@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.13 → 3.0.0-alpha.15

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.15 (2026-09-21)
+
+### Bug Fixes
+
+* **deps:** update rescript to 12.3.1 ([ea1ce37](https://github.com/ReventlessDev/reventless-core/commit/ea1ce377297640f6d0d360e6c84c778d59ecbcc5))
+* **deps:** update sury to 11.0.0 ([8715b22](https://github.com/ReventlessDev/reventless-core/commit/8715b22b33856c46ba57518aad151065c123a995))
+
+
+# 3.0.0-alpha.14 (2026-09-16)
+
+* fix(aws)!: stop a deploy that finds no Lambda layer ([62957f4](https://github.com/ReventlessDev/reventless-core/commit/62957f444ab2120f672b9ac0564f786d64090864))
+
+### BREAKING CHANGES
+
+* PulumiAws.Lambda.reventlessLayerArn is now a function that
+returns the ARN and throws when there is none. Use Lambda.reventlessLayers()
+for a function's layers argument.
+
+
+
 # 3.0.0-alpha.13 (2026-09-11)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "3.0.0-alpha.13",
+  "version": "3.0.0-alpha.15",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -21,17 +21,18 @@
   "dependencies": {
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
-    "sury": "11.0.0-rc.2",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.18",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.20"
+    "sury": "11.0.0",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.20",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.13"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",
-    "rescript": "12.3.0",
-    "sury-ppx": "11.0.0-rc.2"
+    "rescript": "12.3.1",
+    "sury-ppx": "11.0.0"
   },
   "peerDependencies": {
-    "rescript": "12.3.0"
+    "rescript": "^12.3.1"
   },
   "gitHead": "ddea51534dc210635d7b11968089627b3b697ce2",
   "publishConfig": {

package/rescript.json

@@ -21,7 +21,8 @@
   "dependencies": [
     "sury",
     "@reventlessdev/rescript-pulumi-pulumi",
-    "@reventlessdev/rescript-aws-sdk"
+    "@reventlessdev/rescript-aws-sdk",
+    "@reventlessdev/rescript-node"
   ],
   "compiler-flags": []
 }

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -977,9 +977,9 @@ export function request(ctx) {
 `;
 }
 
-function resolveIds(idsField, sortField, ownerField, retiredField, retiredValues, $staropt$star) {
+function resolveIds(idsField, sortField, ownerField, retiredField, retiredValues, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
   return tableName => {
-    let elevatedGroups = $staropt$star !== undefined ? $staropt$star : [];
     let keysCode = sortField !== undefined ? `id => ({ id: util.dynamodb.toString(id.id), ` + sortField + `: util.dynamodb.toString(id.` + sortField + `) })` : `id => ({ id: util.dynamodb.toString(id) })`;
     return importUtil + `
 import { runtime } from '@aws-appsync/utils';
@@ -1011,10 +1011,9 @@ export function response(ctx) {
   };
 }
 
-function batchGetItemsByIds(ownerField, retiredField, retiredValues, $staropt$star) {
-  return tableName => {
-    let elevatedGroups = $staropt$star !== undefined ? $staropt$star : [];
-    return importUtil + `
+function batchGetItemsByIds(ownerField, retiredField, retiredValues, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
+  return tableName => importUtil + `
 import { runtime } from '@aws-appsync/utils';
 export function request(ctx) {
   const ids = ctx.args.ids ?? [];
@@ -1039,22 +1038,21 @@ export function response(ctx) {
   // caller does not own is dropped rather than refused, for the reason the
   // single-key door answers null: distinguishing "not yours" from "not there"
   // would make this door an oracle for which ids exist.` + (
-      ownerField !== undefined ? ownerGuardPreamble(ownerField, elevatedGroups) : ""
-    ) + retiredGuardPreamble(retiredField, retiredValues, elevatedGroups, Stdlib_Option.isSome(ownerField)) + `
+    ownerField !== undefined ? ownerGuardPreamble(ownerField, elevatedGroups) : ""
+  ) + retiredGuardPreamble(retiredField, retiredValues, elevatedGroups, Stdlib_Option.isSome(ownerField)) + `
   return (ctx.result?.data?.['` + tableName + `'] ?? []).filter(item =>
     item !== null` + (
-      Stdlib_Option.isSome(ownerField) ? " && _owns(item)" : ""
-    ) + (
-      Stdlib_Option.isSome(retiredField) ? " && _live(item)" : ""
-    ) + `);
+    Stdlib_Option.isSome(ownerField) ? " && _owns(item)" : ""
+  ) + (
+    Stdlib_Option.isSome(retiredField) ? " && _live(item)" : ""
+  ) + `);
 }
 `;
-  };
 }
 
-function refsByIds(labelField, retiredField, retiredValues, namedWhenRetired, imageExpr, ownerField, $staropt$star) {
+function refsByIds(labelField, retiredField, retiredValues, namedWhenRetired, imageExpr, ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
   return tableName => {
-    let elevatedGroups = $staropt$star !== undefined ? $staropt$star : [];
     let ownerGuard = ownerField !== undefined ? ownerGuardPreamble(ownerField, elevatedGroups) : "\n  const _owns = (row) => true;";
     let retiredExpr;
     if (retiredField !== undefined) {

package/src/IAM/PolicyDocument.res

@@ -124,12 +124,12 @@ type t = policy
 
 let toJsonString: t => string = t => {
   t
-  ->S.decodeOrThrow(~from=policySchema, ~to=S.json)
+  ->S.convertOrThrow(~from=policySchema, ~to=S.json)
   ->JSON.stringify(~space=1)
 }
 
 let fromJsonString: string => t = (policyString: string) =>
-  policyString->S.decodeOrThrow(~from=S.jsonString, ~to=policySchema)
+  S.JsonString(policyString)->S.convertOrThrow(~from=S.jsonString, ~to=policySchema)
 
 let make = (~version=Version2012, ~id=?, ~statements) => {
   version,

package/src/IAM/PolicyDocument.res.mjs

@@ -48,7 +48,7 @@ let conditionEntrySchema = Sury.union([
   Sury.$schema(s => (s.m(Sury.array(Sury.string))))
 ]);
 
-let conditionMapSchema = Sury.dict(conditionEntrySchema);
+let conditionMapSchema = Sury.record(conditionEntrySchema);
 
 let conditionSchema = Sury.$schema(s => ({
   StringEquals: s.m(Sury.$option(conditionMapSchema)),
@@ -121,11 +121,11 @@ let policySchema = Sury.$schema(s => ({
 }));
 
 function toJsonString(t) {
-  return JSON.stringify(S.decodeOrThrow(t, policySchema, Sury.json), undefined, 1);
+  return JSON.stringify(S.convertOrThrow(t, policySchema, undefined, Sury.json), undefined, 1);
 }
 
 function fromJsonString(policyString) {
-  return S.decodeOrThrow(policyString, Sury.jsonString, policySchema);
+  return S.convertOrThrow(policyString, Sury.jsonString, undefined, policySchema);
 }
 
 function make(versionOpt, id, statements) {

package/src/Lambda/Lambda.res

@@ -46,53 +46,136 @@ type eventHandlerNoResult<'event> = eventHandler<'event, unit>
 @send
 external getRemainingTimeInMillis: context => int = "getRemainingTimeInMillis"
 
-@val @scope(("process", "env")) external _layerArnEnv: option<string> = "REVENTLESS_LAYER_ARN"
-@val @scope(("process", "env")) external _pulumiNodejsStack: option<string> = "PULUMI_NODEJS_STACK"
-@module("child_process") external _execSync: (string, {..}) => string = "execSync"
-
-// SSM fallback for local `pulumi up`. CI exports `REVENTLESS_LAYER_ARN`
-// directly (deploy-reventless-aws.yml reads `/reventless/layer-arn/{stack}`
-// via the AWS CLI and injects it as an env var); local devs typically don't.
-// When the env var is unset, shell out to the same SSM parameter from the
-// dev's `aws` CLI so local deploys attach the freshest layer automatically.
-//
-// Failures are swallowed (no `aws` on PATH, missing IAM `ssm:GetParameter`,
-// parameter absent, etc.) — Lambdas then deploy without the layer, which is
-// the same outcome as before this fallback existed.
-let _resolveLayerArnFromSsm = (): option<string> =>
-  switch _pulumiNodejsStack {
-  | None | Some("") => None
-  | Some(stack) =>
-    try {
-      let cmd = `aws ssm get-parameter --name /reventless/layer-arn/${stack} --query Parameter.Value --output text 2>/dev/null`
-      let raw = _execSync(cmd, {"encoding": "utf8"})
-      let trimmed = raw->String.trim
-      if trimmed === "" || trimmed === "None" {
-        None
-      } else {
-        Some(trimmed)
-      }
-    } catch {
-    | _ => None
+/** The outcome of looking for the Reventless layer. `region` is `None` when
+    neither the stack nor the environment names one, and the AWS CLI's default
+    region was asked. */
+type layerLookup =
+  | Found(string)
+  | NotFound({parameter: string, region: option<string>})
+  | CouldNotLook({parameter: string, region: option<string>, reason: string})
+
+let layerParameter = stack => `/reventless/layer-arn/${stack}`
+
+let _nonEmpty = value =>
+  switch value->Option.map(String.trim) {
+  | Some("") | None => None
+  | trimmed => trimmed
+  }
+
+let _lookupRegion = () =>
+  switch Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->_nonEmpty {
+  | Some(_) as region => region
+  | None =>
+    switch NodeProcess.env->Dict.get("AWS_REGION")->_nonEmpty {
+    | Some(_) as region => region
+    | None => NodeProcess.env->Dict.get("AWS_DEFAULT_REGION")->_nonEmpty
     }
   }
 
-/**
- * Reventless Lambda layer ARN for the current Pulumi stack.
- *
- * Resolution order:
- *   1. `REVENTLESS_LAYER_ARN` env var — fast path, used by CI
- *      (deploy-reventless-aws.yml reads SSM and exports it).
- *   2. AWS CLI SSM lookup at `/reventless/layer-arn/${PULUMI_NODEJS_STACK}` —
- *      local-deploy convenience so devs don't need to export the env var
- *      manually.
- *   3. `None` when both fail — Lambdas deploy without the layer.
- */
-let reventlessLayerArn: option<string> = switch _layerArnEnv {
-| Some(arn) if arn->String.trim->String.length > 0 => Some(arn->String.trim)
-| _ => _resolveLayerArnFromSsm()
+let _firstLine = text =>
+  text
+  ->String.split("\n")
+  ->Array.map(String.trim)
+  ->Array.find(line => line !== "")
+  ->Option.getOr("the AWS CLI exited without saying why")
+
+/** Reads the result of `aws ssm get-parameter`: only `ParameterNotFound` means
+    there is no layer; a missing CLI or a refused call means nobody could tell. */
+let classifySsmLookup = (
+  ~parameter,
+  ~region,
+  result: NodeChildProcess.spawnSyncResult,
+): layerLookup => {
+  let stderr = result.stderr->Nullable.toOption->Option.getOr("")
+  switch (result.error->Nullable.toOption, result.status->Nullable.toOption) {
+  | (Some(error), _) =>
+    let message = error->JsExn.message->Option.getOr("unknown error")
+    CouldNotLook({parameter, region, reason: `the AWS CLI could not be run (${message})`})
+  | (None, Some(0)) =>
+    switch result.stdout->Nullable.toOption->_nonEmpty {
+    | None | Some("None") => NotFound({parameter, region})
+    | Some(arn) => Found(arn)
+    }
+  | (None, _) if stderr->String.includes("ParameterNotFound") => NotFound({parameter, region})
+  | (None, _) => CouldNotLook({parameter, region, reason: _firstLine(stderr)})
+  }
 }
 
+let _lookupInSsm = (): layerLookup => {
+  let parameter = layerParameter(Pulumi.Pulumi.getStackName())
+  let region = _lookupRegion()
+  let regionArgs = region->Option.mapOr([], region => ["--region", region])
+  NodeChildProcess.spawnSync(
+    "aws",
+    [
+      "ssm",
+      "get-parameter",
+      "--name",
+      parameter,
+      "--query",
+      "Parameter.Value",
+      "--output",
+      "text",
+    ]->Array.concat(regionArgs),
+    {encoding: "utf8"},
+  )->classifySsmLookup(~parameter, ~region, _)
+}
+
+let _lookup: ref<option<layerLookup>> = ref(None)
+
+/** Looks once per deploy: `REVENTLESS_LAYER_ARN` when set (CI exports it),
+    otherwise the stack's SSM parameter through the AWS CLI, in the stack's
+    `aws:region` when it sets one. */
+let lookupLayer = (): layerLookup =>
+  switch _lookup.contents {
+  | Some(lookup) => lookup
+  | None =>
+    let lookup = switch NodeProcess.env->Dict.get("REVENTLESS_LAYER_ARN")->_nonEmpty {
+    | Some(arn) => Found(arn)
+    | None => _lookupInSsm()
+    }
+    _lookup := Some(lookup)
+    lookup
+  }
+
+let _regionName = region =>
+  region->Option.mapOr("the AWS CLI's default region", region => `region ${region}`)
+
+let _publishHint = `Publish the layer and store its ARN in that parameter, or set REVENTLESS_LAYER_ARN: https://docs.reventless.dev/infrastructure/aws/get-started#the-lambda-layer`
+
+/** Why a deploy cannot go on without the layer, or `None` when it was found. */
+let missingLayerMessage = lookup =>
+  switch lookup {
+  | Found(_) => None
+  | NotFound({parameter, region}) =>
+    Some(
+      `No Reventless Lambda layer: the SSM parameter ${parameter} does not exist in ${_regionName(
+          region,
+        )}. Without the layer every function fails with "Cannot find package" on its first run. ${_publishHint}`,
+    )
+  | CouldNotLook({parameter, region, reason}) =>
+    Some(
+      `Could not look up the Reventless Lambda layer in the SSM parameter ${parameter} (${_regionName(
+          region,
+        )}): ${reason}. ${_publishHint}`,
+    )
+  }
+
+/** The layer's ARN. Throws with `missingLayerMessage` when there is none, so a
+    function is never created without the framework code it imports. */
+let reventlessLayerArn = (): string =>
+  switch lookupLayer() {
+  | Found(arn) => arn
+  | lookup =>
+    JsError.throwWithMessage(
+      missingLayerMessage(lookup)->Option.getOr("No Reventless Lambda layer"),
+    )
+  }
+
+/** The `layers` argument of every framework function. */
+let reventlessLayers = (): Pulumi.Input.t<array<Pulumi.Input.t<string>>> =>
+  [reventlessLayerArn()->Pulumi.Input.make]->Pulumi.Input.make
+
 @val
 external environment: option<string> = "process.env.Environment"
 
@@ -150,10 +233,7 @@ module CallbackFunction = {
       ~memorySize=1024->Pulumi.Input.make,
       ~timeout=180->Pulumi.Input.make,
       ~runtime=NodeJs22,
-      ~layers=reventlessLayerArn
-      ->Option.map(arn => [arn->Pulumi.Input.make])
-      ->Option.getOr([])
-      ->Pulumi.Input.make,
+      ~layers=reventlessLayers(),
       ~vpcConfig=?,
       ~tags=?,
       ~environment={

package/src/Lambda/Lambda.res.mjs

@@ -1,43 +1,161 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as Child_process from "child_process";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Nodechild_process from "node:child_process";
 import * as PolicyDocument$PulumiAws from "../IAM/PolicyDocument.res.mjs";
 
-function _resolveLayerArnFromSsm() {
-  let stack = process.env.PULUMI_NODEJS_STACK;
-  if (stack === undefined) {
-    return;
+function layerParameter(stack) {
+  return `/reventless/layer-arn/` + stack;
+}
+
+function _nonEmpty(value) {
+  let trimmed = Stdlib_Option.map(value, prim => prim.trim());
+  if (trimmed !== undefined && trimmed !== "") {
+    return trimmed;
+  }
+}
+
+function _lookupRegion() {
+  let region = _nonEmpty(new Pulumi.Config("aws").get("region"));
+  if (region !== undefined) {
+    return region;
   }
-  if (stack === "") {
-    return;
+  let region$1 = _nonEmpty(process.env["AWS_REGION"]);
+  if (region$1 !== undefined) {
+    return region$1;
+  } else {
+    return _nonEmpty(process.env["AWS_DEFAULT_REGION"]);
   }
-  try {
-    let cmd = `aws ssm get-parameter --name /reventless/layer-arn/` + stack + ` --query Parameter.Value --output text 2>/dev/null`;
-    let raw = Child_process.execSync(cmd, {
-      encoding: "utf8"
-    });
-    let trimmed = raw.trim();
-    if (trimmed === "" || trimmed === "None") {
-      return;
+}
+
+function _firstLine(text) {
+  return Stdlib_Option.getOr(text.split("\n").map(prim => prim.trim()).find(line => line !== ""), "the AWS CLI exited without saying why");
+}
+
+function classifySsmLookup(parameter, region, result) {
+  let stderr = Stdlib_Option.getOr(Primitive_option.fromNullable(result.stderr), "");
+  let match = result.error;
+  let match$1 = result.status;
+  if (match == null) {
+    if (!(match$1 == null) && match$1 === 0) {
+      let arn = _nonEmpty(Primitive_option.fromNullable(result.stdout));
+      if (arn !== undefined && arn !== "None") {
+        return {
+          TAG: "Found",
+          _0: arn
+        };
+      } else {
+        return {
+          TAG: "NotFound",
+          parameter: parameter,
+          region: region
+        };
+      }
+    }
+    if (stderr.includes("ParameterNotFound")) {
+      return {
+        TAG: "NotFound",
+        parameter: parameter,
+        region: region
+      };
     } else {
-      return trimmed;
+      return {
+        TAG: "CouldNotLook",
+        parameter: parameter,
+        region: region,
+        reason: _firstLine(stderr)
+      };
     }
-  } catch (exn) {
-    return;
   }
+  let message = Stdlib_Option.getOr(Stdlib_JsExn.message(match), "unknown error");
+  return {
+    TAG: "CouldNotLook",
+    parameter: parameter,
+    region: region,
+    reason: `the AWS CLI could not be run (` + message + `)`
+  };
 }
 
-let arn = process.env.REVENTLESS_LAYER_ARN;
+function _lookupInSsm() {
+  let parameter = layerParameter(Pulumi.getStack());
+  let region = _lookupRegion();
+  let regionArgs = Stdlib_Option.mapOr(region, [], region => [
+    "--region",
+    region
+  ]);
+  return classifySsmLookup(parameter, region, Nodechild_process.spawnSync("aws", [
+    "ssm",
+    "get-parameter",
+    "--name",
+    parameter,
+    "--query",
+    "Parameter.Value",
+    "--output",
+    "text"
+  ].concat(regionArgs), {
+    encoding: "utf8"
+  }));
+}
 
-let reventlessLayerArn = arn !== undefined && arn.trim().length > 0 ? arn.trim() : _resolveLayerArnFromSsm();
+let _lookup = {
+  contents: undefined
+};
+
+function lookupLayer() {
+  let lookup = _lookup.contents;
+  if (lookup !== undefined) {
+    return lookup;
+  }
+  let arn = _nonEmpty(process.env["REVENTLESS_LAYER_ARN"]);
+  let lookup$1 = arn !== undefined ? ({
+      TAG: "Found",
+      _0: arn
+    }) : _lookupInSsm();
+  _lookup.contents = lookup$1;
+  return lookup$1;
+}
+
+function _regionName(region) {
+  return Stdlib_Option.mapOr(region, "the AWS CLI's default region", region => `region ` + region);
+}
+
+let _publishHint = `Publish the layer and store its ARN in that parameter, or set REVENTLESS_LAYER_ARN: https://docs.reventless.dev/infrastructure/aws/get-started#the-lambda-layer`;
+
+function missingLayerMessage(lookup) {
+  switch (lookup.TAG) {
+    case "Found" :
+      return;
+    case "NotFound" :
+      return `No Reventless Lambda layer: the SSM parameter ` + lookup.parameter + ` does not exist in ` + _regionName(lookup.region) + `. Without the layer every function fails with "Cannot find package" on its first run. ` + _publishHint;
+    case "CouldNotLook" :
+      return `Could not look up the Reventless Lambda layer in the SSM parameter ` + lookup.parameter + ` (` + _regionName(lookup.region) + `): ` + lookup.reason + `. ` + _publishHint;
+  }
+}
+
+function reventlessLayerArn() {
+  let arn = lookupLayer();
+  switch (arn.TAG) {
+    case "Found" :
+      return arn._0;
+    case "NotFound" :
+    case "CouldNotLook" :
+      return Stdlib_JsError.throwWithMessage(Stdlib_Option.getOr(missingLayerMessage(arn), "No Reventless Lambda layer"));
+  }
+}
+
+function reventlessLayers() {
+  return [reventlessLayerArn()];
+}
 
 function make(callback, role, policies, deadLetterConfig, tracingConfig, memorySizeOpt, timeoutOpt, runtimeOpt, layersOpt, vpcConfig, tags, environmentOpt) {
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : 180;
   let runtime = runtimeOpt !== undefined ? runtimeOpt : "nodejs22.x";
-  let layers = layersOpt !== undefined ? layersOpt : Stdlib_Option.getOr(Stdlib_Option.map(reventlessLayerArn, arn => [arn]), []);
+  let layers = layersOpt !== undefined ? layersOpt : [reventlessLayerArn()];
   let environment = environmentOpt !== undefined ? environmentOpt : ({
       variables: Object.fromEntries([[
           "Environment",
@@ -86,12 +204,23 @@ let defaultLoggingPolicyDocument = PolicyDocument$PulumiAws.make(undefined, unde
   }]);
 
 export {
-  _resolveLayerArnFromSsm,
+  layerParameter,
+  _nonEmpty,
+  _lookupRegion,
+  _firstLine,
+  classifySsmLookup,
+  _lookupInSsm,
+  _lookup,
+  lookupLayer,
+  _regionName,
+  _publishHint,
+  missingLayerMessage,
   reventlessLayerArn,
+  reventlessLayers,
   CallbackFunction,
   $$Function,
   Permission,
   Invocation,
   defaultLoggingPolicyDocument,
 }
-/* arn Not a pure module */
+/* defaultLoggingPolicyDocument Not a pure module */