@reventlessdev/reventless-aws 3.0.0-alpha.305 → 3.0.0-alpha.307

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -27,7 +27,7 @@ import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessde
 // Typed cold-start core — scope/partitionTag derivation, storage-ops wiring, and
 // per-slice handler building (functor + decode + handleCommands), all
 // compiler-checked against the framework signatures (see the module header and
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler, buildInboundReceiver } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
 import { makeDynamoQueryDbOps } from "./QueryDbEntryPoint_Ops.res.mjs";
 
@@ -95,6 +95,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
   );
 
   const handlersByType = {};
+  const commandSchemasByType = {};
   const sharedDcbEventLogOps = dcbEventLogOperationsMake({
     name: config.pluginName,
     // Mirrors DcbEventLog_Builder.res's `name ++ "DcbEventLog"` — the
@@ -119,6 +120,19 @@ export async function buildHandlersForConfig(config, opts = {}) {
     );
     for (const typeName of commandTypeNames(patchedSpec)) {
       handlersByType[typeName] = jsonHandler;
+      // The schema this command's owner fields are read from. Kept beside the
+      // handler because the two answer the same question — "which slice is this
+      // command?" — and a command routed to a handler but not to a schema is
+      // exactly the state that stamps nothing while looking like it worked.
+      if (commandSchemasByType[typeName] !== undefined) {
+        log.error(
+          "two DCB slices declare the command \"" + typeName + "\"; owner stamping " +
+            "resolves a command by that name alone and cannot tell them apart",
+          { comp: "DcbCommandTopicRuntime" },
+        );
+      } else {
+        commandSchemasByType[typeName] = patchedSpec.commandSchema;
+      }
     }
   });
 
@@ -191,9 +205,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // Sync (default): inline-dispatch the command via the same composite handler
   // that Route 2 uses, so the AppSync resolver gets a typed Accepted/Rejected
   // outcome. Async: undefined → makeCommandGenerator falls back to publishJsons
-  // and returns Pending. The schema is permissive (S.json) because AppSync has
-  // already validated input against the SDL — per-slice schemas reapply inside
-  // the typed core's buildSliceHandler decode.
+  // and returns Pending.
   const publishJsonsAndWait = DISPATCH_MODE === "async"
     ? undefined
     : (jsons) => runInlineAndCollect(jsons, compositeJsonCommandsHandler);
@@ -202,14 +214,31 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // the framework signature. stripIdFromParams=false: DCB slices may declare a
   // literal `id` field as part of the command schema (composite partition keys
   // etc.) — don't strip it.
-  const generateCommand = makeCommandGenerator(
+  //
+  // One generator per command, differing only in the schema. This used to be a
+  // single generator built on the permissive `jsonSchema`, on the still-true
+  // grounds that AppSync has already validated input against the SDL and that
+  // per-slice schemas reapply inside `buildSliceHandler`'s decode. What that
+  // reasoning did not cover is that the schema is also where `makeGenerateCommand`
+  // reads a command's `@owner` fields from: given `S.json` it finds none, for every
+  // command, and the write keeps whatever owner the CLIENT sent. Validation was
+  // never the only job.
+  const makeGeneratorFor = (commandSchema) => makeCommandGenerator(
     publishJsons,
     publishJsonsAndWait,
     config.pluginName,
-    jsonSchema,
+    commandSchema,
     "StateChangeSlice",
     false,
   );
+  const generatorsByType = {};
+  for (const typeName of Object.keys(commandSchemasByType)) {
+    generatorsByType[typeName] = makeGeneratorFor(commandSchemasByType[typeName]);
+  }
+  // A command no loaded slice claims keeps the permissive generator — what every
+  // command got before this change — so anything reaching this handler by another
+  // route behaves as it did. It also cannot stamp, hence the warning.
+  const generateFallback = makeGeneratorFor(jsonSchema);
 
   const cmdGenHandler = (event) => {
     // CommandGenerator.meta declares ip as array<string> (X-Forwarded-For chain).
@@ -225,6 +254,15 @@ export async function buildHandlersForConfig(config, opts = {}) {
           groups: [],
           provider: { TAG: "Custom", _0: "aws" },
         };
+    let generateCommand = generatorsByType[event.command];
+    if (generateCommand === undefined) {
+      log.warn(
+        "no DCB slice declares the command \"" + event.command + "\"; dispatching " +
+          "without an owner stamp, so any @owner field keeps the value the caller sent",
+        { comp: "DcbCommandTopicRuntime" },
+      );
+      generateCommand = generateFallback;
+    }
     return generateCommand({ ...event, meta, identity });
   };
 

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the DCB CommandTopic Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 // The `.mjs` shell owns the one boundary that is inherently untyped: reading
 // `HANDLER_CONFIG` and dynamically `import()`-ing user Spec/Behavior modules at
 // cold start, whose types are unknowable here. Everything below is compiler-

package/src/adapter/Runtime/EventCollectorEntryPoint.mjs

@@ -3,7 +3,7 @@
 // driven entirely by HANDLER_CONFIG.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of EP/extension/spec
 // modules named in HANDLER_CONFIG and the functor applications consuming those
 // runtime-loaded modules. Everything else (config parse/validation, the Plugin-RM

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the Plugin EventCollector Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // EventCollectorEntryPoint.mjs owns ONLY the untyped seams — the dynamic
 // `import()` of EP/extension/spec modules named in HANDLER_CONFIG and the
 // functor applications consuming those runtime-loaded modules

package/src/adapter/Runtime/EventMapperEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires EventMapper_Callback.MakeCounterHandler + MakeEventCollectorHandler.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the
 // target-spec/mappings modules named in HANDLER_CONFIG, the shape fix-ups on
 // those runtime-loaded modules (patchSpecId / patchMappingsSourceIds), and the

package/src/adapter/Runtime/EventMapperEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the EventMapper Lambda entry point (Micro mode).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // EventMapperEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of the target-spec/mappings modules named in HANDLER_CONFIG, the
 // `patchSpecId` / mapping-Source-Id fix-ups, and the

package/src/adapter/Runtime/ExtensionPointEntryPoint.mjs

@@ -4,7 +4,7 @@
 // routes SQS events through handleQueueEvent.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the
 // spec/mappings modules named in HANDLER_CONFIG, the `patchSpecId` fix-up, and
 // the two functor applications consuming them. The callback config,

package/src/adapter/Runtime/ExtensionPointEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core for the (per-extension-point) ExtensionPoint Lambda
 // entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // ExtensionPointEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of the spec/mappings modules named in HANDLER_CONFIG, the
 // `patchSpecId` fix-up, and the ExtensionPoint_Callback.Make /

package/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs

@@ -9,7 +9,7 @@
 // PgQueryResolver_Lambda.dispatch routes.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the spec
 // packages named in QUERY_RESOLVER_CONFIG, the `patchSpecId` fix-up, and the
 // reads of the runtime-loaded modules' exports. QUERY_RESOLVER_CONFIG parsing,

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core for the shared PgQueryResolver Lambda entry point
 // (B3.2b).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // PgQueryResolverEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of each spec package named in QUERY_RESOLVER_CONFIG, the
 // `patchSpecId` fix-up, and the reads of the runtime-loaded module's exports
@@ -163,6 +163,12 @@ let registerBinding = (
       ->Reventless.StateAnnotations.getSpec
       ->Option.flatMap(a => a.retired)
       ->Option.flatMap(r => r.values),
+      // Read off the retirement rather than from a second annotation: a record
+      // cannot declare the reach of a retirement it does not have.
+      namedWhenRetired: spec.stateSchema
+      ->Reventless.StateAnnotations.getSpec
+      ->Option.flatMap(a => a.retired)
+      ->Option.mapOr(false, r => r.namedWhenRetired),
     },
   )
   logDebug("registered resolver binding for " ++ entry.readModelName, {comp: "PgQueryResolver"})

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -77,7 +77,8 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     authorization: spec.authorization,
     ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0],
     retiredField: Stdlib_Option.map(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.field),
-    retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values)
+    retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values),
+    namedWhenRetired: Stdlib_Option.mapOr(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), false, r => r.namedWhenRetired)
   });
   HandlerFactoryHelpersMjs.log.debug("registered resolver binding for " + entry.readModelName, {
     comp: "PgQueryResolver"

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -95,7 +95,7 @@ module Mappings = {
   // Parity with the former shell: only the Plugin lifecycle mapping. The
   // in-process wiring (PluginExtensionPoint_Builder) additionally registers
   // PluginExtensionPoint_UiFragment.Mapping — divergence tracked in
-  // docs/plans/entry-point-rescript-conversion.md.
+  // docs/plans/done/entry-point-rescript-conversion.md.
   let mappings: array<module(Mapping)> = [module(PluginMappingInstance.Mapping)]
 }
 

package/src/adapter/Runtime/ProjectionEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed QueryDb-assembly core shared by the two projection Lambda entry points
 // (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // both shells build the QueryDb operation set (DynamoDB or Postgres, live-update
 // wrapped) for each projection from spec-module reads; that machinery lives
 // here, fully type-checked. The routed dispatch boundary they share (with the

package/src/adapter/Runtime/QueryDbEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core shared by the QueryDb-backed entry-point shells
 // (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 // The DynamoDB QueryDb operations were built in each shell with seven positional
 // `load(table)` / `save(table)` / … calls into the compiled runtime, assembled
 // into an object the shell then passes to the ReadModel/StateViewSlice callback

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires ReadModel_Callback.Make, builds handler map keyed by source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of spec/mappings
 // modules named in HANDLER_CONFIG, the shape fix-ups on those runtime-loaded
 // modules (patchSpecId / fixMappingsModule), and the ReadModel_Callback.Make

package/src/adapter/Runtime/ReadModelEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the ReadModel Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // ReadModelEntryPoint.mjs keeps only the untyped seams — the dynamic `import()`
 // of spec/mappings modules named in HANDLER_CONFIG, the `patchSpecId` /
 // `fixMappingsModule` shape fix-ups on those runtime-loaded modules, and the

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -354,7 +354,7 @@ let makeFromCodeAsset: (
 
   // Announce the provisioned execution unit to the Monitoring registry. No-op
   // unless a deploy program registered a backend via Monitoring.use — see
-  // docs/plans/monitoring-hook-seam.md.
+  // docs/plans/done/monitoring-hook-seam.md.
   ReventlessCore.Monitoring.notify(~kind=unitKind, ~name, ~component=lambdaResource)
 
   {

package/src/adapter/Runtime/SideEffectEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires SideEffectHandler_Callback.Make, builds handler map keyed by source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the side-effect
 // modules named in HANDLER_CONFIG and the SideEffectHandler_Callback.Make
 // functor application consuming them. HANDLER_CONFIG parsing and handler

package/src/adapter/Runtime/SideEffectEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the SideEffectHandler Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // SideEffectEntryPoint.mjs keeps only the untyped seam — the dynamic `import()`
 // of the side-effect modules named in HANDLER_CONFIG and the
 // SideEffectHandler_Callback.Make functor application consuming them.

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -4,7 +4,7 @@
 // source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // inherently-untyped seam — the dynamic `import()` of spec/projection modules
 // named in HANDLER_CONFIG and the reads of their exports. Everything else
 // (HANDLER_CONFIG parsing incl. the compact-v2 expansion, the QueryDb operation

package/src/adapter/Runtime/StateViewSliceEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the StateViewSlice Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // StateViewSliceEntryPoint.mjs keeps only the inherently-untyped seam — the
 // dynamic `import()` of spec/projection modules named in HANDLER_CONFIG and the
 // reads of their exports. HANDLER_CONFIG parsing (including the compact-v2

package/src/adapter/Runtime/StreamRoutedEntryPoint_Ops.res

@@ -2,7 +2,7 @@
 // points (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs,
 // AutomationSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // all three shells route DynamoDB-stream / SQS-feed records to per-source-URN
 // handler lists with per-handler log attribution — machinery the `.mjs` files
 // previously duplicated verbatim. It lives here so every co-hosted component

package/src/adapter/Runtime/TaskBucketEntryPoint.mjs

@@ -4,7 +4,7 @@
 // Events schedules).
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // inherently-untyped seam — the dynamic `import()` of the callback module named
 // in HANDLER_CONFIG and the read of its `callback` export. Everything else
 // (HANDLER_CONFIG parsing, S3-event handling via TaskBucket_S3_Runtime, the

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the TaskBucket Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // TaskBucketEntryPoint.mjs keeps only the inherently-untyped seam — the
 // dynamic `import()` of the task callback module named in HANDLER_CONFIG and
 // the read of its `callback` export. HANDLER_CONFIG parsing, the S3-event →

package/src/util/Util_Bundle.res

@@ -122,7 +122,7 @@ let hashString = (str: string): string =>
 // (set on the Lambda env by RuntimeEnvironment_Lambda.makeFromCodeAsset). Shipped
 // at the root of every code archive; NODE_OPTIONS=--import points Node at
 // register-hook.mjs. Validated on a Node 22.17.1 rig; see
-// docs/plans/deployed-lambda-esm-self-containment.md.
+// docs/plans/done/deployed-lambda-esm-self-containment.md.
 let registerHookFileName = "register-hook.mjs"
 let layerResolverFileName = "layer-resolver.mjs"
 

package/src/util/Util_DynamoDbStream_Runtime.res

@@ -5,7 +5,7 @@ type result =
   | Invalid
 
 // Returns None for rows that aren't events — e.g. DCB FENCE rows and aggregate
-// snapshot rows (position = "SNAPSHOT"; docs/plans/aggregate-snapshotting.md),
+// snapshot rows (position = "SNAPSHOT"; docs/plans/done/aggregate-snapshotting.md),
 // neither of which has an `event` column. The caller filters these out via
 // `Invalid` rather than synthesising a bogus event that sury would later reject.
 let buildJsonEvent' = dict => {

package/tests/AWS_TagsTest.res

@@ -3,7 +3,7 @@ open JestGlobals
 // Guards the resource-attribution tag schema. A downstream inventory answers
 // "which model component owns this resource, in what role, at what scope" purely
 // from these keys, so the key set and its namespacing are load-bearing.
-// See docs/plans/resource-attribution-tag-schema.md.
+// See docs/plans/done/resource-attribution-tag-schema.md.
 
 module Attribution = ReventlessCore.ResourceAttribution
 
@@ -95,7 +95,7 @@ describe("AWS_Tags — owner overrides the piece adapter's own kind", () => {
   // The piece adapters pass their OWN ComponentType as ~kind, which names the
   // piece and so collapses onto ~role. A QueryDb is instantiated by six different
   // component kinds, so without the owner a reader cannot tell a ReadModel's
-  // table from a StateViewSlice's. See docs/plans/resource-attribution-owner-kind.md.
+  // table from a StateViewSlice's. See docs/plans/done/resource-attribution-owner-kind.md.
   let queryDbTagsFor = (~owner=?) =>
     AWS_Tags.make(
       ~name="ProductsQueryDb",