@reventlessdev/reventless-aws 3.0.0-alpha.211 → 3.0.0-alpha.213

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.213 (2026-07-15)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
+# 3.0.0-alpha.212 (2026-07-14)
+
+### Bug Fixes
+
+* **aws:** create EC publishToAggregates SendMessage grants — cross-plugin extension→DCB publishes no longer AccessDenied ([c2126df](https://github.com/ReventlessDev/reventless-core/commit/c2126df0b9af4a79a980f2668ffc18a7760ef4c3))
+* **aws:** create heartbeat SendMessage grant at top level; document the pulumi.all side-channel gotcha ([6ffa06a](https://github.com/ReventlessDev/reventless-core/commit/6ffa06ac87070af4027ba5753ac7c2cb216a76d0))
+* **aws:** filter Internal read models from Platform_ComponentDefinitions ([fda1a81](https://github.com/ReventlessDev/reventless-core/commit/fda1a81f420f64bf4bdf3c988f84829719ffc0d1))
+### Features
+
+* **core:** thread ~comp through Projection.handleAction for attributed action logging ([fa32d93](https://github.com/ReventlessDev/reventless-core/commit/fa32d93dedabea1b1f655f01a4ea769a5908b143))
+* surface masked GraphQL resolver errors server-side (local + AWS) ([b3bca51](https://github.com/ReventlessDev/reventless-core/commit/b3bca51b539e40c604b3db338d570de6215ea837))
+
+
 # 3.0.0-alpha.211 (2026-07-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.211",
+  "version": "3.0.0-alpha.213",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -10,15 +10,15 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.27",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.52",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.53",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.15",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.167",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.99",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.169",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.33",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.100",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.15",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.26",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.76"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.77",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.26"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -5,8 +5,11 @@
 // field. The persisted structure is sury-encoded with the exact same shape
 // the in-memory adapter's `Platform_ComponentDefinitionsApi.encodePluginStructureEntry`
 // produces (literal-string `commandLevel`, `null`-encoded options), so the
-// handler simply wraps each persisted structure with `pluginId` — no decoding
-// or re-encoding needed.
+// handler wraps each persisted structure with `pluginId` without decoding.
+// One caveat: the persisted structure is PRE-filter — it still carries Internal
+// ReadModels / StateViewSlices for developer tooling. The handler re-applies the
+// `isPublicQueryable` filter (mirroring `encodePluginStructureEntry`) so Internal
+// components stay out of the deployed AutoUI, matching the in-memory adapter.
 
 open PulumiAws
 
@@ -64,6 +67,16 @@ export async function handler() {
     }
     return 0;
   };
+  // The persisted structure carries Internal ReadModels / StateViewSlices for
+  // developer tooling; they must stay out of the deployed AutoUI. Mirror
+  // ReventlessCore.Platform_ComponentDefinitionsApi.isPublicQueryable here on the
+  // read path (the persisted structure is pre-filter — it is NOT re-encoded).
+  const isPublicQueryable = (q) => q?.visibility !== "Internal";
+  const filterStructure = (s) => ({
+    ...s,
+    readModels: (s.readModels ?? []).filter(isPublicQueryable),
+    stateViewSlices: (s.stateViewSlices ?? []).filter(isPublicQueryable),
+  });
   const latestByName = new Map();
   for (const item of items) {
     if (!item || !item.structure) continue;
@@ -71,7 +84,7 @@ export async function handler() {
     const version = String(item.name).split("@")[1] ?? "";
     const prev = latestByName.get(name);
     if (!prev || cmpVer(version, prev.version) > 0) {
-      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+      latestByName.set(name, { version, entry: { pluginId: name, ...filterStructure(item.structure) } });
     }
   }
   const userEntries = [...latestByName.values()].map(v => v.entry);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -65,6 +65,16 @@ export async function handler() {
     }
     return 0;
   };
+  // The persisted structure carries Internal ReadModels / StateViewSlices for
+  // developer tooling; they must stay out of the deployed AutoUI. Mirror
+  // ReventlessCore.Platform_ComponentDefinitionsApi.isPublicQueryable here on the
+  // read path (the persisted structure is pre-filter — it is NOT re-encoded).
+  const isPublicQueryable = (q) => q?.visibility !== "Internal";
+  const filterStructure = (s) => ({
+    ...s,
+    readModels: (s.readModels ?? []).filter(isPublicQueryable),
+    stateViewSlices: (s.stateViewSlices ?? []).filter(isPublicQueryable),
+  });
   const latestByName = new Map();
   for (const item of items) {
     if (!item || !item.structure) continue;
@@ -72,7 +82,7 @@ export async function handler() {
     const version = String(item.name).split("@")[1] ?? "";
     const prev = latestByName.get(name);
     if (!prev || cmpVer(version, prev.version) > 0) {
-      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+      latestByName.set(name, { version, entry: { pluginId: name, ...filterStructure(item.structure) } });
     }
   }
   const userEntries = [...latestByName.values()].map(v => v.entry);

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -91,7 +91,10 @@ export function buildJsonEventsHandler(specModule, projectionModule, queryDbTabl
       // every such action hit the `MissingSubIdConfig` guard and silently write nothing,
       // while the test-harness callback path (which threads it) stayed green. `undefined`
       // for slices without an `@subId` is correct — those never emit sub-id actions.
-      Effect.promise(() => handleAction(action, queryDbOps, specModule.subIdConfig)),
+      // First positional arg is the compiled `~comp=` optional (attribution
+      // for Projection.handleAction's debug-lazy action log) — the slice's
+      // spec name. Compiled shape: (comp, action, operations, subIdConfig).
+      Effect.promise(() => handleAction(specModule.name, action, queryDbOps, specModule.subIdConfig)),
       _ => {}
     )
   );

package/src/components/Api/AppSync_Adapter.res

@@ -486,6 +486,24 @@ let _makeApiResourceWith = (
     ~opts=Some(customOpts),
   )
 
+  // Let AppSync push field-resolver errors to CloudWatch. The API's own service
+  // role is already assumable by appsync.amazonaws.com, so attach the AWS-managed
+  // push policy to it and reuse it as the logging role. `fieldLogLevel = ERROR`
+  // (below) then captures resolver failures AppSync otherwise swallows into the
+  // client's `errors[]` — e.g. a non-null coercion on a stale read-model row.
+  let _appsyncCwLogsAttachment = IAM.RolePolicyAttachment.make(
+    ~name=`${name}-appsync-cwlogs`,
+    ~args={
+      role: iamRole.name->Pulumi.Output.asInput,
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+  let appsyncLogConfig: AppSync.GraphQLApi.logConfig = {
+    cloudwatchLogsRoleArn: iamRole.arn->Pulumi.Output.asInput,
+    fieldLogLevel: AppSync.GraphQLApi.ERROR->Pulumi.Input.make,
+  }
+
   // Resolve the Cognito UserPool — either supplied by the caller (plugin-stack
   // source APIs read it from the platform's StackReference exports so they
   // never provision pool/client resources of their own) or resolved via
@@ -520,6 +538,7 @@ let _makeApiResourceWith = (
       )->Pulumi.Input.make,
     ]->Pulumi.Input.make,
     schema: ?(schema->Option.map(Pulumi.Input.make)),
+    logConfig: appsyncLogConfig->Pulumi.Input.make,
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -276,6 +276,15 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let iamRole = new (Aws.iam.Role)(name + `-appsync-role`, {
     assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
   }, customOpts);
+  new (Aws.iam.RolePolicyAttachment)(name + `-appsync-cwlogs`, {
+    policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
+    role: iamRole.name
+  }, customOpts);
+  let appsyncLogConfig_cloudwatchLogsRoleArn = iamRole.arn;
+  let appsyncLogConfig = {
+    cloudwatchLogsRoleArn: appsyncLogConfig_cloudwatchLogsRoleArn,
+    fieldLogLevel: "ERROR"
+  };
   let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
       userPoolId: c.userPoolId,
       defaultAction: "ALLOW",
@@ -286,11 +295,13 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let apiArgs_additionalAuthenticationProviders = [{
       authenticationType: "AWS_IAM"
     }];
+  let apiArgs_logConfig = appsyncLogConfig;
   let apiArgs = {
     authenticationType: "AMAZON_COGNITO_USER_POOLS",
     schema: apiArgs_schema,
     userPoolConfig: apiArgs_userPoolConfig,
-    additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders
+    additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders,
+    logConfig: apiArgs_logConfig
   };
   let graphQLApi = new (Aws.appsync.GraphQLApi)(name, apiArgs, customOpts);
   return [

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res

@@ -25,16 +25,48 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
   let lambdaRole = runtime.parts.lambdaRole
   let coreSqsQueue = remoteChannel.resources->Util_SQS.findResolvedResource
 
-  let _attachPoliciesAndSetEventTarget =
-    (
-      lambda->Pulumi.Output.flatMap(lambda => lambda.arn),
-      lambda->Pulumi.Output.flatMap(lambda => lambda.name),
-      lambdaRole.id,
+  // Grant sqs:SendMessage on the Core Plugin ExtensionPoint command topic at
+  // TOP LEVEL. Previously this RolePolicy was created inside the
+  // `Pulumi.Output.apply` below — and a resource created inside an apply
+  // callback does not reliably register with the engine, which intermittently
+  // left the heartbeat Lambda without this grant (IAM AccessDenied:
+  // `sqs:sendmessage on CorePluginExtPointCmdTopic`). `coreSqsQueue.urn` is an
+  // already-resolved ARN string from the remote channel and `lambdaRole.id` an
+  // Output, so neither needs an apply. Mirrors the EC `pta` grant fix — see
+  // docs/analysis/ec-publish-to-aggregates-grant-broken.md.
+  let _attachHeartbeatLambdaPolicy = {
+    open PulumiAws.PolicyDocument
+    let heartbeatLambdaSendMessagePolicyDocument = PulumiAws.PolicyDocument.make(
+      ~statements=[
+        {
+          sid: "AllowLambdaToSendSQS",
+          effect: Allow,
+          actions: Action("sqs:SendMessage"),
+          resources: Resource(coreSqsQueue.urn),
+        },
+      ],
     )
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((lambdaArn, lambdaName, heartbeatRoleId)) => {
-      open PulumiAws.PolicyDocument
+    PulumiAws.IAM.RolePolicy.make(
+      ~name=name ++ "RolePolicy",
+      ~args={
+        policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
+          name ++ "Policy",
+          [
+            PulumiAws.Lambda.defaultLoggingPolicyDocument,
+            heartbeatLambdaSendMessagePolicyDocument,
+          ],
+        )->Pulumi.Output.asInput,
+        role: lambdaRole.id->Pulumi.Output.asInput,
+      },
+    )
+  }
 
+  // The Lambda permission and CloudWatch event target genuinely need the
+  // Lambda's resolved arn/name, so they stay inside an apply.
+  let _permissionAndEventTarget =
+    (lambda->Pulumi.Output.flatMap(lambda => lambda.arn), lambda->Pulumi.Output.flatMap(lambda => lambda.name))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
       let _addHeartbeatLambdaPermission = PulumiAws.Lambda.Permission.make(
         ~name,
         ~args={
@@ -45,33 +77,6 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
         ~opts,
       )
 
-      let heartbeatLambdaSendMessagePolicyDocument = {
-        PulumiAws.PolicyDocument.make(
-          ~statements=[
-            {
-              sid: "AllowLambdaToSendSQS",
-              effect: Allow,
-              actions: Action("sqs:SendMessage"),
-              resources: Resource(coreSqsQueue.urn),
-            },
-          ],
-        )
-      }
-
-      let _attachHeartbeatLambdaPolicy = PulumiAws.IAM.RolePolicy.make(
-        ~name=name ++ "RolePolicy",
-        ~args={
-          policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
-            name ++ "Policy",
-            [
-              PulumiAws.Lambda.defaultLoggingPolicyDocument,
-              heartbeatLambdaSendMessagePolicyDocument,
-            ],
-          )->Pulumi.Output.asInput,
-          role: heartbeatRoleId->Pulumi.Input.make,
-        },
-      )
-
       let _cloudwatchEventTarget = {
         open PulumiAws.Cloudwatch
         EventTarget.make(

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res.mjs

@@ -27,29 +27,28 @@ function make(name, remoteChannel, timeout, runtime, opts) {
   let lambda = runtime.parts.lambda;
   let lambdaRole = runtime.parts.lambdaRole;
   let coreSqsQueue = Util_SQS$ReventlessAws.findResolvedResource(remoteChannel.resources);
+  let heartbeatLambdaSendMessagePolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
+      Sid: "AllowLambdaToSendSQS",
+      Effect: "Allow",
+      Action: "sqs:SendMessage",
+      Resource: coreSqsQueue.urn
+    }]);
+  new (Aws.iam.RolePolicy)(name + "RolePolicy", {
+    policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "Policy", [
+      Lambda$PulumiAws.defaultLoggingPolicyDocument,
+      heartbeatLambdaSendMessagePolicyDocument
+    ]),
+    role: lambdaRole.id
+  });
   Pulumi.all([
     Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
-    Output$Pulumi.flatMap(lambda, lambda => lambda.name),
-    lambdaRole.id
+    Output$Pulumi.flatMap(lambda, lambda => lambda.name)
   ]).apply(param => {
     new (Aws.lambda.Permission)(name, {
       action: "lambda:InvokeFunction",
       function: param[1],
       principal: AWS$ReventlessAws.CloudwatchEventRule.principal
     }, opts$1);
-    let heartbeatLambdaSendMessagePolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
-        Sid: "AllowLambdaToSendSQS",
-        Effect: "Allow",
-        Action: "sqs:SendMessage",
-        Resource: coreSqsQueue.urn
-      }]);
-    new (Aws.iam.RolePolicy)(name + "RolePolicy", {
-      policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "Policy", [
-        Lambda$PulumiAws.defaultLoggingPolicyDocument,
-        heartbeatLambdaSendMessagePolicyDocument
-      ]),
-      role: param[2]
-    });
     new (Aws.cloudwatch.EventTarget)(name, {
       rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(cloudwatchEventRule),
       arn: param[0]

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -622,79 +622,68 @@ module Make = (
         aggregateNameSet->Dict.set(aggName, ())
       )
     )
-    let queueUrlOutputs =
-      aggregateNameSet
-      ->Dict.keysToArray
-      ->Array.filterMap(aggName => context.publishToAggregates->Dict.get(aggName))
-    let _ = if queueUrlOutputs->Array.length > 0 {
-      // The dict is declared as `dict<Pulumi.Output.t<string>>` but the
-      // DCB slice path (Dcb_Builder.dcbCommandTopicQueueUrl) can leak the
-      // `{BS_PRIVATE_NESTED_SOME_NONE: 0}` nested-option sentinel as a
-      // value when the SQS Queue's .id is still unresolved during early
-      // CustomResource construction. Pulumi.all happily wraps & resolves
-      // it as Output<sentinel>, so .apply hands us a non-string. Drop
-      // anything that isn't actually a string — an extension targeting
-      // the affected slice will need a separate grant out-of-band until
-      // the resource is fully provisioned and a subsequent preview/up
-      // produces a real ARN. We build the policy document inline so an
-      // empty filtered ARN array skips RolePolicy creation entirely
-      // (PutRolePolicy rejects empty Resource arrays with
-      // MalformedPolicyDocument).
-      let policyJsonOutput =
-        queueUrlOutputs
-        ->Pulumi.Output.all
-        ->Pulumi.Output.apply(urls => {
-          let queueArns =
-            urls
-            ->Array.filter(url => typeof(url) === #string)
-            ->Array.map(url =>
-              // queue URL → ARN: https://sqs.<region>.amazonaws.com/<acct>/<name>
-              //                → arn:aws:sqs:<region>:<acct>:<name>
-              switch url->String.split("/") {
-              | [_, _, host, acct, name] =>
-                let region =
-                  host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
-                `arn:aws:sqs:${region}:${acct}:${name}`
-              | _ => url
-              }
-            )
-          if queueArns->Array.length == 0 {
-            None
+    // One RolePolicy per extension target, each derived through a SINGLE
+    // `.apply` on that target's queue-URL Output. `Pulumi.Output.all` is
+    // deliberately NOT used here: the DCB slice's URL is an `.apply`-lifted
+    // Output (Dcb_Builder reads the queue id via `operations.apply(_ =>
+    // resources[0].id)`), and `Pulumi.Output.all` mis-resolves such lifted
+    // Outputs to the `{BS_PRIVATE_NESTED_SOME_NONE: 0}` sentinel (both at
+    // preview and up) while a direct `.apply` on the same Output resolves the
+    // real URL — verified by deploying both variants. RolePolicy creation
+    // happens at TOP LEVEL: calling `RolePolicy.make` inside a
+    // `Pulumi.Output.apply` callback does not reliably register the resource
+    // (the previous inside-apply variant existed on no collector role in the
+    // account). Dict values are heterogeneous at runtime — plain resolved URL
+    // strings for aggregate targets, Outputs for DCB-slice targets; anything
+    // else is skipped. Inside the apply a non-string URL falls back to a
+    // benign placeholder ARN so the policy document stays valid (IAM rejects
+    // empty Resource entries with MalformedPolicyDocument).
+    // See docs/analysis/ec-publish-to-aggregates-grant-broken.md.
+    aggregateNameSet
+    ->Dict.keysToArray
+    ->Array.forEach(aggName => {
+      let urlOutput = switch context.publishToAggregates->Dict.get(aggName) {
+      | Some(o) if Pulumi.Output.isOutput(o) => Some(o)
+      | Some(o) if typeof(o) === #string => Some(Pulumi.Output.make((o->Obj.magic: string)))
+      | _ => None
+      }
+      switch urlOutput {
+      | Some(urlOutput) =>
+        let policyJson = urlOutput->Pulumi.Output.apply(url => {
+          let arn = if typeof(url) === #string {
+            // queue URL → ARN: https://sqs.<region>.amazonaws.com/<acct>/<name>
+            //                → arn:aws:sqs:<region>:<acct>:<name>
+            switch url->String.split("/") {
+            | [_, _, host, acct, name] =>
+              let region = host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
+              `arn:aws:sqs:${region}:${acct}:${name}`
+            | _ => url
+            }
           } else {
-            Some(
-              PulumiAws.PolicyDocument.make(
-                ~id=`${name}PublishToAggregatesPolicy`,
-                ~statements=[
-                  {
-                    sid: "AllowEcPublishToAggregateCmdTopics",
-                    effect: Allow,
-                    actions: Action("sqs:SendMessage"),
-                    resources: Resources(queueArns),
-                  },
-                ],
-              )->PulumiAws.PolicyDocument.toJsonString,
-            )
+            "arn:aws:sqs:eu-west-1:000000000000:reventless-unresolved-cmd-topic"
           }
-        })
-      // Pulumi.all wraps a Some(string)/None and resolves to either the
-      // policy JSON or undefined — the latter makes PutRolePolicy a no-op
-      // by failing fast in the provider, so guard RolePolicy creation on
-      // the resolved value being Some.
-      let _ =
-        policyJsonOutput->Pulumi.Output.apply(policyOpt =>
-          switch policyOpt {
-          | Some(policyJson) =>
-            let _ = PulumiAws.IAM.RolePolicy.make(
-              ~name=`${name}-publishToAggregates`,
-              ~args={
-                policy: policyJson->Pulumi.Input.make,
-                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          PulumiAws.PolicyDocument.make(
+            ~id=`${name}Pta${aggName}Policy`,
+            ~statements=[
+              {
+                sid: "AllowEcPublishToAggregateCmdTopic",
+                effect: Allow,
+                actions: Action("sqs:SendMessage"),
+                resources: Resource(arn),
               },
-            )
-          | None => ()
-          }
+            ],
+          )->PulumiAws.PolicyDocument.toJsonString
+        })
+        let _ = PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-pta-${aggName}`,
+          ~args={
+            policy: policyJson->Pulumi.Output.asInput,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
         )
-    }
+      | None => ()
+      }
+    })
   }
 
   let forPluginHeartbeat: ReventlessCore.Runtime.forComponent<

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -1,7 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Aws from "@pulumi/aws";
-import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
@@ -366,41 +365,44 @@ function Make(EventCollectorChannel) {
         aggregateNameSet[aggName] = undefined;
       });
     });
-    let queueUrlOutputs = Stdlib_Array.filterMap(Object.keys(aggregateNameSet), aggName => context.publishToAggregates[aggName]);
-    if (queueUrlOutputs.length !== 0) {
-      let policyJsonOutput = Pulumi.all(queueUrlOutputs).apply(urls => {
-        let queueArns = urls.filter(url => typeof url === "string").map(url => {
+    Object.keys(aggregateNameSet).forEach(aggName => {
+      let o = context.publishToAggregates[aggName];
+      let urlOutput = o !== undefined ? (
+          Pulumi.Output.isInstance(o) ? o : (
+              typeof o === "string" ? Pulumi.output(o) : undefined
+            )
+        ) : undefined;
+      if (urlOutput === undefined) {
+        return;
+      }
+      let policyJson = urlOutput.apply(url => {
+        let arn;
+        if (typeof url === "string") {
           let match = url.split("/");
           if (match.length !== 5) {
-            return url;
+            arn = url;
+          } else {
+            let host = match[2];
+            let acct = match[3];
+            let name$1 = match[4];
+            let region = Stdlib_Option.getOr(host.split(".")[1], "eu-west-1");
+            arn = `arn:aws:sqs:` + region + `:` + acct + `:` + name$1;
           }
-          let host = match[2];
-          let acct = match[3];
-          let name = match[4];
-          let region = Stdlib_Option.getOr(host.split(".")[1], "eu-west-1");
-          return `arn:aws:sqs:` + region + `:` + acct + `:` + name;
-        });
-        if (queueArns.length === 0) {
-          return;
         } else {
-          return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `PublishToAggregatesPolicy`, [{
-              Sid: "AllowEcPublishToAggregateCmdTopics",
-              Effect: "Allow",
-              Action: "sqs:SendMessage",
-              Resource: queueArns
-            }]));
+          arn = "arn:aws:sqs:eu-west-1:000000000000:reventless-unresolved-cmd-topic";
         }
+        return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `Pta` + aggName + `Policy`, [{
+            Sid: "AllowEcPublishToAggregateCmdTopic",
+            Effect: "Allow",
+            Action: "sqs:SendMessage",
+            Resource: arn
+          }]));
       });
-      policyJsonOutput.apply(policyOpt => {
-        if (policyOpt !== undefined) {
-          new (Aws.iam.RolePolicy)(name + `-publishToAggregates`, {
-            policy: policyOpt,
-            role: runtime.parts.lambdaRole.id
-          });
-          return;
-        }
+      new (Aws.iam.RolePolicy)(name + `-pta-` + aggName, {
+        policy: policyJson,
+        role: runtime.parts.lambdaRole.id
       });
-    }
+    });
   };
   let forPluginHeartbeat = (param, connect, memorySizeOpt, timeoutOpt, heartbeat) => {
     let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;