@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.45 → 2.4.0-alpha.47

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.47 (2026-07-08)
+
+### Bug Fixes
+
+* **reventless-aws:** exclude internal rows from Platform_Plugins connection scan ([df14af2](https://github.com/ReventlessDev/reventless-core/commit/df14af2cbd70d49062f2afc03418cdbf18d151d6))
+
+
+# 2.4.0-alpha.46 (2026-07-06)
+
+### Features
+
+* **rescript-pulumi-aws:** add subnetIds to EC2_VpcEndpoint binding ([77fb606](https://github.com/ReventlessDev/reventless-core/commit/77fb6069d76b8026c7c12db433e5f6717b037d39))
+* **reventless-aws:** deploy-time Postgres schema provisioning via in-VPC migration Lambda (A3) ([44c8eee](https://github.com/ReventlessDev/reventless-core/commit/44c8eeebd351e883f2d2e21460108e2963a061ce))
+
+
 # 2.4.0-alpha.45 (2026-07-05)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.45",
+  "version": "2.4.0-alpha.47",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -430,7 +430,21 @@ let listAllItemsConnection = (
   ~filterFields: array<string>=[],
   ~rangeFields: array<string>=[],
   ~sortFields: array<string>=[],
+  // When set, emit an always-on `attribute_exists(#<attr>)` FilterExpression clause
+  // (ANDed with any client filters) so rows lacking that attribute never enter the
+  // Connection. Used for read models whose physical DynamoDB table co-hosts internal
+  // bookkeeping rows written outside the projection (e.g. the Plugins admin RM, whose
+  // table also holds `deploy-schema:*` / `plugin-info:*` rows with no `name`). Those
+  // rows would otherwise resolve `name`/`status`/`version` to null and violate the
+  // non-null GraphQL connection schema, nulling the whole connection.
+  ~requireAttribute: option<string>=?,
 ) => {
+  let requireAttributeClause = switch requireAttribute {
+  | Some(attr) => `
+  names['#${attr}'] = '${attr}';
+  parts.push('attribute_exists(#${attr})');`
+  | None => ""
+  }
   let filterClauses =
     filterFields
     ->Array.map(f => `
@@ -514,7 +528,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }${filterClauses}${rangeClauses}
+  }${filterClauses}${rangeClauses}${requireAttributeClause}
   const req = {
     operation: 'Scan',
     limit: (ctx.args.first ?? 50),

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -360,10 +360,13 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt) {
+function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute) {
   let filterFields = filterFieldsOpt !== undefined ? filterFieldsOpt : [];
   let rangeFields = rangeFieldsOpt !== undefined ? rangeFieldsOpt : [];
   let sortFields = sortFieldsOpt !== undefined ? sortFieldsOpt : [];
+  let requireAttributeClause = requireAttribute !== undefined ? `
+  names['#` + requireAttribute + `'] = '` + requireAttribute + `';
+  parts.push('attribute_exists(#` + requireAttribute + `)');` : "";
   let filterClauses = filterFields.map(f => `
   if (filter.` + f + `Eq !== undefined && filter.` + f + `Eq !== null && filter.` + f + `Eq !== '') {
     names['#` + f + `'] = '` + f + `';
@@ -427,7 +430,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }` + filterClauses + rangeClauses + `
+  }` + filterClauses + rangeClauses + requireAttributeClause + `
   const req = {
     operation: 'Scan',
     limit: (ctx.args.first ?? 50),

package/src/EC2/EC2_VpcEndpoint.res

@@ -11,6 +11,9 @@ type args = {
   /** routeTableIds are only relevant if endpointType = Gateway */
   routeTableIds?: array<Pulumi.Input.t<string>>,
   securityGroupIds?: array<Pulumi.Input.t<string>>,
+  /** Subnets the Interface endpoint's ENIs are placed in (one per AZ). Required
+    for `Interface` endpoints; ignored for `Gateway`. */
+  subnetIds?: array<Pulumi.Input.t<string>>,
   serviceName: Pulumi.Input.t<string>,
   tags?: Aws.tags,
   /** Default: Gateway */
@@ -33,6 +36,7 @@ let make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?)
       policy: ?args.policy,
       privateDnsEnabled: ?args.privateDnsEnabled,
       securityGroupIds: ?args.securityGroupIds,
+      subnetIds: ?args.subnetIds,
       serviceName: args.serviceName,
       tags: args.tags->EC2_Common.supplementTagsWithName(name),
       vpcEndpointType: ?args.vpcEndpointType,

package/src/EC2/EC2_VpcEndpoint.res.mjs

@@ -9,6 +9,7 @@ function make(name, args, opts) {
     policy: args.policy,
     privateDnsEnabled: args.privateDnsEnabled,
     securityGroupIds: args.securityGroupIds,
+    subnetIds: args.subnetIds,
     serviceName: args.serviceName,
     tags: EC2_Common$PulumiAws.supplementTagsWithName(args.tags, name),
     vpcEndpointType: args.vpcEndpointType,

package/src/Lambda/Lambda.res

@@ -268,6 +268,32 @@ module Permission = {
     "Permission"
 }
 
+module Invocation = {
+  /** `aws.lambda.Invocation` — invokes the function **during `pulumi up`** (a
+    data-plane action, not a control-plane resource) and re-invokes whenever
+    `input` or `triggers` change. Used for one-shot deploy-time work such as
+    running a schema migration from inside the target VPC, so the deploy runner
+    itself needs no network path to the private resource. */
+  type args = {
+    functionName: Pulumi.Input.t<string>,
+    /** JSON string passed as the Lambda event payload. */
+    input: Pulumi.Input.t<string>,
+    /** Optional map whose changes force a re-invocation independently of `input`. */
+    triggers?: Pulumi.Input.t<dict<string>>,
+    qualifier?: Pulumi.Input.t<string>,
+  }
+
+  type t = {
+    id: Pulumi.Output.t<string>,
+    /** The function's JSON response, as a string. */
+    result: Pulumi.Output.t<string>,
+  }
+
+  @module("@pulumi/aws") @scope("lambda") @new
+  external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+    "Invocation"
+}
+
 let defaultLoggingPolicyDocument = PolicyDocument.make(
   ~statements=[
     {

package/src/Lambda/Lambda.res.mjs

@@ -72,6 +72,8 @@ let $$Function = {};
 
 let Permission = {};
 
+let Invocation = {};
+
 let defaultLoggingPolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
     Sid: "DefaultLambdaLoggingPolicy",
     Effect: "Allow",
@@ -89,6 +91,7 @@ export {
   CallbackFunction,
   $$Function,
   Permission,
+  Invocation,
   defaultLoggingPolicyDocument,
 }
 /* arn Not a pure module */