@reventlessdev/reventless-aws 3.0.0-alpha.253 → 3.0.0-alpha.254

package/src/capability/Capability_ObjectStore_S3.res

@@ -37,6 +37,14 @@
 
 open PulumiAws
 
+/** One prefix in this bucket whose never-claimed uploads expire, and after how
+    many days. A list rather than a scalar because a shared-layout bucket holds
+    several stores, and expiry is opt-in per store. */
+type pendingExpiry = {
+  prefix: string,
+  days: int,
+}
+
 // Browser direct-PUT needs CORS. These defaults match what deployments wrote by
 // hand; `~corsRules` overrides them for a store the browser never touches.
 let defaultCorsRules: S3.Bucket.corsRules = [
@@ -64,13 +72,19 @@ let defaultCorsRules: S3.Bucket.corsRules = [
     `~protect` (default on) blocks `pulumi destroy` and accidental replacement.
     `~forceDestroy` is its counterpart for disposable stacks: a protected bucket
     cannot be torn down, so a PR stack would leak exactly the buckets that
-    sharing exists to save. */
+    sharing exists to save.
+
+    `~expirePending` turns on the sweep of never-claimed uploads. One entry per
+    prefix rather than one setting for the bucket, because a shared-layout
+    bucket holds several stores and the setting is each store's own — see the
+    comment on the rule below before setting it. */
 let make = (
   ~name: string,
   ~keyPrefix: string=Upload_Presign_S3.defaultServedPrefix,
   ~plugin: option<string>=?,
   ~protect: bool=true,
   ~forceDestroy: bool=false,
+  ~expirePending: array<pendingExpiry>=[],
   ~corsRules: S3.Bucket.corsRules=defaultCorsRules,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
 ): ReventlessInfra.Platform.objectStore => {
@@ -92,11 +106,38 @@ let make = (
     protect,
   }
 
+  // Expire objects nobody ever claimed — the half of abandonment the release
+  // path cannot reach, because the client that would have released them is
+  // gone (tab closed, navigation, dead network).
+  //
+  // Filtered on the pending tag **and** this store's served prefix, never on
+  // either alone, and written per store rather than once per bucket — a shared
+  // bucket holds several stores, and expiring a neighbouring store's objects on
+  // this store's setting would be exactly the wrong kind of surprise on a
+  // bucket created with `protect: true`.
+  //
+  // What makes it safe is what it *cannot* match. An object minted before this
+  // mechanism existed carries no tag; a claimed object has had its tag stripped.
+  // Neither is inside the filter, so the rule's blast radius is precisely
+  // "uploaded here, and no committed event references it". The one way it
+  // deletes live data is a claim component that stopped and was not noticed —
+  // which is why the claimer alarms on its own lag, why this is opt-in per
+  // store, and why the plan sequences reconciliation before the first store
+  // turns it on.
+  let lifecycleRules = expirePending->Array.map(({prefix, days}) => {
+    S3.Bucket.id: `reventless-pending-expiry-${prefix->String.replaceAll("/", "-")}`,
+    enabled: true,
+    prefix: `${prefix}/`,
+    tags: Dict.fromArray([(Upload_PendingTag.key, Upload_PendingTag.value)]),
+    expiration: {days: days},
+  })
+
   let bucket = S3.Bucket.make(
     ~name,
     ~args={
       corsRules: corsRules->Pulumi.Input.make,
       forceDestroy: forceDestroy->Pulumi.Input.make,
+      lifecycleRules: lifecycleRules->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name,
         ~kind,

package/src/capability/Capability_ObjectStore_S3.res.mjs

@@ -3,6 +3,7 @@
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+import * as Upload_PendingTag$ReventlessAws from "../adapter/Upload/Upload_PendingTag.res.mjs";
 import * as Upload_Presign_S3$ReventlessAws from "../adapter/Upload/Upload_Presign_S3.res.mjs";
 
 let defaultCorsRules = [{
@@ -18,10 +19,11 @@ let defaultCorsRules = [{
     maxAgeSeconds: 3000
   }];
 
-function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRulesOpt, opts) {
+function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, expirePendingOpt, corsRulesOpt, opts) {
   let keyPrefix = keyPrefixOpt !== undefined ? keyPrefixOpt : Upload_Presign_S3$ReventlessAws.defaultServedPrefix;
   let protect = protectOpt !== undefined ? protectOpt : true;
   let forceDestroy = forceDestroyOpt !== undefined ? forceDestroyOpt : false;
+  let expirePending = expirePendingOpt !== undefined ? expirePendingOpt : [];
   let corsRules = corsRulesOpt !== undefined ? corsRulesOpt : defaultCorsRules;
   let match = plugin !== undefined ? [
       "Plugin",
@@ -32,9 +34,25 @@ function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRules
     ];
   let newrecord = {...Stdlib_Option.getOr(opts, {})};
   newrecord.protect = protect;
+  let lifecycleRules = expirePending.map(param => {
+    let prefix = param.prefix;
+    return {
+      enabled: true,
+      expiration: {
+        days: param.days
+      },
+      id: `reventless-pending-expiry-` + prefix.replaceAll("/", "-"),
+      prefix: prefix + `/`,
+      tags: Object.fromEntries([[
+          Upload_PendingTag$ReventlessAws.key,
+          Upload_PendingTag$ReventlessAws.value
+        ]])
+    };
+  });
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: corsRules,
     forceDestroy: forceDestroy,
+    lifecycleRules: lifecycleRules,
     tags: AWS_Tags$ReventlessAws.make(name, match[0], {
       TAG: "Other",
       _0: "ObjectStore"

package/src/components/Api/AppSync_Adapter.res

@@ -549,6 +549,42 @@ let _makeApiResourceWith = (
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
+  // Managed log group with tiered retention for AppSync's own field-resolver logs,
+  // which land in `/aws/appsync/apis/<id>` and otherwise live forever with no
+  // retention. Managed on every stack by default (bar any in
+  // `unmanagedLogGroupStacks`), same as the Lambda groups. The name derives from
+  // the API id output so it matches the group AppSync writes to, and Pulumi
+  // therefore tears it down with the API.
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+  if Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks) {
+    let _ = Cloudwatch.LogGroup.make(
+      ~name=`${name}AppSyncLogGroup`,
+      ~args={
+        name: graphQLApi.id
+        ->Pulumi.Output.apply(id => `/aws/appsync/apis/${id}`)
+        ->Pulumi.Output.asInput,
+        retentionInDays: Util_LogRetention.retentionDaysFor(
+          ~stack,
+          ~prodStacks,
+          ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+            Int.fromString(s)
+          ),
+        )->Pulumi.Input.make,
+        tags: AWS.Tags.make(
+          ~name=`${name}AppSyncLogGroup`,
+          ~kind=ReventlessCore.ComponentType.Plugin,
+          ~role=Logs,
+          ~scope=Plugin,
+        ),
+      },
+      ~opts=customOpts,
+    )
+  }
+
   (graphQLApi->Pulumi.Output.make, iamRole->Pulumi.Output.make)
 }
 

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
@@ -15,7 +16,10 @@ import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as ClientAppsync from "@aws-sdk/client-appsync";
 import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
 import * as AppSync_Error$ReventlessAws from "../../errors/AppSync_Error.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
+import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "./AppSync_SdlDecorate.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
@@ -308,6 +312,16 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
     tags: apiArgs_tags
   };
   let graphQLApi = new (Aws.appsync.GraphQLApi)(name, apiArgs, customOpts);
+  let stack = Pulumi.getStack();
+  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
+  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
+  if (Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks)) {
+    new (Aws.cloudwatch.LogGroup)(name + `AppSyncLogGroup`, {
+      name: graphQLApi.id.apply(id => `/aws/appsync/apis/` + id),
+      retentionInDays: Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))),
+      tags: AWS_Tags$ReventlessAws.make(name + `AppSyncLogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined)
+    }, customOpts);
+  }
   return [
     Pulumi.output(graphQLApi),
     Pulumi.output(iamRole)

package/src/util/Util_LogRetention.res

@@ -0,0 +1,86 @@
+// How long a stack keeps its logs, and how verbose they are — tiered by
+// environment, the same way `Util_StoreLayout` tiers bucket layout and
+// `Util_HostUiDomain` tiers the host-shell FQDN. Pure functions so both
+// decisions are decidable and unit-testable without touching Pulumi.
+//
+// Retention and level pull in opposite directions between prod and dev, which is
+// the whole reason a single global setting cannot serve both:
+//
+//   prod  — quiet (`info`) and long-lived (365d): incident + forensic window
+//   dev   — loud  (`debug`) and short-lived (3–7d): consumed within hours
+//
+// The `prodStacks` allow-list is `Util_HostUiDomain.resolveProdStacks` — the one
+// notion of "is this stack production" the platform already shares for domain
+// naming and store layout, on purpose. A `configOverride` (from the Pulumi
+// `logRetentionDays` / `logLevel` config keys) wins over the tier default so a
+// stack can be dialled without a code change.
+
+// CloudWatch only accepts a fixed enum of retention values; every number below is
+// a member of it. `0` means "never expire" and is a valid explicit opt-in, but
+// never a tier default — hot CloudWatch storage billed forever is what this
+// tiering exists to bound.
+
+/** Retention in days for a stack. prod/main = 365, beta = 30, `pr-*` = 3,
+    everything else (alpha and any unlisted stack) = 7. A `configOverride` wins. */
+let retentionDaysFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<int>=?,
+): int =>
+  switch configOverride {
+  | Some(days) => days
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => 365
+    | "beta" => 30
+    | s if s->String.startsWith("pr-") => 3
+    | _ => 7
+    }
+  }
+
+/** The default `LOG_LEVEL` for a stack. prod/main and beta stay at `info` so
+    pre-prod behaves like prod and debug detail never leaks payloads in prod;
+    every other stack defaults to `debug` for verbose feedback during active
+    development (paired with short retention, so cheap). A `configOverride`
+    wins. */
+let logLevelFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<string>=?,
+): string =>
+  switch configOverride {
+  | Some(level) => level
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => "info"
+    | "beta" => "info"
+    | _ => "debug"
+    }
+  }
+
+/**
+Whether the framework creates a *managed* CloudWatch log group for this stack, or
+leaves Lambda/AppSync to auto-create an unmanaged one.
+
+**Managed for every stack by default.** A stack deployed on this framework gets
+its log groups from Pulumi on the first `pulumi up`, before Lambda/AppSync would
+lazily auto-create them — so on a fresh stack there is nothing to adopt and no
+`ResourceAlreadyExists` hazard. Every current stack is `alpha`, and there is no
+prod stack to migrate, so extending management to all stacks costs nothing today.
+
+The one case that still needs care is *adopting* a stack that predates managed
+groups: it already carries Lambda's auto-created group, and `CreateLogGroup`
+fails with `ResourceAlreadyExists` rather than adopting it. When such a stack
+ever appears, either `pulumi import` its groups first, or name it in the
+`unmanagedLogGroupStacks` config key to keep it on auto-created groups until the
+import is done. That escape hatch is the "prepared for the future" seam — turning
+a prod adoption into a config flip rather than an edit to this function.
+*/
+let managesLogGroup = (~stack: string, ~unmanagedStacks: array<string>=[]): bool =>
+  !(unmanagedStacks->Array.includes(stack))
+
+/** Parse the `unmanagedLogGroupStacks` config value — a CSV of stack names kept
+    on auto-created groups pending a `pulumi import`. Same tolerant parse as the
+    prod-stacks list: trims, drops empty entries. */
+let parseUnmanagedStacks = (csv: string): array<string> =>
+  csv->String.split(",")->Array.map(String.trim)->Array.filter(s => s !== "")

package/src/util/Util_LogRetention.res.mjs

@@ -0,0 +1,43 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function retentionDaysFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack)) {
+    return 365;
+  } else if (stack === "beta") {
+    return 30;
+  } else if (stack.startsWith("pr-")) {
+    return 3;
+  } else {
+    return 7;
+  }
+}
+
+function logLevelFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack) || stack === "beta") {
+    return "info";
+  } else {
+    return "debug";
+  }
+}
+
+function managesLogGroup(stack, unmanagedStacksOpt) {
+  let unmanagedStacks = unmanagedStacksOpt !== undefined ? unmanagedStacksOpt : [];
+  return !unmanagedStacks.includes(stack);
+}
+
+function parseUnmanagedStacks(csv) {
+  return csv.split(",").map(prim => prim.trim()).filter(s => s !== "");
+}
+
+export {
+  retentionDaysFor,
+  logLevelFor,
+  managesLogGroup,
+  parseUnmanagedStacks,
+}
+/* No side effect */

package/src/util/Util_StoreLayout.res

@@ -189,3 +189,40 @@ let coverageFor = (~required: array<string>, ~provisioned: array<string>): cover
   | (missing, provisioned) => Missing({missing, provisioned})
   }
 }
+
+/**
+After how many days a store expires objects still tagged pending — `None`, which
+is the default, meaning it expires nothing.
+
+The setting is a deployment's, not a declaration's: `@storageRef("productImages")`
+says a store is needed, and says nothing about how long an unclaimed upload
+should live there. Read from the `pendingUploadExpiryDays` config key (env var
+`REVENTLESS_PENDING_UPLOAD_EXPIRY_DAYS`, or the `Pulumi.local.yaml` sidecar) as a
+comma-separated list of `{plugin}.{store}=days` pairs:
+
+    pendingUploadExpiryDays: "Catalog.productImages=30, Ordering.receipts=14"
+
+**Per store and off by default, on purpose.** Enabling this is the one step in
+the mechanism that deletes data, and it is only sound once the claim component
+has been live long enough for reconciliation to confirm that the objects still
+tagged pending really are the unreferenced ones. A global switch — or a default
+value — would turn it on for stores nobody had checked yet, which is the whole
+failure this sequencing exists to prevent. A store that accumulates forever is a
+legitimate choice, and stays the choice until a deployment says otherwise.
+
+Only positive whole days are accepted. A malformed or non-positive entry is
+ignored rather than rounded or defaulted: guessing at what a typo meant, in the
+one setting that deletes objects, is not a service.
+*/
+let pendingExpiryFor = (~config: option<string>, ~store: string): option<int> =>
+  config
+  ->Option.getOr("")
+  ->String.split(",")
+  ->Array.filterMap(entry =>
+    switch entry->String.split("=") {
+    | [name, days] if name->String.trim == store =>
+      days->String.trim->Int.fromString->Option.filter(d => d > 0)
+    | _ => None
+    }
+  )
+  ->Array.get(0)

package/src/util/Util_StoreLayout.res.mjs

@@ -1,5 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 
 let defaultEphemeralPrefixes = ["pr-"];
 
@@ -64,6 +67,20 @@ function coverageFor(required, provisioned) {
   }
 }
 
+function pendingExpiryFor(config, store) {
+  return Stdlib_Array.filterMap(Stdlib_Option.getOr(config, "").split(","), entry => {
+      let match = entry.split("=");
+      if (match.length !== 2) {
+        return;
+      }
+      let name = match[0];
+      let days = match[1];
+      if (name.trim() === store) {
+        return Stdlib_Option.filter(Stdlib_Int.fromString(days.trim(), undefined), d => d > 0);
+      }
+    })[0];
+}
+
 export {
   defaultEphemeralPrefixes,
   layoutFor,
@@ -72,5 +89,6 @@ export {
   keyPrefixFor,
   servingFor,
   coverageFor,
+  pendingExpiryFor,
 }
 /* No side effect */

package/tests/Upload_ClaimTest.res

@@ -0,0 +1,132 @@
+// The claim component's pure decisions — no S3, no DynamoDB stream.
+//
+// Everything between "a committed event appeared" and "an S3 untag happens" is
+// decided by three functions in `Upload_Claim_S3_Ops`: which table a record came
+// from, which refs a declared field holds, and whether a ref resolves to an
+// object this claimer may touch. The untag itself has no branching left in it,
+// so pinning these pins the behaviour that matters.
+//
+// The direction under test throughout is refusal. An untag this component
+// wrongly *skips* costs a delayed cleanup; one it wrongly *performs* removes the
+// only thing standing between an object and an expiry rule.
+
+open JestGlobals
+
+module Ops = Upload_Claim_S3_Ops
+
+// `stores` and `refFieldsByTable` are read from the environment at module load,
+// so these tests exercise the decision functions against explicitly-built
+// inputs rather than a configured module — which is also the honest scope: the
+// env parsing is `JSON.parse` plus field reads.
+
+describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  testSync("reads the table name out of a stream ARN", () =>
+    expect(
+      Ops.tableNameFromEventSourceArn(
+        "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000",
+      ),
+    )->toEqual(Some("CatalogDcbEventLog-a1b2c3"))
+  )
+
+  testSync("returns None for an ARN that is not a table stream", () =>
+    expect(Ops.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue"))->toEqual(
+      None,
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  testSync("strips the leading slash the mint side writes", () =>
+    expect(Ops.keyOfRef("/Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+
+  testSync("leaves an already-bare key alone", () =>
+    expect(Ops.keyOfRef("Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single: Ops.refField = {field: "imageUrl", many: false, store: "Catalog.productImages"}
+  let multi: Ops.refField = {field: "imageUrls", many: true, store: "Catalog.productImages"}
+  let ref1 = "/Catalog/productImages/sub/one/p.png"
+  let ref2 = "/Catalog/productImages/sub/two/q.png"
+
+  testSync("reads one ref from a string field", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(ref1))]), single),
+    )->toEqual([ref1])
+  )
+
+  testSync("reads every ref from an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.string(ref2)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1, ref2])
+  )
+
+  // `StorageRef` admits "" as the "no object" sentinel, so a present-but-empty
+  // field must cost no S3 call rather than resolving to the store's root.
+  testSync("ignores the empty-string sentinel", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(""))]), single),
+    )->toEqual([])
+  )
+
+  testSync("ignores an absent field", () =>
+    expect(Ops.refsOfField(~data=Dict.make(), single))->toEqual([])
+  )
+
+  // Arity is declared, not sniffed: a field declared single that arrives as an
+  // array (or the reverse) is a schema and a deploy disagreeing, and reading it
+  // anyway would mean guessing which one is right.
+  testSync("a single-arity field ignores an array value", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([("imageUrl", JSON.Encode.array([JSON.Encode.string(ref1)]))]),
+        single,
+      ),
+    )->toEqual([])
+  )
+
+  testSync("a multi-arity field ignores a bare string value", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrls", JSON.Encode.string(ref1))]), multi),
+    )->toEqual([])
+  )
+
+  testSync("ignores non-string elements of an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.int(7)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1])
+  )
+})
+
+describe("Upload_Claim_S3_Ops.claim", () => {
+  // The tag key is the contract between three separately-deployed things: the
+  // presigned PUT that writes it, this component that removes it, and the
+  // lifecycle rule that expires what still carries it. A drift in any one of
+  // them is silent — a rule filtered on a key nobody writes matches nothing, and
+  // a claimer stripping the wrong key leaves every object tagged.
+  testSync("removes the same tag the mint side writes", () =>
+    expect(Upload_PendingTag.key)->toBe("reventless:pending")
+  )
+
+  // The presigned URL carries `Tagging` as a URL-encoded query string, so the
+  // colon has to survive one decode by S3 to land as the key above.
+  testSync("the presign tagging parameter decodes to that key and value", () =>
+    expect(Upload_PendingTag.putObjectTagging)->toBe("reventless%3Apending=true")
+  )
+})

package/tests/Upload_ClaimTest.res.mjs

@@ -0,0 +1,101 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Upload_PendingTag$ReventlessAws from "../src/adapter/Upload/Upload_PendingTag.res.mjs";
+import * as Upload_Claim_S3_Ops$ReventlessAws from "../src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs";
+
+globalThis.describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  globalThis.test("reads the table name out of a stream ARN", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000")).toEqual("CatalogDcbEventLog-a1b2c3");
+  });
+  globalThis.test("returns None for an ARN that is not a table stream", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue")).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  globalThis.test("strips the leading slash the mint side writes", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("/Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+  globalThis.test("leaves an already-bare key alone", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single = {
+    field: "imageUrl",
+    many: false,
+    store: "Catalog.productImages"
+  };
+  let multi = {
+    field: "imageUrls",
+    many: true,
+    store: "Catalog.productImages"
+  };
+  let ref1 = "/Catalog/productImages/sub/one/p.png";
+  let ref2 = "/Catalog/productImages/sub/two/q.png";
+  globalThis.test("reads one ref from a string field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ref1
+      ]]), single)).toEqual([ref1]);
+  });
+  globalThis.test("reads every ref from an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          ref2
+        ]
+      ]]), multi)).toEqual([
+      ref1,
+      ref2
+    ]);
+  });
+  globalThis.test("ignores the empty-string sentinel", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ""
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("ignores an absent field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField({}, single)).toEqual([]);
+  });
+  globalThis.test("a single-arity field ignores an array value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        [ref1]
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("a multi-arity field ignores a bare string value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        ref1
+      ]]), multi)).toEqual([]);
+  });
+  globalThis.test("ignores non-string elements of an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          7
+        ]
+      ]]), multi)).toEqual([ref1]);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.claim", () => {
+  globalThis.test("removes the same tag the mint side writes", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.key).toBe("reventless:pending");
+  });
+  globalThis.test("the presign tagging parameter decodes to that key and value", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.putObjectTagging).toBe("reventless%3Apending=true");
+  });
+});
+
+let Ops;
+
+export {
+  Ops,
+}
+/*  Not a pure module */