@reventlessdev/reventless-aws 3.0.0-alpha.252 → 3.0.0-alpha.253

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.253 (2026-08-01)
+
+* feat(aws,core,spec)!: qualify store prefixes by plugin and refuse name collisions ([da39405](https://github.com/ReventlessDev/reventless-core/commit/da394059d9f8f981bf7adc79e2c1ce2b429e0267))
+* feat(core,aws)!: name task buckets for their plugin and task ([05203cb](https://github.com/ReventlessDev/reventless-core/commit/05203cb3b0b019401a6f32cf78109f397b6799d5))
+
+### BREAKING CHANGES
+
+* objects minted under the old bare prefix are orphaned and their
+refs unresolvable. The migration is `seed:reset` for the owning plugin, then
+re-seed. Legacy-prefix grandfathering was considered and deliberately dropped —
+it would have added a permanent prefix SET across the deploy argument, both store
+configs, the presign IAM fan-out, the release scope check and the stack output,
+to spare a disposable stack one wipe.
+* a bucket name change is a replace. TaskBucket_S3 now sets
+forceDestroy on disposable stacks (Util_StoreLayout.protectionFor), so pr-*
+stacks recreate cleanly; protected stacks must have the task bucket drained by
+hand before the first deploy after this, or the replace fails BucketNotEmpty.
+
+
+
 # 3.0.0-alpha.252 (2026-08-01)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.252",
+  "version": "3.0.0-alpha.253",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,16 +13,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.116",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.91",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.199",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.63"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.200",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.64",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.117",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.92",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1537,6 +1537,30 @@ module MakeWithConfig = (
           : Array.concat(acc, [(plugin, store)])
       )
 
+    // Refuse two stores that cannot be told apart, BEFORE a single resource is
+    // created. Left to the deploy, the same collision surfaces as a CloudFront
+    // error about a duplicate path pattern — minutes in, naming a path pattern
+    // rather than the two plugins — and only after the intermixed objects and
+    // the over-broad presign grant have already been provisioned.
+    //
+    // Checked on the prefix, so it costs nothing to keep once prefixes are
+    // qualified: a qualified prefix simply stops colliding, while the check
+    // still guards any bare prefix that outlives the change.
+    switch ReventlessCore.StorePrefixCollision.collisionsFor(
+      ~stores=declaredStores->Array.map(((plugin, store)) => {
+        ReventlessCore.StorePrefixCollision.qualified: `${plugin}.${store}`,
+        prefix: Util_StoreLayout.keyPrefixFor(~plugin, ~store),
+      }),
+    ) {
+    | [] => ()
+    | collisions =>
+      JsError.throwWithMessage(
+        collisions
+        ->Array.map(ReventlessCore.StorePrefixCollision.collisionMessage)
+        ->Array.join("\n\n"),
+      )
+    }
+
     if declaredStores->Array.length > 0 {
       // The fail-open in `layoutFor` is only dangerous while it is silent: a
       // production stack that is not on the prod list gets the shared layout and
@@ -1567,7 +1591,7 @@ module MakeWithConfig = (
         ~plugin,
         ~store,
       )
-      let keyPrefix = Util_StoreLayout.keyPrefixFor(~store)
+      let keyPrefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
       let bucket = switch storeBuckets->Dict.get(bucketName) {
       | Some(b) => b
       | None =>

package/src/Platform.res.mjs

@@ -59,6 +59,7 @@ import * as Geocoder_AwsLocation$ReventlessAws from "./adapter/Geocoder/Geocoder
 import * as QueryEngine_DynamoDb$ReventlessAws from "./adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as PluginsReadModelSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginsReadModelSpec.res.mjs";
+import * as StorePrefixCollision$ReventlessCore from "@reventlessdev/reventless-core/src/util/StorePrefixCollision.res.mjs";
 import * as ExtensionPoint_Builder$ReventlessAws from "./components/ExtensionPoint_Builder.res.mjs";
 import * as StateViewSlice_Builder$ReventlessAws from "./components/StateViewSlice_Builder.res.mjs";
 import * as Task_Builder_PerBucket$ReventlessAws from "./components/Task_Builder_PerBucket.res.mjs";
@@ -904,6 +905,17 @@ function MakeWithConfig(Config) {
           ]]);
       }
     });
+    let collisions = StorePrefixCollision$ReventlessCore.collisionsFor(declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      return {
+        qualified: plugin + `.` + store,
+        prefix: Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store)
+      };
+    }));
+    if (collisions.length !== 0) {
+      Stdlib_JsError.throwWithMessage(collisions.map(StorePrefixCollision$ReventlessCore.collisionMessage).join("\n\n"));
+    }
     if (declaredStores.length !== 0) {
       let tmp;
       tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
@@ -917,7 +929,7 @@ function MakeWithConfig(Config) {
       let store = param[1];
       let plugin = param[0];
       let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
-      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
       let b = storeBuckets[bucketName];
       let bucket;
       if (b !== undefined) {
@@ -2038,6 +2050,17 @@ function Make($star) {
           ]]);
       }
     });
+    let collisions = StorePrefixCollision$ReventlessCore.collisionsFor(declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      return {
+        qualified: plugin + `.` + store,
+        prefix: Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store)
+      };
+    }));
+    if (collisions.length !== 0) {
+      Stdlib_JsError.throwWithMessage(collisions.map(StorePrefixCollision$ReventlessCore.collisionMessage).join("\n\n"));
+    }
     if (declaredStores.length !== 0) {
       let tmp;
       tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
@@ -2051,7 +2074,7 @@ function Make($star) {
       let store = param[1];
       let plugin = param[0];
       let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
-      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
       let b = storeBuckets[bucketName];
       let bucket;
       if (b !== undefined) {

package/src/adapter/Task/TaskBucket_S3.res

@@ -125,10 +125,21 @@ let connect = (
 let make: ReventlessCore.Task_Adapter.bucketMaker<bucketParts> = (~name, ~opts) => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
 
+  // A task bucket holds transient input a slice consumes, so disposability
+  // follows the stack, exactly as it does for declared stores. It matters
+  // because a bucket name change is a *replace*, and a replace of a non-empty
+  // bucket fails the deploy with `BucketNotEmpty` — which would wedge precisely
+  // the throwaway stacks that are recreated most often. Protected stacks keep
+  // the safe default and drain by hand.
+  let forceDestroy =
+    Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName()) ==
+      Util_StoreLayout.Unprotected
+
   let bucket = {
     PulumiAws.S3.Bucket.make(
       ~name,
       ~args={
+        forceDestroy: forceDestroy->Pulumi.Input.make,
         corsRules: [
           {
             PulumiAws.S3.Bucket.allowedHeaders: ["*"],

package/src/adapter/Task/TaskBucket_S3.res.mjs

@@ -11,6 +11,7 @@ import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adap
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
+import * as Util_StoreLayout$ReventlessAws from "../../util/Util_StoreLayout.res.mjs";
 import * as TaskBucket_S3_Runtime$ReventlessAws from "./TaskBucket_S3_Runtime.res.mjs";
 
 function subscribeLambda2S3Bucket(lambda, name, bucket, opts) {
@@ -75,6 +76,7 @@ function connect(name, bucket, bucketMode, commandTopics, runtime, opts) {
 
 function make(name, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let forceDestroy = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined) === "Unprotected";
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: [{
         allowedHeaders: ["*"],
@@ -93,6 +95,7 @@ function make(name, opts) {
         ],
         maxAgeSeconds: 3000
       }],
+    forceDestroy: forceDestroy,
     tags: AWS_Tags$ReventlessAws.make(name, Task$ReventlessCore.componentType, {
       TAG: "Other",
       _0: "Bucket"

package/src/adapter/Upload/Upload_Presign_S3_Ops.res

@@ -123,6 +123,10 @@ type releaseOutcome = Released | Refused(string)
 // Key must sit under this store's served prefix (`not_in_store`) and under the
 // caller's own identity segment within it (`not_yours`); an empty `sub` is
 // `unauthenticated` (the authorizer should have refused first — this is a guard).
+//
+// One prefix, not a set: changing a store's prefix strands the refs already
+// minted under the old one, so a prefix change is a breaking change resolved by
+// emptying the store and re-seeding, never by carrying both prefixes forever.
 let scopeCheck = (~key: string, ~sub: string, ~servedPrefix: string): result<unit, string> =>
   if sub == "" {
     Error("unauthenticated")

package/src/util/Util_StoreLayout.res

@@ -109,20 +109,36 @@ let bucketNameFor = (~layout: t, ~stack: string, ~plugin: string, ~store: string
   }
 
 /**
-The prefix a store's object keys are rooted at — the store name, in **both**
+The prefix a store's object keys are rooted at — `{plugin}/{store}`, in **both**
 layouts.
 
-This is the property that keeps the two layouts one model rather than a fork.
-The presign service mints `{store}/{identity}{uuid}/{file}` either way, so the
-stored ref is `/{store}/…` regardless of which bucket sits behind it, and only
-the CDN origin differs. Refs live in an append-only event log: one that encoded
-its bucket layout would be environment-specific and unrewritable, so a prod dump
-restored into a PR stack would carry refs that cannot resolve.
+Layout-invariance is what keeps the two layouts one model rather than a fork.
+The presign service mints `{prefix}/{identity}/{uuid}/{file}` either way, so the
+stored ref is `/{prefix}/…` regardless of which bucket sits behind it, and only
+the CDN origin differs. Refs live in an append-only event log: a prefix that
+encoded its bucket layout would be environment-specific and unrewritable, so a
+prod dump restored into a PR stack would carry refs that cannot resolve. Plugin
+and store are stack-invariant, so qualifying by plugin costs none of that.
+
+Qualified because the prefix is a **platform-global** namespace: one distribution
+fronts every store bucket and takes one cache behavior per prefix, so a bare
+store name made two plugins declaring `productImages` unroutable — in either
+layout, since the per-store layout still lands both prefixes on the one
+distribution. Qualifying narrows uniqueness from "per platform" to "per plugin",
+which is what plugin isolation wants and what a platform composing plugins it
+did not author needs.
 
 The cost is a slightly redundant prefix inside a dedicated bucket
-(`catalog-productImages/productImages/…`). Take the redundancy.
+(`catalog-productImages/Catalog/productImages/…`). Take the redundancy.
+
+**Changing this string is breaking.** Minted refs are `/{prefix}/…` in an
+append-only event log, so objects written under an earlier prefix become
+unreachable and their refs unresolvable. There is deliberately no grandfathering
+machinery: a stack that predates a change to this function empties its stores
+(`seed:reset`, which wipes per plugin) and re-seeds. Carrying a permanent prefix
+set to spare a disposable stack one wipe is the worse trade.
 */
-let keyPrefixFor = (~store: string): string => store
+let keyPrefixFor = (~plugin: string, ~store: string): string => `${plugin}/${store}`
 
 /**
 Who serves the declared stores — and the answer is never "both".

package/src/util/Util_StoreLayout.res.mjs

@@ -28,8 +28,8 @@ function bucketNameFor(layout, stack, plugin, store) {
   }
 }
 
-function keyPrefixFor(store) {
-  return store;
+function keyPrefixFor(plugin, store) {
+  return plugin + `/` + store;
 }
 
 function servingFor(hasHostUiBundle, declaredBucketCount) {

package/tests/Util_StoreLayoutTest.res

@@ -222,8 +222,21 @@ describe("Util_StoreLayout.bucketNameFor", () => {
 describe("Util_StoreLayout.keyPrefixFor", () => {
   // The assertion the whole dual-layout scheme rests on: a ref is
   // layout-independent, so the same declaration produces the same stored string
-  // on a per-store stack and a shared one.
-  testSync("the key prefix is the store name in both layouts", () =>
-    expect(Util_StoreLayout.keyPrefixFor(~store="productImages"))->toBe("productImages")
+  // on a per-store stack and a shared one. Plugin and store are both
+  // stack-invariant, so qualifying by plugin keeps that property.
+  testSync("the key prefix qualifies the store with its plugin", () =>
+    expect(Util_StoreLayout.keyPrefixFor(~plugin="Catalog", ~store="productImages"))->toBe(
+      "Catalog/productImages",
+    )
+  )
+
+  // The reason it is qualified: the prefix is a platform-global namespace (one
+  // distribution, one cache behavior per prefix), so two plugins declaring one
+  // store name were unroutable in EITHER layout until the plugin qualified them.
+  testSync("two plugins declaring one store name get distinct prefixes", () =>
+    expect(
+      Util_StoreLayout.keyPrefixFor(~plugin="Catalog", ~store="productImages") !=
+        Util_StoreLayout.keyPrefixFor(~plugin="Ordering", ~store="productImages"),
+    )->toBe(true)
   )
 })

package/tests/Util_StoreLayoutTest.res.mjs

@@ -113,8 +113,11 @@ globalThis.describe("Util_StoreLayout.bucketNameFor", () => {
 });
 
 globalThis.describe("Util_StoreLayout.keyPrefixFor", () => {
-  globalThis.test("the key prefix is the store name in both layouts", () => {
-    globalThis.expect(Util_StoreLayout$ReventlessAws.keyPrefixFor("productImages")).toBe("productImages");
+  globalThis.test("the key prefix qualifies the store with its plugin", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.keyPrefixFor("Catalog", "productImages")).toBe("Catalog/productImages");
+  });
+  globalThis.test("two plugins declaring one store name get distinct prefixes", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.keyPrefixFor("Catalog", "productImages") !== Util_StoreLayout$ReventlessAws.keyPrefixFor("Ordering", "productImages")).toBe(true);
   });
 });