@reventlessdev/reventless-aws 3.0.0-alpha.346 → 3.0.0-alpha.348

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -2,8 +2,10 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
 
@@ -314,6 +316,116 @@ globalThis.describe("Runtime.buildScanFilter — excludes fence sentinels (Issue
   });
 });
 
+globalThis.describe("Runtime.derivePartitionKey — each event type under its slice's key", () => {
+  let partitionTag = {
+    TAG: "ByEventType",
+    _0: Object.fromEntries([
+      [
+        "OrderPlaced",
+        "orderId"
+      ],
+      [
+        "AddressLinked",
+        "customerId"
+      ]
+    ])
+  };
+  let thrownMessage = f => {
+    try {
+      f();
+      return "";
+    } catch (raw_err) {
+      let err = Primitive_exceptions.internalToException(raw_err);
+      if (err.RE_EXN_ID === "JsExn") {
+        return Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "");
+      }
+      throw err;
+    }
+  };
+  globalThis.test("files an event under its own type's key, not its first tag", () => {
+    globalThis.expect(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, "AddressLinked", [
+      {
+        key: "addressId",
+        value: "a1"
+      },
+      {
+        key: "customerId",
+        value: "c1"
+      }
+    ])).toBe("customerId:c1");
+  });
+  globalThis.test("another type in the same log keeps its own key", () => {
+    globalThis.expect(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, "OrderPlaced", [
+      {
+        key: "customerId",
+        value: "c1"
+      },
+      {
+        key: "orderId",
+        value: "o1"
+      }
+    ])).toBe("orderId:o1");
+  });
+  globalThis.test("an event type no slice writes throws instead of guessing", () => {
+    globalThis.expect(thrownMessage(() => DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, "Unknown", [{
+        key: "customerId",
+        value: "c1"
+      }])).includes("Unknown has no partition key")).toBe(true);
+  });
+  globalThis.test("an event missing its partition tag throws instead of guessing", () => {
+    globalThis.expect(thrownMessage(() => DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, "AddressLinked", [{
+        key: "addressId",
+        value: "a1"
+      }])).includes("carries no customerId tag")).toBe(true);
+  });
+  globalThis.test("a conditional append puts and fences the event under that key", () => {
+    let linked_data = {};
+    let linked_tags = [
+      {
+        key: "addressId",
+        value: "a1"
+      },
+      {
+        key: "customerId",
+        value: "c1"
+      }
+    ];
+    let linked_meta = testMeta();
+    let linked = {
+      eventType: "AddressLinked",
+      data: linked_data,
+      tags: linked_tags,
+      meta: linked_meta
+    };
+    let cond_query = [{
+        eventTypes: ["AddressLinked"],
+        tags: [{
+            key: "customerId",
+            value: "c1"
+          }]
+      }];
+    let cond_after = "50";
+    let cond = {
+      query: cond_query,
+      after: cond_after
+    };
+    let ids = Stdlib_Array.filterMap(Stdlib_Array.filterMap(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.buildConditionalTransactItems(table, [linked], cond, "100", partitionTag, undefined), it => {
+      let match = it.Put;
+      let match$1 = it.Update;
+      if (match !== undefined) {
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(match.Item), i => i["id"]);
+      } else if (match$1 !== undefined) {
+        return match$1.Key["id"];
+      } else {
+        return;
+      }
+    }), Stdlib_JSON.Decode.string);
+    globalThis.expect(ids.includes("customerId:c1")).toBe(true);
+    globalThis.expect(ids.includes("fence#customerId:c1")).toBe(true);
+    globalThis.expect(ids.some(id => id.includes("addressId"))).toBe(false);
+  });
+});
+
 globalThis.describe("Runtime.buildEventPuts", () => {
   let event = (eventType, tags) => ({
     eventType: eventType,

package/tests/DcbUnresolvedPartitionSlice.res

@@ -0,0 +1,28 @@
+// A slice whose partition cannot be inferred, for `DcbColdStartPartitionTest`.
+// It writes two ids and reads both off an event nothing in its boundary writes,
+// so neither can be told apart from a reference.
+//
+// Explicit `@s.matches(...)` form: reventless-ppx is not wired into this package.
+
+@schema
+type consumedEvent = GadgetImported({gadgetId: string, supplierId: string})
+
+@schema
+type command =
+  | LinkGadget({
+      gadgetId: @s.matches(Reventless.DcbTag.string) string,
+      supplierId: @s.matches(Reventless.DcbTag.string) string,
+    })
+
+@schema
+type error = AlreadyLinked
+
+@schema
+type event =
+  | GadgetLinked({
+      gadgetId: @s.matches(Reventless.DcbTag.string) string,
+      supplierId: @s.matches(Reventless.DcbTag.string) string,
+    })
+
+let name = "LinkGadget"
+let moduleUrl = "cold-start-test://LinkGadget"

package/tests/DcbUnresolvedPartitionSlice.res.mjs

@@ -0,0 +1,38 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Sury from "sury";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+
+let consumedEventSchema = Sury.$schema(s => ({
+  TAG: "GadgetImported",
+  gadgetId: s.m(Sury.string),
+  supplierId: s.m(Sury.string)
+}));
+
+let commandSchema = Sury.$schema(s => ({
+  TAG: "LinkGadget",
+  gadgetId: s.m(DcbTag$Reventless.string),
+  supplierId: s.m(DcbTag$Reventless.string)
+}));
+
+let errorSchema = Sury.literal("AlreadyLinked");
+
+let eventSchema = Sury.$schema(s => ({
+  TAG: "GadgetLinked",
+  gadgetId: s.m(DcbTag$Reventless.string),
+  supplierId: s.m(DcbTag$Reventless.string)
+}));
+
+let name = "LinkGadget";
+
+let moduleUrl = "cold-start-test://LinkGadget";
+
+export {
+  consumedEventSchema,
+  commandSchema,
+  errorSchema,
+  eventSchema,
+  name,
+  moduleUrl,
+}
+/* consumedEventSchema Not a pure module */

package/tests/DeployAppTest.res

@@ -0,0 +1,90 @@
+open JestGlobals
+
+// What `deploy-app` decides without AWS or Pulumi: its arguments, the checks
+// that stop it before anything is created, and what a new stack starts with.
+
+describe("DeployApp.parseArgs", () => {
+  testSync("up with the defaults", () =>
+    expect(DeployApp.parseArgs(["up"]))->toEqual(
+      Ok({DeployApp.command: Some(Up), manifest: None, stack: "dev", help: false}),
+    )
+  )
+
+  testSync("down with a manifest and a stack", () =>
+    expect(DeployApp.parseArgs(["down", "--manifest", "../m.yaml", "--stack", "try"]))->toEqual(
+      Ok({DeployApp.command: Some(Down), manifest: Some("../m.yaml"), stack: "try", help: false}),
+    )
+  )
+
+  testSync("a second command is refused", () =>
+    expect(DeployApp.parseArgs(["up", "down"]))->toEqual(Error(`unknown argument "down"`))
+  )
+})
+
+describe("DeployApp checks", () => {
+  testSync("Node 22 and later pass", () => {
+    expect(DeployApp.checkNode("22.17.1"))->toEqual(None)
+    expect(DeployApp.checkNode("24.0.0"))->toEqual(None)
+  })
+
+  testSync("an older Node says which version is needed", () =>
+    expect(DeployApp.checkNode("20.11.0")->Option.getOr(""))->toContain("Node 22 or later")
+  )
+
+  testSync("Pulumi Cloud needs no passphrase", () =>
+    expect(
+      DeployApp.backendNeedsPassphrase(~url=Some("https://app.pulumi.com/me"), ~env=Dict.make()),
+    )->toBe(false)
+  )
+
+  testSync("a local backend needs one, unless it is set", () => {
+    expect(DeployApp.backendNeedsPassphrase(~url=Some("file://~"), ~env=Dict.make()))->toBe(true)
+    expect(
+      DeployApp.backendNeedsPassphrase(
+        ~url=Some("s3://bucket"),
+        ~env=Dict.fromArray([("PULUMI_CONFIG_PASSPHRASE", "")]),
+      ),
+    )->toBe(false)
+  })
+})
+
+describe("DeployApp stacks and layer", () => {
+  let project = {
+    DeployApp.label: "platform",
+    dir: "/app/platform-aws",
+    projectName: "shop-platform-aws",
+    program: "/app/platform-aws/src/Main.res.mjs",
+    stackDefaults: Dict.fromArray([("aws:region", "us-east-1"), ("platform:x", "y")]),
+  }
+
+  // The region and the try-out flag come last, so an app default cannot turn a
+  // try-out into a stack `down` refuses to remove.
+  testSync("a new stack gets the app's defaults, then the region and the try-out flag", () =>
+    expect(DeployApp.newStackConfig(~project, ~region="eu-west-1"))->toEqual([
+      ("aws:region", "us-east-1"),
+      ("platform:x", "y"),
+      ("aws:region", "eu-west-1"),
+      ("aws-native:region", "eu-west-1"),
+      ("reventless:disposable", "true"),
+    ])
+  )
+
+  testSync("the release download is named by the package and version", () =>
+    expect(DeployApp.releaseUrl("3.0.0-alpha.346"))->toBe(
+      "https://github.com/ReventlessDev/reventless-core/releases/download/%40reventlessdev%2Freventless-aws%403.0.0-alpha.346/reventless-layer.zip",
+    )
+  )
+
+  testSync("a layer is marked with the release it was published for", () =>
+    expect(DeployApp.layerDescription("3.0.0"))->toBe("reventless-aws@3.0.0")
+  )
+
+  testSync("sign-ins line up under each other", () =>
+    expect(
+      DeployApp.signInLines([
+        {username: "admin@example.com", password: "", groups: ["Admin"]},
+        {username: "a@example.com", password: "", groups: []},
+      ]),
+    )->toEqual(["    admin@example.com  [Admin]", "    a@example.com      []"])
+  )
+})

package/tests/DeployAppTest.res.mjs

@@ -0,0 +1,133 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DeployApp$ReventlessAws from "../scripts/DeployApp.res.mjs";
+
+globalThis.describe("DeployApp.parseArgs", () => {
+  globalThis.test("up with the defaults", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs(["up"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        command: "Up",
+        manifest: undefined,
+        stack: "dev",
+        help: false
+      }
+    });
+  });
+  globalThis.test("down with a manifest and a stack", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs([
+      "down",
+      "--manifest",
+      "../m.yaml",
+      "--stack",
+      "try"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        command: "Down",
+        manifest: "../m.yaml",
+        stack: "try",
+        help: false
+      }
+    });
+  });
+  globalThis.test("a second command is refused", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs([
+      "up",
+      "down"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "down"`
+    });
+  });
+});
+
+globalThis.describe("DeployApp checks", () => {
+  globalThis.test("Node 22 and later pass", () => {
+    globalThis.expect(DeployApp$ReventlessAws.checkNode("22.17.1")).toEqual(undefined);
+    globalThis.expect(DeployApp$ReventlessAws.checkNode("24.0.0")).toEqual(undefined);
+  });
+  globalThis.test("an older Node says which version is needed", () => {
+    globalThis.expect(Stdlib_Option.getOr(DeployApp$ReventlessAws.checkNode("20.11.0"), "")).toContain("Node 22 or later");
+  });
+  globalThis.test("Pulumi Cloud needs no passphrase", () => {
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("https://app.pulumi.com/me", {})).toBe(false);
+  });
+  globalThis.test("a local backend needs one, unless it is set", () => {
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("file://~", {})).toBe(true);
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("s3://bucket", Object.fromEntries([[
+        "PULUMI_CONFIG_PASSPHRASE",
+        ""
+      ]]))).toBe(false);
+  });
+});
+
+globalThis.describe("DeployApp stacks and layer", () => {
+  let project_stackDefaults = Object.fromEntries([
+    [
+      "aws:region",
+      "us-east-1"
+    ],
+    [
+      "platform:x",
+      "y"
+    ]
+  ]);
+  let project = {
+    label: "platform",
+    dir: "/app/platform-aws",
+    projectName: "shop-platform-aws",
+    program: "/app/platform-aws/src/Main.res.mjs",
+    stackDefaults: project_stackDefaults
+  };
+  globalThis.test("a new stack gets the app's defaults, then the region and the try-out flag", () => {
+    globalThis.expect(DeployApp$ReventlessAws.newStackConfig(project, "eu-west-1")).toEqual([
+      [
+        "aws:region",
+        "us-east-1"
+      ],
+      [
+        "platform:x",
+        "y"
+      ],
+      [
+        "aws:region",
+        "eu-west-1"
+      ],
+      [
+        "aws-native:region",
+        "eu-west-1"
+      ],
+      [
+        "reventless:disposable",
+        "true"
+      ]
+    ]);
+  });
+  globalThis.test("the release download is named by the package and version", () => {
+    globalThis.expect(DeployApp$ReventlessAws.releaseUrl("3.0.0-alpha.346")).toBe("https://github.com/ReventlessDev/reventless-core/releases/download/%40reventlessdev%2Freventless-aws%403.0.0-alpha.346/reventless-layer.zip");
+  });
+  globalThis.test("a layer is marked with the release it was published for", () => {
+    globalThis.expect(DeployApp$ReventlessAws.layerDescription("3.0.0")).toBe("reventless-aws@3.0.0");
+  });
+  globalThis.test("sign-ins line up under each other", () => {
+    globalThis.expect(DeployApp$ReventlessAws.signInLines([
+      {
+        username: "admin@example.com",
+        password: "",
+        groups: ["Admin"]
+      },
+      {
+        username: "a@example.com",
+        password: "",
+        groups: []
+      }
+    ])).toEqual([
+      "    admin@example.com  [Admin]",
+      "    a@example.com      []"
+    ]);
+  });
+});
+
+/*  Not a pure module */

package/tests/LambdaLayerLookupTest.res

@@ -0,0 +1,104 @@
+open JestGlobals
+
+module Lambda = PulumiAws.Lambda
+
+// A deploy with no layer used to succeed and leave every function failing with
+// "Cannot find package". These pin what the lookup tells apart and what the
+// stopped deploy says.
+let parameter = "/reventless/layer-arn/dev"
+
+let cliResult = (~status=?, ~stdout="", ~stderr="", ~error=?) => {
+  NodeChildProcess.status: status->Nullable.fromOption,
+  stdout: Nullable.make(stdout),
+  stderr: Nullable.make(stderr),
+  error: error->Nullable.fromOption,
+}
+
+describe("Lambda.classifySsmLookup", () => {
+  let classify = (~region=Some("eu-west-1"), result) =>
+    Lambda.classifySsmLookup(~parameter, ~region, result)
+
+  testSync("a stored value is the layer", () =>
+    expect(
+      classify(cliResult(~status=0, ~stdout="arn:aws:lambda:eu-west-1:1:layer:reventless:7\n")),
+    )->toEqual(Lambda.Found("arn:aws:lambda:eu-west-1:1:layer:reventless:7"))
+  )
+
+  testSync("ParameterNotFound means there is no layer", () =>
+    expect(
+      classify(
+        cliResult(
+          ~status=254,
+          ~stderr="\nAn error occurred (ParameterNotFound) when calling the GetParameter operation: \n",
+        ),
+      ),
+    )->toEqual(Lambda.NotFound({parameter, region: Some("eu-west-1")}))
+  )
+
+  testSync("a refused call is not mistaken for a missing layer", () =>
+    expect(
+      classify(
+        cliResult(
+          ~status=254,
+          ~stderr="\nAn error occurred (AccessDeniedException) when calling the GetParameter operation: no\n",
+        ),
+      ),
+    )->toEqual(
+      Lambda.CouldNotLook({
+        parameter,
+        region: Some("eu-west-1"),
+        reason: "An error occurred (AccessDeniedException) when calling the GetParameter operation: no",
+      }),
+    )
+  )
+
+  testSync("a CLI that cannot be started is not mistaken for a missing layer", () => {
+    let error = JsError.make("spawnSync aws ENOENT")->JsError.toJsExn
+    let reason = switch classify(
+      ~region=None,
+      {...cliResult(~error), stdout: Nullable.null, stderr: Nullable.null},
+    ) {
+    | CouldNotLook({reason}) => Some(reason)
+    | _ => None
+    }
+    expect(reason)->toEqual(Some("the AWS CLI could not be run (spawnSync aws ENOENT)"))
+  })
+})
+
+describe("Lambda.missingLayerMessage", () => {
+  testSync("names the parameter and the region it looked in", () => {
+    let message =
+      Lambda.NotFound({parameter, region: Some("eu-west-1")})
+      ->Lambda.missingLayerMessage
+      ->Option.getOr("")
+    expect(message)->toContain(parameter)
+    expect(message)->toContain("region eu-west-1")
+    expect(message)->toContain("REVENTLESS_LAYER_ARN")
+  })
+
+  testSync("says when the CLI's default region was asked", () =>
+    expect(
+      Lambda.NotFound({parameter, region: None})->Lambda.missingLayerMessage->Option.getOr(""),
+    )->toContain("the AWS CLI's default region")
+  )
+
+  testSync("carries the reason a lookup could not be made", () =>
+    expect(
+      Lambda.CouldNotLook({parameter, region: None, reason: "no credentials"})
+      ->Lambda.missingLayerMessage
+      ->Option.getOr(""),
+    )->toContain("no credentials")
+  )
+
+  testSync("is silent when the layer was found", () =>
+    expect(Lambda.Found("arn")->Lambda.missingLayerMessage)->toEqual(None)
+  )
+})
+
+describe("Lambda.reventlessLayerArn", () => {
+  testSync("REVENTLESS_LAYER_ARN wins without asking AWS", () =>
+    expect(Lambda.reventlessLayerArn())->toBe(
+      "arn:aws:lambda:eu-central-1:000000000000:layer:reventless-test:1",
+    )
+  )
+})

package/tests/LambdaLayerLookupTest.res.mjs

@@ -0,0 +1,117 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+
+let parameter = "/reventless/layer-arn/dev";
+
+function cliResult(status, stdoutOpt, stderrOpt, error) {
+  let stdout = stdoutOpt !== undefined ? stdoutOpt : "";
+  let stderr = stderrOpt !== undefined ? stderrOpt : "";
+  return {
+    status: Stdlib_Nullable.fromOption(status),
+    stdout: stdout,
+    stderr: stderr,
+    error: Stdlib_Nullable.fromOption(error)
+  };
+}
+
+globalThis.describe("Lambda.classifySsmLookup", () => {
+  let classify = (regionOpt, result) => {
+    let region = regionOpt !== undefined ? Primitive_option.valFromOption(regionOpt) : "eu-west-1";
+    return Lambda$PulumiAws.classifySsmLookup(parameter, region, result);
+  };
+  globalThis.test("a stored value is the layer", () => {
+    globalThis.expect(classify(undefined, cliResult(0, "arn:aws:lambda:eu-west-1:1:layer:reventless:7\n", undefined, undefined))).toEqual({
+      TAG: "Found",
+      _0: "arn:aws:lambda:eu-west-1:1:layer:reventless:7"
+    });
+  });
+  globalThis.test("ParameterNotFound means there is no layer", () => {
+    globalThis.expect(classify(undefined, cliResult(254, undefined, "\nAn error occurred (ParameterNotFound) when calling the GetParameter operation: \n", undefined))).toEqual({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: "eu-west-1"
+    });
+  });
+  globalThis.test("a refused call is not mistaken for a missing layer", () => {
+    globalThis.expect(classify(undefined, cliResult(254, undefined, "\nAn error occurred (AccessDeniedException) when calling the GetParameter operation: no\n", undefined))).toEqual({
+      TAG: "CouldNotLook",
+      parameter: parameter,
+      region: "eu-west-1",
+      reason: "An error occurred (AccessDeniedException) when calling the GetParameter operation: no"
+    });
+  });
+  globalThis.test("a CLI that cannot be started is not mistaken for a missing layer", () => {
+    let error = new Error("spawnSync aws ENOENT");
+    let init = cliResult(undefined, undefined, undefined, Primitive_option.some(error));
+    let match = classify(Primitive_option.some(undefined), {
+      status: init.status,
+      stdout: null,
+      stderr: null,
+      error: init.error
+    });
+    let reason;
+    switch (match.TAG) {
+      case "Found" :
+      case "NotFound" :
+        reason = undefined;
+        break;
+      case "CouldNotLook" :
+        reason = match.reason;
+        break;
+    }
+    globalThis.expect(reason).toEqual("the AWS CLI could not be run (spawnSync aws ENOENT)");
+  });
+});
+
+globalThis.describe("Lambda.missingLayerMessage", () => {
+  globalThis.test("names the parameter and the region it looked in", () => {
+    let message = Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: "eu-west-1"
+    }), "");
+    globalThis.expect(message).toContain(parameter);
+    globalThis.expect(message).toContain("region eu-west-1");
+    globalThis.expect(message).toContain("REVENTLESS_LAYER_ARN");
+  });
+  globalThis.test("says when the CLI's default region was asked", () => {
+    globalThis.expect(Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: undefined
+    }), "")).toContain("the AWS CLI's default region");
+  });
+  globalThis.test("carries the reason a lookup could not be made", () => {
+    globalThis.expect(Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "CouldNotLook",
+      parameter: parameter,
+      region: undefined,
+      reason: "no credentials"
+    }), "")).toContain("no credentials");
+  });
+  globalThis.test("is silent when the layer was found", () => {
+    globalThis.expect(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "Found",
+      _0: "arn"
+    })).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Lambda.reventlessLayerArn", () => {
+  globalThis.test("REVENTLESS_LAYER_ARN wins without asking AWS", () => {
+    globalThis.expect(Lambda$PulumiAws.reventlessLayerArn()).toBe("arn:aws:lambda:eu-central-1:000000000000:layer:reventless-test:1");
+  });
+});
+
+let Lambda;
+
+export {
+  Lambda,
+  parameter,
+  cliResult,
+}
+/*  Not a pure module */

package/tests/ProvisionAccountsTest.res

@@ -140,3 +140,29 @@ describe("ProvisionAccounts.looksLikeEmail", () => {
     expect(Provision.looksLikeEmail("admin@localhost"))->toBe(false)
   )
 })
+
+// A refused pool used to leave generated passwords in the file, and the seed then
+// offered accounts that exist nowhere.
+describe("ProvisionAccounts.provision", () => {
+  let manifest = `# the cast
+- username: shopper
+  password: ""
+  groups: [Shopper]
+`
+
+  test("a refused pool leaves the manifest untouched", async () => {
+    let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "provision-accounts-"]))
+    let file = NodePath.join([dir, "users.yaml"])
+    NodeFs.writeFileSync(file, manifest)
+    let refuse = async (~providerId as _, ~usernames as _) => Error("pool signs in on email")
+    let outcome = await Provision.provision(
+      ~file,
+      ~providerId="eu-west-1_Refuses",
+      ~checkPool=refuse,
+    )
+    let after = NodeFs.readFileSync(file)
+    NodeFs.rmSync(dir, {recursive: true, force: true})
+    expect(outcome)->toEqual(Error("pool signs in on email"))
+    expect(after)->toBe(manifest)
+  })
+})