@reventlessdev/reventless-aws 3.0.0-alpha.253 → 3.0.0-alpha.255

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -11,6 +11,7 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Monitoring$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Monitoring/Monitoring.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "./Util_Lambda.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "./Util_LambdaLogging.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "./Util_EventSourceMapping.res.mjs";
 
 let name = "DeadLetterQueue";
@@ -73,10 +74,13 @@ let handler = new (Aws.lambda.Function)(name, {
   layers: layers,
   tags: AWS_Tags$ReventlessAws.make(name, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined),
   environment: {
-    variables: Object.fromEntries([[
+    variables: Object.fromEntries([
+      [
         "Environment",
         Pulumi.getStack()
-      ]])
+      ],
+      Util_LambdaLogging$ReventlessAws.logLevelEntry()
+    ])
   },
   sourceCodeHash: sourceCodeHash
 }, opts);

package/src/util/Util_LambdaLogging.res

@@ -0,0 +1,83 @@
+// Shared application of the environment-tiered logging policy
+// (`Util_LogRetention`) to Lambdas. `RuntimeEnvironment_Lambda.makeFromCodeAsset`
+// and the bespoke `Lambda.Function.make` builders (DeadLetterQueue, Upload,
+// Geocoder, the platform UI Lambdas, the state-topic publisher) all route the
+// `LOG_LEVEL` default and the managed log group through here, so a builder cannot
+// silently miss the tier policy — the gap that left ~8 platform Lambdas on the
+// logger's default and unmanaged, forever-retained log groups.
+open PulumiAws
+
+// Stack + prod allow-list + the unmanaged-groups escape hatch, resolved from
+// config. Impure by necessity (reads the stack name and config keys); the tier
+// decisions it feeds are the pure functions in `Util_LogRetention`.
+let stackContext = () => {
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+  (stack, prodStacks, unmanagedStacks)
+}
+
+// The `("LOG_LEVEL", <tier default>)` env-var entry. For the bespoke builders
+// that assemble their env with `Dict.fromArray([...])` and never pin LOG_LEVEL —
+// they just append this entry.
+let logLevelEntry = (): (string, Pulumi.Input.t<string>) => {
+  let (stack, prodStacks, _) = stackContext()
+  (
+    "LOG_LEVEL",
+    Util_LogRetention.logLevelFor(
+      ~stack,
+      ~prodStacks,
+      ~configOverride=?Util_LocalConfig.get("logLevel"),
+    )->Pulumi.Input.make,
+  )
+}
+
+// Default `LOG_LEVEL` to the environment tier when the caller has not pinned one.
+// Mutates the given variables dict in place, so it must run after the caller's
+// own env vars are set (theirs win). For `makeFromCodeAsset`, whose callers can
+// pass LOG_LEVEL through `envVars`.
+let applyLogLevelDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  if variables->Dict.get("LOG_LEVEL")->Option.isNone {
+    let (key, value) = logLevelEntry()
+    variables->Dict.set(key, value)
+  }
+
+// Create a managed CloudWatch log group with tier retention for a Lambda when the
+// stack manages its groups (`Util_LogRetention.managesLogGroup`). The group name
+// derives from the function's own *physical* name output — never the logical
+// name — so it matches the group Lambda would auto-create and carries Pulumi's
+// uniqueness suffix. The caller supplies `~tags` (Logs-role, its own attribution
+// convention) and `~opts` (so the group parents to the same component and is torn
+// down with it — closing the orphan-group loop for the bespoke builders too). The
+// trailing `()` terminates the optional `~opts`.
+let makeManagedLogGroup = (
+  ~name: string,
+  ~lambdaName: Pulumi.Output.t<string>,
+  ~tags,
+  ~opts=?,
+  (),
+) => {
+  let (stack, prodStacks, unmanagedStacks) = stackContext()
+  if Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks) {
+    let days = Util_LogRetention.retentionDaysFor(
+      ~stack,
+      ~prodStacks,
+      ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+        Int.fromString(s)
+      ),
+    )
+    let _ = Cloudwatch.LogGroup.make(
+      ~name=`${name}LogGroup`,
+      ~args={
+        name: lambdaName
+        ->Pulumi.Output.apply(n => `/aws/lambda/${n}`)
+        ->Pulumi.Output.asInput,
+        retentionInDays: days->Pulumi.Input.make,
+        tags,
+      },
+      ~opts?,
+    )
+  }
+}

package/src/util/Util_LambdaLogging.res.mjs

@@ -0,0 +1,59 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Util_LocalConfig$ReventlessAws from "./Util_LocalConfig.res.mjs";
+import * as Util_HostUiDomain$ReventlessAws from "./Util_HostUiDomain.res.mjs";
+import * as Util_LogRetention$ReventlessAws from "./Util_LogRetention.res.mjs";
+
+function stackContext() {
+  let stack = Pulumi.getStack();
+  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
+  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
+  return [
+    stack,
+    prodStacks,
+    unmanagedStacks
+  ];
+}
+
+function logLevelEntry() {
+  let match = stackContext();
+  return [
+    "LOG_LEVEL",
+    Util_LogRetention$ReventlessAws.logLevelFor(match[0], match[1], Util_LocalConfig$ReventlessAws.get("logLevel"))
+  ];
+}
+
+function applyLogLevelDefault(variables) {
+  if (!Stdlib_Option.isNone(variables["LOG_LEVEL"])) {
+    return;
+  }
+  let match = logLevelEntry();
+  variables[match[0]] = match[1];
+}
+
+function makeManagedLogGroup(name, lambdaName, tags, opts, param) {
+  let match = stackContext();
+  let stack = match[0];
+  if (!Util_LogRetention$ReventlessAws.managesLogGroup(stack, match[2])) {
+    return;
+  }
+  let days = Util_LogRetention$ReventlessAws.retentionDaysFor(stack, match[1], Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined)));
+  new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {
+    name: lambdaName.apply(n => `/aws/lambda/` + n),
+    retentionInDays: days,
+    tags: tags
+  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+}
+
+export {
+  stackContext,
+  logLevelEntry,
+  applyLogLevelDefault,
+  makeManagedLogGroup,
+}
+/* @pulumi/aws Not a pure module */

package/src/util/Util_LogRetention.res

@@ -0,0 +1,86 @@
+// How long a stack keeps its logs, and how verbose they are — tiered by
+// environment, the same way `Util_StoreLayout` tiers bucket layout and
+// `Util_HostUiDomain` tiers the host-shell FQDN. Pure functions so both
+// decisions are decidable and unit-testable without touching Pulumi.
+//
+// Retention and level pull in opposite directions between prod and dev, which is
+// the whole reason a single global setting cannot serve both:
+//
+//   prod  — quiet (`info`) and long-lived (365d): incident + forensic window
+//   dev   — loud  (`debug`) and short-lived (3–7d): consumed within hours
+//
+// The `prodStacks` allow-list is `Util_HostUiDomain.resolveProdStacks` — the one
+// notion of "is this stack production" the platform already shares for domain
+// naming and store layout, on purpose. A `configOverride` (from the Pulumi
+// `logRetentionDays` / `logLevel` config keys) wins over the tier default so a
+// stack can be dialled without a code change.
+
+// CloudWatch only accepts a fixed enum of retention values; every number below is
+// a member of it. `0` means "never expire" and is a valid explicit opt-in, but
+// never a tier default — hot CloudWatch storage billed forever is what this
+// tiering exists to bound.
+
+/** Retention in days for a stack. prod/main = 365, beta = 30, `pr-*` = 3,
+    everything else (alpha and any unlisted stack) = 7. A `configOverride` wins. */
+let retentionDaysFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<int>=?,
+): int =>
+  switch configOverride {
+  | Some(days) => days
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => 365
+    | "beta" => 30
+    | s if s->String.startsWith("pr-") => 3
+    | _ => 7
+    }
+  }
+
+/** The default `LOG_LEVEL` for a stack. prod/main and beta stay at `info` so
+    pre-prod behaves like prod and debug detail never leaks payloads in prod;
+    every other stack defaults to `debug` for verbose feedback during active
+    development (paired with short retention, so cheap). A `configOverride`
+    wins. */
+let logLevelFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<string>=?,
+): string =>
+  switch configOverride {
+  | Some(level) => level
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => "info"
+    | "beta" => "info"
+    | _ => "debug"
+    }
+  }
+
+/**
+Whether the framework creates a *managed* CloudWatch log group for this stack, or
+leaves Lambda/AppSync to auto-create an unmanaged one.
+
+**Managed for every stack by default.** A stack deployed on this framework gets
+its log groups from Pulumi on the first `pulumi up`, before Lambda/AppSync would
+lazily auto-create them — so on a fresh stack there is nothing to adopt and no
+`ResourceAlreadyExists` hazard. Every current stack is `alpha`, and there is no
+prod stack to migrate, so extending management to all stacks costs nothing today.
+
+The one case that still needs care is *adopting* a stack that predates managed
+groups: it already carries Lambda's auto-created group, and `CreateLogGroup`
+fails with `ResourceAlreadyExists` rather than adopting it. When such a stack
+ever appears, either `pulumi import` its groups first, or name it in the
+`unmanagedLogGroupStacks` config key to keep it on auto-created groups until the
+import is done. That escape hatch is the "prepared for the future" seam — turning
+a prod adoption into a config flip rather than an edit to this function.
+*/
+let managesLogGroup = (~stack: string, ~unmanagedStacks: array<string>=[]): bool =>
+  !(unmanagedStacks->Array.includes(stack))
+
+/** Parse the `unmanagedLogGroupStacks` config value — a CSV of stack names kept
+    on auto-created groups pending a `pulumi import`. Same tolerant parse as the
+    prod-stacks list: trims, drops empty entries. */
+let parseUnmanagedStacks = (csv: string): array<string> =>
+  csv->String.split(",")->Array.map(String.trim)->Array.filter(s => s !== "")

package/src/util/Util_LogRetention.res.mjs

@@ -0,0 +1,43 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function retentionDaysFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack)) {
+    return 365;
+  } else if (stack === "beta") {
+    return 30;
+  } else if (stack.startsWith("pr-")) {
+    return 3;
+  } else {
+    return 7;
+  }
+}
+
+function logLevelFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack) || stack === "beta") {
+    return "info";
+  } else {
+    return "debug";
+  }
+}
+
+function managesLogGroup(stack, unmanagedStacksOpt) {
+  let unmanagedStacks = unmanagedStacksOpt !== undefined ? unmanagedStacksOpt : [];
+  return !unmanagedStacks.includes(stack);
+}
+
+function parseUnmanagedStacks(csv) {
+  return csv.split(",").map(prim => prim.trim()).filter(s => s !== "");
+}
+
+export {
+  retentionDaysFor,
+  logLevelFor,
+  managesLogGroup,
+  parseUnmanagedStacks,
+}
+/* No side effect */

package/src/util/Util_StoreLayout.res

@@ -189,3 +189,40 @@ let coverageFor = (~required: array<string>, ~provisioned: array<string>): cover
   | (missing, provisioned) => Missing({missing, provisioned})
   }
 }
+
+/**
+After how many days a store expires objects still tagged pending — `None`, which
+is the default, meaning it expires nothing.
+
+The setting is a deployment's, not a declaration's: `@storageRef("productImages")`
+says a store is needed, and says nothing about how long an unclaimed upload
+should live there. Read from the `pendingUploadExpiryDays` config key (env var
+`REVENTLESS_PENDING_UPLOAD_EXPIRY_DAYS`, or the `Pulumi.local.yaml` sidecar) as a
+comma-separated list of `{plugin}.{store}=days` pairs:
+
+    pendingUploadExpiryDays: "Catalog.productImages=30, Ordering.receipts=14"
+
+**Per store and off by default, on purpose.** Enabling this is the one step in
+the mechanism that deletes data, and it is only sound once the claim component
+has been live long enough for reconciliation to confirm that the objects still
+tagged pending really are the unreferenced ones. A global switch — or a default
+value — would turn it on for stores nobody had checked yet, which is the whole
+failure this sequencing exists to prevent. A store that accumulates forever is a
+legitimate choice, and stays the choice until a deployment says otherwise.
+
+Only positive whole days are accepted. A malformed or non-positive entry is
+ignored rather than rounded or defaulted: guessing at what a typo meant, in the
+one setting that deletes objects, is not a service.
+*/
+let pendingExpiryFor = (~config: option<string>, ~store: string): option<int> =>
+  config
+  ->Option.getOr("")
+  ->String.split(",")
+  ->Array.filterMap(entry =>
+    switch entry->String.split("=") {
+    | [name, days] if name->String.trim == store =>
+      days->String.trim->Int.fromString->Option.filter(d => d > 0)
+    | _ => None
+    }
+  )
+  ->Array.get(0)

package/src/util/Util_StoreLayout.res.mjs

@@ -1,5 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 
 let defaultEphemeralPrefixes = ["pr-"];
 
@@ -64,6 +67,20 @@ function coverageFor(required, provisioned) {
   }
 }
 
+function pendingExpiryFor(config, store) {
+  return Stdlib_Array.filterMap(Stdlib_Option.getOr(config, "").split(","), entry => {
+      let match = entry.split("=");
+      if (match.length !== 2) {
+        return;
+      }
+      let name = match[0];
+      let days = match[1];
+      if (name.trim() === store) {
+        return Stdlib_Option.filter(Stdlib_Int.fromString(days.trim(), undefined), d => d > 0);
+      }
+    })[0];
+}
+
 export {
   defaultEphemeralPrefixes,
   layoutFor,
@@ -72,5 +89,6 @@ export {
   keyPrefixFor,
   servingFor,
   coverageFor,
+  pendingExpiryFor,
 }
 /* No side effect */

package/tests/Upload_ClaimTest.res

@@ -0,0 +1,132 @@
+// The claim component's pure decisions — no S3, no DynamoDB stream.
+//
+// Everything between "a committed event appeared" and "an S3 untag happens" is
+// decided by three functions in `Upload_Claim_S3_Ops`: which table a record came
+// from, which refs a declared field holds, and whether a ref resolves to an
+// object this claimer may touch. The untag itself has no branching left in it,
+// so pinning these pins the behaviour that matters.
+//
+// The direction under test throughout is refusal. An untag this component
+// wrongly *skips* costs a delayed cleanup; one it wrongly *performs* removes the
+// only thing standing between an object and an expiry rule.
+
+open JestGlobals
+
+module Ops = Upload_Claim_S3_Ops
+
+// `stores` and `refFieldsByTable` are read from the environment at module load,
+// so these tests exercise the decision functions against explicitly-built
+// inputs rather than a configured module — which is also the honest scope: the
+// env parsing is `JSON.parse` plus field reads.
+
+describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  testSync("reads the table name out of a stream ARN", () =>
+    expect(
+      Ops.tableNameFromEventSourceArn(
+        "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000",
+      ),
+    )->toEqual(Some("CatalogDcbEventLog-a1b2c3"))
+  )
+
+  testSync("returns None for an ARN that is not a table stream", () =>
+    expect(Ops.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue"))->toEqual(
+      None,
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  testSync("strips the leading slash the mint side writes", () =>
+    expect(Ops.keyOfRef("/Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+
+  testSync("leaves an already-bare key alone", () =>
+    expect(Ops.keyOfRef("Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single: Ops.refField = {field: "imageUrl", many: false, store: "Catalog.productImages"}
+  let multi: Ops.refField = {field: "imageUrls", many: true, store: "Catalog.productImages"}
+  let ref1 = "/Catalog/productImages/sub/one/p.png"
+  let ref2 = "/Catalog/productImages/sub/two/q.png"
+
+  testSync("reads one ref from a string field", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(ref1))]), single),
+    )->toEqual([ref1])
+  )
+
+  testSync("reads every ref from an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.string(ref2)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1, ref2])
+  )
+
+  // `StorageRef` admits "" as the "no object" sentinel, so a present-but-empty
+  // field must cost no S3 call rather than resolving to the store's root.
+  testSync("ignores the empty-string sentinel", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(""))]), single),
+    )->toEqual([])
+  )
+
+  testSync("ignores an absent field", () =>
+    expect(Ops.refsOfField(~data=Dict.make(), single))->toEqual([])
+  )
+
+  // Arity is declared, not sniffed: a field declared single that arrives as an
+  // array (or the reverse) is a schema and a deploy disagreeing, and reading it
+  // anyway would mean guessing which one is right.
+  testSync("a single-arity field ignores an array value", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([("imageUrl", JSON.Encode.array([JSON.Encode.string(ref1)]))]),
+        single,
+      ),
+    )->toEqual([])
+  )
+
+  testSync("a multi-arity field ignores a bare string value", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrls", JSON.Encode.string(ref1))]), multi),
+    )->toEqual([])
+  )
+
+  testSync("ignores non-string elements of an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.int(7)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1])
+  )
+})
+
+describe("Upload_Claim_S3_Ops.claim", () => {
+  // The tag key is the contract between three separately-deployed things: the
+  // presigned PUT that writes it, this component that removes it, and the
+  // lifecycle rule that expires what still carries it. A drift in any one of
+  // them is silent — a rule filtered on a key nobody writes matches nothing, and
+  // a claimer stripping the wrong key leaves every object tagged.
+  testSync("removes the same tag the mint side writes", () =>
+    expect(Upload_PendingTag.key)->toBe("reventless:pending")
+  )
+
+  // The presigned URL carries `Tagging` as a URL-encoded query string, so the
+  // colon has to survive one decode by S3 to land as the key above.
+  testSync("the presign tagging parameter decodes to that key and value", () =>
+    expect(Upload_PendingTag.putObjectTagging)->toBe("reventless%3Apending=true")
+  )
+})

package/tests/Upload_ClaimTest.res.mjs

@@ -0,0 +1,101 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Upload_PendingTag$ReventlessAws from "../src/adapter/Upload/Upload_PendingTag.res.mjs";
+import * as Upload_Claim_S3_Ops$ReventlessAws from "../src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs";
+
+globalThis.describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  globalThis.test("reads the table name out of a stream ARN", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000")).toEqual("CatalogDcbEventLog-a1b2c3");
+  });
+  globalThis.test("returns None for an ARN that is not a table stream", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue")).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  globalThis.test("strips the leading slash the mint side writes", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("/Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+  globalThis.test("leaves an already-bare key alone", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single = {
+    field: "imageUrl",
+    many: false,
+    store: "Catalog.productImages"
+  };
+  let multi = {
+    field: "imageUrls",
+    many: true,
+    store: "Catalog.productImages"
+  };
+  let ref1 = "/Catalog/productImages/sub/one/p.png";
+  let ref2 = "/Catalog/productImages/sub/two/q.png";
+  globalThis.test("reads one ref from a string field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ref1
+      ]]), single)).toEqual([ref1]);
+  });
+  globalThis.test("reads every ref from an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          ref2
+        ]
+      ]]), multi)).toEqual([
+      ref1,
+      ref2
+    ]);
+  });
+  globalThis.test("ignores the empty-string sentinel", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ""
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("ignores an absent field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField({}, single)).toEqual([]);
+  });
+  globalThis.test("a single-arity field ignores an array value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        [ref1]
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("a multi-arity field ignores a bare string value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        ref1
+      ]]), multi)).toEqual([]);
+  });
+  globalThis.test("ignores non-string elements of an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          7
+        ]
+      ]]), multi)).toEqual([ref1]);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.claim", () => {
+  globalThis.test("removes the same tag the mint side writes", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.key).toBe("reventless:pending");
+  });
+  globalThis.test("the presign tagging parameter decodes to that key and value", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.putObjectTagging).toBe("reventless%3Apending=true");
+  });
+});
+
+let Ops;
+
+export {
+  Ops,
+}
+/*  Not a pure module */