@reventlessdev/reventless-aws 3.0.0-alpha.401 → 3.0.0-alpha.402

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.402 (2026-10-29)
+
+* feat(core)!: the caller's IP address leaves the messages a request causes ([aa9e8c7](https://github.com/ReventlessDev/reventless-core/commit/aa9e8c79c0360528a5cfeda2bb88d1da52f28674))
+### Features
+
+* **upload:** an upload's path carries nothing a person typed ([456c88c](https://github.com/ReventlessDev/reventless-core/commit/456c88c4ccee6a50943e3a71011a2e78aef0d770))
+
+### BREAKING CHANGES
+
+* `Message.generateMeta` no longer takes `~ip`. Drop the argument; a
+message that must carry the address declares it as a field of its own payload.
+
+Step PD3 of docs/plans/a-personal-field-is-marked-redacted-and-encrypted-at-the-seam.md.
+Claude-Session: https://claude.ai/code/session_01HiQfdxVEsHwLHRoHSUcus1
+
+
+
 # 3.0.0-alpha.401 (2026-10-29)
 
 * refactor!: drop `dcbSources`, the cross-plugin DCB subscription nobody declared ([cf3b66d](https://github.com/ReventlessDev/reventless-core/commit/cf3b66d8c1b5d87673197b64eaee174598bb8253))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.401",
+  "version": "3.0.0-alpha.402",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -26,15 +26,15 @@
     "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.34",
-    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.35",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.311",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.208",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.175",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.312",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.209",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.179"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.180",
+    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.176"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res.mjs

@@ -1552,7 +1552,7 @@ function MakeWithConfig(Config) {
           };
           let publishHeartbeat = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO");
           let message_id = hbConfig.pluginId;
-          let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, undefined, "DeployHeartbeat", undefined, undefined, undefined, undefined, undefined);
+          let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, "DeployHeartbeat", undefined, undefined, undefined, undefined, undefined);
           let message_commandJson = Util_Sury$Reventless.toJson({
             TAG: "RedetectPlugin",
             _0: hbConfig.heartbeatTimeout
@@ -2962,7 +2962,7 @@ function Make($star) {
           };
           let publishHeartbeat = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO");
           let message_id = hbConfig.pluginId;
-          let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, undefined, "DeployHeartbeat", undefined, undefined, undefined, undefined, undefined);
+          let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, "DeployHeartbeat", undefined, undefined, undefined, undefined, undefined);
           let message_commandJson = Util_Sury$Reventless.toJson({
             TAG: "RedetectPlugin",
             _0: hbConfig.heartbeatTimeout

package/src/adapter/Mcp/MCP_Lambda.res

@@ -383,7 +383,7 @@ let dispatchTool = async (tool: mcpToolEntry, args: JSON.t, identity: Reventless
   let payload: ReventlessCore.CommandGenerator.payload = {
     command: tool.name,
     arguments: args->Obj.magic,
-    meta: {ip: [], user: identity.userId, info: `mcp/tools/${tool.name}`},
+    meta: {user: identity.userId, info: `mcp/tools/${tool.name}`},
     identity,
   }
   // Route through the shared dispatch helper so this tool call gets the same

package/src/adapter/Mcp/MCP_Lambda.res.mjs

@@ -254,7 +254,6 @@ async function dispatchTool(tool, args, identity) {
   let generateCommand = CommandGenerator_CallbackResMjs.makeGenerateCommand(publishJsons, tool.name, Sury.json, tool.componentKind, false);
   let payload_command = tool.name;
   let payload_meta = {
-    ip: [],
     user: identity.userId,
     info: `mcp/tools/` + tool.name
   };

package/src/adapter/Runtime/HeartbeatEntryPoint.res

@@ -39,7 +39,6 @@ let handler = async (_event: JSON.t, _context: PulumiAws.Lambda.context) => {
     id: pluginId,
     meta: ReventlessCore.Message.generateMeta(
       ~service=ReventlessInfra.PluginExtensionPointSpec.name,
-      ~ip="",
       ~user="Heartbeat",
     ),
     commandJson: ReventlessInfra.PluginExtensionPointSpec.Heartbeat(

package/src/adapter/Runtime/HeartbeatEntryPoint.res.mjs

@@ -26,7 +26,7 @@ let runtimeExtensionsReady = HandlerFactoryHelpersMjs.runtimeExtensionsReady;
 
 async function handler(_event, _context) {
   await runtimeExtensionsReady;
-  let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, "", "Heartbeat", undefined, undefined, undefined, undefined, undefined);
+  let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, "Heartbeat", undefined, undefined, undefined, undefined, undefined);
   let message_commandJson = Util_Sury$Reventless.toJson({
     TAG: "Heartbeat",
     _0: timeout

package/src/adapter/Upload/Upload_Presign_S3_Ops.res

@@ -11,7 +11,7 @@
 // surface — the earlier `decodeJwtSub` path is gone.
 //
 // Two operations dispatch on the `operation` field the resolver bakes in:
-//   presign → derive `{servedPrefix}/{sub}/{uuid}/{fileName}`, presign a PUT to the
+//   presign → derive `{servedPrefix}/{sub}/{uuid}.{ext}`, presign a PUT to the
 //             store's bucket (expires 300s), return `{uploadUrl, storageRef}`.
 //   release → apply the release rule (scope + age) to a `storageRef` and, if it
 //             passes, `DeleteObject`; return `{released, reason}`.
@@ -211,6 +211,10 @@ let headLastModifiedMs = async (~client: s3Client, ~bucket: string, ~key: string
 
 // ── Operations ──────────────────────────────────────────────────────────────
 
+// The object key a presign mints, pure so a test can pin its shape.
+let presignKey = (~servedPrefix, ~sub, ~uuid, ~contentType) =>
+  `${servedPrefix}/${sub}/${Reventless.StorageRef.objectName(~uuid, ~contentType)}`
+
 let handlePresign = async (
   ~client: s3Client,
   ~bucket: string,
@@ -221,11 +225,17 @@ let handlePresign = async (
   if sub == "" {
     JsError.throwWithMessage("unauthenticated")
   }
-  let fileName = args.fileName->Option.getOr("upload")
   // The object key doubles as the served path segment: rooted at the store's
   // served prefix so the CloudFront `{prefix}/*` behavior fronts it, and namespaced
   // by the verified `sub` so the release rule can tell one caller's objects apart.
-  let key = `${servedPrefix}/${sub}/${NodeCrypto.randomUUID()}/${fileName}`
+  // The `fileName` argument is not used: the key ends in an opaque name, because a
+  // ref is stored in an event and a file name is often personal data.
+  let key = presignKey(
+    ~servedPrefix,
+    ~sub,
+    ~uuid=NodeCrypto.randomUUID(),
+    ~contentType=args.contentType,
+  )
   // The object is provisional from the moment the bytes land: it carries the
   // pending tag until a committed event referencing it strips it (see
   // `Upload_Claim_S3_Ops`). Written into the signature here, not asked of the

package/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs

@@ -9,6 +9,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as StorageRef$Reventless from "@reventlessdev/reventless-spec/src/semantic/StorageRef.res.mjs";
 import * as S3RequestPresigner from "@aws-sdk/s3-request-presigner";
 import * as Upload_PendingTag$ReventlessAws from "./Upload_PendingTag.res.mjs";
 
@@ -167,12 +168,15 @@ async function headLastModifiedMs(client, bucket, key) {
   }
 }
 
+function presignKey(servedPrefix, sub, uuid, contentType) {
+  return servedPrefix + `/` + sub + `/` + StorageRef$Reventless.objectName(uuid, contentType);
+}
+
 async function handlePresign(client, bucket, servedPrefix, sub, args) {
   if (sub === "") {
     Stdlib_JsError.throwWithMessage("unauthenticated");
   }
-  let fileName = Stdlib_Option.getOr(args.fileName, "upload");
-  let key = servedPrefix + `/` + sub + `/` + Nodecrypto.randomUUID() + `/` + fileName;
+  let key = presignKey(servedPrefix, sub, Nodecrypto.randomUUID(), args.contentType);
   let command = new ClientS3.PutObjectCommand({
     Bucket: bucket,
     Key: key,
@@ -235,6 +239,7 @@ export {
   releaseResult,
   keyOfRef,
   headLastModifiedMs,
+  presignKey,
   handlePresign,
   handleRelease,
   handler,

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -114,7 +114,7 @@ export const handler = async (event) => {
     ["REVENTLESS_CORE_STACK", process.env.STACK_ORG + "/" + process.env.STACK_PROJECT + "/" + process.env.STACK_STACK],
     ["RESTORE_DATE_TIME", event.restoreDateTime],
   ]);
-  console.log("clone: requested by user " + event.meta.user + " from ip " + event.meta.ip);
+  console.log("clone: requested by user " + event.meta.user);
   await client.send(new RunTaskCommand({
     taskDefinition: process.env.TASK_DEFINITION_ARN,
     cluster: process.env.CLUSTER_ARN,
@@ -358,7 +358,6 @@ export function request(ctx) {
     payload: {
       restoreDateTime: ctx.args.restoreDateTime,
       meta: {
-        ip: ctx.identity.sourceIp,
         user: ctx.identity.username
       }
     }

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -67,7 +67,7 @@ export const handler = async (event) => {
     ["REVENTLESS_CORE_STACK", process.env.STACK_ORG + "/" + process.env.STACK_PROJECT + "/" + process.env.STACK_STACK],
     ["RESTORE_DATE_TIME", event.restoreDateTime],
   ]);
-  console.log("clone: requested by user " + event.meta.user + " from ip " + event.meta.ip);
+  console.log("clone: requested by user " + event.meta.user);
   await client.send(new RunTaskCommand({
     taskDefinition: process.env.TASK_DEFINITION_ARN,
     cluster: process.env.CLUSTER_ARN,
@@ -235,7 +235,6 @@ export function request(ctx) {
     payload: {
       restoreDateTime: ctx.args.restoreDateTime,
       meta: {
-        ip: ctx.identity.sourceIp,
         user: ctx.identity.username
       }
     }

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -17,7 +17,7 @@ function tag(key, value) {
 }
 
 function testMeta() {
-  return Message$ReventlessCore.generateMeta("test", undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+  return Message$ReventlessCore.generateMeta("test", undefined, undefined, undefined, undefined, undefined, undefined);
 }
 
 let table = {

package/tests/EventMapperEntryPoint_OpsTest.res

@@ -78,7 +78,7 @@ describe("EventMapperEntryPoint_Ops.makeStreamHandler", () => {
     }
     let command: ReventlessCore.Message.commandJson = {
       id: "prd-1",
-      meta: ReventlessCore.Message.generateMeta(~service="Product", ~ip="", ~user="test"),
+      meta: ReventlessCore.Message.generateMeta(~service="Product", ~user="test"),
       commandJson: JSON.Encode.string("Add"),
     }
     let commonEventsHandler: EventMapperEntryPoint_Ops.commonEventsHandler = async jsons => {

package/tests/EventMapperEntryPoint_OpsTest.res.mjs

@@ -70,7 +70,7 @@ globalThis.describe("EventMapperEntryPoint_Ops.makeStreamHandler", () => {
       publishJsons: ops_publishJsons,
       queryEngine: ops_queryEngine
     };
-    let command_meta = Message$ReventlessCore.generateMeta("Product", "", "test", undefined, undefined, undefined, undefined, undefined);
+    let command_meta = Message$ReventlessCore.generateMeta("Product", "test", undefined, undefined, undefined, undefined, undefined);
     let command = {
       id: "prd-1",
       meta: command_meta,

package/tests/PgChangeFeedRelay_IntegrationTest.res.mjs

@@ -22,7 +22,7 @@ function stored(eventType, tags, data) {
     eventType: eventType,
     data: data,
     tags: tags,
-    meta: Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined, undefined)
+    meta: Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined)
   };
 }
 
@@ -124,7 +124,7 @@ if (url !== undefined) {
           "data",
           data
         ]
-      ].concat(Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined, undefined))));
+      ].concat(Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined))));
       await match[1].append(0, "agg-1", [
         flatItem("agg-1", 0, "NameUpdated", Object.fromEntries([[
             "n",
@@ -155,7 +155,7 @@ if (url !== undefined) {
       let mkOps = name => EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, name, undefined, undefined)[1];
       let opsB = mkOps("ClassicRelayIsoBEventLog");
       let opsA = mkOps("ClassicRelayIsoAEventLog");
-      let meta = () => Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined, undefined));
+      let meta = () => Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta("relay-it", undefined, undefined, undefined, undefined, undefined, undefined));
       let item = (id, eventType) => Object.fromEntries([
         [
           "id",

package/tests/PgPipeline_IntegrationTest.res.mjs

@@ -132,7 +132,7 @@ function flatItem(id, seq, service, event) {
       "data",
       match[1]
     ]
-  ].concat(Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta(service, undefined, undefined, undefined, undefined, undefined, undefined, undefined))));
+  ].concat(Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta(service, undefined, undefined, undefined, undefined, undefined, undefined))));
 }
 
 function asSqsEvent(bodies) {

package/tests/Upload_ReleaseRuleTest.res

@@ -88,3 +88,27 @@ describe("Upload_Presign_S3_Ops.decideRelease", () => {
     )
   )
 })
+
+describe("Upload_Presign_S3_Ops.presignKey", () => {
+  testSync("is {prefix}/{sub}/{uuid}.{ext}, with nothing the uploader typed", () =>
+    expect(
+      Ops.presignKey(~servedPrefix=prefix, ~sub, ~uuid="0b1c", ~contentType=Some("image/png")),
+    )->toEqual("uploads/user-1/0b1c.png")
+  )
+
+  testSync("an undeclared content type is stored as bin", () =>
+    expect(Ops.presignKey(~servedPrefix=prefix, ~sub, ~uuid="0b1c", ~contentType=None))->toEqual(
+      "uploads/user-1/0b1c.bin",
+    )
+  )
+
+  testSync("a minted key passes the release rule's scope check for its own caller", () =>
+    expect(
+      Ops.scopeCheck(
+        ~key=Ops.presignKey(~servedPrefix=prefix, ~sub, ~uuid="0b1c", ~contentType=None),
+        ~sub,
+        ~servedPrefix=prefix,
+      ),
+    )->toEqual(Ok())
+  )
+})

package/tests/Upload_ReleaseRuleTest.res.mjs

@@ -89,6 +89,21 @@ globalThis.describe("Upload_Presign_S3_Ops.decideRelease", () => {
   });
 });
 
+globalThis.describe("Upload_Presign_S3_Ops.presignKey", () => {
+  globalThis.test("is {prefix}/{sub}/{uuid}.{ext}, with nothing the uploader typed", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.presignKey(prefix, sub, "0b1c", "image/png")).toEqual("uploads/user-1/0b1c.png");
+  });
+  globalThis.test("an undeclared content type is stored as bin", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.presignKey(prefix, sub, "0b1c", undefined)).toEqual("uploads/user-1/0b1c.bin");
+  });
+  globalThis.test("a minted key passes the release rule's scope check for its own caller", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.scopeCheck(Upload_Presign_S3_Ops$ReventlessAws.presignKey(prefix, sub, "0b1c", undefined), sub, prefix)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+});
+
 let Ops;
 
 let nowMs = 1000000.0;

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res.mjs

@@ -13,7 +13,7 @@ function tag(key, value) {
 }
 
 function meta() {
-  return Message$ReventlessCore.generateMeta("dcb-it", undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+  return Message$ReventlessCore.generateMeta("dcb-it", undefined, undefined, undefined, undefined, undefined, undefined);
 }
 
 function event(eventType, tags) {