@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.44 → 2.4.0-alpha.46

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.46 (2026-07-06)
+
+### Features
+
+* **rescript-pulumi-aws:** add subnetIds to EC2_VpcEndpoint binding ([77fb606](https://github.com/ReventlessDev/reventless-core/commit/77fb6069d76b8026c7c12db433e5f6717b037d39))
+* **reventless-aws:** deploy-time Postgres schema provisioning via in-VPC migration Lambda (A3) ([44c8eee](https://github.com/ReventlessDev/reventless-core/commit/44c8eeebd351e883f2d2e21460108e2963a061ce))
+
+
+# 2.4.0-alpha.45 (2026-07-05)
+
+### Features
+
+* **rescript-pulumi-aws:** add RDS, Secrets Manager, and Lambda VPC bindings ([9b4fb3d](https://github.com/ReventlessDev/reventless-core/commit/9b4fb3d0b4173cc6f645a903801e59901dbbdeb2))
+* **reventless-aws:** add PgConnection component + wire reventless-postgres dep ([a403a62](https://github.com/ReventlessDev/reventless-core/commit/a403a6292381513cfe679a2f7a967fda0ab00c0e))
+
+
 # 2.4.0-alpha.44 (2026-06-27)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.44",
+  "version": "2.4.0-alpha.46",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {

package/src/EC2/EC2_SecurityGroup.res

@@ -4,7 +4,18 @@
 type t = {id: Pulumi.Output.t<string>}
 
 module Ingress = {
-  type t = {fromPort: int, protocol: string, toPort: int, cidrBlocks: array<string>}
+  type t = {
+    fromPort: int,
+    protocol: string,
+    toPort: int,
+    cidrBlocks: array<string>,
+    /** Allow traffic from other members of this same security group. The
+      idiomatic RDS+Lambda pattern: the DB and its client Lambdas share one SG
+      and this rule lets them reach the DB port without a separate client SG. */
+    self?: bool,
+    /** Allow traffic from the given source security group IDs. */
+    securityGroups?: array<Pulumi.Input.t<string>>,
+  }
   let allowAll = {fromPort: 0, protocol: "-1", toPort: 0, cidrBlocks: ["0.0.0.0/0"]}
 }
 

package/src/EC2/EC2_VpcEndpoint.res

@@ -11,6 +11,9 @@ type args = {
   /** routeTableIds are only relevant if endpointType = Gateway */
   routeTableIds?: array<Pulumi.Input.t<string>>,
   securityGroupIds?: array<Pulumi.Input.t<string>>,
+  /** Subnets the Interface endpoint's ENIs are placed in (one per AZ). Required
+    for `Interface` endpoints; ignored for `Gateway`. */
+  subnetIds?: array<Pulumi.Input.t<string>>,
   serviceName: Pulumi.Input.t<string>,
   tags?: Aws.tags,
   /** Default: Gateway */
@@ -33,6 +36,7 @@ let make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?)
       policy: ?args.policy,
       privateDnsEnabled: ?args.privateDnsEnabled,
       securityGroupIds: ?args.securityGroupIds,
+      subnetIds: ?args.subnetIds,
       serviceName: args.serviceName,
       tags: args.tags->EC2_Common.supplementTagsWithName(name),
       vpcEndpointType: ?args.vpcEndpointType,

package/src/EC2/EC2_VpcEndpoint.res.mjs

@@ -9,6 +9,7 @@ function make(name, args, opts) {
     policy: args.policy,
     privateDnsEnabled: args.privateDnsEnabled,
     securityGroupIds: args.securityGroupIds,
+    subnetIds: args.subnetIds,
     serviceName: args.serviceName,
     tags: EC2_Common$PulumiAws.supplementTagsWithName(args.tags, name),
     vpcEndpointType: args.vpcEndpointType,

package/src/Lambda/Lambda.res

@@ -206,6 +206,15 @@ module Function = {
 
   type ephemeralStorage = {size: Pulumi.Input.t<int>}
 
+  /** Places the function inside a VPC so it can reach private resources such as
+    RDS/Aurora. Adds ENIs to the given subnets and attaches the security
+    groups; the execution role then needs `ec2:CreateNetworkInterface`,
+    `ec2:DescribeNetworkInterfaces`, `ec2:DeleteNetworkInterface`. */
+  type vpcConfig = {
+    subnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+    securityGroupIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  }
+
   type args = {
     handler?: Pulumi.Input.t<string>,
     runtime?: Pulumi.Input.t<string>,
@@ -219,6 +228,7 @@ module Function = {
     sourceCodeHash?: Pulumi.Input.t<string>,
     reservedConcurrentExecutions?: Pulumi.Input.t<int>,
     ephemeralStorage?: Pulumi.Input.t<ephemeralStorage>,
+    vpcConfig?: Pulumi.Input.t<vpcConfig>,
   }
 
   type t = {
@@ -258,6 +268,32 @@ module Permission = {
     "Permission"
 }
 
+module Invocation = {
+  /** `aws.lambda.Invocation` — invokes the function **during `pulumi up`** (a
+    data-plane action, not a control-plane resource) and re-invokes whenever
+    `input` or `triggers` change. Used for one-shot deploy-time work such as
+    running a schema migration from inside the target VPC, so the deploy runner
+    itself needs no network path to the private resource. */
+  type args = {
+    functionName: Pulumi.Input.t<string>,
+    /** JSON string passed as the Lambda event payload. */
+    input: Pulumi.Input.t<string>,
+    /** Optional map whose changes force a re-invocation independently of `input`. */
+    triggers?: Pulumi.Input.t<dict<string>>,
+    qualifier?: Pulumi.Input.t<string>,
+  }
+
+  type t = {
+    id: Pulumi.Output.t<string>,
+    /** The function's JSON response, as a string. */
+    result: Pulumi.Output.t<string>,
+  }
+
+  @module("@pulumi/aws") @scope("lambda") @new
+  external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+    "Invocation"
+}
+
 let defaultLoggingPolicyDocument = PolicyDocument.make(
   ~statements=[
     {

package/src/Lambda/Lambda.res.mjs

@@ -72,6 +72,8 @@ let $$Function = {};
 
 let Permission = {};
 
+let Invocation = {};
+
 let defaultLoggingPolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
     Sid: "DefaultLambdaLoggingPolicy",
     Effect: "Allow",
@@ -89,6 +91,7 @@ export {
   CallbackFunction,
   $$Function,
   Permission,
+  Invocation,
   defaultLoggingPolicyDocument,
 }
 /* arn Not a pure module */

package/src/Rds/Rds.res

@@ -0,0 +1,8 @@
+/** @pulumi/aws/rds
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds
+*/
+module Instance = Rds_Instance
+module Cluster = Rds_Cluster
+module ClusterInstance = Rds_ClusterInstance
+module SubnetGroup = Rds_SubnetGroup
+module Proxy = Rds_Proxy

package/src/Rds/Rds.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let Instance;
+
+let Cluster;
+
+let ClusterInstance;
+
+let SubnetGroup;
+
+let $$Proxy;
+
+export {
+  Instance,
+  Cluster,
+  ClusterInstance,
+  SubnetGroup,
+  $$Proxy,
+}
+/* No side effect */

package/src/Rds/Rds_Cluster.res

@@ -0,0 +1,59 @@
+/** @pulumi/aws/rds/cluster
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/cluster
+
+  Aurora (incl. Aurora Serverless v2) Postgres cluster. Pair with one or more
+  `Rds_ClusterInstance` — a cluster has no compute of its own.
+*/
+
+/** See `Rds_Instance.masterUserSecret`. */
+type masterUserSecret = {
+  kmsKeyId: string,
+  secretArn: string,
+  secretStatus: string,
+}
+
+/** Aurora Serverless v2 autoscaling bounds, in ACUs (0.5-increment floats). */
+type serverlessv2ScalingConfiguration = {
+  maxCapacity: float,
+  minCapacity: float,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  clusterIdentifier: Pulumi.Output.t<string>,
+  /** Writer endpoint hostname. */
+  endpoint: Pulumi.Output.t<string>,
+  /** Load-balanced reader endpoint hostname. */
+  readerEndpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+  databaseName: Pulumi.Output.t<string>,
+  masterUsername: Pulumi.Output.t<string>,
+  masterUserSecrets: Pulumi.Output.t<array<masterUserSecret>>,
+}
+
+type args = {
+  engine: Pulumi.Input.t<string>,
+  engineMode?: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  clusterIdentifier?: Pulumi.Input.t<string>,
+  databaseName?: Pulumi.Input.t<string>,
+  masterUsername?: Pulumi.Input.t<string>,
+  masterPassword?: Pulumi.Input.t<string>,
+  manageMasterUserPassword?: Pulumi.Input.t<bool>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  port?: Pulumi.Input.t<int>,
+  serverlessv2ScalingConfiguration?: Pulumi.Input.t<serverlessv2ScalingConfiguration>,
+  storageEncrypted?: Pulumi.Input.t<bool>,
+  backupRetentionPeriod?: Pulumi.Input.t<int>,
+  deletionProtection?: Pulumi.Input.t<bool>,
+  skipFinalSnapshot?: Pulumi.Input.t<bool>,
+  finalSnapshotIdentifier?: Pulumi.Input.t<string>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Cluster"

package/src/Rds/Rds_Cluster.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_ClusterInstance.res

@@ -0,0 +1,29 @@
+/** @pulumi/aws/rds/clusterinstance
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/clusterinstance
+
+  A compute node attached to an `Rds_Cluster`. Use `instanceClass =
+  "db.serverless"` for Aurora Serverless v2.
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** This node's own endpoint hostname (prefer the cluster writer endpoint). */
+  endpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+}
+
+type args = {
+  clusterIdentifier: Pulumi.Input.t<string>,
+  instanceClass: Pulumi.Input.t<string>,
+  engine: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  identifier?: Pulumi.Input.t<string>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  publiclyAccessible?: Pulumi.Input.t<bool>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "ClusterInstance"

package/src/Rds/Rds_ClusterInstance.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_Instance.res

@@ -0,0 +1,59 @@
+/** @pulumi/aws/rds/instance
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance
+*/
+
+/** One entry of `masterUserSecrets`, populated when `manageMasterUserPassword`
+  is true — RDS creates and rotates the master password in Secrets Manager and
+  reports the secret ARN here. */
+type masterUserSecret = {
+  kmsKeyId: string,
+  secretArn: string,
+  secretStatus: string,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** Hostname of the instance (no port). */
+  address: Pulumi.Output.t<string>,
+  /** `address:port`. */
+  endpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+  dbName: Pulumi.Output.t<string>,
+  username: Pulumi.Output.t<string>,
+  /** Present when `manageMasterUserPassword=true`. */
+  masterUserSecrets: Pulumi.Output.t<array<masterUserSecret>>,
+}
+
+type args = {
+  allocatedStorage?: Pulumi.Input.t<int>,
+  maxAllocatedStorage?: Pulumi.Input.t<int>,
+  engine: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  instanceClass: Pulumi.Input.t<string>,
+  /** Name of the initial database created inside the instance. */
+  dbName?: Pulumi.Input.t<string>,
+  identifier?: Pulumi.Input.t<string>,
+  username?: Pulumi.Input.t<string>,
+  password?: Pulumi.Input.t<string>,
+  /** Let RDS manage the master password in Secrets Manager (mutually
+    exclusive with `password`). Secret ARN surfaces on `masterUserSecrets`. */
+  manageMasterUserPassword?: Pulumi.Input.t<bool>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  port?: Pulumi.Input.t<int>,
+  multiAz?: Pulumi.Input.t<bool>,
+  publiclyAccessible?: Pulumi.Input.t<bool>,
+  storageEncrypted?: Pulumi.Input.t<bool>,
+  backupRetentionPeriod?: Pulumi.Input.t<int>,
+  deletionProtection?: Pulumi.Input.t<bool>,
+  skipFinalSnapshot?: Pulumi.Input.t<bool>,
+  finalSnapshotIdentifier?: Pulumi.Input.t<string>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  parameterGroupName?: Pulumi.Input.t<string>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Instance"

package/src/Rds/Rds_Instance.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_Proxy.res

@@ -0,0 +1,38 @@
+/** @pulumi/aws/rds/proxy
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/proxy
+
+  RDS Proxy multiplexes many Lambda-container connections onto a small pool of
+  DB connections. At Lambda fan-out scale this is the recommended fronting for
+  RDS/Aurora; pair with the `#RowLocks` DCB strategy (advisory locks pin
+  connections and defeat the proxy — see the AWS-deployment guide).
+*/
+type auth = {
+  authScheme?: string,
+  iamAuth?: string,
+  secretArn?: Pulumi.Input.t<string>,
+  description?: string,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** Proxy endpoint hostname — Lambdas connect here instead of the DB. */
+  endpoint: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  engineFamily: Pulumi.Input.t<string>,
+  auths: Pulumi.Input.t<array<Pulumi.Input.t<auth>>>,
+  roleArn: Pulumi.Input.t<string>,
+  vpcSubnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  requireTls?: Pulumi.Input.t<bool>,
+  idleClientTimeout?: Pulumi.Input.t<int>,
+  debugLogging?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Proxy"

package/src/Rds/Rds_Proxy.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_SubnetGroup.res

@@ -0,0 +1,18 @@
+/** @pulumi/aws/rds/subnetgroup
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/subnetgroup
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  name: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  subnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "SubnetGroup"

package/src/Rds/Rds_SubnetGroup.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/SecretsManager/SecretsManager.res

@@ -0,0 +1,6 @@
+/** @pulumi/aws/secretsmanager
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager
+*/
+module Secret = SecretsManager_Secret
+module SecretVersion = SecretsManager_SecretVersion
+module GetSecretVersion = GetSecretVersion

package/src/SecretsManager/SecretsManager.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let Secret;
+
+let SecretVersion;
+
+let GetSecretVersion;
+
+export {
+  Secret,
+  SecretVersion,
+  GetSecretVersion,
+}
+/* No side effect */

package/src/SecretsManager/SecretsManager_Secret.res

@@ -0,0 +1,23 @@
+/** @pulumi/aws/secretsmanager/secret
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secret
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  name: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  namePrefix?: Pulumi.Input.t<string>,
+  description?: Pulumi.Input.t<string>,
+  kmsKeyId?: Pulumi.Input.t<string>,
+  /** Days before a deleted secret is irrecoverably purged. Set `0` to delete
+    immediately (handy for throwaway CI/dev stacks). */
+  recoveryWindowInDays?: Pulumi.Input.t<int>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("secretsmanager") @new
+external make: (~name: string, ~args: args=?, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Secret"

package/src/SecretsManager/SecretsManager_Secret.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/SecretsManager/SecretsManager_SecretVersion.res

@@ -0,0 +1,21 @@
+/** @pulumi/aws/secretsmanager/secretversion
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secretversion
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  versionId: Pulumi.Output.t<string>,
+}
+
+type args = {
+  secretId: Pulumi.Input.t<string>,
+  /** Plaintext secret payload (typically a JSON connection blob). Prefer
+    `secretString` over `secretBinary`. */
+  secretString?: Pulumi.Input.t<string>,
+  secretBinary?: Pulumi.Input.t<string>,
+  versionStages?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+}
+
+@module("@pulumi/aws") @scope("secretsmanager") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "SecretVersion"

package/src/SecretsManager/SecretsManager_SecretVersion.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */