@reventlessdev/reventless-aws 3.0.0-alpha.223 → 3.0.0-alpha.225

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -10,64 +10,62 @@ let toResources = (eventTopics: ReventlessCore.EventTopic.allOutputs) =>
   ->Array.flatMap(outputs => outputs.resources)
   ->ReventlessCore.Adapter.resourcesToResolvedOutput
 
-let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, _resources, opts) => {
-  let _ =
-    (queue.arn, queue.id)
-    ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((queueArn, queueId)) => {
-      // SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment
-      // index 4 (0-based). Used to scope cross-plugin SNS sources to this
-      // account (aws:SourceAccount) and to topic names following the
-      // Reventless EventTopic naming convention (aws:SourceArn arnLike).
-      let accountId = queueArn->String.split(":")->Array.get(4)->Option.getOr("")
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            // Single statement allows SendMessage from any SNS topic owned by
-            // this AWS account whose name matches the Reventless EventTopic
-            // naming convention. Replaces the previous per-topic arnEquals
-            // list so cross-plugin SNS subscriptions created at runtime by the
-            // admin's manageSubscriptions hook (Phase 3 Step 1) are accepted
-            // without requiring a redeploy of the receiving plugin. Security
-            // boundary: SourceAccount condition keeps third-party-account
-            // topics out; ArnLike + SNS service principal further narrows
-            // accepted senders to in-account EventTopic resources.
-            {
-              sid: "AllowReceiveSnsEvents",
-              principal: Principals({
-                service: PrincipalIds([AWS.SNS.principal]),
-              }),
-              effect: Allow,
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-              conditions: {
-                stringEquals: [
-                  ("aws:SourceAccount", ConditionValue(accountId)),
-                ]->Dict.fromArray,
-                arnLike: [
-                  ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
-                ]->Dict.fromArray,
-              },
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = {
-        PulumiAws.SQS.QueuePolicy.make(
-          ~name,
-          ~args={
-            queueUrl: queueId->Pulumi.Input.make,
-            policy: queuePolicyDocument,
+let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, opts) => {
+  // The document is a *value* derived from the resolved ARN, so it is built in
+  // an apply. The QueuePolicy itself stays outside: passing `queue.id` as an
+  // Output is what registers the policy -> queue dependency, without which
+  // Pulumi has no ordering constraint and can delete the queue first on a
+  // replacement, leaving the policy's delete polling a queue that is gone.
+  let queuePolicyDocument = queue.arn->Pulumi.Output.apply(queueArn => {
+    // Scopes cross-plugin SNS sources to this account (aws:SourceAccount) and
+    // to topic names following the Reventless EventTopic naming convention
+    // (aws:SourceArn arnLike).
+    let accountId = queueArn->accountIdOfQueueArn
+    PulumiAws.PolicyDocument.make(
+      ~id=name ++ "QueuePolicy",
+      ~statements=[
+        // Single statement allows SendMessage from any SNS topic owned by
+        // this AWS account whose name matches the Reventless EventTopic
+        // naming convention. A per-topic arnEquals list would require a
+        // redeploy of the receiving plugin whenever the platform's
+        // manageSubscriptions hook creates a cross-plugin SNS subscription at
+        // runtime. Security boundary: SourceAccount keeps third-party-account
+        // topics out; ArnLike + SNS service principal further narrows accepted
+        // senders to in-account EventTopic resources.
+        {
+          sid: "AllowReceiveSnsEvents",
+          principal: Principals({
+            service: PrincipalIds([AWS.SNS.principal]),
+          }),
+          effect: Allow,
+          actions: Actions(["sqs:SendMessage"]),
+          resources: Resource(queueArn),
+          conditions: {
+            stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+            arnLike: [
+              ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
+            ]->Dict.fromArray,
           },
-          ~opts=Some(opts),
-        )
-      }
-    })
+        },
+      ],
+    )->toJsonString
+  })
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
-let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Adapter.resolvedResource>, opts) => {
+let subscribeQueue2SnsTopic = (
+  queue,
+  name,
+  resources: array<ReventlessInfra.Adapter.resolvedResource>,
+  opts,
+) => {
   let _snsTopicSubscriptions = resources->Array.map(resource => {
     log.debug(~comp="EventCollector", `subscribeToSnsTopic: ${name} -> ${resource.name}`)
     let subscription = Util_SQS.subscribeToSnsTopic(
@@ -82,20 +80,35 @@ let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Ada
 }
 
 let connectSqsQueue2SnsTopics = (queue: PulumiAws.SQS.Queue.t, name, eventTopics, opts) => {
+  // The policy grants SendMessage to any in-account EventTopic by naming
+  // convention, so it does not depend on the resolved topic resources and is
+  // created outside the apply. Only the SNS subscriptions need them.
+  queue->createQueuePolicy(name, opts)
   let _ =
     (eventTopics->toResources, queue.id)
     ->Pulumi.Output.all2
     ->Pulumi.Output.apply(((eventTopicResources, queueId)) => {
       log.debug(
         ~comp="EventCollector",
-        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources->Array.length->Int.toString} topic resource(s)`,
+        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources
+          ->Array.length
+          ->Int.toString} topic resource(s)`,
       )
-      let snsResources = eventTopicResources->snsResources
-      queue->createQueuePolicy(name, snsResources, opts)
-      queue->subscribeQueue2SnsTopic(name, snsResources, opts)
+      queue->subscribeQueue2SnsTopic(name, eventTopicResources->snsResources, opts)
     })
 }
 
+// The EventCollector's transport wiring: one mapping per stream source plus one
+// per buffer queue. `~component=name` keeps them attributed to the collector they
+// feed, not to the mapping's own generated name.
+let esmTags = (name, esmName) =>
+  AWS.Tags.make(
+    ~name=esmName,
+    ~kind=ReventlessCore.EventCollector.componentType,
+    ~role=EventSourceMapping,
+    ~component=name,
+  )
+
 let connectLambda = (
   lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   name: string,
@@ -252,6 +265,10 @@ let connectLambda = (
             ~targetName=name,
             ~sourceName=dynamoDbStreamResource.name,
             ~source=dynamoDbStreamResource->ReventlessCore.AdapterDeploytime.resolvedToResource,
+            ~tags=esmTags(
+              name,
+              dynamoDbStreamResource.name->ReventlessCore.Util.baseName ++ ("2" ++ name),
+            ),
             ~opts,
           )
         )
@@ -259,7 +276,13 @@ let connectLambda = (
 
   let subscriptionResources = queues->Array.mapWithIndex((queue, idx) => {
     let esmName = queues->Array.length > 1 ? `${name}Sqs${Int.toString(idx)}` : name
-    Util_EventSourceMapping.subscribeSqs(~lambda, ~name=esmName, ~queue, ~opts)
+    Util_EventSourceMapping.subscribeSqs(
+      ~lambda,
+      ~name=esmName,
+      ~queue,
+      ~tags=esmTags(name, esmName),
+      ~opts,
+    )
   })
 
   subscriptionResources

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -2,15 +2,17 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
+import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as AdapterDeploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/AdapterDeploytime.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
@@ -20,14 +22,10 @@ function toResources(eventTopics) {
   return Adapter$ReventlessCore.resourcesToResolvedOutput(Object.values(eventTopics).flatMap(outputs => outputs.resources));
 }
 
-function createQueuePolicy(queue, name, _resources, opts) {
-  Pulumi.all([
-    queue.arn,
-    queue.id
-  ]).apply(param => {
-    let queueArn = param[0];
-    let accountId = Stdlib_Option.getOr(queueArn.split(":")[4], "");
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
+function createQueuePolicy(queue, name, opts) {
+  let queuePolicyDocument = queue.arn.apply(queueArn => {
+    let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+    return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
         Sid: "AllowReceiveSnsEvents",
         Principal: {
           Service: [AWS$ReventlessAws.SNS.principal]
@@ -46,11 +44,11 @@ function createQueuePolicy(queue, name, _resources, opts) {
             ]])
         }
       }]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
   });
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function subscribeQueue2SnsTopic(queue, name, resources, opts) {
@@ -62,18 +60,21 @@ function subscribeQueue2SnsTopic(queue, name, resources, opts) {
 }
 
 function connectSqsQueue2SnsTopics(queue, name, eventTopics, opts) {
+  createQueuePolicy(queue, name, opts);
   Pulumi.all([
     toResources(eventTopics),
     queue.id
   ]).apply(param => {
     let eventTopicResources = param[0];
     log.debug("EventCollector", undefined, `connectSqsQueue2SnsTopics ` + param[1] + `: ` + eventTopicResources.length.toString() + ` topic resource(s)`);
-    let snsResources = Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources);
-    createQueuePolicy(queue, name, snsResources, opts);
-    subscribeQueue2SnsTopic(queue, name, snsResources, opts);
+    subscribeQueue2SnsTopic(queue, name, Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources), opts);
   });
 }
 
+function esmTags(name, esmName) {
+  return AWS_Tags$ReventlessAws.make(esmName, EventCollector$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined);
+}
+
 function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
   Pulumi.all([
     toResources(eventTopics),
@@ -147,11 +148,11 @@ function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources,
       ])),
       role: lambdaRole.id
     }, opts);
-    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), opts));
+    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), esmTags(name, Util$ReventlessCore.baseName(dynamoDbStreamResource.name) + ("2" + name)), opts));
   });
   return queues.map((queue, idx) => {
     let esmName = queues.length > 1 ? name + `Sqs` + idx.toString() : name;
-    return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, opts);
+    return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, esmTags(name, esmName), opts);
   });
 }
 
@@ -161,6 +162,7 @@ export {
   createQueuePolicy,
   subscribeQueue2SnsTopic,
   connectSqsQueue2SnsTopics,
+  esmTags,
   connectLambda,
 }
 /* log Not a pure module */

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res

@@ -108,44 +108,52 @@ let make = (
       )
       ->Pulumi.Output.asInput,
       sqsManagedSseEnabled: false->Pulumi.Input.make,
+      tags: AWS.Tags.make(
+        ~name=name ++ "EventLogSubQueue",
+        ~kind=ReventlessCore.EventTopic.componentType,
+        ~role=EventLogSubscription,
+        ~component=name,
+      ),
     },
     ~opts,
   )
 
   // SQS queue policy — allow SNS to send messages
   let snsResource = eventTopicOutputs.resources->Array.getUnsafe(0)
-  let _ =
-    (queue.arn, queue.id, snsResource.urn)
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, snsUrn)) => {
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, snsResource.urn)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, snsUrn)) => {
       open PolicyDocument
-      let _queuePolicy = SQS.QueuePolicy.make(
-        ~name=name ++ "EventLogSubQueuePolicy",
-        ~args={
-          queueUrl: queueId->Pulumi.Input.make,
-          policy: PolicyDocument.make(
-            ~id=name ++ "EventLogSubQueuePolicy",
-            ~statements=[
-              {
-                sid: "AllowSNSSend",
-                principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
-                effect: Allow,
-                actions: Actions(["sqs:SendMessage"]),
-                resources: Resource(queueArn),
-                conditions: {
-                  arnEquals: [
-                    ("aws:SourceArn", ConditionValues([snsUrn])),
-                  ]->Dict.fromArray,
-                },
-              },
-            ],
-          )
-          ->PolicyDocument.toJsonString
-          ->Pulumi.Input.make,
-        },
-        ~opts=Some(opts),
-      )
+      PolicyDocument.make(
+        ~id=name ++ "EventLogSubQueuePolicy",
+        ~statements=[
+          {
+            sid: "AllowSNSSend",
+            principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
+            effect: Allow,
+            actions: Actions(["sqs:SendMessage"]),
+            resources: Resource(queueArn),
+            conditions: {
+              arnEquals: [("aws:SourceArn", ConditionValues([snsUrn]))]->Dict.fromArray,
+            },
+          },
+        ],
+      )->PolicyDocument.toJsonString
     })
+  let _queuePolicy = SQS.QueuePolicy.make(
+    ~name=name ++ "EventLogSubQueuePolicy",
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 
   // SNS → SQS subscription (raw delivery so body IS the event JSON)
   let _subscription = Util_SQS.subscribeToSnsTopic(
@@ -264,6 +272,12 @@ let make = (
     ~lambda=lambdaOutput,
     ~name=name ++ "EventLogSubEventSourceMapping",
     ~queue,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "EventLogSubEventSourceMapping",
+      ~kind=ReventlessCore.EventTopic.componentType,
+      ~role=EventSourceMapping,
+      ~component=name,
+    ),
     ~opts,
   )
 }

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res.mjs

@@ -81,34 +81,33 @@ export async function handler(event) {
 function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
   let queue = new (Aws.sqs.Queue)(name + "EventLogSubQueue", {
     redrivePolicy: Util_DeadLetterQueue$ReventlessAws.queue.arn.apply(dlqArn => SQS_Queue$PulumiAws.RedrivePolicy.make(dlqArn, 5)),
+    tags: AWS_Tags$ReventlessAws.make(name + "EventLogSubQueue", EventTopic$ReventlessCore.componentType, "EventLogSubscription", undefined, name, undefined, undefined, undefined),
     visibilityTimeoutSeconds: 60,
     sqsManagedSseEnabled: false
   }, opts);
   let snsResource = eventTopicOutputs.resources[0];
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     snsResource.urn
-  ]).apply(param => {
-    new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
-          Sid: "AllowSNSSend",
-          Principal: {
-            Service: [AWS$ReventlessAws.SNS.principal]
-          },
-          Effect: "Allow",
-          Action: ["sqs:SendMessage"],
-          Resource: param[0],
-          Condition: {
-            ArnEquals: Object.fromEntries([[
-                "aws:SourceArn",
-                [param[2]]
-              ]])
-          }
-        }])),
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
+      Sid: "AllowSNSSend",
+      Principal: {
+        Service: [AWS$ReventlessAws.SNS.principal]
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: param[0],
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "aws:SourceArn",
+            [param[1]]
+          ]])
+      }
+    }])));
+  new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
   Util_SQS$ReventlessAws.subscribeToSnsTopic(queue, name + "EventLogSub", name, snsResource, opts);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "EventLogSubRole", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "EventLogSubRole", EventTopic$ReventlessCore.componentType, "Identity", undefined, name, undefined, undefined, undefined), opts);
   Pulumi.all([
@@ -174,7 +173,7 @@ function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
     sourceCodeHash: sourceCodeHash
   }, opts);
   let lambdaOutput = Pulumi.output(lambda);
-  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambdaOutput, name + "EventLogSubEventSourceMapping", queue, undefined, opts);
+  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambdaOutput, name + "EventLogSubEventSourceMapping", queue, undefined, AWS_Tags$ReventlessAws.make(name + "EventLogSubEventSourceMapping", EventTopic$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined), opts);
 }
 
 export {

package/src/adapter/Postgres/PgProjectionFeed.res

@@ -51,6 +51,14 @@ let makeQueue = (
       )
       ->Pulumi.Output.asInput,
       sqsManagedSseEnabled: false->Pulumi.Input.make,
+      // Plugin substrate: one shared feed per plugin ("AllReadModelsFeed"), not a
+      // resource any single component owns.
+      tags: AWS.Tags.make(
+        ~name,
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=EventCollector,
+        ~scope=Plugin,
+      ),
     },
     ~opts,
   )
@@ -69,7 +77,18 @@ let connect = (
   ~lambdaRole: PulumiAws.IAM.Role.t,
   ~opts: Pulumi.CustomResourceOptions.t,
 ) => {
-  let _esm = Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~opts)
+  let _esm = Util_EventSourceMapping.subscribeSqs(
+    ~lambda,
+    ~name,
+    ~queue,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Plugin,
+      ~role=EventSourceMapping,
+      ~scope=Plugin,
+    ),
+    ~opts,
+  )
   let _policy = queue.arn->Pulumi.Output.apply(queueArn => {
     open PulumiAws.PolicyDocument
     PulumiAws.IAM.RolePolicy.make(

package/src/adapter/Postgres/PgProjectionFeed.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as SQS_Queue$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/SQS/SQS_Queue.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
@@ -15,6 +16,7 @@ function getFeedQueues() {
 function makeQueue(name, scope, includeClassic, includeDcb, opts) {
   let queue = new (Aws.sqs.Queue)(name, {
     redrivePolicy: Util_DeadLetterQueue$ReventlessAws.queue.arn.apply(dlqArn => SQS_Queue$PulumiAws.RedrivePolicy.make(dlqArn, 5)),
+    tags: AWS_Tags$ReventlessAws.make(name, "Plugin", "EventCollector", "Plugin", undefined, undefined, undefined, undefined),
     visibilityTimeoutSeconds: 120,
     sqsManagedSseEnabled: false
   }, opts);
@@ -29,7 +31,7 @@ function makeQueue(name, scope, includeClassic, includeDcb, opts) {
 }
 
 function connect(name, queue, lambda, lambdaRole, opts) {
-  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, opts);
+  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, AWS_Tags$ReventlessAws.make(name, "Plugin", "EventSourceMapping", "Plugin", undefined, undefined, undefined, undefined), opts);
   queue.arn.apply(queueArn => new (Aws.iam.RolePolicy)(name + `Receive`, {
     policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `ReceivePolicy`, [{
         Sid: "AllowReceiveFeedQueue",

package/src/adapter/Runtime/EventCollectorEntryPoint.mjs

@@ -430,7 +430,11 @@ const importFromAsset = (() => {
 async function buildHandler() {
   const config = parseHandlerConfig(process.env["HANDLER_CONFIG"]);
   const pluginDefinition = loadPluginDefinition();
-  const lambdaFunctionName = process.env["AWS_LAMBDA_FUNCTION_NAME"] || "unknown";
+  // Stack name, not the function name — see PluginExtensionPointEntryPoint for
+  // why the disconnect schedule's rule prefix must not carry a content hash.
+  // Both entry points instantiate the same admin Plugin EP module, so they have
+  // to derive this identically.
+  const environment = process.env["Environment"] || "unknown";
 
   // runtimeOps carries only what the admin EP mapping's callHandler actually
   // needs: sendMessageToChannel for ForwardCommand. Cross-plugin SNS
@@ -496,7 +500,7 @@ async function buildHandler() {
       // Admin's Plugin EP: invoke the Make functor with runtime ops.
       const epModule = mappingsMod.Make({
         runtimeOps,
-        environment: lambdaFunctionName,
+        environment,
         // Connect-driven schema self-heal retired (Phase 4b) — the ApiSchemaPush
         // SideEffect on ApiFragmentRegistry events is the single schema writer.
         updateApiSchema: undefined,

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs

@@ -37,10 +37,17 @@ function buildHandler() {
   // Instantiate Plugin EP mapping. updateApiSchema and manageSubscriptions are
   // admin-only hooks; this Lambda only handles incoming commands (Heartbeat,
   // ForwardCommand) so they stay undefined here.
-  const lambdaFunctionName = process.env["AWS_LAMBDA_FUNCTION_NAME"] || "unknown";
+  //
+  // `environment` prefixes the disconnect schedule's EventBridge rule name, so it
+  // must be stable across deploys and unique per stack. The stack name is both;
+  // AWS_LAMBDA_FUNCTION_NAME is neither — it carries a content hash, so replacing
+  // this Lambda would orphan every outstanding rule the previous generation
+  // created. EventCollectorEntryPoint instantiates the same EP module and must
+  // agree, or one Lambda creates rules the other cannot delete.
+  const environment = process.env["Environment"] || "unknown";
   const pluginModule = pluginEPPluginMake({
     runtimeOps,
-    environment: lambdaFunctionName,
+    environment,
     updateApiSchema: undefined,
     manageSubscriptions: undefined,
   });

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -27,15 +27,21 @@ let make: ReventlessCore.Runtime.environmentMaker<'event, context, 'result, part
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
+  // Legacy path (see above): no component kind reaches here because nothing calls
+  // it, so it is attributed to the Platform rather than to an invented domain kind.
+  let tags = AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Platform, ~role=Runtime, ~scope=Platform)
+
   let lambdaRole = IAM.Role.makeWithDefaultPolicy(
     ~name,
     ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
     ~opts?,
   )
-
-  // Legacy path (see above): no component kind reaches here because nothing calls
-  // it, so it is attributed to the Platform rather than to an invented domain kind.
-  let tags = AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Platform, ~role=Runtime, ~scope=Platform)
   let lambda =
     handler->Pulumi.Output.apply(handler =>
       Lambda.CallbackFunction.make(

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -29,8 +29,8 @@ function make(name, handler, memorySizeOpt, timeoutOpt, opts) {
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : 30;
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
-  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), undefined, opts$1);
   let tags = AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   let lambda = handler.apply(handler => new (Aws.lambda.CallbackFunction)(name, Lambda$PulumiAws.CallbackFunction.Args.make(handler, lambdaRole, undefined, undefined, undefined, memorySize, timeout, undefined, undefined, undefined, tags, undefined), opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined));
   return {
     parts: {

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -410,14 +410,21 @@ let finish = (
     // isolates the bad record across those retries instead of redelivering
     // the whole batch each time.
     entries->Array.forEach(entry => {
+      let esmName = entry.topicName ++ "Stream2" ++ name ++ "StateTopic"
       let _esm = EventSourceMapping.make(
-        ~name=entry.topicName ++ "Stream2" ++ name ++ "StateTopic",
+        ~name=esmName,
         ~args={
           EventSourceMapping.functionName: lambda.arn->Pulumi.Output.asInput,
           eventSourceArn: entry.streamArn->Pulumi.Output.asInput,
           startingPosition: LATEST,
           maximumRetryAttempts: 3,
           bisectBatchOnFunctionError: true,
+          tags: AWS.Tags.make(
+            ~name=esmName,
+            ~kind=ReventlessCore.QueryDb.componentType,
+            ~role=EventSourceMapping,
+            ~component=name,
+          ),
         },
         ~opts=Some(opts),
       )

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -284,12 +284,14 @@ function finish(eventsApi, opts) {
     sourceCodeHash: sourceCodeHash
   }, opts);
   entries.forEach(entry => {
-    new (Aws.lambda.EventSourceMapping)(entry.topicName + "Stream2" + name + "StateTopic", {
+    let esmName = entry.topicName + "Stream2" + name + "StateTopic";
+    new (Aws.lambda.EventSourceMapping)(esmName, {
       functionName: lambda.arn,
       bisectBatchOnFunctionError: true,
       eventSourceArn: entry.streamArn,
       maximumRetryAttempts: 3,
-      startingPosition: "LATEST"
+      startingPosition: "LATEST",
+      tags: AWS_Tags$ReventlessAws.make(esmName, QueryDb$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined)
     }, opts);
   });
   registry[key] = [];

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -209,6 +209,12 @@ export const handler = async (event) => {
           cpu: "1024"->Pulumi.Input.make,
           requiresCompatibilities: ["FARGATE"],
           networkMode: #awsvpc,
+          tags: AWS.Tags.make(
+            ~name,
+            ~kind=ReventlessCore.Cloner.componentType,
+            ~role=DataTransfer,
+            ~component=name,
+          ),
         },
         ~opts?,
       )