@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -0,0 +1,263 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as ClientCloudfront from "@aws-sdk/client-cloudfront";
+import * as Util_StaticBundle$ReventlessAws from "../../util/Util_StaticBundle.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let cachingOptimizedPolicyId = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+
+let cachingDisabledPolicyId = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+
+let cloudFrontAliasZoneId = "Z2FDTNDATAQYW2";
+
+let _usEast1Provider = {
+  contents: undefined
+};
+
+function _getUsEast1Provider() {
+  let p = _usEast1Provider.contents;
+  if (p !== undefined) {
+    return Primitive_option.valFromOption(p);
+  }
+  let p$1 = new Aws.Provider("us-east-1", {
+    region: "us-east-1"
+  });
+  _usEast1Provider.contents = Primitive_option.some(p$1);
+  return p$1;
+}
+
+function cacheControlFor(relativePath) {
+  if (relativePath.startsWith("assets/")) {
+    return "public, max-age=31536000, immutable";
+  } else {
+    return "no-cache";
+  }
+}
+
+async function invalidateDistribution(distributionId, paths) {
+  try {
+    let client = new ClientCloudfront.CloudFrontClient();
+    let input_InvalidationBatch = {
+      CallerReference: "reventless-" + Date.now().toString(),
+      Paths: {
+        Quantity: paths.length,
+        Items: paths
+      }
+    };
+    let input = {
+      DistributionId: distributionId,
+      InvalidationBatch: input_InvalidationBatch
+    };
+    await client.send(new ClientCloudfront.CreateInvalidationCommand(input));
+    return log.info("makeUiBundleDistribution", undefined, `CloudFront invalidation submitted for ` + distributionId);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
+    return log.info("makeUiBundleDistribution", undefined, `CloudFront invalidation skipped (` + msg + `)`);
+  }
+}
+
+function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbackOpt, indexDocumentOpt, stableNameOpt, excludeFilesOpt, customDomain) {
+  let spaFallback = spaFallbackOpt !== undefined ? spaFallbackOpt : false;
+  let indexDocument = indexDocumentOpt !== undefined ? indexDocumentOpt : "index.html";
+  let stableName = stableNameOpt !== undefined ? stableNameOpt : false;
+  let excludeFiles = excludeFilesOpt !== undefined ? excludeFilesOpt : [];
+  let name = stableName ? pluginId : pluginId + "-" + bundleVersion;
+  let bucket = new (Aws.s3.Bucket)(name + "-bundle");
+  new (Aws.s3.BucketPublicAccessBlock)(name + "-bundle-pab", {
+    bucket: bucket.id,
+    blockPublicAcls: true,
+    blockPublicPolicy: true,
+    ignorePublicAcls: true,
+    restrictPublicBuckets: true
+  });
+  let oac = new (Aws.cloudfront.OriginAccessControl)(name + "-oac", {
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4"
+  });
+  let originId = pluginId + "-s3";
+  let customErrorResponses = spaFallback ? [
+      {
+        errorCode: 403,
+        responseCode: 200,
+        responsePagePath: "/" + indexDocument,
+        errorCachingMinTtl: 0
+      },
+      {
+        errorCode: 404,
+        responseCode: 200,
+        responsePagePath: "/" + indexDocument,
+        errorCachingMinTtl: 0
+      }
+    ] : [];
+  let noCacheBehavior = pattern => ({
+    pathPattern: pattern,
+    targetOriginId: originId,
+    viewerProtocolPolicy: "redirect-to-https",
+    allowedMethods: [
+      "GET",
+      "HEAD"
+    ],
+    cachedMethods: [
+      "GET",
+      "HEAD"
+    ],
+    cachePolicyId: cachingDisabledPolicyId
+  });
+  let orderedCacheBehaviors = [noCacheBehavior("/remoteEntry.js")].concat(spaFallback ? [
+      noCacheBehavior("/" + indexDocument),
+      noCacheBehavior("/config.json")
+    ] : []);
+  let viewerCertificate;
+  if (customDomain !== undefined) {
+    let usEast1 = _getUsEast1Provider();
+    let cert = new (Aws.acm.Certificate)(pluginId + "-domain-cert", {
+      domainName: customDomain.fqdn,
+      validationMethod: "DNS"
+    }, {
+      provider: Primitive_option.some(usEast1)
+    });
+    let firstValidationOption = cert.domainValidationOptions.apply(opts => opts[0]);
+    let validationRecord = new (Aws.route53.Record)(pluginId + "-domain-validation-record", {
+      zoneId: customDomain.hostedZoneId,
+      name: firstValidationOption.apply(o => o.resourceRecordName),
+      type: firstValidationOption.apply(o => o.resourceRecordType),
+      ttl: 60,
+      records: firstValidationOption.apply(o => [o.resourceRecordValue]),
+      allowOverwrite: true
+    });
+    let validated = new (Aws.acm.CertificateValidation)(pluginId + "-domain-cert-validation", {
+      certificateArn: cert.arn,
+      validationRecordFqdns: Pulumi.all([validationRecord.fqdn])
+    }, {
+      provider: Primitive_option.some(usEast1)
+    });
+    viewerCertificate = {
+      acmCertificateArn: validated.certificateArn,
+      sslSupportMethod: "sni-only",
+      minimumProtocolVersion: "TLSv1.2_2021"
+    };
+  } else {
+    viewerCertificate = {
+      cloudfrontDefaultCertificate: true
+    };
+  }
+  let distribution = new (Aws.cloudfront.Distribution)(name + "-cdn", {
+    enabled: true,
+    aliases: customDomain !== undefined ? [customDomain.fqdn] : undefined,
+    origins: Pulumi.all([
+      bucket.bucketRegionalDomainName,
+      oac.id
+    ]).apply(param => [{
+        domainName: param[0],
+        originId: originId,
+        originAccessControlId: param[1]
+      }]),
+    defaultCacheBehavior: {
+      targetOriginId: originId,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    },
+    orderedCacheBehaviors: orderedCacheBehaviors,
+    restrictions: {
+      geoRestriction: {
+        restrictionType: "none"
+      }
+    },
+    viewerCertificate: viewerCertificate,
+    comment: pluginId + " UI bundle CDN",
+    customErrorResponses: customErrorResponses,
+    defaultRootObject: indexDocument
+  });
+  if (customDomain !== undefined) {
+    new (Aws.route53.Record)(pluginId + "-domain-alias", {
+      zoneId: customDomain.hostedZoneId,
+      name: customDomain.fqdn,
+      type: "A",
+      aliases: [{
+          name: distribution.domainName,
+          zoneId: cloudFrontAliasZoneId,
+          evaluateTargetHealth: false
+        }]
+    });
+  }
+  new (Aws.s3.BucketPolicy)(name + "-bundle-policy", {
+    bucket: bucket.id,
+    policy: Pulumi.all([
+      bucket.arn,
+      distribution.arn
+    ]).apply(param => JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [{
+          Sid: "AllowCloudFrontServicePrincipal",
+          Effect: "Allow",
+          Principal: {
+            Service: "cloudfront.amazonaws.com"
+          },
+          Action: "s3:GetObject",
+          Resource: param[0] + "/*",
+          Condition: {
+            StringEquals: {
+              "AWS:SourceArn": param[1]
+            }
+          }
+        }]
+    }))
+  });
+  if (assetsDir !== undefined) {
+    let allEntries = Util_StaticBundle$ReventlessAws.walk(assetsDir);
+    if (allEntries.length === 0) {
+      Stdlib_JsError.throwWithMessage(`Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ` + assetsDir);
+    }
+    let entries = allEntries.filter(entry => !excludeFiles.includes(entry.relativePath));
+    let objectEtags = entries.map(entry => new (Aws.s3.BucketObject)(name + "-asset-" + Util_StaticBundle$ReventlessAws.sanitizeName(entry.relativePath), {
+      bucket: bucket.id,
+      key: entry.relativePath,
+      source: entry.fileAsset,
+      contentType: Util_StaticBundle$ReventlessAws.contentTypeFor(entry.relativePath),
+      cacheControl: cacheControlFor(entry.relativePath),
+      etag: entry.contentHash
+    }).etag);
+    Output$Pulumi.flatMap(Pulumi.all([
+      distribution.id,
+      Pulumi.all(objectEtags)
+    ]), param => invalidateDistribution(param[0], ["/*"]));
+  }
+  let distributionUrl = customDomain !== undefined ? Pulumi.output("https://" + customDomain.fqdn) : distribution.domainName.apply(d => "https://" + d);
+  return {
+    distributionUrl: distributionUrl,
+    bucketName: bucket.bucket
+  };
+}
+
+export {
+  log,
+  cachingOptimizedPolicyId,
+  cachingDisabledPolicyId,
+  cloudFrontAliasZoneId,
+  _usEast1Provider,
+  _getUsEast1Provider,
+  cacheControlFor,
+  invalidateDistribution,
+  makeUiBundleDistribution,
+}
+/* log Not a pure module */

package/src/util/Util.res

@@ -0,0 +1,29 @@
+module AppSync = Util_AppSync
+module Cloudwatch = Util_Cloudwatch
+module Cognito_Runtime = Util_Cognito_Runtime
+module CognitoGroupUser = Util_CognitoGroupUser
+module CognitoGroupUser_Runtime = Util_CognitoGroupUser_Runtime
+module DeadLetterQueue = Util_DeadLetterQueue
+module DynamoDb = Util_DynamoDb
+module DynamoDb_Runtime = Util_DynamoDb_Runtime
+module DynamoDb_TableManager = Util_DynamoDb_TableManager
+module DynamoDbStream = Util_DynamoDbStream
+module DynamoDbStream_Runtime = Util_DynamoDbStream_Runtime
+module Env = Util_Env
+module EventSourceMapping = Util_EventSourceMapping
+module IAM_Role = Util_IAM_Role
+module Kinesis_Runtime = Util_Kinesis_Runtime
+module Lambda = Util_Lambda
+module PluginMessage_Runtime = Util_PluginMessage_Runtime
+module ResourceNaming = Util_ResourceNaming
+module S3 = Util_S3
+module S3_Runtime = Util_S3_Runtime
+module StaticBundle = Util_StaticBundle
+module SesPolicy_Runtime = Util_SesPolicy_Runtime
+module SNS = Util_SNS
+module SNS_FIFO = Util_SNS_FIFO
+module SNS_Runtime = Util_SNS_Runtime
+module SQS = Util_SQS
+module SQS_FIFO = Util_SQS_FIFO
+module SQS_Runtime = Util_SQS_Runtime
+module Vpc = Util_Vpc

package/src/util/Util.res.mjs

@@ -0,0 +1,93 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let AppSync;
+
+let Cloudwatch;
+
+let Cognito_Runtime;
+
+let CognitoGroupUser;
+
+let CognitoGroupUser_Runtime;
+
+let DeadLetterQueue;
+
+let DynamoDb;
+
+let DynamoDb_Runtime;
+
+let DynamoDb_TableManager;
+
+let DynamoDbStream;
+
+let DynamoDbStream_Runtime;
+
+let Env;
+
+let EventSourceMapping;
+
+let IAM_Role;
+
+let Kinesis_Runtime;
+
+let Lambda;
+
+let PluginMessage_Runtime;
+
+let ResourceNaming;
+
+let S3;
+
+let S3_Runtime;
+
+let StaticBundle;
+
+let SesPolicy_Runtime;
+
+let SNS;
+
+let SNS_FIFO;
+
+let SNS_Runtime;
+
+let SQS;
+
+let SQS_FIFO;
+
+let SQS_Runtime;
+
+let Vpc;
+
+export {
+  AppSync,
+  Cloudwatch,
+  Cognito_Runtime,
+  CognitoGroupUser,
+  CognitoGroupUser_Runtime,
+  DeadLetterQueue,
+  DynamoDb,
+  DynamoDb_Runtime,
+  DynamoDb_TableManager,
+  DynamoDbStream,
+  DynamoDbStream_Runtime,
+  Env,
+  EventSourceMapping,
+  IAM_Role,
+  Kinesis_Runtime,
+  Lambda,
+  PluginMessage_Runtime,
+  ResourceNaming,
+  S3,
+  S3_Runtime,
+  StaticBundle,
+  SesPolicy_Runtime,
+  SNS,
+  SNS_FIFO,
+  SNS_Runtime,
+  SQS,
+  SQS_FIFO,
+  SQS_Runtime,
+  Vpc,
+}
+/* No side effect */

package/src/util/Util_AppSync.res

@@ -0,0 +1,36 @@
+let toResource: Types.AppSync.resolver => ReventlessInfra.Adapter.resource = ({
+  id,
+  arn,
+  type_,
+  field,
+}) =>
+  ReventlessInfra.Adapter.make(
+    ~name=id,
+    ~id,
+    ~urn=arn,
+    ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
+    ~resourceInfo=(type_, field)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((type_, field)) => ReventlessInfra.Adapter.ApiResolver({typeName: type_, fieldName: field})),
+    ~resourceType="aws:appsync:Resolver"->Pulumi.Output.make,
+  )
+
+/** Variant for aws-native.appsync.Resolver (different field names: resolverArn
+    vs arn, typeName vs type_, fieldName vs field). Emits the same
+    ReventlessInfra.Adapter.resource shape as the classic variant. */
+let toResourceNative: PulumiAws.AwsNative.AppSync.Resolver.t => ReventlessInfra.Adapter.resource = ({
+  id,
+  resolverArn,
+  typeName,
+  fieldName,
+}) =>
+  ReventlessInfra.Adapter.make(
+    ~name=id,
+    ~id,
+    ~urn=resolverArn,
+    ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
+    ~resourceInfo=(typeName, fieldName)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((t, f)) => ReventlessInfra.Adapter.ApiResolver({typeName: t, fieldName: f})),
+    ~resourceType="aws-native:appsync:Resolver"->Pulumi.Output.make,
+  )

package/src/util/Util_AppSync.res.mjs

@@ -0,0 +1,35 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+
+function toResource(param) {
+  let id = param.id;
+  return Adapter$ReventlessInfra.make(id, id, param.arn, id.apply(param => AWS$ReventlessAws.AppSync.service), Pulumi.all([
+    param.type,
+    param.field
+  ]).apply(param => ({
+    TAG: "ApiResolver",
+    typeName: param[0],
+    fieldName: param[1]
+  })), undefined, undefined, Pulumi.output("aws:appsync:Resolver"), undefined, undefined);
+}
+
+function toResourceNative(param) {
+  let id = param.id;
+  return Adapter$ReventlessInfra.make(id, id, param.resolverArn, id.apply(param => AWS$ReventlessAws.AppSync.service), Pulumi.all([
+    param.typeName,
+    param.fieldName
+  ]).apply(param => ({
+    TAG: "ApiResolver",
+    typeName: param[0],
+    fieldName: param[1]
+  })), undefined, undefined, Pulumi.output("aws-native:appsync:Resolver"), undefined, undefined);
+}
+
+export {
+  toResource,
+  toResourceNative,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/util/Util_AppSync_Caller.res

@@ -0,0 +1,213 @@
+// IAM-signed AppSync HTTP mutation sender for deploy-time dispatch.
+//
+// Uses @smithy/signature-v4 + @aws-sdk/credential-provider-node to sign
+// requests with the ambient AWS credentials available in the Pulumi deploy
+// process (developer machine, CI role, or EC2/ECS instance profile).
+//
+// The signed request is sent via the Node 18+ global fetch.
+// Arguments are serialised as inline GraphQL literals — no variable-type
+// declarations required, so any mutation can be called generically.
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// ── AWS credential provider ────────────────────────────────────────────────
+
+type awsCredentials = {
+  accessKeyId: string,
+  secretAccessKey: string,
+  sessionToken?: string,
+}
+
+// defaultProvider() returns a credential-provider function.
+// It resolves credentials from env vars → SSO → ini files → IMDSv2.
+@module("@aws-sdk/credential-provider-node")
+external defaultProvider: unit => (unit => promise<awsCredentials>) = "defaultProvider"
+
+// ── SigV4 signer ──────────────────────────────────────────────────────────────
+
+// Hash constructor type used as sha256 option for SignatureV4
+type hashCtor
+
+// Hash class from @smithy/hash-node; used as Hash.bind(null, "sha256")
+@module("@smithy/hash-node") external _hashClass: hashCtor = "Hash"
+
+// Hash.bind(null, "sha256") yields a zero-argument constructor that
+// SignatureV4 calls internally to create SHA-256 hash instances.
+@send external bindCtor: (hashCtor, @as(json`null`) _, string) => hashCtor = "bind"
+let sha256: hashCtor = _hashClass->bindCtor("sha256")
+
+type signerOptions = {
+  service: string,
+  region: string,
+  credentials: unit => promise<awsCredentials>,
+  sha256: hashCtor,
+}
+
+type httpHeaders = dict<string>
+
+type httpRequest = {
+  method: string,
+  hostname: string,
+  path: string,
+  headers: httpHeaders,
+  body: string,
+}
+
+type signer
+
+@module("@smithy/signature-v4") @new
+external makeSigner: signerOptions => signer = "SignatureV4"
+
+@send external signRequest: (signer, httpRequest) => promise<httpRequest> = "sign"
+
+// ── Node 18+ global fetch ──────────────────────────────────────────────────
+
+type fetchInit = {
+  method: string,
+  headers: httpHeaders,
+  body: string,
+}
+
+@val external fetch: (string, fetchInit) => promise<{..}> = "fetch"
+@send external responseJson: {..} => promise<JSON.t> = "json"
+
+// ── URL parser ─────────────────────────────────────────────────────────────
+
+@new external parseUrl: string => {..} = "URL"
+
+// ── GraphQL inline-arg serialiser ──────────────────────────────────────────
+//
+// Converts a JSON.t value to a GraphQL literal string.
+// GraphQL accepts the same literals as JSON for scalars and arrays;
+// input-object fields use unquoted keys (same as JS object shorthand).
+// This lets us call any mutation without declaring variable types.
+//
+// graphqlEnum wraps a string so jsonToLiteral renders it without quotes,
+// which is required for GraphQL enum arguments (e.g. kind: Domain, not
+// kind: "Domain").
+let graphqlEnum = (name: string): JSON.t =>
+  JSON.Encode.object(Dict.fromArray([("__enum", JSON.Encode.string(name))]))
+
+let rec jsonToLiteral = (value: JSON.t): string =>
+  switch value {
+  | String(s) =>
+    let escaped = s->String.replaceAll("\\", "\\\\")->String.replaceAll("\"", "\\\"")
+    `"${escaped}"`
+  | Boolean(b) => b ? "true" : "false"
+  | Number(n) => n->Float.toString
+  | Null => "null"
+  | Array(arr) => `[${arr->Array.map(jsonToLiteral)->Array.join(", ")}]`
+  | Object(obj) =>
+    // {__enum: "Value"} encodes a GraphQL enum literal (rendered without quotes).
+    switch obj->Dict.get("__enum") {
+    | Some(String(enumVal)) => enumVal
+    | _ =>
+      let pairs = obj->Dict.toArray->Array.map(((k, v)) => `${k}: ${jsonToLiteral(v)}`)
+      `{${pairs->Array.join(", ")}}`
+    }
+  }
+
+let buildQuery = (~mutation: string, ~variablesDict: dict<JSON.t>): string => {
+  let args =
+    variablesDict
+    ->Dict.toArray
+    ->Array.map(((k, v)) => `${k}: ${jsonToLiteral(v)}`)
+    ->Array.join(", ")
+  `mutation { ${mutation}(${args}) }`
+}
+
+// ── sendMutation ────────────────────────────────────────────────────────────
+//
+// Signs and sends a single GraphQL mutation to an AppSync endpoint via IAM.
+// ~variables accepts any value; undefined/optional fields are omitted by
+// JSON.stringifyAny (mirrors how JSON.stringify drops undefined object keys).
+// Returns a promise — callers fire-and-forget with `let _ = sendMutation(...)`.
+
+// Signs and sends a GraphQL query; returns the `data` object or None on error.
+// ~queryString must be a complete "query { field(...) { ... } }" string.
+let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string): option<JSON.t> => {
+  let url = parseUrl(endpoint)
+  let hostname: string = (url)["hostname"]
+  let path: string = (url)["pathname"]
+
+  let body =
+    Dict.fromArray([("query", queryString->JSON.Encode.string)])
+    ->JSON.Encode.object
+    ->JSON.stringify
+
+  let credProvider = defaultProvider()
+  let signer = makeSigner({
+    service: "appsync",
+    region,
+    credentials: credProvider,
+    sha256,
+  })
+
+  let headers: dict<string> = Dict.fromArray([
+    ("content-type", "application/json"),
+    ("host", hostname),
+  ])
+
+  let request: httpRequest = {method: "POST", hostname, path, headers, body}
+  let signed = await signer->signRequest(request)
+  let response = await fetch(endpoint, {method: "POST", headers: signed.headers, body: signed.body})
+  let json = await response->responseJson
+  switch json->JSON.Decode.object {
+  | Some(d) =>
+    switch d->Dict.get("errors") {
+    | Some(errors) =>
+      log.error(~comp="Util_AppSync_Caller", ~data=errors, "query errors")
+      None
+    | None => d->Dict.get("data")
+    }
+  | None => None
+  }
+}
+
+let sendMutation = async (~endpoint: string, ~region: string, ~mutation: string, ~variables: 'a) => {
+  let url = parseUrl(endpoint)
+  let hostname: string = (url)["hostname"]
+  let path: string = (url)["pathname"]
+
+  // Normalise variables to a JSON.t dict (strips undefined optional fields)
+  let variablesDict: dict<JSON.t> =
+    switch variables->JSON.stringifyAny {
+    | Some(str) =>
+      switch str->JSON.parseOrThrow {
+      | Object(d) => d
+      | _ => Dict.make()
+      }
+    | None => Dict.make()
+    }
+
+  let query = buildQuery(~mutation, ~variablesDict)
+  let body =
+    Dict.fromArray([("query", query->JSON.Encode.string)])
+    ->JSON.Encode.object
+    ->JSON.stringify
+
+  let credProvider = defaultProvider()
+  let signer = makeSigner({
+    service: "appsync",
+    region,
+    credentials: credProvider,
+    sha256,
+  })
+
+  let headers: dict<string> = Dict.fromArray([
+    ("content-type", "application/json"),
+    ("host", hostname),
+  ])
+
+  let request: httpRequest = {method: "POST", hostname, path, headers, body}
+  let signed = await signer->signRequest(request)
+
+  let response = await fetch(endpoint, {method: "POST", headers: signed.headers, body: signed.body})
+
+  let json = await response->responseJson
+  switch json->JSON.Decode.object->Option.flatMap(d => d->Dict.get("errors")) {
+  | Some(errors) =>
+    log.error(~comp="Util_AppSync_Caller", ~data=errors, `${mutation} errors`)
+  | None => ()
+  }
+}