@reventlessdev/reventless-aws 3.0.0-alpha.251 → 3.0.0-alpha.253

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.253 (2026-08-01)
+
+* feat(aws,core,spec)!: qualify store prefixes by plugin and refuse name collisions ([da39405](https://github.com/ReventlessDev/reventless-core/commit/da394059d9f8f981bf7adc79e2c1ce2b429e0267))
+* feat(core,aws)!: name task buckets for their plugin and task ([05203cb](https://github.com/ReventlessDev/reventless-core/commit/05203cb3b0b019401a6f32cf78109f397b6799d5))
+
+### BREAKING CHANGES
+
+* objects minted under the old bare prefix are orphaned and their
+refs unresolvable. The migration is `seed:reset` for the owning plugin, then
+re-seed. Legacy-prefix grandfathering was considered and deliberately dropped —
+it would have added a permanent prefix SET across the deploy argument, both store
+configs, the presign IAM fan-out, the release scope check and the stack output,
+to spare a disposable stack one wipe.
+* a bucket name change is a replace. TaskBucket_S3 now sets
+forceDestroy on disposable stacks (Util_StoreLayout.protectionFor), so pr-*
+stacks recreate cleanly; protected stacks must have the task bucket drained by
+hand before the first deploy after this, or the replace fails BucketNotEmpty.
+
+
+
+# 3.0.0-alpha.252 (2026-08-01)
+
+### Bug Fixes
+
+* **aws:** let a dead letter be seen ([e64949b](https://github.com/ReventlessDev/reventless-core/commit/e64949bb3f4965cb8e6fc7a2f04971290ebe43bf))
+* **aws:** let the Function URL own CORS on the upload and geocoder services ([19d4b7f](https://github.com/ReventlessDev/reventless-core/commit/19d4b7f26f0925b7c659a1b37555e952bb7c7f46))
+### Features
+
+* **upload:** add the release half of the upload contract via the domain API ([448f887](https://github.com/ReventlessDev/reventless-core/commit/448f88714a5875be420f794a08d482fcf4ba8404))
+
+
 # 3.0.0-alpha.251 (2026-08-01)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.251",
+  "version": "3.0.0-alpha.253",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,16 +13,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.198",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.62",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.115",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.90"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.200",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.64",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.117",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.92",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -67,7 +67,6 @@ type objectStoreEndpoint = {
   // only known after the bucket resolves — and a plain string here is exactly
   // how this shipped exporting a bucket name that no ARN matches.
   bucketName: Pulumi.Output.t<string>,
-  uploadUrl: Pulumi.Output.t<string>,
   // Public base URL the store is served from, when the platform serves it
   // itself. `None` when a host-UI bundle is deployed — there the shell's own
   // origin serves the store same-origin and a relative `/{prefix}/…` resolves
@@ -170,9 +169,15 @@ module MakeWithConfig = (
   // "Relay node resolution" section of the merged-api plan (never resolved on
   // any deployed AWS platform, zero consumers; the Node interface and global
   // IDs stay).
+  // The upload service (route B) lives on the domain base, not the Admin-gated admin
+  // base: `Upload_Presign`/`Upload_Release` take the domain API's default
+  // `AllowAuthenticated` auth so any authenticated user can mint/release their own
+  // uploads. See [docs/plans/upload-release-path.md] § "Which API". (Split mode only —
+  // unified mode carries the admin base here instead; it declares no stores in practice,
+  // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
-    types: [],
-    mutations: [],
+    types: ReventlessCore.Platform_AdminApi.uploadTypes,
+    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields,
     queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: [],
@@ -1532,6 +1537,30 @@ module MakeWithConfig = (
           : Array.concat(acc, [(plugin, store)])
       )
 
+    // Refuse two stores that cannot be told apart, BEFORE a single resource is
+    // created. Left to the deploy, the same collision surfaces as a CloudFront
+    // error about a duplicate path pattern — minutes in, naming a path pattern
+    // rather than the two plugins — and only after the intermixed objects and
+    // the over-broad presign grant have already been provisioned.
+    //
+    // Checked on the prefix, so it costs nothing to keep once prefixes are
+    // qualified: a qualified prefix simply stops colliding, while the check
+    // still guards any bare prefix that outlives the change.
+    switch ReventlessCore.StorePrefixCollision.collisionsFor(
+      ~stores=declaredStores->Array.map(((plugin, store)) => {
+        ReventlessCore.StorePrefixCollision.qualified: `${plugin}.${store}`,
+        prefix: Util_StoreLayout.keyPrefixFor(~plugin, ~store),
+      }),
+    ) {
+    | [] => ()
+    | collisions =>
+      JsError.throwWithMessage(
+        collisions
+        ->Array.map(ReventlessCore.StorePrefixCollision.collisionMessage)
+        ->Array.join("\n\n"),
+      )
+    }
+
     if declaredStores->Array.length > 0 {
       // The fail-open in `layoutFor` is only dangerous while it is silent: a
       // production stack that is not on the prod list gets the shared layout and
@@ -1562,7 +1591,7 @@ module MakeWithConfig = (
         ~plugin,
         ~store,
       )
-      let keyPrefix = Util_StoreLayout.keyPrefixFor(~store)
+      let keyPrefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
       let bucket = switch storeBuckets->Dict.get(bucketName) {
       | Some(b) => b
       | None =>
@@ -1585,17 +1614,14 @@ module MakeWithConfig = (
         b
       }
       let storeHandle = bucket->Capability_ObjectStore_S3.underPrefix(~keyPrefix)
-      // One presign service per store, scoped to that store's own prefix.
-      let presign = Upload_Presign_S3.make(
-        ~name=`UploadPresign-${plugin}-${store}`,
-        ~bucketName=storeHandle.bucketName,
-        ~servedPrefix=storeHandle.keyPrefix,
-      )
       // `bucketName` is the layout's *logical* name and groups the served view
       // below; `storeHandle.bucketName` is the physical one Pulumi resolves, and
       // is what a consumer needs to build an ARN. Carrying both is the point —
       // they are different strings and only one of them exists in S3.
-      (`${plugin}.${store}`, keyPrefix, bucketName, storeHandle.bucketName, presign.url)
+      //
+      // Presigning is no longer per store: one platform-API Upload service (below)
+      // covers every declared store, keyed by the qualified `{plugin}.{store}` name.
+      (`${plugin}.${store}`, keyPrefix, bucketName, storeHandle.bucketName)
     })
 
     // Group the served view by bucket: one origin and one bucket policy per
@@ -1606,7 +1632,7 @@ module MakeWithConfig = (
       ->Option.map(b => {
         ReventlessInfra.Platform.id: bucketName,
         prefixes: declaredStoreServices
-        ->Array.filterMap(((_, prefix, bn, _, _)) => bn == bucketName ? Some(prefix) : None),
+        ->Array.filterMap(((_, prefix, bn, _)) => bn == bucketName ? Some(prefix) : None),
         bucketId: b.bucketId,
         bucketArn: b.bucketArn,
         bucketRegionalDomainName: b.bucketRegionalDomainName,
@@ -1645,30 +1671,58 @@ module MakeWithConfig = (
       keyPrefix,
       _logicalBucketName,
       physicalBucketName,
-      uploadUrl,
     )) => {
       store,
       keyPrefix,
       bucketName: physicalBucketName->Pulumi.Output.fromInput,
-      uploadUrl,
       baseUrl: storeServingBaseUrl,
     })
     objectStoreEndpointsRef := declaredStoreEndpoints
 
+    // One domain-API Upload service (route B1) covers every declared store plus the
+    // legacy `hostUiBundle.uploadBucket`, keyed by the qualified `{plugin}.{store}` name
+    // the caller passes as the `store` argument. On the domain API (not the Admin-gated
+    // platform API — see the plan's "Which API" note) so any authenticated user can
+    // mint/release. Created here in the outer scope — not inside the `hostUiBundle`
+    // branch — because a platform whose UI ships from another stack still has declared
+    // stores that need presigning. `uploads` keys the legacy store, matching the prefix
+    // it has always served under.
+    let uploadServiceStores =
+      declaredStoreServices
+      ->Array.map(((qualified, keyPrefix, _logical, physicalBucketName)) => {
+        Upload_Presign_S3.qualified: qualified,
+        bucketName: physicalBucketName,
+        servedPrefix: keyPrefix,
+      })
+      ->Array.concat(
+        switch hostUiBundle->Option.flatMap(c => c.uploadBucket) {
+        | Some(store) => [
+            {
+              Upload_Presign_S3.qualified: store.keyPrefix,
+              bucketName: store.bucketName,
+              servedPrefix: store.keyPrefix,
+            },
+          ]
+        | None => []
+        },
+      )
+    if uploadServiceStores->Array.length > 0 {
+      let _uploadService = Upload_Presign_S3.make(
+        ~api=domainApi,
+        ~stores=uploadServiceStores,
+        ~opts={},
+      )
+    }
+
     // Exported unconditionally — the provisioning above already is. Their only
     // consumers used to sit inside `switch hostUiBundle`, which left a platform
     // whose UI ships from another stack holding stores it could not name.
     //
     // Omitted entirely when nothing is declared, so a deployment with no
-    // declared store keeps a byte-identical output set.
+    // declared store keeps a byte-identical output set. The presign endpoint is no
+    // longer exported — under route B the client calls the platform API's
+    // `Upload_Presign` mutation, so there is no per-store URL to publish.
     if declaredStoreEndpoints->Array.length > 0 {
-      Pulumi.Pulumi.export(
-        "uploadEndpoints",
-        declaredStoreEndpoints
-        ->Array.map(e => e.uploadUrl->Pulumi.Output.apply(u => (e.store, JSON.Encode.string(u))))
-        ->Pulumi.Output.all
-        ->Pulumi.Output.apply(pairs => pairs->Dict.fromArray->JSON.Encode.object),
-      )
       Pulumi.Pulumi.export(
         "objectStores",
         declaredStoreEndpoints
@@ -1826,27 +1880,11 @@ module MakeWithConfig = (
       | None => Pulumi.Output.make(None)
       }
 
-      // Optional public upload presign Function URL, provisioned against the
-      // configured store; its resolved URL becomes config.json's
-      // `uploadEndpoint`. No store ⇒ Output<None> ⇒ field omitted below.
-      let uploadEndpointOutput: Pulumi.Output.t<option<string>> = switch cfg.uploadBucket {
-      | Some(store) =>
-        Upload_Presign_S3.make(~bucketName=store.bucketName).url->Pulumi.Output.apply(u => Some(u))
-      | None => Pulumi.Output.make(None)
-      }
-
-      // Per-store presign endpoints, keyed by the store's qualified name. This
-      // is what lets an upload input bind to the store its field *declares*
-      // rather than inferring one from the field's name — the endpoint exists
-      // per store, so there is something concrete to bind to.
-      //
-      // `uploadEndpoint` (singular) stays as the legacy service's URL: a shell
-      // built before per-store binding reads it and is unaffected.
-      let storeUploadEndpointsOutput: Pulumi.Output.t<array<(string, string)>> =
-        declaredStoreServices
-        ->Array.map(((qualified, _, _, _, url)) => url->Pulumi.Output.apply(u => (qualified, u)))
-        ->Pulumi.Output.all
-
+      // Presign endpoints are no longer written to config.json: under route B the
+      // client calls the platform API's `Upload_Presign` mutation (reachable from
+      // `platformApiEndpoint`, already present) with the store it declares, so there
+      // is no per-store URL to publish. The store's *serving* base URL still travels
+      // in the `objectStores` stack output above.
       let configJsonContent =
         (
           (
@@ -1857,14 +1895,12 @@ module MakeWithConfig = (
           )->Pulumi.Output.all4,
           domainEventsEndpointOutput,
           geocoderEndpointOutput,
-          (uploadEndpointOutput, storeUploadEndpointsOutput)->Pulumi.Output.all2,
         )
-        ->Pulumi.Output.all4
+        ->Pulumi.Output.all3
         ->Pulumi.Output.apply(((
           (domainEp, platformEp, poolId, clientId),
           eventsEpOpt,
           geocoderEpOpt,
-          (uploadEpOpt, storeUploadEps),
         )) => {
           let fields = [
             ("apiEndpoint", JSON.Encode.string(domainEp)),
@@ -1897,29 +1933,7 @@ module MakeWithConfig = (
           | Some(ep) => Array.concat(withEvents, [("geocoderEndpoint", JSON.Encode.string(ep))])
           | None => withEvents
           }
-          let withUpload = switch uploadEpOpt {
-          | Some(ep) => Array.concat(withGeocoder, [("uploadEndpoint", JSON.Encode.string(ep))])
-          | None => withGeocoder
-          }
-          // Omitted entirely when nothing is declared, so a deployment without
-          // declared stores writes a byte-identical config.json.
-          let withStoreUploads = switch storeUploadEps {
-          | [] => withUpload
-          | eps =>
-            Array.concat(
-              withUpload,
-              [
-                (
-                  "uploadEndpoints",
-                  eps
-                  ->Array.map(((qualified, url)) => (qualified, JSON.Encode.string(url)))
-                  ->Dict.fromArray
-                  ->JSON.Encode.object,
-                ),
-              ],
-            )
-          }
-          withStoreUploads->Dict.fromArray->JSON.Encode.object->JSON.stringify
+          withGeocoder->Dict.fromArray->JSON.Encode.object->JSON.stringify
         })
 
       let _ = PulumiAws.S3.BucketObject.make(