@reventlessdev/reventless-aws 3.0.0-alpha.373 → 3.0.0-alpha.375

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.375 (2026-10-08)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
+# 3.0.0-alpha.374 (2026-10-06)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.373 (2026-10-05)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.373",
+  "version": "3.0.0-alpha.375",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.28",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.29",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.23",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.21",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.24",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.289",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.186",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.158",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.39",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.157"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.153"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -2543,7 +2543,7 @@ module MakeWithConfig = (
     }
 
     // Where a caller records the role they want to act as
-    // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
+    // (docs/plans/done/active-role-narrows-the-token.md §6). The mutation only writes
     // a preference; the pre-token-generation trigger reads the row and re-checks
     // it against real membership before narrowing anything, so this door grants
     // nobody anything on its own.

package/src/Platform_Stack.res

@@ -149,7 +149,7 @@ let _resolveUncached = (): cognitoUserPool => {
   // Provisioned ahead of the pool in both pool modes: the pre-token-generation
   // trigger reads these rows, and in auto mode the pool is declared carrying the
   // trigger's ARN — so table → trigger → pool is a forced order, not a choice.
-  // See [docs/plans/active-role-narrows-the-token.md] §6.
+  // See [docs/plans/done/active-role-narrows-the-token.md] §6.
   //
   // Unconditional, including for a unified-API platform that mounts no
   // `Platform_SetActiveRole` and so can never write a row.
@@ -174,7 +174,7 @@ let _resolveUncached = (): cognitoUserPool => {
   // provider: named by derivation from the provider id, looked up rather than
   // created, and provisioned outside every stack alongside the pool itself. See
   // [Auth_ActiveRoleStore.chooseStore] and
-  // [docs/plans/active-role-store-scoped-to-the-pool.md].
+  // [docs/plans/done/active-role-store-scoped-to-the-pool.md].
   let activeRoleTable = Auth_ActiveRoleStore.resolveTable(
     ~choice=Auth_ActiveRoleStore.chooseStore(~identityProviderId=existingPoolId),
     ~opts={},
@@ -363,7 +363,7 @@ let _resolveUncached = (): cognitoUserPool => {
   //
   // `Arn` survives the rename on purpose — the value *is* an ARN, and `urn` in a
   // Pulumi codebase already means the Pulumi URN every resource carries. See
-  // [docs/plans/active-role-store-scoped-to-the-pool.md] step 7.
+  // [docs/plans/done/active-role-store-scoped-to-the-pool.md] step 7.
   let managedStr = Pulumi.Output.make(result.managed ? "true" : "false")
   let regionOutput = Pulumi.Output.make(regionStr)
 

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -24,7 +24,7 @@
     writes — every role switch reporting success and doing nothing. So the
     describe this already performs is also read for *what is attached*, and a
     slot held by anything else fails the deploy naming it. See [classifySlot] and
-    [docs/plans/active-role-store-scoped-to-the-pool.md].
+    [docs/plans/done/active-role-store-scoped-to-the-pool.md].
 
     🚨 **`UpdateUserPool` resets by omission.** The API requires "a value for all
     parameters that you don't want set to a default value". An attach that sends

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -1,5 +1,5 @@
 // The role a caller chose to act as, as server-side state — and the one door
-// that writes it. See [docs/plans/active-role-narrows-the-token.md] §6.
+// that writes it. See [docs/plans/done/active-role-narrows-the-token.md] §6.
 //
 // Why state rather than a parameter on the token request: Cognito "doesn't
 // include data from the ClientMetadata parameter in AdminInitiateAuth and
@@ -32,7 +32,7 @@
 //
 // 🚨 **The rows follow the identity provider, not the stack** — see
 // [ReventlessCore.Auth_ActiveRole] for the contract and
-// [docs/plans/active-role-store-scoped-to-the-pool.md] for the defect that
+// [docs/plans/done/active-role-store-scoped-to-the-pool.md] for the defect that
 // produced it. A pool holds one pre-token-generation trigger, so two stacks
 // sharing a pool with a table each have the winning trigger reading rows the
 // serving resolver never wrote: every switch succeeds and does nothing.

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res

@@ -2,7 +2,7 @@
 // and Pulumi-free so it ships as an EntryPoint module (`Auth_ActiveRoleStore`
 // bundles it and attaches it as the domain API's Lambda data source). See
 // [Upload_Presign_S3_Ops.res] for why an EntryPoint rather than a serialized
-// closure, and [docs/plans/active-role-narrows-the-token.md] §6 for the design.
+// closure, and [docs/plans/done/active-role-narrows-the-token.md] §6 for the design.
 //
 // What this writes is a *preference*, not a token. Cognito mints the token, and
 // the pre-token-generation trigger ([Auth_ActiveRoleTrigger_Ops.res]) reads this

package/src/adapter/Auth/Auth_ActiveRoleStore_Schema.res

@@ -1,5 +1,5 @@
 // The active-role store's identity: what it is called, and how its rows are
-// keyed. See [docs/plans/active-role-store-scoped-to-the-pool.md].
+// keyed. See [docs/plans/done/active-role-store-scoped-to-the-pool.md].
 //
 // 🚨 **One definition, four consumers, and that is the whole reason this file
 // exists.** The deploy creates or looks the table up ([Auth_ActiveRoleStore]),

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -1,7 +1,7 @@
 // Deploy-time half of the Cognito pre-token-generation trigger — the Lambda that
 // narrows `cognito:groups` to the role a caller chose. Runtime logic lives in
 // [Auth_ActiveRoleTrigger_Ops.res]; see
-// [docs/plans/active-role-narrows-the-token.md] §6.
+// [docs/plans/done/active-role-narrows-the-token.md] §6.
 //
 // `make` provisions the function and its execution role (Logs + a read of the
 // one role-state table). It does **not** attach itself to a user pool, and does

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -1,6 +1,6 @@
 // Runtime handler for the Cognito **pre token generation** trigger — the AWS
 // minting point for "acting as one of the roles you hold". See
-// [docs/plans/active-role-narrows-the-token.md] §6.
+// [docs/plans/done/active-role-narrows-the-token.md] §6.
 //
 // Compiled, type-checked and Pulumi-free so it ships as an EntryPoint module
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb.res

@@ -29,7 +29,7 @@ let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
   // partition), and a future cross-partition secondary-tag read (Phase 7) goes
   // `Query` (keys) → `BatchGetItem` (payloads against the base table). KEYS_ONLY
   // drops the per-GSI event-payload storage multiplier and most of the per-write
-  // WCU while keeping the index queryable. See docs/plans/dcb-consistency-hardening.md
+  // WCU while keeping the index queryable. See docs/plans/done/dcb-consistency-hardening.md
   // Phase 3.
   let globalSecondaryIndexes =
     indexes

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -49,7 +49,7 @@ let tagToAttributeName = (tagKey: string) => `tag_${tagKey}`
 // reads resolve events directly from it. The per-tag `tag_<key>` GSIs are
 // `KEYS_ONLY` — no reader today, and Phase 7's cross-partition read goes
 // `Query`(keys) → `BatchGetItem`(payloads). Pure predicate so it is unit-testable
-// without the Pulumi deploy layer. See docs/plans/dcb-consistency-hardening.md Phase 3.
+// without the Pulumi deploy layer. See docs/plans/done/dcb-consistency-hardening.md Phase 3.
 let compositeIndexName = "tag_composite"
 let indexKeepsFullProjection = (indexName: string): bool => indexName == compositeIndexName
 

package/tests/Auth_ActiveRoleStoreTest.res

@@ -79,7 +79,7 @@ describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
 // Which store this deployment reads and writes. Two cases and no third: a stack
 // that creates its own provider owns everything attached to it, and a stack given
 // a provider owns none of it. See
-// [docs/plans/active-role-store-scoped-to-the-pool.md].
+// [docs/plans/done/active-role-store-scoped-to-the-pool.md].
 describe("Auth_ActiveRoleStore.chooseStore", () => {
   testSync("a stack that creates its own provider keeps its own table", () =>
     expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=None))->toEqual(

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -16,7 +16,7 @@
 // is the only thing that proves the fence-scope model (Issue 1 fix) and the
 // optimistic-concurrency guarantees end-to-end. See
 // `docs/analysis/dcb-consistency-check-issues.md` and
-// `docs/plans/dcb-consistency-hardening.md` (Phase 1).
+// `docs/plans/done/dcb-consistency-hardening.md` (Phase 1).
 
 open JestGlobals