@reventlessdev/reventless-aws 3.0.0-alpha.334 → 3.0.0-alpha.335

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.335 (2026-09-02)
+
+### Bug Fixes
+
+* **aws:** a deployed Lambda carries its plugin's own dependencies ([8dfac24](https://github.com/ReventlessDev/reventless-core/commit/8dfac24285723beb74f84c6cc821864e56ee75a2))
+
+
 # 3.0.0-alpha.334 (2026-09-02)
 
 * feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.334",
+  "version": "3.0.0-alpha.335",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -15,15 +15,15 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.14",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.7",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/reventless-core": "3.0.0-alpha.254",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.155",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.34",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.118",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.127"

package/src/util/Util_Bundle.res

@@ -349,6 +349,126 @@ let isRuntimeProvided = (specifier: string, ~pkgName: string): bool =>
     }
   )
 
+// Memo for isFrameworkPackage — one require.resolve per package name per deploy.
+let frameworkPackageCache: dict<bool> = Dict.make()
+
+/**
+ * Whether the framework's own module resolution reaches this package: the
+ * deploy-time stand-in for "the Lambda layer already carries it", since the
+ * layer is built from reventless-aws's dependency closure.
+ *
+ * Deliberately framework-rooted only — no Pulumi-project fallback. The question
+ * here is the opposite of `resolvePackageRoot`'s: a package the *project*
+ * resolves but the framework does not is precisely a user package, which is
+ * what the closure walk below must treat as a starting point rather than as
+ * something the runtime provides.
+ */
+let isFrameworkPackage = (pkgName: string): bool =>
+  switch frameworkPackageCache->Dict.get(pkgName) {
+  | Some(known) => known
+  | None =>
+    let known = try {
+      let _ = localRequire->NodeModule.requireResolve(pkgName ++ "/package.json")
+      true
+    } catch {
+    | _ => false
+    }
+    frameworkPackageCache->Dict.set(pkgName, known)
+    known
+  }
+
+// The distinct bare packages a package's own bundled files import, memoised per
+// package root: the same file set the archive carries, so what is scanned is
+// what is deployed.
+let importedPackagesCache: dict<array<string>> = Dict.make()
+let importedPackages = (packageRoot: string): array<string> =>
+  switch importedPackagesCache->Dict.get(packageRoot) {
+  | Some(names) => names
+  | None =>
+    let assets: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+    let paths: array<(string, string)> = []
+    walkDir(~dir=packageRoot, ~prefix="", ~assets, ~paths)
+    let names: array<string> = []
+    paths->Array.forEach(((relPath, absPath)) =>
+      if relPath->String.endsWith(".mjs") || relPath->String.endsWith(".js") {
+        NodeFs.readFileSync(absPath)
+        ->staticImportSpecifiers
+        ->Array.forEach(specifier =>
+          if isBareSpecifier(specifier) {
+            let name = extractPackageName(specifier)
+            if !(names->Array.includes(name)) {
+              names->Array.push(name)
+            }
+          }
+        )
+      }
+    )
+    importedPackagesCache->Dict.set(packageRoot, names)
+    names
+  }
+
+/**
+ * Resolve a package root as the importing package would — from that package's
+ * own directory. Under pnpm a plugin's dependency is reachable only from the
+ * plugin, never from the framework or the Pulumi project, so this is the one
+ * rooting that finds it. `None` when nothing is installed there: the archive
+ * cannot carry what is not on disk, and a package the code truly imported at
+ * runtime would already be failing today.
+ */
+let resolvePackageRootFrom = (~fromRoot: string, pkgName: string): option<string> =>
+  try {
+    Some(
+      NodePath.dirname(
+        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))
+        ->NodeModule.requireResolve(pkgName ++ "/package.json"),
+      ),
+    )
+  } catch {
+  | _ => None
+  }
+
+/**
+ * Carry every package a bundled *user* package imports into the archive, and
+ * every package those import in turn.
+ *
+ * A plugin package rides in `/var/task/node_modules/<plugin>`, but its own
+ * dependencies do not: the layer holds reventless-aws's closure, which a domain
+ * trait or any other plugin-level library is by definition outside of. The
+ * import then fails at the first command the slice handles — a green deploy and
+ * a `Cannot find package` at runtime.
+ *
+ * Framework packages are the starting points that are skipped, not walked:
+ * their closure is the layer's, and their sources reach deploy-time-only
+ * imports (the @pulumi bindings) that no Lambda loads — walking them would add
+ * tens of megabytes to every archive.
+ */
+let addImportedPackageClosure = (packageDirs: dict<string>): unit => {
+  let pending =
+    packageDirs->Dict.toArray->Array.filter(((pkgName, _)) => !isFrameworkPackage(pkgName))
+  let next = ref(0)
+  while next.contents < pending->Array.length {
+    let (_, pkgRoot) = pending->Array.getUnsafe(next.contents)
+    next := next.contents + 1
+    importedPackages(pkgRoot)->Array.forEach(dep =>
+      if (
+        !(packageDirs->Dict.has(dep)) &&
+        !(dep->String.startsWith("node:")) &&
+        !(nodeBuiltins->Set.has(dep)) &&
+        !(dep->String.startsWith("@aws-sdk/")) &&
+        !(dep->String.startsWith("@smithy/")) &&
+        !isFrameworkPackage(dep)
+      ) {
+        switch resolvePackageRootFrom(~fromRoot=pkgRoot, dep) {
+        | Some(depRoot) =>
+          packageDirs->Dict.set(dep, depRoot)
+          pending->Array.push((dep, depRoot))
+        | None => ()
+        }
+      }
+    )
+  }
+}
+
 /**
  * Deploy-time guard: every bare package statically imported by a bundled
  * runtime-extension (or companion) package must either be in the archive
@@ -451,7 +571,12 @@ let buildCodeArchive = (
   // deploy whose extensions are silently skipped.
   if bundleRuntimeExtensions {
     let extensionPackages = allPackageDirs->addRuntimeExtensionPackages
+    // The closure runs first so a companion package that is simply a static
+    // import of the extension is already bundled by the time the guard looks.
+    allPackageDirs->addImportedPackageClosure
     assertRuntimeExtensionImportsResolvable(~extensionPackages, ~bundledPackages=allPackageDirs)
+  } else {
+    allPackageDirs->addImportedPackageClosure
   }
   let packageContentHashes: ref<array<string>> = ref([])
   allPackageDirs->Dict.forEachWithKey((pkgRoot, pkgName) => {

package/src/util/Util_Bundle.res.mjs

@@ -232,6 +232,87 @@ function isRuntimeProvided(specifier, pkgName) {
   }
 }
 
+let frameworkPackageCache = {};
+
+function isFrameworkPackage(pkgName) {
+  let known = frameworkPackageCache[pkgName];
+  if (known !== undefined) {
+    return known;
+  }
+  let known$1;
+  try {
+    localRequire.resolve(pkgName + "/package.json");
+    known$1 = true;
+  } catch (exn) {
+    known$1 = false;
+  }
+  frameworkPackageCache[pkgName] = known$1;
+  return known$1;
+}
+
+let importedPackagesCache = {};
+
+function importedPackages(packageRoot) {
+  let names = importedPackagesCache[packageRoot];
+  if (names !== undefined) {
+    return names;
+  }
+  let assets = {};
+  let paths = [];
+  walkDir(packageRoot, "", assets, paths);
+  let names$1 = [];
+  paths.forEach(param => {
+    let relPath = param[0];
+    if (relPath.endsWith(".mjs") || relPath.endsWith(".js")) {
+      staticImportSpecifiers(Nodefs.readFileSync(param[1], "utf8")).forEach(specifier => {
+        if (!isBareSpecifier(specifier)) {
+          return;
+        }
+        let name = extractPackageName(specifier);
+        if (!names$1.includes(name)) {
+          names$1.push(name);
+          return;
+        }
+      });
+      return;
+    }
+  });
+  importedPackagesCache[packageRoot] = names$1;
+  return names$1;
+}
+
+function resolvePackageRootFrom(fromRoot, pkgName) {
+  try {
+    return Nodepath.dirname(Nodemodule.createRequire(Nodepath.join(fromRoot, "index.js")).resolve(pkgName + "/package.json"));
+  } catch (exn) {
+    return;
+  }
+}
+
+function addImportedPackageClosure(packageDirs) {
+  let pending = Object.entries(packageDirs).filter(param => !isFrameworkPackage(param[0]));
+  let next = 0;
+  while (next < pending.length) {
+    let match = pending[next];
+    let pkgRoot = match[1];
+    next = next + 1 | 0;
+    importedPackages(pkgRoot).forEach(dep => {
+      if (dep in packageDirs || dep.startsWith("node:") || nodeBuiltins.has(dep) || dep.startsWith("@aws-sdk/") || dep.startsWith("@smithy/") || isFrameworkPackage(dep)) {
+        return;
+      }
+      let depRoot = resolvePackageRootFrom(pkgRoot, dep);
+      if (depRoot !== undefined) {
+        packageDirs[dep] = depRoot;
+        pending.push([
+          dep,
+          depRoot
+        ]);
+        return;
+      }
+    });
+  };
+}
+
 function assertRuntimeExtensionImportsResolvable(extensionPackages, bundledPackages) {
   Stdlib_Dict.forEachWithKey(extensionPackages, (pkgRoot, pkgName) => {
     let assets = {};
@@ -275,7 +356,10 @@ function buildCodeArchive(entryPointModule, packageDirs, extraStringAssetsOpt, b
   }
   if (bundleRuntimeExtensions) {
     let extensionPackages = addRuntimeExtensionPackages(allPackageDirs);
+    addImportedPackageClosure(allPackageDirs);
     assertRuntimeExtensionImportsResolvable(extensionPackages, allPackageDirs);
+  } else {
+    addImportedPackageClosure(allPackageDirs);
   }
   let packageContentHashes = {
     contents: []
@@ -326,6 +410,12 @@ export {
   isBareSpecifier,
   nodeBuiltins,
   isRuntimeProvided,
+  frameworkPackageCache,
+  isFrameworkPackage,
+  importedPackagesCache,
+  importedPackages,
+  resolvePackageRootFrom,
+  addImportedPackageClosure,
   assertRuntimeExtensionImportsResolvable,
   buildCodeArchive,
 }

package/tests/Util_BundleDependencyClosureTest.res

@@ -0,0 +1,111 @@
+open JestGlobals
+
+// A plugin package rides in the code archive, but its own dependencies used to
+// stay behind: the layer carries reventless-aws's closure, and a domain trait
+// (or any other plugin-level library) is outside it. The archive build now
+// walks what a bundled user package actually imports.
+
+let mkTmpRoot = (prefix: string) =>
+  NodeFs.realpathSync(NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), prefix])))
+
+let writePkg = (~root: string, ~name: string, files: array<(string, string)>): string => {
+  NodeFs.mkdirSync(root, {recursive: true})
+  NodeFs.writeFileSync(
+    NodePath.join([root, "package.json"]),
+    `{"name":"${name}","version":"1.0.0"}`,
+  )
+  files->Array.forEach(((relPath, content)) => {
+    let abs = NodePath.join([root, relPath])
+    NodeFs.mkdirSync(NodePath.dirname(abs), {recursive: true})
+    NodeFs.writeFileSync(abs, content)
+  })
+  root
+}
+
+// A user package whose slice imports a trait, the trait imports a rules
+// package, and both are installed only under the user package — the pnpm shape,
+// where nothing but the importer can resolve them.
+let hostName = "@fixture/closure-host"
+let traitName = "@fixture/closure-trait"
+let rulesName = "@fixture/closure-rules"
+
+let hostRoot = mkTmpRoot("bundle-closure-")
+let traitRoot = NodePath.join([hostRoot, "node_modules", traitName])
+let rulesRoot = NodePath.join([hostRoot, "node_modules", rulesName])
+
+let _ = writePkg(
+  ~root=hostRoot,
+  ~name=hostName,
+  [
+    (
+      "src/Slice.res.mjs",
+      `import * as Trait from "${traitName}";
+import * as Sury from "sury";
+import * as Fs from "node:fs";
+import * as Path from "path";
+import * as Ddb from "@aws-sdk/client-dynamodb";
+import * as Missing from "@fixture/never-installed";
+export const handle = () => Trait.rule(Sury, Fs, Path, Ddb, Missing);
+`,
+    ),
+  ],
+)
+let _ = writePkg(
+  ~root=traitRoot,
+  ~name=traitName,
+  [
+    (
+      "src/Trait.res.mjs",
+      `import * as Rules from "${rulesName}";
+export const rule = () => Rules.check();
+`,
+    ),
+  ],
+)
+let _ = writePkg(~root=rulesRoot, ~name=rulesName, [("src/Rules.res.mjs", `export const check = () => true;
+`)])
+
+let closureOf = (packageDirs: dict<string>) => {
+  Util_Bundle.addImportedPackageClosure(packageDirs)
+  packageDirs
+}
+
+describe("Util_Bundle — bundled user packages carry their imports", () => {
+  afterAll(() => NodeFs.rmSync(hostRoot, {recursive: true, force: true}))
+
+  testSync("a dependency only the importing package can resolve is added", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    expect(closureOf(packageDirs)->Dict.get(traitName))->toEqual(Some(traitRoot))
+  })
+
+  testSync("the walk is transitive — the dependency's own imports come too", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    expect(closureOf(packageDirs)->Dict.get(rulesName))->toEqual(Some(rulesRoot))
+  })
+
+  testSync("packages the deployed runtime provides are left out", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    let bundled = closureOf(packageDirs)->Dict.keysToArray
+    // sury rides in the layer (framework-resolvable); node builtins and the
+    // @aws-sdk scope resolve from the runtime's own dirs.
+    expect(bundled->Array.includes("sury"))->toBe(false)
+    expect(bundled->Array.includes("fs"))->toBe(false)
+    expect(bundled->Array.includes("path"))->toBe(false)
+    expect(bundled->Array.includes("@aws-sdk/client-dynamodb"))->toBe(false)
+  })
+
+  testSync("an import that resolves nowhere is skipped, not thrown on", () => {
+    let packageDirs = Dict.fromArray([(hostName, hostRoot)])
+    let bundled = closureOf(packageDirs)->Dict.keysToArray
+    expect(bundled->Array.includes("@fixture/never-installed"))->toBe(false)
+  })
+
+  testSync("framework packages are starting points, not walked", () => {
+    // Walking reventless-aws would reach its deploy-time-only imports (the
+    // @pulumi bindings) and add tens of megabytes to every archive.
+    let packageDirs = Dict.fromArray([
+      ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+    ])
+    expect(closureOf(packageDirs)->Dict.keysToArray->Array.length)->toBe(1)
+  })
+})

package/tests/Util_BundleDependencyClosureTest.res.mjs

@@ -0,0 +1,129 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodeos from "node:os";
+import * as Nodepath from "node:path";
+import * as Util_Bundle$ReventlessAws from "../src/util/Util_Bundle.res.mjs";
+
+function mkTmpRoot(prefix) {
+  return Nodefs.realpathSync(Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), prefix)));
+}
+
+function writePkg(root, name, files) {
+  Nodefs.mkdirSync(root, {
+    recursive: true
+  });
+  Nodefs.writeFileSync(Nodepath.join(root, "package.json"), `{"name":"` + name + `","version":"1.0.0"}`, "utf8");
+  files.forEach(param => {
+    let abs = Nodepath.join(root, param[0]);
+    Nodefs.mkdirSync(Nodepath.dirname(abs), {
+      recursive: true
+    });
+    Nodefs.writeFileSync(abs, param[1], "utf8");
+  });
+  return root;
+}
+
+let hostName = "@fixture/closure-host";
+
+let traitName = "@fixture/closure-trait";
+
+let rulesName = "@fixture/closure-rules";
+
+let hostRoot = mkTmpRoot("bundle-closure-");
+
+let traitRoot = Nodepath.join(hostRoot, "node_modules", traitName);
+
+let rulesRoot = Nodepath.join(hostRoot, "node_modules", rulesName);
+
+writePkg(hostRoot, hostName, [[
+    "src/Slice.res.mjs",
+    `import * as Trait from "` + traitName + `";
+import * as Sury from "sury";
+import * as Fs from "node:fs";
+import * as Path from "path";
+import * as Ddb from "@aws-sdk/client-dynamodb";
+import * as Missing from "@fixture/never-installed";
+export const handle = () => Trait.rule(Sury, Fs, Path, Ddb, Missing);
+`
+  ]]);
+
+writePkg(traitRoot, traitName, [[
+    "src/Trait.res.mjs",
+    `import * as Rules from "` + rulesName + `";
+export const rule = () => Rules.check();
+`
+  ]]);
+
+writePkg(rulesRoot, rulesName, [[
+    "src/Rules.res.mjs",
+    `export const check = () => true;
+`
+  ]]);
+
+function closureOf(packageDirs) {
+  Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs);
+  return packageDirs;
+}
+
+globalThis.describe("Util_Bundle — bundled user packages carry their imports", () => {
+  globalThis.afterAll(() => {
+    Nodefs.rmSync(hostRoot, {
+      recursive: true,
+      force: true
+    });
+  });
+  globalThis.test("a dependency only the importing package can resolve is added", () => {
+    let packageDirs = Object.fromEntries([[
+        hostName,
+        hostRoot
+      ]]);
+    globalThis.expect((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs)[traitName]).toEqual(traitRoot);
+  });
+  globalThis.test("the walk is transitive — the dependency's own imports come too", () => {
+    let packageDirs = Object.fromEntries([[
+        hostName,
+        hostRoot
+      ]]);
+    globalThis.expect((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs)[rulesName]).toEqual(rulesRoot);
+  });
+  globalThis.test("packages the deployed runtime provides are left out", () => {
+    let packageDirs = Object.fromEntries([[
+        hostName,
+        hostRoot
+      ]]);
+    let bundled = Object.keys((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs));
+    globalThis.expect(bundled.includes("sury")).toBe(false);
+    globalThis.expect(bundled.includes("fs")).toBe(false);
+    globalThis.expect(bundled.includes("path")).toBe(false);
+    globalThis.expect(bundled.includes("@aws-sdk/client-dynamodb")).toBe(false);
+  });
+  globalThis.test("an import that resolves nowhere is skipped, not thrown on", () => {
+    let packageDirs = Object.fromEntries([[
+        hostName,
+        hostRoot
+      ]]);
+    let bundled = Object.keys((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs));
+    globalThis.expect(bundled.includes("@fixture/never-installed")).toBe(false);
+  });
+  globalThis.test("framework packages are starting points, not walked", () => {
+    let packageDirs = Object.fromEntries([[
+        "@reventlessdev/reventless-aws",
+        Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+      ]]);
+    globalThis.expect(Object.keys((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs)).length).toBe(1);
+  });
+});
+
+export {
+  mkTmpRoot,
+  writePkg,
+  hostName,
+  traitName,
+  rulesName,
+  hostRoot,
+  traitRoot,
+  rulesRoot,
+  closureOf,
+}
+/* hostRoot Not a pure module */