@reventlessdev/reventless-aws 3.0.0-alpha.342 → 3.0.0-alpha.343

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.343 (2026-09-08)
+
+### Bug Fixes
+
+* **aws:** the collector gate waits on the one property an update changes ([2c48193](https://github.com/ReventlessDev/reventless-core/commit/2c481934d58c64b8e637d0df1b051b03cf59a35c))
+
+
 # 3.0.0-alpha.342 (2026-09-08)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.342",
+  "version": "3.0.0-alpha.343",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -19,14 +19,14 @@
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.11",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.260",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.161",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.124",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.133",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.161"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.260"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -677,13 +677,12 @@ module Make = (
       ~opts,
     )
 
-    // Through an output property, not the resource. `apply` receives the Function
-    // record as soon as the outer Output carries it — at construction, fields
-    // still unresolved — so discarding it reported ready mid-update, and the
-    // re-detect reached a Lambda still serving the previous bundle. `flatMap`
-    // returns the Output itself, which Pulumi awaits.
-    eventCollectorReadyRef :=
-      runtime.parts.lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())
+    // Not the resource, and not one of its identifiers: both are known before the
+    // update lands, so either opens the gate while the collector is still serving
+    // the previous bundle — and the re-detect that follows is answered with the
+    // previous definition. `updateLanded` depends on the one property that cannot
+    // be known early.
+    eventCollectorReadyRef := runtime.parts.lambda->Util_Lambda.updateLanded
 
     // Admin-only cross-plugin SNS subscription permissions. The admin EC
     // Lambda's manageSubscriptions hook (Phase 3 Step 1) creates SNS

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
-import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
@@ -15,6 +14,7 @@ import * as Heartbeat$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
 import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
 import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../../adapter/EventLog/EventLogBackend.res.mjs";
@@ -414,7 +414,7 @@ function Make(EventCollectorChannel) {
         eventTopics: eventTopics,
         resources: resources
       }], runtime, opts);
-    eventCollectorReadyRef.contents = Output$Pulumi.flatMap(runtime.parts.lambda, fn => fn.arn).apply(param => {});
+    eventCollectorReadyRef.contents = Util_Lambda$ReventlessAws.updateLanded(runtime.parts.lambda);
     let isAdminEventCollector = Stdlib_Option.isNone(Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name]);
     if (isAdminEventCollector) {
       new (Aws.iam.RolePolicy)(name + `-snsManageSubs`, {

package/src/util/Util_Lambda.res

@@ -26,8 +26,21 @@ let fromOutput = (output: Pulumi.Output.t<PulumiAws.Lambda.Function.t>) => {
   id: output->Pulumi.Output.flatMap(({id}) => id),
   name: output->Pulumi.Output.flatMap(({name}) => name),
   invokeArn: output->Pulumi.Output.flatMap(({invokeArn}) => invokeArn),
+  lastModified: output->Pulumi.Output.flatMap(({lastModified}) => lastModified),
 }
 
+/** Resolves once the function's update has actually landed — the barrier a
+    deploy-time handshake needs before it may publish to that function.
+
+    It must depend on `lastModified`. The identifiers (`arn`, `id`, `name`,
+    `invokeArn`) are equal before and after a code update, so the engine resolves
+    them from existing state and a gate built on one of them opens while the
+    update is still in flight — measurably, about a second before it even starts.
+    `sourceCodeHash` is no better: it is also an input, so it can be known in
+    advance for the same reason. */
+let updateLanded = (lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>): Pulumi.Output.t<unit> =>
+  lambda->Pulumi.Output.flatMap(({lastModified}) => lastModified)->Pulumi.Output.apply(_ => ())
+
 let functionToResource = (~tags=?, {id, name, arn}: PulumiAws.Lambda.Function.t): ReventlessInfra.Adapter.resource =>
   ReventlessInfra.Adapter.make(
     ~name,

package/src/util/Util_Lambda.res.mjs

@@ -26,10 +26,15 @@ function fromOutput(output) {
     arn: Output$Pulumi.flatMap(output, param => param.arn),
     id: Output$Pulumi.flatMap(output, param => param.id),
     name: Output$Pulumi.flatMap(output, param => param.name),
-    invokeArn: Output$Pulumi.flatMap(output, param => param.invokeArn)
+    invokeArn: Output$Pulumi.flatMap(output, param => param.invokeArn),
+    lastModified: Output$Pulumi.flatMap(output, param => param.lastModified)
   };
 }
 
+function updateLanded(lambda) {
+  return Output$Pulumi.flatMap(lambda, param => param.lastModified).apply(param => {});
+}
+
 function functionToResource(tags, param) {
   let name = param.name;
   return Adapter$ReventlessInfra.make(name, param.id, param.arn, name.apply(param => AWS$ReventlessAws.Lambda.service), undefined, undefined, undefined, Pulumi.output("aws:lambda:Function"), undefined, tags);
@@ -40,6 +45,7 @@ export {
   toResource,
   fromResource,
   fromOutput,
+  updateLanded,
   functionToResource,
 }
 /* @pulumi/aws Not a pure module */

package/tests/EventCollectorConnectLambdaPreviewTest.res

@@ -110,6 +110,7 @@ let lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t> = Pulumi.Output.make({
   id: "AllStateViewSlices"->Pulumi.Output.make,
   name: "AllStateViewSlices"->Pulumi.Output.make,
   invokeArn: "arn:aws:apigateway:invoke"->Pulumi.Output.make,
+  lastModified: "2026-01-01T00:00:00.000+0000"->Pulumi.Output.make,
 })
 
 // ── Tests ────────────────────────────────────────────────────────────────────

package/tests/EventCollectorConnectLambdaPreviewTest.res.mjs

@@ -66,7 +66,8 @@ let lambda = Pulumi.output({
   arn: Pulumi.output("arn:aws:lambda:eu-west-1:123456789012:function:AllStateViewSlices"),
   id: Pulumi.output("AllStateViewSlices"),
   name: Pulumi.output("AllStateViewSlices"),
-  invokeArn: Pulumi.output("arn:aws:apigateway:invoke")
+  invokeArn: Pulumi.output("arn:aws:apigateway:invoke"),
+  lastModified: Pulumi.output("2026-01-01T00:00:00.000+0000")
 });
 
 globalThis.describe("EventCollectorChannel_Helpers.connectLambda under an unknown view table", () => {

package/tests/EventCollectorReadyGateTest.res

@@ -1,26 +1,26 @@
 open JestGlobals
 
-// Guards what `eventCollectorReadyRef` waits for.
+// Guards what `Util_Lambda.updateLanded` waits for — the barrier the deploy
+// publishes its synthetic re-detect behind.
 //
-// The deploy publishes a synthetic re-detect once the EventCollector Lambda is
-// ready, because that Lambda is what ANSWERS the handshake: reached while it is
-// still serving the previous bundle, it replies with the previous definition,
-// Connect sees a definition it already holds and emits nothing, and the
-// registration keeps the old structure — with no second re-detect coming.
+// That collector Lambda is what ANSWERS the handshake: reached while it is still
+// serving the previous bundle, it replies with the previous definition, Connect
+// sees a definition it already holds and emits nothing, and the registration
+// keeps the old structure — with no second re-detect coming.
 //
-// The gate used to be `lambda->Output.apply(_ => ())`. `apply` receives the
-// Function record as soon as the OUTER Output carries it, which is at
-// construction, with every field inside still an unresolved Output — so the gate
-// settled while the update was in flight and the whole barrier was inert. No
-// deploy-shaped test catches it: the answer is only stale when a deploy changes a
-// structure, and the race is won more often than it is lost.
+// The first attempt at this gate depended on `arn`, and failed in production
+// exactly as it had before: the re-detect went out ~1.2s BEFORE the Lambda update
+// even started. A Lambda's identifiers are equal on both sides of a code update,
+// so the engine resolves them from existing state without waiting for it. The
+// mechanism (`flatMap` awaiting the Output it returns) was never in doubt — the
+// property was.
 //
-// So this asserts the barrier directly — the gate must not settle until the
-// resource's own outputs do.
+// So these pin the property, not the mechanism. The middle test is the one that
+// fails for an identifier-based gate.
 
 // The engine's Output constructor, so a field can be left genuinely pending
-// rather than faked. A resolved promise would settle on the next tick either
-// way, which is the difference under test.
+// rather than faked. A resolved promise settles on the next tick either way,
+// which is the difference under test.
 @module("@pulumi/pulumi") @new
 external makeOutput: (
   Set.t<unit>,
@@ -34,7 +34,13 @@ let pending = (value: 'a): (Pulumi.Output.t<'a>, unit => unit) => {
   let settle = ref(() => ())
   let p = Promise.make((resolve, _) => settle := () => resolve(value))
   (
-    makeOutput(Set.make(), p, Promise.resolve(true), Promise.resolve(false), Promise.resolve(Set.make())),
+    makeOutput(
+      Set.make(),
+      p,
+      Promise.resolve(true),
+      Promise.resolve(false),
+      Promise.resolve(Set.make()),
+    ),
     settle.contents,
   )
 }
@@ -43,14 +49,17 @@ let ticks = async () => await Promise.make((resolve, _) => {
   let _ = setTimeout(() => resolve(), 50)
 })
 
-// A Lambda mid-update: the resource record exists, its outputs do not yet.
+/** A collector mid-update, the way the engine presents one: the identifiers are
+    already known — they do not change across a code update — and only
+    `lastModified` is still pending. `complete` is AWS answering. */
 let deploying = (): (Pulumi.Output.t<PulumiAws.Lambda.Function.t>, unit => unit) => {
-  let (arn, complete) = pending("arn:aws:lambda:eu-west-1:123456789012:function:CatalogPluginEventColl")
+  let (lastModified, complete) = pending("2026-09-08T12:13:41.891+0000")
   let fn: PulumiAws.Lambda.Function.t = {
-    arn,
-    id: "CatalogPluginEventColl"->Pulumi.Output.make,
-    name: "CatalogPluginEventColl"->Pulumi.Output.make,
+    arn: "arn:aws:lambda:eu-west-1:123456789012:function:OrderingPluginEventColl"->Pulumi.Output.make,
+    id: "OrderingPluginEventColl"->Pulumi.Output.make,
+    name: "OrderingPluginEventColl"->Pulumi.Output.make,
     invokeArn: "arn:aws:apigateway:invoke"->Pulumi.Output.make,
+    lastModified,
   }
   // `apply` preserves the nested Outputs, which is how the real resource arrives.
   (()->Pulumi.Output.make->Pulumi.Output.apply(_ => fn), complete)
@@ -62,28 +71,33 @@ let observe = (gate: Pulumi.Output.t<unit>): ref<bool> => {
   settled
 }
 
-describe("the EventCollector readiness gate", () => {
-  testAsync("does not settle while the function's outputs are still pending", async () => {
+describe("Util_Lambda.updateLanded", () => {
+  // The regression. Every identifier on the record is already resolved here, so a
+  // gate reading any of them opens immediately — which is the production failure,
+  // reproduced.
+  testAsync("does not open while only the identifiers are known", async () => {
     let (lambda, _complete) = deploying()
-    let settled = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
+    let settled = lambda->Util_Lambda.updateLanded->observe
     await ticks()
     expect(settled.contents)->toBe(false)
   })
 
-  testAsync("settles once they resolve", async () => {
+  testAsync("opens once AWS reports the update", async () => {
     let (lambda, complete) = deploying()
-    let settled = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
+    let settled = lambda->Util_Lambda.updateLanded->observe
     complete()
     await ticks()
     expect(settled.contents)->toBe(true)
   })
 
-  // The shape that shipped, kept as the reason the one above is written the way it
-  // is: applying to the resource settles against a Lambda still being updated.
-  testAsync("settles immediately when taken off the resource instead", async () => {
+  // Kept as the reason the gate is written the way it is: both shapes that were
+  // tried before open against a collector still serving the previous bundle.
+  testAsync("the shapes that shipped before open too early", async () => {
     let (lambda, _complete) = deploying()
-    let settled = lambda->Pulumi.Output.apply(_ => ())->observe
+    let onResource = lambda->Pulumi.Output.apply(_ => ())->observe
+    let onArn = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
     await ticks()
-    expect(settled.contents)->toBe(true)
+    expect(onResource.contents)->toBe(true)
+    expect(onArn.contents)->toBe(true)
   })
 })

package/tests/EventCollectorReadyGateTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Util_Lambda$ReventlessAws from "../src/util/Util_Lambda.res.mjs";
 
 function pending(value) {
   let settle = {
@@ -23,16 +24,18 @@ async function ticks() {
 }
 
 function deploying() {
-  let match = pending("arn:aws:lambda:eu-west-1:123456789012:function:CatalogPluginEventColl");
-  let fn_arn = match[0];
-  let fn_id = Pulumi.output("CatalogPluginEventColl");
-  let fn_name = Pulumi.output("CatalogPluginEventColl");
+  let match = pending("2026-09-08T12:13:41.891+0000");
+  let fn_arn = Pulumi.output("arn:aws:lambda:eu-west-1:123456789012:function:OrderingPluginEventColl");
+  let fn_id = Pulumi.output("OrderingPluginEventColl");
+  let fn_name = Pulumi.output("OrderingPluginEventColl");
   let fn_invokeArn = Pulumi.output("arn:aws:apigateway:invoke");
+  let fn_lastModified = match[0];
   let fn = {
     arn: fn_arn,
     id: fn_id,
     name: fn_name,
-    invokeArn: fn_invokeArn
+    invokeArn: fn_invokeArn,
+    lastModified: fn_lastModified
   };
   return [
     Pulumi.output().apply(() => fn),
@@ -50,25 +53,28 @@ function observe(gate) {
   return settled;
 }
 
-globalThis.describe("the EventCollector readiness gate", () => {
-  globalThis.test("does not settle while the function's outputs are still pending", async () => {
+globalThis.describe("Util_Lambda.updateLanded", () => {
+  globalThis.test("does not open while only the identifiers are known", async () => {
     let match = deploying();
-    let settled = observe(Output$Pulumi.flatMap(match[0], fn => fn.arn).apply(param => {}));
+    let settled = observe(Util_Lambda$ReventlessAws.updateLanded(match[0]));
     await ticks();
     globalThis.expect(settled.contents).toBe(false);
   });
-  globalThis.test("settles once they resolve", async () => {
+  globalThis.test("opens once AWS reports the update", async () => {
     let match = deploying();
-    let settled = observe(Output$Pulumi.flatMap(match[0], fn => fn.arn).apply(param => {}));
+    let settled = observe(Util_Lambda$ReventlessAws.updateLanded(match[0]));
     match[1]();
     await ticks();
     globalThis.expect(settled.contents).toBe(true);
   });
-  globalThis.test("settles immediately when taken off the resource instead", async () => {
+  globalThis.test("the shapes that shipped before open too early", async () => {
     let match = deploying();
-    let settled = observe(match[0].apply(param => {}));
+    let lambda = match[0];
+    let onResource = observe(lambda.apply(param => {}));
+    let onArn = observe(Output$Pulumi.flatMap(lambda, fn => fn.arn).apply(param => {}));
     await ticks();
-    globalThis.expect(settled.contents).toBe(true);
+    globalThis.expect(onResource.contents).toBe(true);
+    globalThis.expect(onArn.contents).toBe(true);
   });
 });