@reventlessdev/reventless-core 3.0.0-alpha.253 → 3.0.0-alpha.254

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.254 (2026-09-02)
+
+* feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))
+### Features
+
+* **dcb:** a boundary that cannot derive its scope says so ([db79969](https://github.com/ReventlessDev/reventless-core/commit/db79969df36bd90607425f6a22b4624227cfc4a0))
+
+### BREAKING CHANGES
+
+* `Capability_Messaging_Ses.make` is replaced by
+`Capability_Messaging.make(~name)`, which reads the transport and the address
+from config; the SES module keeps only `emailSender`. A deployment that named its
+sender in code must move it to `platform:messagingEmailSender` or the deploy is
+refused.
+
+
+
 # 3.0.0-alpha.253 (2026-09-01)
 
 **Note:** Version bump only for package @reventlessdev/reventless-core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.253",
+  "version": "3.0.0-alpha.254",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,17 +28,17 @@
   "dependencies": {
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.154",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.34",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.126",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.155",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.127",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.34"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Messaging/Messaging_Log_Backend.res

@@ -0,0 +1,98 @@
+// A logging messaging transport: accepts every message, delivers none, prints
+// each one to the log.
+//
+// Provider-neutral and therefore here rather than beside either platform's own
+// transport: both use it, and two copies would drift into two different ideas of
+// what a logged send looks like. It is the counterpart to
+// `Messaging_Ses_Backend` and deliberately the same shape — `channels` derived
+// from the sender, `send` answering the shared `Messaging` vocabulary, `provider`
+// closing over the sender. A slice reaches it through the injected capability
+// record and cannot tell which one it got, which is the property that makes
+// running a shop against it worth anything.
+//
+// **Accepting is the honest answer here, not a shortcut.** The alternative is
+// `Capabilities.none`, which reports `Unavailable` — a *retryable* outage, so
+// every notification is retried three times and then recorded as failed. A
+// delivery view that is all failures teaches the wrong thing about a competency
+// that works. Nothing leaves the process either way; the difference is only
+// whether the outcome tells the truth about the domain.
+//
+// It refuses nothing a real provider would refuse, and that is the tradeoff to
+// know: SES rejects a message with no subject, this does not, so a bug of that
+// shape is caught on the real transport and not here.
+//
+// Runtime-pure: no Pulumi import, so it can be bundled into a Lambda entry point
+// without dragging deploy-time modules into the cold-start graph.
+
+let log = Logger.fromEnv()
+
+/** Logged messages are numbered rather than given a random id: someone reading two
+    log lines wants to know they are two messages, and a counter says so at a
+    glance where a uuid does not. Per process, like the transport itself. */
+let sent = ref(0)
+
+/**
+The channels this transport can attempt.
+
+Derived from the sender exactly as SES derives it, so a platform that chose this
+transport but named no address publishes the same empty list an unprovisioned
+deployment does. SMS and push are absent for the same reason they are absent
+there — no transport — and answer `UnsupportedChannel`, which is settled rather
+than retried.
+*/
+let channels = (~sender: string): array<Reventless.Messaging.channel> =>
+  sender == "" ? [] : [Email]
+
+/** The message as it would have gone out, headers and all.
+
+    The whole point of the transport: someone checking that a notification says the
+    right thing needs the words, not a line saying words were sent. Rendered as
+    one record rather than a line per header so two concurrent sends cannot
+    interleave into one unreadable message. */
+let render = (
+  ~ref_: string,
+  ~sender: string,
+  ~to_: string,
+  ~message: Reventless.Messaging.message,
+) =>
+  [
+    `${ref_} — logged, not sent`,
+    `  From:    ${sender}`,
+    `  To:      ${to_}`,
+    `  Subject: ${message.subject->Option.getOr("(none)")}`,
+    "",
+    message.body,
+  ]->Array.join("\n")
+
+/** Accept the message, print it, deliver nothing. */
+let send = async (
+  ~sender: string,
+  ~recipient: Reventless.Messaging.recipient,
+  ~message: Reventless.Messaging.message,
+): result<Reventless.Messaging.receipt, Reventless.Messaging.failure> =>
+  switch recipient {
+  | ToSms(_) => Error(UnsupportedChannel(Sms))
+  | ToPush(_) => Error(UnsupportedChannel(Push))
+  | ToEmail(address) =>
+    if sender == "" {
+      // The wording an unprovisioned platform gave before this transport existed.
+      // It is what lands in the delivery view's `detail`, and a platform that
+      // provisions nothing should still read the way it always did.
+      Error(Unavailable("no messaging provider is configured for this platform"))
+    } else {
+      sent := sent.contents + 1
+      let ref_ = `log:${sent.contents->Int.toString}`
+      log.info(
+        ~comp="Messaging:Log",
+        render(~ref_, ~sender, ~to_=address->Reventless.Email.toString, ~message),
+      )
+      Ok({ref: ref_})
+    }
+  }
+
+/** The port, closed over the sender this platform was given. What a platform's
+    capability record carries when logging is the chosen transport. */
+let provider = (~sender: string): Reventless.Messaging.provider => {
+  channels: channels(~sender),
+  send: (~recipient, ~message) => send(~sender, ~recipient, ~message),
+}

package/src/adapter/Messaging/Messaging_Log_Backend.res.mjs

@@ -0,0 +1,86 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let sent = {
+  contents: 0
+};
+
+function channels(sender) {
+  if (sender === "") {
+    return [];
+  } else {
+    return ["Email"];
+  }
+}
+
+function render(ref_, sender, to_, message) {
+  return [
+    ref_ + ` — logged, not sent`,
+    `  From:    ` + sender,
+    `  To:      ` + to_,
+    `  Subject: ` + Stdlib_Option.getOr(message.subject, "(none)"),
+    "",
+    message.body
+  ].join("\n");
+}
+
+async function send(sender, recipient, message) {
+  switch (recipient.TAG) {
+    case "ToEmail" :
+      if (sender === "") {
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Unavailable",
+            _0: "no messaging provider is configured for this platform"
+          }
+        };
+      }
+      sent.contents = sent.contents + 1 | 0;
+      let ref_ = `log:` + sent.contents.toString();
+      log.info("Messaging:Log", undefined, render(ref_, sender, recipient._0, message));
+      return {
+        TAG: "Ok",
+        _0: {
+          ref: ref_
+        }
+      };
+    case "ToSms" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Sms"
+        }
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Push"
+        }
+      };
+  }
+}
+
+function provider(sender) {
+  return {
+    channels: channels(sender),
+    send: (recipient, message) => send(sender, recipient, message)
+  };
+}
+
+export {
+  log,
+  sent,
+  channels,
+  render,
+  send,
+  provider,
+}
+/* log Not a pure module */

package/src/components/Dcb/Dcb_Builder.res

@@ -379,10 +379,7 @@ module Make = (
         // (DcbCommandTopicEntryPoint.mjs) route through `DcbTag.deriveEffectiveScope`
         // so the runtime decision query cannot drift from this scope — see
         // docs/analysis/dcb-runtime-scope-annotation-drift.md.
-        let {
-          crossPartitionTagKeys: effectiveCrossPartitionTagKeys,
-          tagKeysByEventType: effectiveTagKeysByEventType,
-        } = Reventless.DcbTag.deriveEffectiveScope(
+        let effective = Reventless.DcbTag.deriveEffectiveScope(
           stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) => {
             Reventless.DcbTag.name: Sc.Spec.name,
             commandSchema: Sc.Spec.commandSchema->S.castToUnknown,
@@ -390,6 +387,26 @@ module Make = (
             eventSchema: Sc.Spec.eventSchema->S.castToUnknown,
           }),
         )
+        let effectiveCrossPartitionTagKeys = effective.crossPartitionTagKeys
+        let effectiveTagKeysByEventType = effective.tagKeysByEventType
+
+        // An ambiguity is a warning above because a boundary can fall back and
+        // lose nothing. Losing a cross-partition key is not that: the decision
+        // read for every slice that references another entity silently narrows to
+        // its own partition, so it decides against an empty history and rejects a
+        // command whose facts are sitting in the log. Nothing downstream fails —
+        // the wrong answer *is* the failure — so this is the only place it can be
+        // said, and it is said at error level naming the slice to fix.
+        if effective.droppedCrossPartitionTagKeys->Array.length > 0 {
+          log.error(
+            ~comp="Dcb_Builder",
+            `DCB scope degraded (${name}): cross-partition reads of [${effective.droppedCrossPartitionTagKeys->Array.join(
+                ", ",
+              )}] were derived but dropped — an ambiguous slice forced the boundary onto @crossPartition annotations that do not carry them. Slices referencing another entity by these keys will decide against an empty history and reject valid commands. Resolve: ${effective.ambiguities
+              ->Array.map(((slice, reason)) => `${slice} (${reason})`)
+              ->Array.join(" | ")}`,
+          )
+        }
 
         module DcbEventLog = DcbEventLog_Builder.Make(
           DcbEventLogStorage,

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -231,14 +231,17 @@ function Make(DcbEventLogStorage) {
       let scopeIssues = DcbValidation$Reventless.validateScopeVsInference(scopeAnnotations, inferred);
       scopeIssues.contradictions.forEach(e => log.warn("Dcb_Builder", undefined, `DCB scope contradiction (` + e.sliceName + `): ` + e.message));
       scopeIssues.redundancies.forEach(e => log.info("Dcb_Builder", undefined, `DCB scope (` + e.sliceName + `): ` + e.message));
-      let match = DcbTag$Reventless.deriveEffectiveScope(stateChangeSlices.map(Sc => ({
+      let effective = DcbTag$Reventless.deriveEffectiveScope(stateChangeSlices.map(Sc => ({
         name: Sc.Spec.name,
         commandSchema: Sc.Spec.commandSchema,
         consumedEventSchema: Sc.Spec.consumedEventSchema,
         eventSchema: Sc.Spec.eventSchema
       })));
-      let effectiveTagKeysByEventType = match.tagKeysByEventType;
-      let effectiveCrossPartitionTagKeys = match.crossPartitionTagKeys;
+      let effectiveCrossPartitionTagKeys = effective.crossPartitionTagKeys;
+      let effectiveTagKeysByEventType = effective.tagKeysByEventType;
+      if (effective.droppedCrossPartitionTagKeys.length !== 0) {
+        log.error("Dcb_Builder", undefined, `DCB scope degraded (` + name + `): cross-partition reads of [` + effective.droppedCrossPartitionTagKeys.join(", ") + `] were derived but dropped — an ambiguous slice forced the boundary onto @crossPartition annotations that do not carry them. Slices referencing another entity by these keys will decide against an empty history and reject valid commands. Resolve: ` + effective.ambiguities.map(param => param[0] + ` (` + param[1] + `)`).join(" | "));
+      }
       let DcbEventLog = DcbEventLog_Builder$ReventlessCore.Make(DcbEventLogStorage)(DcbEventTopicPublisher);
       let dcbEventLog = DcbEventLog.make(name, indexes$1, partitionTag, effectiveCrossPartitionTagKeys, opts);
       Stdlib_Option.forEach(HooksConfig.hooks.onDcbEventLogCreated, hook => hook(dcbEventLog));