@reventlessdev/reventless-aws 3.0.0-alpha.346 → 3.0.0-alpha.348

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -26,7 +26,7 @@ import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/revent
 // re-exporting it in sury 11. This is the same binding the compiled ReScript uses.
 import { json as jsonSchema } from "sury";
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
-// Typed cold-start core — scope/partitionTag derivation, storage-ops wiring, and
+// Typed cold-start core — scope/partition derivation, storage-ops wiring, and
 // per-slice handler building (functor + decode + handleCommands), all
 // compiler-checked against the framework signatures (see the module header and
 // docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
@@ -89,7 +89,6 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // as `dcb_event.log_name`); absence keeps the DynamoDB path byte-identical.
   const specs = loadedSlices.map(({ patchedSpec }) => patchedSpec);
   const scope = deriveScope(specs);
-  const { crossPartitionTagKeys, tagKeysByEventType } = scope;
   const rawStorageOps = makeStorageOps(
     config.dcbEventLogTableName,
     config.pgConnection,
@@ -98,6 +97,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
 
   const handlersByType = {};
   const commandSchemasByType = {};
+  const partitionTagsByType = {};
   const sharedDcbEventLogOps = dcbEventLogOperationsMake({
     name: config.pluginName,
     // Mirrors DcbEventLog_Builder.res's `name ++ "DcbEventLog"` — the
@@ -116,8 +116,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
     const jsonHandler = buildSliceHandler(
       patchedSpec,
       behaviorModule,
-      tagKeysByEventType,
-      crossPartitionTagKeys,
+      scope,
       sharedDcbEventLogOps,
     );
     for (const typeName of commandTypeNames(patchedSpec)) {
@@ -134,6 +133,8 @@ export async function buildHandlersForConfig(config, opts = {}) {
         );
       } else {
         commandSchemasByType[typeName] = patchedSpec.commandSchema;
+        // The envelope id is the command's value of its slice's partition key.
+        partitionTagsByType[typeName] = scope.partitionTagBySlice[patchedSpec.name];
       }
     }
   });
@@ -225,17 +226,21 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // reads a command's `@owner` fields from: given `S.json` it finds none, for every
   // command, and the write keeps whatever owner the CLIENT sent. Validation was
   // never the only job.
-  const makeGeneratorFor = (commandSchema) => makeCommandGenerator(
+  const makeGeneratorFor = (commandSchema, partitionTag) => makeCommandGenerator(
     publishJsons,
     publishJsonsAndWait,
     config.pluginName,
     commandSchema,
     "StateChangeSlice",
     false,
+    partitionTag,
   );
   const generatorsByType = {};
   for (const typeName of Object.keys(commandSchemasByType)) {
-    generatorsByType[typeName] = makeGeneratorFor(commandSchemasByType[typeName]);
+    generatorsByType[typeName] = makeGeneratorFor(
+      commandSchemasByType[typeName],
+      partitionTagsByType[typeName],
+    );
   }
   // A command no loaded slice claims keeps the permissive generator — what every
   // command got before this change — so anything reaching this handler by another
@@ -301,6 +306,10 @@ async function buildHandler() {
 }
 
 const initPromise = buildHandler();
+// Startup runs at module load, before any invocation awaits it. A failure left
+// unhandled until then can surface as a bare `Runtime.UnhandledPromiseRejection`
+// and a restart; handled here, every invocation rethrows the same clear error.
+initPromise.catch(() => {});
 
 export async function handler(event, context) {
   setRequestId(context?.awsRequestId);

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -37,47 +37,62 @@ type pgConnectionJson
 @get external pgLockStrategy: pgConnectionJson => Nullable.t<string> = "lockStrategy"
 external asConnectionConfig: pgConnectionJson => PgConnection.connectionConfig = "%identity"
 
-// The decision-read scope + storage partition tag for one consistency boundary,
+// The decision-read scope + storage partition for one consistency boundary,
 // derived exactly the way the deploy-time `Dcb_Builder` does (both call the same
 // `Reventless.DcbTag` functions — the single source of truth), so the runtime
 // query can't diverge from the storage/GSI scope.
 type derivedScope = {
   crossPartitionTagKeys: array<string>,
   tagKeysByEventType: dict<array<string>>,
+  /** `None` only for a Lambda hosting no StateChangeSlices, which never appends. */
   partitionTag: option<Reventless.DcbTag.derivedPartitionTag>,
+  /** Slice name -> its partition: the handler's entity id and each command's envelope id. */
+  partitionTagBySlice: dict<Reventless.DcbTag.derivedPartitionTag>,
 }
 
-let deriveScope = (specs: array<specModule>): derivedScope => {
-  let scope = Reventless.DcbTag.deriveEffectiveScope(
-    specs->Array.map(s => {
+let deriveScope = (specs: array<specModule>): derivedScope =>
+  switch specs {
+  | [] => {
+      crossPartitionTagKeys: [],
+      tagKeysByEventType: Dict.make(),
+      partitionTag: None,
+      partitionTagBySlice: Dict.make(),
+    }
+  | _ =>
+    let slices = specs->Array.map(s => {
       Reventless.DcbTag.name: specName(s),
       commandSchema: specCommandSchema(s),
       consumedEventSchema: specConsumedEventSchema(s),
       eventSchema: specEventSchema(s),
-    }),
-  )
-
-  // `derivePartitionTag` throws only on a misconfigured spec, which the deploy
-  // would already have rejected; degrade to untagged fences rather than crash
-  // cold start (matches the shell's prior defensive behaviour).
-  let partitionTag = try Some(
-    Reventless.DcbTag.derivePartitionTag(
-      specs->Array.map(s => (
-        specName(s),
-        specModuleUrl(s)->Nullable.toOption->Option.getOr(specName(s)),
-        specEventSchema(s),
-      )),
-    ),
-  ) catch {
-  | _ => None
-  }
-
-  {
-    crossPartitionTagKeys: scope.crossPartitionTagKeys,
-    tagKeysByEventType: scope.tagKeysByEventType,
-    partitionTag,
+      moduleUrl: ?(specModuleUrl(s)->Nullable.toOption),
+    })
+    let scope = Reventless.DcbTag.deriveEffectiveScope(slices)
+    // Deploy derives this from the same slice list, so on the same code it cannot
+    // fail here. It can when the framework in the Lambda layer differs from the
+    // one deploy used — and then carrying on would file events under the wrong
+    // keys. Refuse to start instead, saying why before the rejection can be lost.
+    // Rethrown as the original JS error, so each invocation reports its message.
+    let boundary = try Reventless.DcbTag.deriveBoundaryPartition(slices) catch {
+    | JsExn(err) =>
+      ReventlessCore.EffectLogger.logError(
+        ~comp="DcbCommandTopicRuntime",
+        `refusing to start: ${err->JsExn.message->Option.getOr("unknown error")}`,
+      )->Effect.runSync
+      JsExn.throw(err)
+    }
+    let partitionTagBySlice = Dict.make()
+    slices->Array.forEach(s =>
+      boundary
+      ->Reventless.DcbTag.slicePartitionTag(s.name)
+      ->Option.forEach(tag => partitionTagBySlice->Dict.set(s.name, tag))
+    )
+    {
+      crossPartitionTagKeys: scope.crossPartitionTagKeys,
+      tagKeysByEventType: scope.tagKeysByEventType,
+      partitionTag: Some(boundary.partitionTag),
+      partitionTagBySlice,
+    }
   }
-}
 
 // The command TAG names this slice handles — used by the shell to build its
 // `handlersByType` routing map.
@@ -166,6 +181,7 @@ type sliceCallback = {
   handleCommands: (
     ~tagKeysByEventType: dict<array<string>>=?,
     ~crossPartitionTagKeys: array<string>=?,
+    ~partitionTag: Reventless.DcbTag.derivedPartitionTag=?,
     ReventlessInfra.DcbEventLog.operations,
     Stream.t<
       ReventlessInfra.CommandTopic.topicItem<
@@ -188,8 +204,7 @@ external makeSliceCallback: specModule => behaviorModule => sliceCallback = "Mak
 let buildSliceHandler = (
   spec: specModule,
   behavior: behaviorModule,
-  ~tagKeysByEventType: dict<array<string>>,
-  ~crossPartitionTagKeys: array<string>,
+  scope: derivedScope,
   dcbEventLog: ReventlessInfra.DcbEventLog.operations,
 ) => {
   let callback = makeSliceCallback(spec)(behavior)
@@ -220,7 +235,13 @@ let buildSliceHandler = (
         | None => Stream.empty
         }
       )
-    callback.handleCommands(~tagKeysByEventType, ~crossPartitionTagKeys, dcbEventLog, decodedStream)
+    callback.handleCommands(
+      ~tagKeysByEventType=scope.tagKeysByEventType,
+      ~crossPartitionTagKeys=scope.crossPartitionTagKeys,
+      ~partitionTag=?scope.partitionTagBySlice->Dict.get(specName(spec)),
+      dcbEventLog,
+      decodedStream,
+    )
   }
 }
 

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs

@@ -20,26 +20,43 @@ import * as StateChangeSlice_CallbackResMjs from "@reventlessdev/reventless-core
 import * as InboundTranslationSlice_CallbackResMjs from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
 
 function deriveScope(specs) {
-  let scope = DcbTag$Reventless.deriveEffectiveScope(specs.map(s => ({
+  if (specs.length === 0) {
+    return {
+      crossPartitionTagKeys: [],
+      tagKeysByEventType: {},
+      partitionTag: undefined,
+      partitionTagBySlice: {}
+    };
+  }
+  let slices = specs.map(s => ({
     name: s.name,
     commandSchema: s.commandSchema,
     consumedEventSchema: s.consumedEventSchema,
-    eventSchema: s.eventSchema
-  })));
-  let partitionTag;
+    eventSchema: s.eventSchema,
+    moduleUrl: Primitive_option.fromNullable(s.moduleUrl)
+  }));
+  let scope = DcbTag$Reventless.deriveEffectiveScope(slices);
+  let boundary;
   try {
-    partitionTag = DcbTag$Reventless.derivePartitionTag(specs.map(s => [
-      s.name,
-      Stdlib_Option.getOr(Primitive_option.fromNullable(s.moduleUrl), s.name),
-      s.eventSchema
-    ]));
-  } catch (exn) {
-    partitionTag = undefined;
+    boundary = DcbTag$Reventless.deriveBoundaryPartition(slices);
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      let err$1 = err._1;
+      Effect.runSync(EffectLogger$ReventlessCore.logError("DcbCommandTopicRuntime", undefined, `refusing to start: ` + Stdlib_Option.getOr(Stdlib_JsExn.message(err$1), "unknown error")));
+      throw err$1;
+    }
+    throw err;
   }
+  let partitionTagBySlice = {};
+  slices.forEach(s => Stdlib_Option.forEach(DcbTag$Reventless.slicePartitionTag(boundary, s.name), tag => {
+    partitionTagBySlice[s.name] = tag;
+  }));
   return {
     crossPartitionTagKeys: scope.crossPartitionTagKeys,
     tagKeysByEventType: scope.tagKeysByEventType,
-    partitionTag: partitionTag
+    partitionTag: boundary.partitionTag,
+    partitionTagBySlice: partitionTagBySlice
   };
 }
 
@@ -75,7 +92,7 @@ function makeStorageOps(tableName, pgConnection, scope) {
   }
 }
 
-function buildSliceHandler(spec, behavior, tagKeysByEventType, crossPartitionTagKeys, dcbEventLog) {
+function buildSliceHandler(spec, behavior, scope, dcbEventLog) {
   let callback = StateChangeSlice_CallbackResMjs.Make(spec)(behavior);
   let commandSchema = spec.commandSchema;
   return jsonStream => {
@@ -97,7 +114,7 @@ function buildSliceHandler(spec, behavior, tagKeysByEventType, crossPartitionTag
         return Stream.empty;
       }
     });
-    return callback.handleCommands(tagKeysByEventType, crossPartitionTagKeys, dcbEventLog, decodedStream);
+    return callback.handleCommands(scope.tagKeysByEventType, scope.crossPartitionTagKeys, scope.partitionTagBySlice[spec.name], dcbEventLog, decodedStream);
   };
 }
 

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -224,11 +224,7 @@ let makeFromCodeAsset: (
     })
   })
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   let variables = Dict.fromArray([("Environment", stack->Pulumi.Input.make)])
   envVars->Dict.forEachWithKey((value, key) => {

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -91,7 +91,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
       });
     });
   });
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let variables = Object.fromEntries([[
       "Environment",
       stack

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -332,11 +332,7 @@ let finish = (~eventsApi: AppSync_EventsApi.t, ~opts: Pulumi.CustomResourceOptio
       ~bundleRuntimeExtensions=false,
     )
 
-    let layers =
-      Lambda.reventlessLayerArn
-      ->Option.map(arn => [arn->Pulumi.Input.make])
-      ->Option.getOr([])
-      ->Pulumi.Input.make
+    let layers = Lambda.reventlessLayers()
 
     let appsyncEndpoint = AppSync_EventsApi.httpEndpoint(eventsApi)
 

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -120,7 +120,7 @@ function finish(eventsApi, opts) {
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs", packageDirs, undefined, false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let appsyncEndpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(eventsApi);
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "StateTopicPublisher", undefined, AWS_Tags$ReventlessAws.make(name + "StateTopicPublisherLogGroup", QueryDb$ReventlessCore.componentType, "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   let lambda = new (Aws.lambda.Function)(name + "StateTopicPublisher", {

package/src/adapter/Task/TaskBucket_S3.res

@@ -136,9 +136,7 @@ let make: ReventlessCore.Task_Adapter.bucketMaker<bucketParts> = (~name, ~opts)
   // bucket fails the deploy with `BucketNotEmpty` — which would wedge precisely
   // the throwaway stacks that are recreated most often. Protected stacks keep
   // the safe default and drain by hand.
-  let forceDestroy =
-    Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName()) ==
-      Util_StoreLayout.Unprotected
+  let forceDestroy = Util_StoreLayout.protectionOfDeployedStack() == Util_StoreLayout.Unprotected
 
   let bucket = {
     PulumiAws.S3.Bucket.make(

package/src/adapter/Task/TaskBucket_S3.res.mjs

@@ -76,7 +76,7 @@ function connect(name, bucket, bucketMode, commandTopics, runtime, opts) {
 
 function make(name, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
-  let forceDestroy = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined) === "Unprotected";
+  let forceDestroy = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack() === "Unprotected";
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: [{
         allowedHeaders: ["*"],

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -257,11 +257,7 @@ let finish = (
       ~bundleRuntimeExtensions=false,
     )
 
-    let layers =
-      Lambda.reventlessLayerArn
-      ->Option.map(arn => [arn->Pulumi.Input.make])
-      ->Option.getOr([])
-      ->Pulumi.Input.make
+    let layers = Lambda.reventlessLayers()
 
     // Created before the function that writes to it — see
     // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.

package/src/adapter/Upload/Upload_Claim_S3.res.mjs

@@ -124,7 +124,7 @@ function finish(plugin, stores, iteratorAgeAlarmMsOpt, opts) {
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs", packageDirs, undefined, false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Plugin", "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -180,11 +180,7 @@ let make = (
     ~bundleRuntimeExtensions=false,
   )
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   // Created before the function that writes to it — see
   // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -3,7 +3,6 @@
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -93,7 +92,7 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined, false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",

package/src/capability/Capability_Geocoding_AwsLocation.res

@@ -23,6 +23,8 @@ open PulumiAws
 let defaultDataSource = "Esri"
 let defaultIntendedUse = "SingleUse"
 
+let physicalName = (~name: string, ~stack: string): string => `${name}-${stack}`
+
 /** Create a place index with framework attribution tags and config-driven
     provider/retention settings. */
 let make = (
@@ -35,7 +37,9 @@ let make = (
   let index = Location.PlaceIndex.make(
     ~name,
     ~args={
-      indexName: Pulumi.Input.make(name),
+      // Stack-scoped: an index name is unique per account and region, so two
+      // stacks of one app in the same place would otherwise collide.
+      indexName: Pulumi.Input.make(physicalName(~name, ~stack=Pulumi.Pulumi.getStackName())),
       dataSource: Pulumi.Input.make(dataSource),
       dataSourceConfiguration: Pulumi.Input.make({
         Location.PlaceIndex.intendedUse: Pulumi.Input.make(intendedUse),

package/src/capability/Capability_Geocoding_AwsLocation.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "../util/Util_LocalConfig.res.mjs";
@@ -10,11 +11,15 @@ let defaultDataSource = "Esri";
 
 let defaultIntendedUse = "SingleUse";
 
+function physicalName(name, stack) {
+  return name + `-` + stack;
+}
+
 function make(name, opts) {
   let dataSource = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("geocoderDataSource"), defaultDataSource);
   let intendedUse = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("geocoderIntendedUse"), defaultIntendedUse);
   let index = new (Aws.location.PlaceIndex)(name, {
-    indexName: name,
+    indexName: physicalName(name, Pulumi.getStack()),
     dataSource: dataSource,
     dataSourceConfiguration: {
       intendedUse: intendedUse
@@ -32,6 +37,7 @@ function make(name, opts) {
 export {
   defaultDataSource,
   defaultIntendedUse,
+  physicalName,
   make,
 }
 /* @pulumi/aws Not a pure module */

package/src/components/Api/AppSync_SdlDecorate.res

@@ -162,8 +162,10 @@ let refuseAnonymousFields = (fieldNames: array<string>): 'a =>
     `Authorization.isAllowed), so a spec that passes locally can still not be\n` ++
     `deployable here. That divergence is the reason this refuses instead of\n` ++
     `emitting a directive that reads as gated and is not.\n\n` ++
-    `To serve anonymous callers on AWS the API needs API_KEY added as a third\n` ++
-    `auth provider, plus something to rotate the key. Until then, declare the\n` ++ `field AllowAuthenticated (or AllowGroups) and mean it.`,
+    `Anonymous fields on AWS are deferred. When they land it will be as a separate\n` ++
+    `API carrying only the unauthenticated fields. Do not add API_KEY to this one:\n` ++
+    `every field here would then have to say whether the key reaches it, and one\n` ++
+    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowGroups) and mean it.`,
   )
 
 // Injects the Cognito group gate on ALL mutation, query, and subscription fields

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -81,7 +81,7 @@ function permissionToGate(permission) {
 }
 
 function refuseAnonymousFields(fieldNames) {
-  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nTo serve anonymous callers on AWS the API needs API_KEY added as a third\nauth provider, plus something to rotate the key. Until then, declare the\nfield AllowAuthenticated (or AllowGroups) and mean it.`);
+  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowGroups) and mean it.`);
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -141,11 +141,7 @@ export const handler = async (event) => {
   let code = Pulumi.Archive.assetArchive(clonerArchiveContents)
   let sourceCodeHash = Util_Bundle.hashString(entryPointCode ++ "\n---\n" ++ loaderHash)
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   let vpcStackName = Pulumi.Config.make(Some("vpc"))->Pulumi.Config.get("stack")->Option.getOrThrow
   let vpcConfig = Util_Vpc.getVpcConfig(~stackName=vpcStackName, ~outputName="vpc")

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -87,7 +87,7 @@ export const handler = async (event) => {
   let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(clonerArchiveContents);
   let code = new (Pulumi.asset.AssetArchive)(clonerArchiveContents);
   let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(entryPointCode + "\n---\n" + loaderHash);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let vpcStackName = Stdlib_Option.getOrThrow(new Pulumi.Config("vpc").get("stack"), undefined);
   let vpcConfig = Util_Vpc$ReventlessAws.getVpcConfig(vpcStackName, "vpc");
   let secrets = Pulumi.all(secretUrns.map(urn => GetSecretVersion$PulumiAws.getSecretNames(urn).apply(names => names.map(name => ({

package/src/plugin/stack/Plugin_Stack.res

@@ -157,9 +157,13 @@ let makeUiBundleDistribution = (
   // shell, where blue/green between versions is wanted.
   let name = stableName ? pluginId : pluginId ++ "-" ++ bundleVersion
 
+  // Emptied on removal from a disposable stack: the manifest bake writes files
+  // here outside Pulumi, which would otherwise fail the destroy.
   let bucket = PulumiAws.S3.Bucket.make(
     ~name=name ++ "-bundle",
     ~args={
+      forceDestroy: (Util_StoreLayout.protectionOfDeployedStack() == Unprotected)
+        ->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name=name ++ "-bundle",
         ~kind=ReventlessCore.ComponentType.Plugin,

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -11,6 +11,7 @@ import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_excep
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as ClientCloudfront from "@aws-sdk/client-cloudfront";
+import * as Util_StoreLayout$ReventlessAws from "../../util/Util_StoreLayout.res.mjs";
 import * as Util_StaticBundle$ReventlessAws from "../../util/Util_StaticBundle.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -76,6 +77,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
   let servedBuckets = servedBucketsOpt !== undefined ? servedBucketsOpt : [];
   let name = stableName ? pluginId : pluginId + "-" + bundleVersion;
   let bucket = new (Aws.s3.Bucket)(name + "-bundle", {
+    forceDestroy: Util_StoreLayout$ReventlessAws.protectionOfDeployedStack() === "Unprotected",
     tags: AWS_Tags$ReventlessAws.make(name + "-bundle", "Plugin", "Hosting", "Plugin", undefined, undefined, pluginId, undefined)
   });
   new (Aws.s3.BucketPublicAccessBlock)(name + "-bundle-pab", {

package/src/util/Util_DeadLetterQueue.res

@@ -123,11 +123,7 @@ archiveContents->Dict.set(
 let code = Pulumi.Archive.assetArchive(archiveContents)
 let sourceCodeHash = Util_Bundle.hashString(entryPointCode)
 
-let layers =
-  Lambda.reventlessLayerArn
-  ->Option.map(arn => [arn->Pulumi.Input.make])
-  ->Option.getOr([])
-  ->Pulumi.Input.make
+let layers = Lambda.reventlessLayers()
 
 // This is the one Lambda in the framework built by hand rather than through
 // `RuntimeEnvironment_Lambda`, and it was the one Lambda whose logs Lambda

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
@@ -76,7 +75,7 @@ let code = new (Pulumi.asset.AssetArchive)(archiveContents);
 
 let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(entryPointCode);
 
-let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+let layers = Lambda$PulumiAws.reventlessLayers();
 
 let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + `LogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined), opts, undefined);
 

package/src/util/Util_StoreLayout.res

@@ -86,13 +86,26 @@ Destroy semantics follow disposability, **not** layout.
 `reventless:wipeable`, but that authorises the reset tool to empty stores
 *deliberately*, after a scope prompt and a typed confirmation. It does not say a
 field rename may destroy a bucket by accident. Only stacks that are routinely
-torn down are unprotected.
+torn down are unprotected: a `pr-*` stack, or one that declares
+`reventless:disposable: "true"` — a try-out meant to be removed whole.
 */
 let protectionFor = (
   ~stack: string,
+  ~disposable: bool=false,
   ~ephemeralPrefixes: array<string>=defaultEphemeralPrefixes,
 ): protection =>
-  ephemeralPrefixes->Array.some(p => stack->String.startsWith(p)) ? Unprotected : Protected
+  disposable || ephemeralPrefixes->Array.some(p => stack->String.startsWith(p))
+    ? Unprotected
+    : Protected
+
+/** `protectionFor` the stack being deployed, reading its `reventless:disposable`
+    setting. The one function here that touches Pulumi. */
+let protectionOfDeployedStack = (): protection =>
+  protectionFor(
+    ~stack=Pulumi.Pulumi.getStackName(),
+    ~disposable=Pulumi.Config.make(Some("reventless"))->Pulumi.Config.get("disposable") ==
+      Some("true"),
+  )
 
 /**
 The bucket a store's objects live in.