@reventlessdev/reventless-aws 3.0.0-alpha.323 → 3.0.0-alpha.324

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.324 (2026-08-24)
+
+### Bug Fixes
+
+* **aws:** keep a served bucket's read grant when serving moves distributions ([40b712a](https://github.com/ReventlessDev/reventless-core/commit/40b712a62d7b9d44621962984ff63c7719df642e))
+
+
 # 3.0.0-alpha.323 (2026-08-23)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.323",
+  "version": "3.0.0-alpha.324",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -16,17 +16,17 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.13",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.5",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.114",
     "@reventlessdev/reventless-core": "3.0.0-alpha.250",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.151",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.123",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.151"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.114",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.33"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/plugin/stack/Plugin_Stack.res

@@ -445,9 +445,19 @@ let makeUiBundleDistribution = (
   // Exactly one policy per bucket — S3 permits no more. Grouping prefixes into
   // one `servedBucket` is what makes that structural rather than a rule to
   // remember.
+  //
+  // `retainOnDelete` is what makes moving a bucket's serving between
+  // distributions survivable. The policy resource is named after the
+  // distribution, so a handover is a create and a delete over the bucket's one
+  // physical policy — and Pulumi runs deletes last, so the old resource's
+  // DeleteBucketPolicy would wipe the grant the new one just wrote. Deploy
+  // green, every object 403. Retaining drops the stale entry from state without
+  // calling the provider; the most it can leave behind is a grant naming a
+  // distribution that no longer exists, which authorizes nothing.
   servedBuckets->Array.forEach(sb => {
     let _ = PulumiAws.S3.BucketPolicy.make(
       ~name=name ++ "-served-" ++ sb.id ++ "-policy",
+      ~opts={retainOnDelete: true},
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
@@ -691,10 +701,12 @@ let makeServedBucketDistribution = (
   }
 
   // One policy per bucket — see the module doc above for why this is here and
-  // not in the consuming stack.
+  // not in the consuming stack, and `makeUiBundleDistribution` for why the
+  // policy is retained rather than deleted.
   servedBuckets->Array.forEach(sb => {
     let _ = PulumiAws.S3.BucketPolicy.make(
       ~name=name ++ "-served-" ++ sb.id ++ "-policy",
+      ~opts={retainOnDelete: true},
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -275,6 +275,8 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
             }
           }]
       }))
+    }, {
+      retainOnDelete: true
     });
   });
   if (assetsDir !== undefined) {
@@ -409,6 +411,8 @@ function makeServedBucketDistribution(name, servedBuckets, customDomain) {
             }
           }]
       }))
+    }, {
+      retainOnDelete: true
     });
   });
   if (customDomain !== undefined) {