stops startup, naming it", async () => {
+    let message = await DcbColdStartPartitionMjs.startWithUnresolvedSlice();
+    globalThis.expect(message.includes("LinkGadget")).toBe(true);
+    globalThis.expect(message.includes("@partitionTag")).toBe(true);
+  });
+  globalThis.test("after a failed startup every invocation rethrows the same error", async () => {
+    let match = await DcbColdStartPartitionMjs.invokeAfterFailedStartup();
+    let messages = match.messages;
+    globalThis.expect(messages.length).toBe(2);
+    globalThis.expect(messages.includes("resolved")).toBe(false);
+    globalThis.expect(messages[0]).toBe(messages[1]);
+    globalThis.expect(match.unhandled).toEqual([]);
+  });
+});
+
+export {
+  invokeAfterFailedStartup,
+  startWithUnresolvedSlice,
+}
+/*  Not a pure module */

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -259,6 +259,94 @@ describe("Runtime.buildScanFilter — excludes fence sentinels (Issue 12)", () =
   })
 })
 
+describe("Runtime.derivePartitionKey — each event type under its slice's key", () => {
+  // Two entities in one log. AddressLinked declares addressId first, so a
+  // positional default would file it under the reference.
+  let partitionTag = Reventless.DcbTag.ByEventType(
+    Dict.fromArray([("OrderPlaced", "orderId"), ("AddressLinked", "customerId")]),
+  )
+  let thrownMessage = f =>
+    try {
+      let _ = f()
+      ""
+    } catch {
+    | JsExn(err) => JsExn.message(err)->Option.getOr("")
+    }
+
+  testSync("files an event under its own type's key, not its first tag", () =>
+    expect(
+      Runtime.derivePartitionKey(
+        ~partitionTag,
+        ~eventType="AddressLinked",
+        [tag("addressId", "a1"), tag("customerId", "c1")],
+      ),
+    )->toBe("customerId:c1")
+  )
+
+  testSync("another type in the same log keeps its own key", () =>
+    expect(
+      Runtime.derivePartitionKey(
+        ~partitionTag,
+        ~eventType="OrderPlaced",
+        [tag("customerId", "c1"), tag("orderId", "o1")],
+      ),
+    )->toBe("orderId:o1")
+  )
+
+  testSync("an event type no slice writes throws instead of guessing", () =>
+    expect(
+      thrownMessage(
+        () =>
+          Runtime.derivePartitionKey(
+            ~partitionTag,
+            ~eventType="Unknown",
+            [tag("customerId", "c1")],
+          ),
+      )->String.includes("Unknown has no partition key"),
+    )->toBe(true)
+  )
+
+  testSync("an event missing its partition tag throws instead of guessing", () =>
+    expect(
+      thrownMessage(
+        () =>
+          Runtime.derivePartitionKey(
+            ~partitionTag,
+            ~eventType="AddressLinked",
+            [tag("addressId", "a1")],
+          ),
+      )->String.includes("carries no customerId tag"),
+    )->toBe(true)
+  )
+
+  testSync("a conditional append puts and fences the event under that key", () => {
+    let linked: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {
+      eventType: "AddressLinked",
+      data: JSON.Object(Dict.make()),
+      tags: [tag("addressId", "a1"), tag("customerId", "c1")],
+      meta: testMeta(),
+    }
+    let cond: Reventless.DcbTag.appendCondition = {
+      query: [{tags: [tag("customerId", "c1")], eventTypes: ["AddressLinked"]}],
+      after: "50",
+    }
+    let ids =
+      Runtime.buildConditionalTransactItems(table, [linked], cond, "100", ~partitionTag)
+      ->Array.filterMap(
+        it =>
+          switch (it.put, it.update) {
+          | (Some(p), _) => p.item->JSON.Decode.object->Option.flatMap(i => i->Dict.get("id"))
+          | (_, Some(u)) => u.key->Dict.get("id")
+          | _ => None
+          },
+      )
+      ->Array.filterMap(JSON.Decode.string)
+    expect(ids->Array.includes("customerId:c1"))->toBe(true)
+    expect(ids->Array.includes("fence#customerId:c1"))->toBe(true)
+    expect(ids->Array.some(id => id->String.includes("addressId")))->toBe(false)
+  })
+})
+
 describe("Runtime.buildEventPuts", () => {
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,