@reventlessdev/reventless-aws 3.0.0-alpha.390 → 3.0.0-alpha.392

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.392 (2026-10-21)
+
+### Features
+
+* **aws:** a UI bundle uploads as one resource, putting only the files that changed ([9e28682](https://github.com/ReventlessDev/reventless-core/commit/9e286829817c6679aace100b3f17195a777a4cf4))
+
+
+# 3.0.0-alpha.391 (2026-10-21)
+
+### Features
+
+* **aws:** a UI bundle's per-file objects are retained on delete, and the deploy workflow takes a pulumi-parallel ([7155acf](https://github.com/ReventlessDev/reventless-core/commit/7155acfc85680f7eebef843e2c34d40a79114a7c))
+
+
 # 3.0.0-alpha.390 (2026-10-21)
 
 * feat!: a rejected command says whether the model, the access check or the platform said no ([6a8a6b0](https://github.com/ReventlessDev/reventless-core/commit/6a8a6b0f2f31e766ae26a944c23b0904e51a5865))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.390",
+  "version": "3.0.0-alpha.392",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -24,15 +24,15 @@
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.33",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.31",
-    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/reventless-core": "3.0.0-alpha.303",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.200",
+    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.167",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.172"
   },

package/src/plugin/stack/Plugin_Stack.res

@@ -114,9 +114,10 @@ let invalidateDistribution = async (~distributionId: string, ~paths: array<strin
 
 /**
  * Provision an S3 bucket + CloudFront distribution for a UI bundle. When
- * `~assetsDir` is supplied, every file under it is uploaded as a `BucketObject`
- * with the correct MIME type and an etag derived from the file's SHA-256 so
- * Pulumi only re-uploads files that actually changed. When `~spaFallback=true`,
+ * `~assetsDir` is supplied, its files are uploaded by one resource
+ * (`Util_StaticBundleUpload`) with the correct MIME type, putting only files
+ * that changed and deleting those two deploys old. A stack must have deployed
+ * the per-file objects with `retainOnDelete` before this replaces them. When `~spaFallback=true`,
  * CloudFront 403/404 responses fall back to the index document so client-side
  * routes resolve correctly on first paint.
  *
@@ -147,9 +148,7 @@ let makeUiBundleDistribution = (
 ): bundleDistribution => {
   // When stableName=true, Pulumi resource names omit bundleVersion so every
   // deploy updates the same bucket + CloudFront distribution in place. The
-  // public CloudFront domain stays the same across releases. Per-file etags
-  // still drive BucketObject diffs, and obsolete objects are removed when
-  // their Pulumi resource disappears from state.
+  // public CloudFront domain stays the same across releases.
   //
   // When false (the default), bundleVersion is baked into every resource name,
   // so each release provisions a fresh bucket + distribution — useful for
@@ -500,39 +499,39 @@ let makeUiBundleDistribution = (
     if allEntries->Array.length == 0 {
       JsError.throwWithMessage(`Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ${dir}`)
     }
-    // Drop excluded relative paths before BucketObject creation. Used so the
+    // Drop excluded relative paths before the upload. Used so the
     // host-shell deploy can skip the dev-mode `public/config.json` it ships
     // with — the explicit Platform.res BucketObject writes the production
     // config to the same S3 key and would otherwise race with the bundle
     // upload (whichever Pulumi applies last wins).
     let entries =
       allEntries->Array.filter(entry => !(excludeFiles->Array.includes(entry.relativePath)))
-    let objectEtags = entries->Array.map(entry => {
-      let obj = PulumiAws.S3.BucketObject.make(
-        ~name=name ++ "-asset-" ++ Util.StaticBundle.sanitizeName(entry.relativePath),
-        ~args={
-          bucket: bucket.id->Pulumi.Output.asInput,
-          key: Pulumi.Input.make(entry.relativePath),
-          source: Pulumi.Input.make(entry.fileAsset),
-          contentType: Pulumi.Input.make(Util.StaticBundle.contentTypeFor(entry.relativePath)),
-          cacheControl: Pulumi.Input.make(cacheControlFor(entry.relativePath)),
-          etag: Pulumi.Input.make(entry.contentHash),
-        },
-      )
-      obj.etag
-    })
+    // One resource for the whole directory: it puts what is new or changed and deletes what
+    // is two deploys old (`Util_StaticBundleUpload`).
+    let upload = Util_StaticBundleUpload.make(
+      ~name=name ++ "-assets",
+      ~props={
+        bucket: bucket.bucket->Pulumi.Output.asInput,
+        dir,
+        files: entries->Array.map((entry): Util_StaticBundleUpload.file => {
+          key: entry.relativePath,
+          contentType: Util.StaticBundle.contentTypeFor(entry.relativePath),
+          cacheControl: cacheControlFor(entry.relativePath),
+        }),
+      },
+    )
 
-    // Auto-invalidate CloudFront once every object is (re)uploaded. Stable-named
+    // Auto-invalidate CloudFront once the upload is done. Stable-named
     // entry files (index.html, the module-federation mf-entry-bootstrap-*.js)
     // are served by the long-TTL default cache behavior, so without this a
     // `pulumi up` lands the new bundle in S3 while CloudFront keeps serving the
-    // prior build until its TTL expires. Chained on the upload etags so it runs
+    // prior build until its TTL expires. Chained on the upload so it runs
     // AFTER the new content is in S3; `/*` is a single invalidation path (well
     // within CloudFront's free-tier monthly allowance even on frequent deploys).
     let _ =
-      (distribution.id, Pulumi.Output.all(objectEtags))
+      (distribution.id, upload.uploaded)
       ->Pulumi.Output.all2
-      ->Pulumi.Output.flatMap(((distId, _etags)) =>
+      ->Pulumi.Output.flatMap(((distId, _uploaded)) =>
         invalidateDistribution(~distributionId=distId, ~paths=["/*"])->Pulumi.Output.fromPromise
       )
   }

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -13,6 +13,7 @@ import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as ClientCloudfront from "@aws-sdk/client-cloudfront";
 import * as Util_StoreLayout$ReventlessAws from "../../util/Util_StoreLayout.res.mjs";
 import * as Util_StaticBundle$ReventlessAws from "../../util/Util_StaticBundle.res.mjs";
+import * as Util_StaticBundleUpload$ReventlessAws from "../../util/Util_StaticBundleUpload.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -287,17 +288,18 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
       Stdlib_JsError.throwWithMessage(`Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ` + assetsDir);
     }
     let entries = allEntries.filter(entry => !excludeFiles.includes(entry.relativePath));
-    let objectEtags = entries.map(entry => new (Aws.s3.BucketObject)(name + "-asset-" + Util_StaticBundle$ReventlessAws.sanitizeName(entry.relativePath), {
-      bucket: bucket.id,
-      key: entry.relativePath,
-      source: entry.fileAsset,
-      contentType: Util_StaticBundle$ReventlessAws.contentTypeFor(entry.relativePath),
-      cacheControl: cacheControlFor(entry.relativePath),
-      etag: entry.contentHash
-    }).etag);
+    let upload = Util_StaticBundleUpload$ReventlessAws.make(name + "-assets", {
+      bucket: bucket.bucket,
+      dir: assetsDir,
+      files: entries.map(entry => ({
+        key: entry.relativePath,
+        contentType: Util_StaticBundle$ReventlessAws.contentTypeFor(entry.relativePath),
+        cacheControl: cacheControlFor(entry.relativePath)
+      }))
+    });
     Output$Pulumi.flatMap(Pulumi.all([
       distribution.id,
-      Pulumi.all(objectEtags)
+      upload.uploaded
     ]), param => invalidateDistribution(param[0], ["/*"]));
   }
   let distributionUrl = customDomain !== undefined ? Pulumi.output("https://" + customDomain.fqdn) : distribution.domainName.apply(d => "https://" + d);

package/src/util/Util_StaticBundleUpload.res

@@ -0,0 +1,275 @@
+/** A static bundle uploaded as **one** resource rather than one `BucketObject` per file.
+
+    A per-file resource costs a create or a delete each, and a rebuild renames most hashed
+    files, so a bundle of a few hundred files spent most of its deploy creating and deleting
+    objects. This resource lists the bucket once, puts what is new or changed sixteen at a time,
+    and deletes what is two generations old: a reader with a page open from the previous deploy
+    can still load its chunks.
+
+    **Always updated.** `diff_` reports a change on every deploy, and the update compares with
+    what the bucket holds (`ListObjectsV2`'s ETag is the MD5 of a single-part upload), so a file
+    removed outside Pulumi is put back by the next deploy. Keys this resource never uploaded —
+    an explicitly written `config.json`, a served bucket's prefix — are never touched.
+
+    Caveat inherited from every Pulumi dynamic provider: the captured closure is serialised into
+    stack state, so the SDK and the Node modules are imported lazily and nothing here captures a
+    Pulumi Output. A fix reaches a stack once this resource is next updated, which is every
+    deploy. */
+let log = ReventlessCore.Logger.fromEnv()
+
+// ── The SDK, imported lazily ─────────────────────────────────────────────────
+
+type s3Client
+type buffer
+
+type listInput = {
+  @as("Bucket") bucket: string,
+  @as("ContinuationToken") continuationToken?: string,
+}
+type listedObject = {@as("Key") key: string, @as("ETag") etag?: string}
+type listResult = {
+  @as("Contents") contents?: array<listedObject>,
+  @as("IsTruncated") isTruncated?: bool,
+  @as("NextContinuationToken") nextContinuationToken?: string,
+}
+type putInput = {
+  @as("Bucket") bucket: string,
+  @as("Key") key: string,
+  @as("Body") body: buffer,
+  @as("ContentType") contentType: string,
+  @as("CacheControl") cacheControl: string,
+}
+type deleteInput = {@as("Bucket") bucket: string, @as("Key") key: string}
+
+type listCmd
+type putCmd
+type deleteCmd
+
+type sdkModule = {
+  @as("S3Client") clientCtor: unknown,
+  @as("ListObjectsV2Command") listCtor: unknown,
+  @as("PutObjectCommand") putCtor: unknown,
+  @as("DeleteObjectCommand") deleteCtor: unknown,
+}
+
+@module("./Util_LogGroup_Adopting_Js.mjs") external newCommand: ('ctor, 'arg) => 'cmd = "newCommand"
+@module("./Util_LogGroup_Adopting_Js.mjs") external newClient: 'ctor => s3Client = "newClient"
+
+@send external sendList: (s3Client, listCmd) => promise<listResult> = "send"
+@send external sendPut: (s3Client, putCmd) => promise<unit> = "send"
+@send external sendDelete: (s3Client, deleteCmd) => promise<unit> = "send"
+
+type fsModule = {readFile: string => promise<buffer>}
+type hash
+type cryptoModule = {createHash: string => hash}
+@send external hashUpdate: (hash, buffer) => hash = "update"
+@send external hashDigest: (hash, string) => string = "digest"
+
+// Emitted as a literal `import("...")`, so the serialiser does not capture the modules.
+@val external importSdk: string => promise<sdkModule> = "import"
+@val external importFs: string => promise<fsModule> = "import"
+@val external importCrypto: string => promise<cryptoModule> = "import"
+
+let _client: ref<option<(sdkModule, s3Client)>> = ref(None)
+
+let client = async (): (sdkModule, s3Client) =>
+  switch _client.contents {
+  | Some(c) => c
+  | None =>
+    let sdk = await importSdk("@aws-sdk/client-s3")
+    let c = (sdk, newClient(sdk.clientCtor))
+    _client.contents = Some(c)
+    c
+  }
+
+// ── The resource ─────────────────────────────────────────────────────────────
+
+/** One file of the bundle: its key, read from `dir ++ "/" ++ key` at upload time. */
+type file = {key: string, contentType: string, cacheControl: string}
+
+type providerInputs = {bucket: string, dir: string, files: array<file>}
+
+/** `keys` are this deploy's, `previousKeys` the deploy's before; a key in neither goes. */
+type outs = {
+  bucket: Nullable.t<string>,
+  keys: Nullable.t<array<string>>,
+  previousKeys: Nullable.t<array<string>>,
+  uploaded: Nullable.t<int>,
+}
+
+type createResultOut = {id: string, outs: outs}
+type updateResultOut = {outs: outs}
+type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace: bool}
+
+/** What the bucket holds, key to ETag (quotes stripped). */
+let listed = async (~bucket: string): dict<string> => {
+  let (sdk, s3) = await client()
+  let found = Dict.make()
+  let rec page = async (token: option<string>) => {
+    let result = await s3->sendList(newCommand(sdk.listCtor, {bucket, continuationToken: ?token}))
+    result.contents
+    ->Option.getOr([])
+    ->Array.forEach(o =>
+      found->Dict.set(o.key, o.etag->Option.getOr("")->String.replaceAll("\"", ""))
+    )
+    switch (result.isTruncated, result.nextContinuationToken) {
+    | (Some(true), Some(next)) => await page(Some(next))
+    | _ => ()
+    }
+  }
+  await page(None)
+  found
+}
+
+/** Runs `work` over `items`, `limit` at a time. */
+let inBatches = async (items: array<'a>, ~limit: int, work: 'a => promise<unit>): unit => {
+  let rec from = async (start: int) =>
+    if start < Array.length(items) {
+      let _ = await Promise.all(items->Array.slice(~start, ~end=start + limit)->Array.map(work))
+      await from(start + limit)
+    }
+  await from(0)
+}
+
+/** Puts every file the bucket lacks or holds different bytes for; returns how many. */
+let upload = async ({bucket, dir, files}: providerInputs): int => {
+  let (sdk, s3) = await client()
+  let fs = await importFs("node:fs/promises")
+  let crypto = await importCrypto("node:crypto")
+  let held = await listed(~bucket)
+  let count = ref(0)
+  await files->inBatches(~limit=16, async f => {
+    let body = await fs.readFile(dir ++ "/" ++ f.key)
+    let md5 = crypto.createHash("md5")->hashUpdate(body)->hashDigest("hex")
+    if held->Dict.get(f.key) != Some(md5) {
+      await s3->sendPut(
+        newCommand(
+          sdk.putCtor,
+          {bucket, key: f.key, body, contentType: f.contentType, cacheControl: f.cacheControl},
+        ),
+      )
+      count := count.contents + 1
+    }
+  })
+  log.info(
+    ~comp="Util_StaticBundleUpload",
+    `${bucket}: ${Int.toString(count.contents)} of ${Int.toString(
+        Array.length(files),
+      )} files uploaded`,
+  )
+  count.contents
+}
+
+let remove = async (~bucket: string, keys: array<string>): unit => {
+  let (sdk, s3) = await client()
+  await keys->inBatches(~limit=16, async key =>
+    await s3->sendDelete(newCommand(sdk.deleteCtor, {bucket, key}))
+  )
+}
+
+let keysOf = (inputs: providerInputs) => inputs.files->Array.map(f => f.key)
+
+/** The keys an update deletes: last deploy's previous ones that neither this deploy nor the
+    last one names. */
+let staleKeys = (
+  ~current: array<string>,
+  ~previous: array<string>,
+  ~beforePrevious: array<string>,
+) =>
+  beforePrevious->Array.filter(k => !(current->Array.includes(k)) && !(previous->Array.includes(k)))
+
+let create = async (inputs: providerInputs): createResultOut => {
+  let uploaded = await upload(inputs)
+  {
+    id: inputs.bucket,
+    outs: {
+      bucket: Nullable.make(inputs.bucket),
+      keys: Nullable.make(keysOf(inputs)),
+      previousKeys: Nullable.make([]),
+      uploaded: Nullable.make(uploaded),
+    },
+  }
+}
+
+let update = async (_id: string, olds: outs, news: providerInputs): updateResultOut => {
+  let uploaded = await upload(news)
+  let current = keysOf(news)
+  let previous = olds.keys->Nullable.toOption->Option.getOr([])
+  let stale = staleKeys(
+    ~current,
+    ~previous,
+    ~beforePrevious=olds.previousKeys->Nullable.toOption->Option.getOr([]),
+  )
+  await remove(~bucket=news.bucket, stale)
+  {
+    outs: {
+      bucket: Nullable.make(news.bucket),
+      keys: Nullable.make(current),
+      previousKeys: Nullable.make(previous),
+      uploaded: Nullable.make(uploaded),
+    },
+  }
+}
+
+/** Takes its files with it: the ones it uploaded in its last two deploys. */
+let delete_ = async (_id: string, olds: outs): unit =>
+  switch olds.bucket->Nullable.toOption {
+  | None => ()
+  | Some(bucket) =>
+    let keys = Array.concat(
+      olds.keys->Nullable.toOption->Option.getOr([]),
+      olds.previousKeys->Nullable.toOption->Option.getOr([]),
+    )
+    await remove(~bucket, keys->Set.fromArray->Set.values->Iterator.toArray)
+  }
+
+let diff_ = (_id: string, olds: outs, news: providerInputs): diffResult => {
+  changes: true,
+  replaces: olds.bucket->Nullable.toOption != Some(news.bucket) ? ["bucket"] : [],
+  deleteBeforeReplace: false,
+}
+
+let provider = {
+  "create": create,
+  "update": update,
+  "delete": delete_,
+  "diff": diff_,
+}
+
+// ── Pulumi dynamic resource binding ──────────────────────────────────────────
+
+type t = {uploaded: Pulumi.Output.t<int>}
+
+type constructorProps = {
+  bucket: Pulumi.Input.t<string>,
+  dir: string,
+  files: array<file>,
+}
+
+/** Output-only properties are declared `undefined`, Pulumi's way to register them. */
+type resourceProps = {
+  bucket: Pulumi.Input.t<string>,
+  dir: string,
+  files: array<file>,
+  keys: Nullable.t<array<string>>,
+  previousKeys: Nullable.t<array<string>>,
+  uploaded: Nullable.t<int>,
+}
+
+@module("@pulumi/pulumi/dynamic/index.js") @new
+external _newResource: ('provider, string, 'props, Pulumi.CustomResourceOptions.t) => t = "Resource"
+
+let make = (~name: string, ~props: constructorProps): t =>
+  _newResource(
+    provider,
+    name,
+    {
+      bucket: props.bucket,
+      dir: props.dir,
+      files: props.files,
+      keys: Nullable.undefined,
+      previousKeys: Nullable.undefined,
+      uploaded: Nullable.undefined,
+    },
+    {},
+  )

package/src/util/Util_StaticBundleUpload.res.mjs

@@ -0,0 +1,211 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Util_LogGroup_Adopting_JsMjs from "./Util_LogGroup_Adopting_Js.mjs";
+import * as IndexJs from "@pulumi/pulumi/dynamic/index.js";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function newCommand(prim0, prim1) {
+  return Util_LogGroup_Adopting_JsMjs.newCommand(prim0, prim1);
+}
+
+function newClient(prim) {
+  return Util_LogGroup_Adopting_JsMjs.newClient(prim);
+}
+
+let _client = {
+  contents: undefined
+};
+
+async function client() {
+  let c = _client.contents;
+  if (c !== undefined) {
+    return c;
+  }
+  let sdk = await import("@aws-sdk/client-s3");
+  let c_1 = Util_LogGroup_Adopting_JsMjs.newClient(sdk.S3Client);
+  let c$1 = [
+    sdk,
+    c_1
+  ];
+  _client.contents = c$1;
+  return c$1;
+}
+
+async function listed(bucket) {
+  let match = await client();
+  let s3 = match[1];
+  let sdk = match[0];
+  let found = {};
+  let page = async token => {
+    let result = await s3.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.ListObjectsV2Command, {
+      Bucket: bucket,
+      ContinuationToken: token
+    }));
+    Stdlib_Option.getOr(result.Contents, []).forEach(o => {
+      found[o.Key] = Stdlib_Option.getOr(o.ETag, "").replaceAll("\"", "");
+    });
+    let match = result.IsTruncated;
+    let match$1 = result.NextContinuationToken;
+    if (match !== undefined && match && match$1 !== undefined) {
+      return await page(match$1);
+    }
+  };
+  await page(undefined);
+  return found;
+}
+
+async function inBatches(items, limit, work) {
+  let from = async start => {
+    if (start < items.length) {
+      await Promise.all(items.slice(start, start + limit | 0).map(work));
+      return await from(start + limit | 0);
+    }
+  };
+  return await from(0);
+}
+
+async function upload(param) {
+  let files = param.files;
+  let dir = param.dir;
+  let bucket = param.bucket;
+  let match = await client();
+  let s3 = match[1];
+  let sdk = match[0];
+  let fs = await import("node:fs/promises");
+  let crypto = await import("node:crypto");
+  let held = await listed(bucket);
+  let count = {
+    contents: 0
+  };
+  await inBatches(files, 16, async f => {
+    let body = await fs.readFile(dir + "/" + f.key);
+    let md5 = crypto.createHash("md5").update(body).digest("hex");
+    if (Primitive_object.notequal(held[f.key], md5)) {
+      await s3.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.PutObjectCommand, {
+        Bucket: bucket,
+        Key: f.key,
+        Body: body,
+        ContentType: f.contentType,
+        CacheControl: f.cacheControl
+      }));
+      count.contents = count.contents + 1 | 0;
+      return;
+    }
+  });
+  log.info("Util_StaticBundleUpload", undefined, bucket + `: ` + count.contents.toString() + ` of ` + files.length.toString() + ` files uploaded`);
+  return count.contents;
+}
+
+async function remove(bucket, keys) {
+  let match = await client();
+  let s3 = match[1];
+  let sdk = match[0];
+  return await inBatches(keys, 16, async key => await s3.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.DeleteObjectCommand, {
+    Bucket: bucket,
+    Key: key
+  })));
+}
+
+function keysOf(inputs) {
+  return inputs.files.map(f => f.key);
+}
+
+function staleKeys(current, previous, beforePrevious) {
+  return beforePrevious.filter(k => {
+    if (current.includes(k)) {
+      return false;
+    } else {
+      return !previous.includes(k);
+    }
+  });
+}
+
+async function create(inputs) {
+  let uploaded = await upload(inputs);
+  return {
+    id: inputs.bucket,
+    outs: {
+      bucket: inputs.bucket,
+      keys: keysOf(inputs),
+      previousKeys: [],
+      uploaded: uploaded
+    }
+  };
+}
+
+async function update(_id, olds, news) {
+  let uploaded = await upload(news);
+  let current = keysOf(news);
+  let previous = Stdlib_Option.getOr(Primitive_option.fromNullable(olds.keys), []);
+  let stale = staleKeys(current, previous, Stdlib_Option.getOr(Primitive_option.fromNullable(olds.previousKeys), []));
+  await remove(news.bucket, stale);
+  return {
+    outs: {
+      bucket: news.bucket,
+      keys: current,
+      previousKeys: previous,
+      uploaded: uploaded
+    }
+  };
+}
+
+async function delete_(_id, olds) {
+  let bucket = olds.bucket;
+  if (bucket == null) {
+    return;
+  }
+  let keys = Stdlib_Option.getOr(Primitive_option.fromNullable(olds.keys), []).concat(Stdlib_Option.getOr(Primitive_option.fromNullable(olds.previousKeys), []));
+  return await remove(bucket, new Set(keys).values().toArray());
+}
+
+function diff_(_id, olds, news) {
+  return {
+    changes: true,
+    replaces: Primitive_object.notequal(Primitive_option.fromNullable(olds.bucket), news.bucket) ? ["bucket"] : [],
+    deleteBeforeReplace: false
+  };
+}
+
+let provider = {
+  create: create,
+  update: update,
+  delete: delete_,
+  diff: diff_
+};
+
+function make(name, props) {
+  return new IndexJs.Resource(provider, name, {
+    bucket: props.bucket,
+    dir: props.dir,
+    files: props.files,
+    keys: undefined,
+    previousKeys: undefined,
+    uploaded: undefined
+  }, {});
+}
+
+export {
+  log,
+  newCommand,
+  newClient,
+  _client,
+  client,
+  listed,
+  inBatches,
+  upload,
+  remove,
+  keysOf,
+  staleKeys,
+  create,
+  update,
+  delete_,
+  diff_,
+  provider,
+  make,
+}
+/* log Not a pure module */

package/tests/Util_StaticBundleUploadTest.res

@@ -0,0 +1,30 @@
+open Jest
+open Expect
+
+describe("Util_StaticBundleUpload.staleKeys", () => {
+  test("deletes a key only once two deploys have not named it", () =>
+    expect(
+      Util_StaticBundleUpload.staleKeys(
+        ~current=["index.html", "assets/c.js"],
+        ~previous=["index.html", "assets/b.js"],
+        ~beforePrevious=["index.html", "assets/a.js", "assets/b.js"],
+      ),
+    )->toEqual(["assets/a.js"])
+  )
+
+  test("keeps a key that came back after a deploy without it", () =>
+    expect(
+      Util_StaticBundleUpload.staleKeys(
+        ~current=["assets/a.js"],
+        ~previous=["assets/b.js"],
+        ~beforePrevious=["assets/a.js"],
+      ),
+    )->toEqual([])
+  )
+
+  test("deletes nothing on the first two deploys", () =>
+    expect(
+      Util_StaticBundleUpload.staleKeys(~current=["a"], ~previous=[], ~beforePrevious=[]),
+    )->toEqual([])
+  )
+})

package/tests/Util_StaticBundleUploadTest.res.mjs

@@ -0,0 +1,22 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Jest from "@reventlessdev/rescript-jest/src/Jest.res.mjs";
+import * as Util_StaticBundleUpload$ReventlessAws from "../src/util/Util_StaticBundleUpload.res.mjs";
+
+Jest.describe("Util_StaticBundleUpload.staleKeys", () => {
+  Jest.test("deletes a key only once two deploys have not named it", () => Jest.Expect.toEqual(Jest.Expect.expect(Util_StaticBundleUpload$ReventlessAws.staleKeys([
+    "index.html",
+    "assets/c.js"
+  ], [
+    "index.html",
+    "assets/b.js"
+  ], [
+    "index.html",
+    "assets/a.js",
+    "assets/b.js"
+  ])), ["assets/a.js"]));
+  Jest.test("keeps a key that came back after a deploy without it", () => Jest.Expect.toEqual(Jest.Expect.expect(Util_StaticBundleUpload$ReventlessAws.staleKeys(["assets/a.js"], ["assets/b.js"], ["assets/a.js"])), []));
+  Jest.test("deletes nothing on the first two deploys", () => Jest.Expect.toEqual(Jest.Expect.expect(Util_StaticBundleUpload$ReventlessAws.staleKeys(["a"], [], [])), []));
+});
+
+/*  Not a pure module */