@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.2 → 3.0.0-alpha.20

package/src/Lambda/FunctionUrl.res

@@ -37,5 +37,8 @@ external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.
   "FunctionUrl"
 
 @module("@pulumi/aws") @scope(("lambda", "FunctionUrl"))
-external get: (~name: string, ~id: Pulumi.Input.t<string>, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
-  "get"
+external get: (
+  ~name: string,
+  ~id: Pulumi.Input.t<string>,
+  ~opts: Pulumi.CustomResourceOptions.t=?,
+) => t = "get"

package/src/Lambda/Lambda.res

@@ -46,54 +46,136 @@ type eventHandlerNoResult<'event> = eventHandler<'event, unit>
 @send
 external getRemainingTimeInMillis: context => int = "getRemainingTimeInMillis"
 
-@val @scope(("process", "env")) external _layerArnEnv: option<string> = "REVENTLESS_LAYER_ARN"
-@val @scope(("process", "env")) external _pulumiNodejsStack: option<string> = "PULUMI_NODEJS_STACK"
-@module("child_process") external _execSync: (string, {..}) => string = "execSync"
-
-// SSM fallback for local `pulumi up`. CI exports `REVENTLESS_LAYER_ARN`
-// directly (deploy-reventless-aws.yml reads `/reventless/layer-arn/{stack}`
-// via the AWS CLI and injects it as an env var); local devs typically don't.
-// When the env var is unset, shell out to the same SSM parameter from the
-// dev's `aws` CLI so local deploys attach the freshest layer automatically.
-//
-// Failures are swallowed (no `aws` on PATH, missing IAM `ssm:GetParameter`,
-// parameter absent, etc.) — Lambdas then deploy without the layer, which is
-// the same outcome as before this fallback existed.
-let _resolveLayerArnFromSsm = (): option<string> =>
-  switch _pulumiNodejsStack {
-  | None | Some("") => None
-  | Some(stack) =>
-    try {
-      let cmd = `aws ssm get-parameter --name /reventless/layer-arn/${stack} --query Parameter.Value --output text 2>/dev/null`
-      let raw = _execSync(cmd, {"encoding": "utf8"})
-      let trimmed = raw->String.trim
-      if trimmed === "" || trimmed === "None" {
-        None
-      } else {
-        Some(trimmed)
-      }
-    } catch {
-    | _ => None
+/** The outcome of looking for the Reventless layer. `region` is `None` when
+    neither the stack nor the environment names one, and the AWS CLI's default
+    region was asked. */
+type layerLookup =
+  | Found(string)
+  | NotFound({parameter: string, region: option<string>})
+  | CouldNotLook({parameter: string, region: option<string>, reason: string})
+
+let layerParameter = stack => `/reventless/layer-arn/${stack}`
+
+let _nonEmpty = value =>
+  switch value->Option.map(String.trim) {
+  | Some("") | None => None
+  | trimmed => trimmed
+  }
+
+let _lookupRegion = () =>
+  switch Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->_nonEmpty {
+  | Some(_) as region => region
+  | None =>
+    switch NodeProcess.env->Dict.get("AWS_REGION")->_nonEmpty {
+    | Some(_) as region => region
+    | None => NodeProcess.env->Dict.get("AWS_DEFAULT_REGION")->_nonEmpty
+    }
+  }
+
+let _firstLine = text =>
+  text
+  ->String.split("\n")
+  ->Array.map(String.trim)
+  ->Array.find(line => line !== "")
+  ->Option.getOr("the AWS CLI exited without saying why")
+
+/** Reads the result of `aws ssm get-parameter`: only `ParameterNotFound` means
+    there is no layer; a missing CLI or a refused call means nobody could tell. */
+let classifySsmLookup = (
+  ~parameter,
+  ~region,
+  result: NodeChildProcess.spawnSyncResult,
+): layerLookup => {
+  let stderr = result.stderr->Nullable.toOption->Option.getOr("")
+  switch (result.error->Nullable.toOption, result.status->Nullable.toOption) {
+  | (Some(error), _) =>
+    let message = error->JsExn.message->Option.getOr("unknown error")
+    CouldNotLook({parameter, region, reason: `the AWS CLI could not be run (${message})`})
+  | (None, Some(0)) =>
+    switch result.stdout->Nullable.toOption->_nonEmpty {
+    | None | Some("None") => NotFound({parameter, region})
+    | Some(arn) => Found(arn)
+    }
+  | (None, _) if stderr->String.includes("ParameterNotFound") => NotFound({parameter, region})
+  | (None, _) => CouldNotLook({parameter, region, reason: _firstLine(stderr)})
+  }
+}
+
+let _lookupInSsm = (): layerLookup => {
+  let parameter = layerParameter(Pulumi.Pulumi.getStackName())
+  let region = _lookupRegion()
+  let regionArgs = region->Option.mapOr([], region => ["--region", region])
+  NodeChildProcess.spawnSync(
+    "aws",
+    [
+      "ssm",
+      "get-parameter",
+      "--name",
+      parameter,
+      "--query",
+      "Parameter.Value",
+      "--output",
+      "text",
+    ]->Array.concat(regionArgs),
+    {encoding: "utf8"},
+  )->classifySsmLookup(~parameter, ~region, _)
+}
+
+let _lookup: ref<option<layerLookup>> = ref(None)
+
+/** Looks once per deploy: `REVENTLESS_LAYER_ARN` when set (CI exports it),
+    otherwise the stack's SSM parameter through the AWS CLI, in the stack's
+    `aws:region` when it sets one. */
+let lookupLayer = (): layerLookup =>
+  switch _lookup.contents {
+  | Some(lookup) => lookup
+  | None =>
+    let lookup = switch NodeProcess.env->Dict.get("REVENTLESS_LAYER_ARN")->_nonEmpty {
+    | Some(arn) => Found(arn)
+    | None => _lookupInSsm()
     }
+    _lookup := Some(lookup)
+    lookup
   }
 
-/**
- * Reventless Lambda layer ARN for the current Pulumi stack.
- *
- * Resolution order:
- *   1. `REVENTLESS_LAYER_ARN` env var — fast path, used by CI
- *      (deploy-reventless-aws.yml reads SSM and exports it).
- *   2. AWS CLI SSM lookup at `/reventless/layer-arn/${PULUMI_NODEJS_STACK}` —
- *      local-deploy convenience so devs don't need to export the env var
- *      manually.
- *   3. `None` when both fail — Lambdas deploy without the layer.
- */
-let reventlessLayerArn: option<string> =
-  switch _layerArnEnv {
-  | Some(arn) if arn->String.trim->String.length > 0 => Some(arn->String.trim)
-  | _ => _resolveLayerArnFromSsm()
+let _regionName = region =>
+  region->Option.mapOr("the AWS CLI's default region", region => `region ${region}`)
+
+let _publishHint = `Publish the layer and store its ARN in that parameter, or set REVENTLESS_LAYER_ARN: https://docs.reventless.dev/infrastructure/aws/get-started#the-lambda-layer`
+
+/** Why a deploy cannot go on without the layer, or `None` when it was found. */
+let missingLayerMessage = lookup =>
+  switch lookup {
+  | Found(_) => None
+  | NotFound({parameter, region}) =>
+    Some(
+      `No Reventless Lambda layer: the SSM parameter ${parameter} does not exist in ${_regionName(
+          region,
+        )}. Without the layer every function fails with "Cannot find package" on its first run. ${_publishHint}`,
+    )
+  | CouldNotLook({parameter, region, reason}) =>
+    Some(
+      `Could not look up the Reventless Lambda layer in the SSM parameter ${parameter} (${_regionName(
+          region,
+        )}): ${reason}. ${_publishHint}`,
+    )
   }
 
+/** The layer's ARN. Throws with `missingLayerMessage` when there is none, so a
+    function is never created without the framework code it imports. */
+let reventlessLayerArn = (): string =>
+  switch lookupLayer() {
+  | Found(arn) => arn
+  | lookup =>
+    JsError.throwWithMessage(
+      missingLayerMessage(lookup)->Option.getOr("No Reventless Lambda layer"),
+    )
+  }
+
+/** The `layers` argument of every framework function. */
+let reventlessLayers = (): Pulumi.Input.t<array<Pulumi.Input.t<string>>> =>
+  [reventlessLayerArn()->Pulumi.Input.make]->Pulumi.Input.make
+
 @val
 external environment: option<string> = "process.env.Environment"
 
@@ -151,10 +233,7 @@ module CallbackFunction = {
       ~memorySize=1024->Pulumi.Input.make,
       ~timeout=180->Pulumi.Input.make,
       ~runtime=NodeJs22,
-      ~layers=reventlessLayerArn
-      ->Option.map(arn => [arn->Pulumi.Input.make])
-      ->Option.getOr([])
-      ->Pulumi.Input.make,
+      ~layers=reventlessLayers(),
       ~vpcConfig=?,
       ~tags=?,
       ~environment={
@@ -253,14 +332,17 @@ module Function = {
     id: Pulumi.Output.t<string>,
     name: Pulumi.Output.t<string>,
     invokeArn: Pulumi.Output.t<string>,
+    /** When AWS last wrote the function. Server-computed and different after
+        every code update, which is what separates it from the four identifiers
+        above: those are equal before and after, so the engine can resolve them
+        from existing state without waiting for the update. Depend on this one to
+        wait for the new code to actually be live. */
+    lastModified: Pulumi.Output.t<string>,
   }
 
   @module("@pulumi/aws") @scope("lambda") @new
-  external make: (
-    ~name: string,
-    ~args: args,
-    ~opts: Pulumi.CustomResourceOptions.t=?,
-  ) => t = "Function"
+  external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+    "Function"
 
   @module("@pulumi/aws") @scope(("lambda", "Function"))
   external get: (

package/src/Lambda/Lambda.res.mjs

@@ -1,43 +1,161 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as Child_process from "child_process";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Nodechild_process from "node:child_process";
 import * as PolicyDocument$PulumiAws from "../IAM/PolicyDocument.res.mjs";
 
-function _resolveLayerArnFromSsm() {
-  let stack = process.env.PULUMI_NODEJS_STACK;
-  if (stack === undefined) {
-    return;
+function layerParameter(stack) {
+  return `/reventless/layer-arn/` + stack;
+}
+
+function _nonEmpty(value) {
+  let trimmed = Stdlib_Option.map(value, prim => prim.trim());
+  if (trimmed !== undefined && trimmed !== "") {
+    return trimmed;
+  }
+}
+
+function _lookupRegion() {
+  let region = _nonEmpty(new Pulumi.Config("aws").get("region"));
+  if (region !== undefined) {
+    return region;
   }
-  if (stack === "") {
-    return;
+  let region$1 = _nonEmpty(process.env["AWS_REGION"]);
+  if (region$1 !== undefined) {
+    return region$1;
+  } else {
+    return _nonEmpty(process.env["AWS_DEFAULT_REGION"]);
   }
-  try {
-    let cmd = `aws ssm get-parameter --name /reventless/layer-arn/` + stack + ` --query Parameter.Value --output text 2>/dev/null`;
-    let raw = Child_process.execSync(cmd, {
-      encoding: "utf8"
-    });
-    let trimmed = raw.trim();
-    if (trimmed === "" || trimmed === "None") {
-      return;
+}
+
+function _firstLine(text) {
+  return Stdlib_Option.getOr(text.split("\n").map(prim => prim.trim()).find(line => line !== ""), "the AWS CLI exited without saying why");
+}
+
+function classifySsmLookup(parameter, region, result) {
+  let stderr = Stdlib_Option.getOr(Primitive_option.fromNullable(result.stderr), "");
+  let match = result.error;
+  let match$1 = result.status;
+  if (match == null) {
+    if (!(match$1 == null) && match$1 === 0) {
+      let arn = _nonEmpty(Primitive_option.fromNullable(result.stdout));
+      if (arn !== undefined && arn !== "None") {
+        return {
+          TAG: "Found",
+          _0: arn
+        };
+      } else {
+        return {
+          TAG: "NotFound",
+          parameter: parameter,
+          region: region
+        };
+      }
+    }
+    if (stderr.includes("ParameterNotFound")) {
+      return {
+        TAG: "NotFound",
+        parameter: parameter,
+        region: region
+      };
     } else {
-      return trimmed;
+      return {
+        TAG: "CouldNotLook",
+        parameter: parameter,
+        region: region,
+        reason: _firstLine(stderr)
+      };
     }
-  } catch (exn) {
-    return;
   }
+  let message = Stdlib_Option.getOr(Stdlib_JsExn.message(match), "unknown error");
+  return {
+    TAG: "CouldNotLook",
+    parameter: parameter,
+    region: region,
+    reason: `the AWS CLI could not be run (` + message + `)`
+  };
 }
 
-let arn = process.env.REVENTLESS_LAYER_ARN;
+function _lookupInSsm() {
+  let parameter = layerParameter(Pulumi.getStack());
+  let region = _lookupRegion();
+  let regionArgs = Stdlib_Option.mapOr(region, [], region => [
+    "--region",
+    region
+  ]);
+  return classifySsmLookup(parameter, region, Nodechild_process.spawnSync("aws", [
+    "ssm",
+    "get-parameter",
+    "--name",
+    parameter,
+    "--query",
+    "Parameter.Value",
+    "--output",
+    "text"
+  ].concat(regionArgs), {
+    encoding: "utf8"
+  }));
+}
 
-let reventlessLayerArn = arn !== undefined && arn.trim().length > 0 ? arn.trim() : _resolveLayerArnFromSsm();
+let _lookup = {
+  contents: undefined
+};
+
+function lookupLayer() {
+  let lookup = _lookup.contents;
+  if (lookup !== undefined) {
+    return lookup;
+  }
+  let arn = _nonEmpty(process.env["REVENTLESS_LAYER_ARN"]);
+  let lookup$1 = arn !== undefined ? ({
+      TAG: "Found",
+      _0: arn
+    }) : _lookupInSsm();
+  _lookup.contents = lookup$1;
+  return lookup$1;
+}
+
+function _regionName(region) {
+  return Stdlib_Option.mapOr(region, "the AWS CLI's default region", region => `region ` + region);
+}
+
+let _publishHint = `Publish the layer and store its ARN in that parameter, or set REVENTLESS_LAYER_ARN: https://docs.reventless.dev/infrastructure/aws/get-started#the-lambda-layer`;
+
+function missingLayerMessage(lookup) {
+  switch (lookup.TAG) {
+    case "Found" :
+      return;
+    case "NotFound" :
+      return `No Reventless Lambda layer: the SSM parameter ` + lookup.parameter + ` does not exist in ` + _regionName(lookup.region) + `. Without the layer every function fails with "Cannot find package" on its first run. ` + _publishHint;
+    case "CouldNotLook" :
+      return `Could not look up the Reventless Lambda layer in the SSM parameter ` + lookup.parameter + ` (` + _regionName(lookup.region) + `): ` + lookup.reason + `. ` + _publishHint;
+  }
+}
+
+function reventlessLayerArn() {
+  let arn = lookupLayer();
+  switch (arn.TAG) {
+    case "Found" :
+      return arn._0;
+    case "NotFound" :
+    case "CouldNotLook" :
+      return Stdlib_JsError.throwWithMessage(Stdlib_Option.getOr(missingLayerMessage(arn), "No Reventless Lambda layer"));
+  }
+}
+
+function reventlessLayers() {
+  return [reventlessLayerArn()];
+}
 
 function make(callback, role, policies, deadLetterConfig, tracingConfig, memorySizeOpt, timeoutOpt, runtimeOpt, layersOpt, vpcConfig, tags, environmentOpt) {
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : 180;
   let runtime = runtimeOpt !== undefined ? runtimeOpt : "nodejs22.x";
-  let layers = layersOpt !== undefined ? layersOpt : Stdlib_Option.getOr(Stdlib_Option.map(reventlessLayerArn, arn => [arn]), []);
+  let layers = layersOpt !== undefined ? layersOpt : [reventlessLayerArn()];
   let environment = environmentOpt !== undefined ? environmentOpt : ({
       variables: Object.fromEntries([[
           "Environment",
@@ -86,12 +204,23 @@ let defaultLoggingPolicyDocument = PolicyDocument$PulumiAws.make(undefined, unde
   }]);
 
 export {
-  _resolveLayerArnFromSsm,
+  layerParameter,
+  _nonEmpty,
+  _lookupRegion,
+  _firstLine,
+  classifySsmLookup,
+  _lookupInSsm,
+  _lookup,
+  lookupLayer,
+  _regionName,
+  _publishHint,
+  missingLayerMessage,
   reventlessLayerArn,
+  reventlessLayers,
   CallbackFunction,
   $$Function,
   Permission,
   Invocation,
   defaultLoggingPolicyDocument,
 }
-/* arn Not a pure module */
+/* defaultLoggingPolicyDocument Not a pure module */

package/src/Rds/Rds_Cluster.res

@@ -4,7 +4,6 @@
   Aurora (incl. Aurora Serverless v2) Postgres cluster. Pair with one or more
   `Rds_ClusterInstance` — a cluster has no compute of its own.
 */
-
 /** See `Rds_Instance.masterUserSecret`. */
 type masterUserSecret = {
   kmsKeyId: string,

package/src/Rds/Rds_Instance.res

@@ -1,7 +1,6 @@
 /** @pulumi/aws/rds/instance
   see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance
 */
-
 /** One entry of `masterUserSecrets`, populated when `manageMasterUserPassword`
   is true — RDS creates and rotates the master password in Secrets Manager and
   reports the secret ARN here. */

package/src/Rds/Rds_Proxy.res

@@ -34,5 +34,4 @@ type args = {
 }
 
 @module("@pulumi/aws") @scope("rds") @new
-external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
-  "Proxy"
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t = "Proxy"

package/src/S3/S3_BucketV2.res

@@ -1,9 +1,7 @@
 /** @pulumi/aws/s3/BucketV2
   see: https://www.pulumi.com/registry/packages/aws/api-docs/s3/bucketv2
 */
-@module("@pulumi/aws")
-@scope("s3")
-@new
+@module("@pulumi/aws") @scope("s3") @new
 external make: (
   ~name: string,
   ~args: S3_Bucket.args=?,

package/src/example/AlarmMailExample.res

@@ -0,0 +1,34 @@
+// Compile-only smoke for the EventBridge bindings: a rule that matches CloudWatch
+// alarm state changes by pattern, and an SNS target that rewrites the matched event
+// into a plain-text body rather than forwarding the raw JSON. Not executed at deploy
+// time — it keeps `eventPattern` and `inputTransformer` type-checked together.
+
+let alarmMailTopic = SNS.Topic.make(~name="example-alarm-mail")
+
+let alarmStateChanges = Cloudwatch.EventRule.make(
+  ~name="example-alarm-state-changes",
+  ~args={
+    description: "CloudWatch alarm state changes, ALARM and OK only"->Pulumi.Input.make,
+    eventPattern: `{"source":["aws.cloudwatch"],"detail-type":["CloudWatch Alarm State Change"],"detail":{"state":{"value":["ALARM","OK"]}}}`->Pulumi.Input.make,
+  },
+)
+
+// A template that is not JSON has to arrive quoted — the surrounding double quotes are
+// part of the value, not ReScript syntax.
+let mailBody: Cloudwatch.EventTarget.inputTransformer = {
+  inputPaths: Dict.fromArray([
+    ("name", "$.detail.alarmName"),
+    ("state", "$.detail.state.value"),
+    ("reason", "$.detail.state.reason"),
+  ]),
+  inputTemplate: `"<state>: <name> — <reason>"`->Pulumi.Input.make,
+}
+
+let _ = Cloudwatch.EventTarget.make(
+  ~name="example-alarm-mail-target",
+  ~args={
+    rule: Cloudwatch.EventTarget.Rule.ofEventRule(alarmStateChanges),
+    arn: alarmMailTopic.arn->Pulumi.Output.asInput,
+    inputTransformer: mailBody->Pulumi.Input.make,
+  },
+)

package/src/example/AlarmMailExample.res.mjs

@@ -0,0 +1,44 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Cloudwatch_EventTarget$PulumiAws from "../Cloudwatch/Cloudwatch_EventTarget.res.mjs";
+
+let alarmMailTopic = new (Aws.sns.Topic)("example-alarm-mail");
+
+let alarmStateChanges = new (Aws.cloudwatch.EventRule)("example-alarm-state-changes", {
+  description: "CloudWatch alarm state changes, ALARM and OK only",
+  eventPattern: `{"source":["aws.cloudwatch"],"detail-type":["CloudWatch Alarm State Change"],"detail":{"state":{"value":["ALARM","OK"]}}}`
+});
+
+let mailBody_inputPaths = Object.fromEntries([
+  [
+    "name",
+    "$.detail.alarmName"
+  ],
+  [
+    "state",
+    "$.detail.state.value"
+  ],
+  [
+    "reason",
+    "$.detail.state.reason"
+  ]
+]);
+
+let mailBody = {
+  inputPaths: mailBody_inputPaths,
+  inputTemplate: `"<state>: <name> — <reason>"`
+};
+
+new (Aws.cloudwatch.EventTarget)("example-alarm-mail-target", {
+  rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(alarmStateChanges),
+  arn: alarmMailTopic.arn,
+  inputTransformer: mailBody
+});
+
+export {
+  alarmMailTopic,
+  alarmStateChanges,
+  mailBody,
+}
+/* alarmMailTopic Not a pure module */

package/src/example/CustomDomainExample.res

@@ -18,9 +18,8 @@ let cert = Acm.Certificate.make(
   ~opts={provider: usEast1},
 )
 
-let firstValidationOption = cert.domainValidationOptions->Pulumi.Output.apply(opts =>
-  opts->Array.getUnsafe(0)
-)
+let firstValidationOption =
+  cert.domainValidationOptions->Pulumi.Output.apply(opts => opts->Array.getUnsafe(0))
 
 let validationRecord = Route53.Record.make(
   ~name="example-cert-validation",

package/src/example/MergedApiExample.res

@@ -8,9 +8,7 @@
 let mergedExecRole = IAM.Role.make(
   ~name="example-merged-exec-role",
   ~args={
-    assumeRolePolicy: Pulumi.Input.make(
-      `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`,
-    ),
+    assumeRolePolicy: Pulumi.Input.make(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`),
   },
 )