@reventlessdev/reventless-aws 3.0.0-alpha.227 → 3.0.0-alpha.228

package/src/adapter/Geocoder/Geocoder_AwsLocation.res.mjs

@@ -0,0 +1,168 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as ClientLocation from "@aws-sdk/client-location";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+
+let getEnv = (function(k) { var v = process.env[k]; return (v === undefined || v === null || v === "") ? undefined : v; });
+
+function corsHeaders() {
+  return Object.fromEntries([
+    [
+      "content-type",
+      "application/json"
+    ],
+    [
+      "access-control-allow-origin",
+      "*"
+    ],
+    [
+      "access-control-allow-methods",
+      "GET,OPTIONS"
+    ],
+    [
+      "access-control-allow-headers",
+      "*"
+    ]
+  ]);
+}
+
+function readQueryParam(event) {
+  let q = Stdlib_Option.flatMap(event.queryStringParameters, p => p["q"]);
+  if (q !== undefined) {
+    return q;
+  } else {
+    return Stdlib_Option.flatMap(event.rawQueryString, raw => Stdlib_Array.findMap(raw.split("&"), pair => {
+      let match = pair.split("=");
+      if (match.length !== 2) {
+        return;
+      }
+      let k = match[0];
+      let v = match[1];
+      if (k === "q") {
+        return decodeURIComponent(v);
+      }
+    }));
+  }
+}
+
+async function handleGeocode(event, _context) {
+  try {
+    let indexName = Stdlib_Option.getOr(getEnv("PLACE_INDEX_NAME"), "");
+    let q = Stdlib_Option.getOr(readQueryParam(event), "");
+    if (indexName === "" || q === "") {
+      return {
+        statusCode: 200,
+        headers: corsHeaders(),
+        body: "[]"
+      };
+    }
+    let client = new ClientLocation.LocationClient();
+    let resp = await client.send(new ClientLocation.SearchPlaceIndexForTextCommand({
+      IndexName: indexName,
+      Text: q,
+      MaxResults: 5
+    }));
+    let results = Stdlib_Array.filterMap(Stdlib_Option.getOr(resp.Results, []), r => {
+      let place = r.Place;
+      if (place === undefined) {
+        return;
+      }
+      let label = Stdlib_Option.getOr(place.Label, "");
+      let pt = Stdlib_Option.flatMap(place.Geometry, g => g.Point);
+      if (pt === undefined) {
+        return;
+      }
+      if (pt.length < 2) {
+        return;
+      }
+      let lng = pt[0];
+      let lat = pt[1];
+      return Object.fromEntries([
+        [
+          "label",
+          label
+        ],
+        [
+          "lat",
+          lat
+        ],
+        [
+          "lng",
+          lng
+        ]
+      ]);
+    });
+    return {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: JSON.stringify(results)
+    };
+  } catch (exn) {
+    return {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: "[]"
+    };
+  }
+}
+
+function make(placeIndexName, corsOriginsOpt, opts) {
+  let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
+  let serviceName = "GeocoderService";
+  let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(serviceName, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  placeIndexName.apply(idx => {
+    let arn = `arn:aws:geo:*:*:place-index/` + idx;
+    new (Aws.iam.RolePolicy)(serviceName + `Policy`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, serviceName + `Policy`, [{
+          Sid: "AllowGeocode",
+          Effect: "Allow",
+          Action: "geo:SearchPlaceIndexForText",
+          Resource: arn
+        }])),
+      role: lambdaRole.id
+    }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  });
+  let environment = {
+    variables: Object.fromEntries([[
+        "PLACE_INDEX_NAME",
+        placeIndexName
+      ]])
+  };
+  let lambda = new (Aws.lambda.CallbackFunction)(serviceName, Lambda$PulumiAws.CallbackFunction.Args.make(handleGeocode, lambdaRole, undefined, undefined, undefined, undefined, 30, undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined), environment), opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
+    authorizationType: "NONE",
+    functionName: lambda.name,
+    cors: {
+      allowHeaders: ["*"].map(prim => prim),
+      allowMethods: ["GET"].map(prim => prim),
+      allowOrigins: corsOrigins.map(prim => prim)
+    }
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  return {
+    url: functionUrl.functionUrl,
+    resources: [
+      lambda.arn,
+      functionUrl.functionArn
+    ]
+  };
+}
+
+export {
+  getEnv,
+  corsHeaders,
+  readQueryParam,
+  handleGeocode,
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Mcp/MCP_Lambda.res

@@ -8,10 +8,11 @@
 // backend as AppSync resolvers. Event history resources read directly from
 // EventLog and DcbEventLog DynamoDB tables.
 //
-// NOTE: Lambda Function URL bindings for rescript-pulumi-aws are not yet
-// available. This module provides the runtime MCP server handler that will
-// be deployed once the Pulumi bindings are added. The deploy-time infrastructure
-// (Lambda + Function URL + IAM role) is documented but not yet wired to Pulumi.
+// NOTE: This module provides the runtime MCP server handler. The Lambda
+// Function URL binding now exists (PulumiAws.Lambda.FunctionUrl), so the
+// deploy-time infrastructure (Lambda + Function URL + IAM role) can be wired to
+// Pulumi following the Geocoder_AwsLocation / Upload_Presign_S3 adapters; the
+// section below still documents the concrete shape that wiring takes.
 
 // ─── Runtime handler ───────────────────────────────────────────────────────
 
@@ -410,10 +411,10 @@ let dispatchTool = async (
   )
 }
 
-// ─── Deploy-time infrastructure (placeholder) ─────────────────────────────
+// ─── Deploy-time infrastructure (documented shape) ────────────────────────
 //
-// When rescript-pulumi-aws gains Lambda Function URL bindings, this section
-// will create:
+// With the Lambda Function URL binding now available, this section documents
+// the resources a full MCP deploy path creates:
 //
 //   1. Lambda function (Node.js 20.x runtime)
 //      - Handler: mcp-handler.handler

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -262,7 +262,13 @@ let makeFromCodeAsset: (
     // is no race against Lambda's lazy auto-created group. Namespace/dimension
     // are CloudWatch-specific and live here, not in core (provider-neutral).
     if dcbMetrics {
-      ["AppendRetry", "AppendConflict"]->Array.forEach(metricName => {
+      [
+        "AppendRetry",
+        "AppendConflict",
+        "DcbDecisionModelCacheHit",
+        "DcbDecisionModelCacheMiss",
+        "DcbDecisionModelDeltaEventCount",
+      ]->Array.forEach(metricName => {
         let _ = Cloudwatch.LogMetricFilter.make(
           ~name=`${name}${metricName}Filter`,
           ~args={

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -126,7 +126,10 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     if (dcbMetrics) {
       [
         "AppendRetry",
-        "AppendConflict"
+        "AppendConflict",
+        "DcbDecisionModelCacheHit",
+        "DcbDecisionModelCacheMiss",
+        "DcbDecisionModelDeltaEventCount"
       ].forEach(metricName => {
         new (Aws.cloudwatch.LogMetricFilter)(name + metricName + `Filter`, {
           pattern: `{ $.reventlessMetric = "` + metricName + `" }`,

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -71,8 +71,14 @@ export function buildJsonEventsHandler(specModule, projectionModule, queryDbTabl
     Stream.flatMap(
       Stream.mapEffect(stream, json => Effect.sync(() => {
         try {
+          // Events arrive as `{id, meta, recordedAt, event}` envelopes
+          // (Util_DynamoDbStream_Runtime.buildJsonEvent' / PgChangeFeedRelay).
+          // Surface `meta` + `recordedAt` to the projection as the `consumed`
+          // envelope; `recordedAt` defaults to "" if a producer omitted it.
           const eventJson = json.event != null ? json.event : json;
-          return project(parseJsonOrThrow(eventJson, eventSchema));
+          const meta = json.meta;
+          const recordedAt = json.recordedAt != null ? json.recordedAt : "";
+          return project({ event: parseJsonOrThrow(eventJson, eventSchema), meta, recordedAt });
         } catch (exn) {
           log.error("failed to decode event", { comp: "StateViewSliceRuntime", detail: exn && exn.message ? exn.message : String(exn) });
           return [];

package/src/adapter/Task/TaskBucket_S3.res

@@ -132,11 +132,11 @@ let make: ReventlessCore.Task_Adapter.bucketMaker<bucketParts> = (~name, ~opts)
         corsRules: [
           {
             PulumiAws.S3.Bucket.allowedHeaders: ["*"],
-            allowedMethods: ["HEAD", "GET"],
+            allowedMethods: ["HEAD", "GET", "PUT", "POST"],
             allowedOrigins: ["*"],
             exposeHeaders: [
               "x-amz-server-side-encryption",
-              ">x-amz-request-id",
+              "x-amz-request-id",
               "x-amz-id-2",
               "ETag",
             ],

package/src/adapter/Task/TaskBucket_S3.res.mjs

@@ -80,12 +80,14 @@ function make(name, opts) {
         allowedHeaders: ["*"],
         allowedMethods: [
           "HEAD",
-          "GET"
+          "GET",
+          "PUT",
+          "POST"
         ],
         allowedOrigins: ["*"],
         exposeHeaders: [
           "x-amz-server-side-encryption",
-          ">x-amz-request-id",
+          "x-amz-request-id",
           "x-amz-id-2",
           "ETag"
         ],

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -0,0 +1,258 @@
+// Direct-to-S3 upload presign service behind a public Lambda Function URL.
+//
+// Deploy-time: `make` provisions a CallbackFunction (handler closure serialized
+// by Pulumi), an IAM execution role scoped to `s3:PutObject` on the target
+// bucket, and a Function URL (no auth) so a browser can request a presigned PUT.
+//
+// Runtime: `handlePresign` reads a JSON body `{fileName, contentType}`, derives
+// a target key `uploads/<identity?>/<uuid>/<fileName>`, presigns a PUT to the
+// bucket named in `UPLOAD_BUCKET` (expires in 300s), and returns
+// `{uploadUrl, storageRef}`. A Bearer token, when present, is decoded (no
+// signature verification here — that is the auth layer's job) and its `sub`
+// namespaces the key; anonymous callers are still served for the demo.
+
+open PulumiAws
+
+// ── AWS SDK v3 bindings ─────────────────────────────────────────────────────
+
+type s3Client
+
+type putObjectInput = {
+  @as("Bucket") bucket: string,
+  @as("Key") key: string,
+  @as("ContentType") contentType?: string,
+}
+type putObjectCommand
+
+@module("@aws-sdk/client-s3") @new external makeS3Client: unit => s3Client = "S3Client"
+
+@module("@aws-sdk/client-s3") @new
+external makePutObjectCommand: putObjectInput => putObjectCommand = "PutObjectCommand"
+
+type presignOptions = {expiresIn: int}
+
+@module("@aws-sdk/s3-request-presigner")
+external getSignedUrl: (s3Client, putObjectCommand, presignOptions) => promise<string> =
+  "getSignedUrl"
+
+// ── Function URL event / response shapes (payload format 2.0) ────────────────
+
+type functionUrlEvent = {
+  body?: string,
+  headers?: dict<string>,
+}
+
+type response = {
+  statusCode: int,
+  headers?: dict<string>,
+  body: string,
+}
+
+let getEnv: string => option<string> = %raw(`
+  function(k) { var v = process.env[k]; return (v === undefined || v === null || v === "") ? undefined : v; }
+`)
+
+// Node 22 exposes globalThis.crypto.randomUUID; fall back to node:crypto.
+let genUuid: unit => string = %raw(`
+  function() {
+    return (globalThis.crypto && globalThis.crypto.randomUUID)
+      ? globalThis.crypto.randomUUID()
+      : require("crypto").randomUUID();
+  }
+`)
+
+// Decode a JWT payload's `sub` claim without verifying the signature (the auth
+// layer verifies; here we only namespace the storage key).
+let decodeJwtSub: string => option<string> = %raw(`
+  function(header) {
+    try {
+      var token = header.indexOf("Bearer ") === 0 ? header.slice(7) : header;
+      var parts = token.split(".");
+      if (parts.length < 2) return undefined;
+      var base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+      var json = Buffer.from(base64, "base64").toString("utf8");
+      var claims = JSON.parse(json);
+      return (claims && claims.sub) ? String(claims.sub) : undefined;
+    } catch (_) { return undefined; }
+  }
+`)
+
+let corsHeaders = () =>
+  Dict.fromArray([
+    ("content-type", "application/json"),
+    ("access-control-allow-origin", "*"),
+    ("access-control-allow-methods", "POST,OPTIONS"),
+    ("access-control-allow-headers", "*"),
+  ])
+
+// Key prefix from the caller identity when a Bearer token is present.
+let identityPrefix = (event: functionUrlEvent): string => {
+  let authHeader =
+    event.headers->Option.flatMap(h =>
+      h->Dict.get("authorization")->Option.orElse(h->Dict.get("Authorization"))
+    )
+  switch authHeader->Option.flatMap(decodeJwtSub) {
+  | Some(sub) => `${sub}/`
+  | None => ""
+  }
+}
+
+// ── Runtime handler ─────────────────────────────────────────────────────────
+
+let handlePresign = async (event: functionUrlEvent, _context: Lambda.context): response => {
+  try {
+    let bucket = getEnv("UPLOAD_BUCKET")->Option.getOr("")
+    let parsed =
+      event.body
+      ->Option.getOr("{}")
+      ->JSON.parseOrThrow
+      ->JSON.Decode.object
+      ->Option.getOr(Dict.make())
+    let fileName =
+      parsed->Dict.get("fileName")->Option.flatMap(JSON.Decode.string)->Option.getOr("upload")
+    let contentType = parsed->Dict.get("contentType")->Option.flatMap(JSON.Decode.string)
+
+    // The object key doubles as the served path segment: it is rooted at the
+    // served prefix (`SERVED_PREFIX`, e.g. `uploads`) so the CloudFront
+    // `{prefix}/*` behavior fronts it. Callers PUT to this exact key.
+    let servedPrefix = getEnv("SERVED_PREFIX")->Option.getOr("uploads")
+    let key = `${servedPrefix}/${identityPrefix(event)}${genUuid()}/${fileName}`
+    let client = makeS3Client()
+    let command = makePutObjectCommand({bucket, key, contentType: ?contentType})
+    let uploadUrl = await getSignedUrl(client, command, {expiresIn: 300})
+
+    // The stored ref is a same-origin relative URL `/{key}`: the served bucket is
+    // fronted read-only by the UI's own CloudFront distribution under
+    // `{prefix}/*`, so a command stores this directly-renderable value and an
+    // `image`-semantic field thumbnails it with no post-processing and no public
+    // bucket. See [docs/plans/done/ui-served-buckets.md].
+    let storageRef = `/${key}`
+
+    {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: Dict.fromArray([
+        ("uploadUrl", JSON.Encode.string(uploadUrl)),
+        ("storageRef", JSON.Encode.string(storageRef)),
+      ])
+      ->JSON.Encode.object
+      ->JSON.stringify,
+    }
+  } catch {
+  | _ => {
+      statusCode: 400,
+      headers: corsHeaders(),
+      body: Dict.fromArray([("error", JSON.Encode.string("presign_failed"))])
+      ->JSON.Encode.object
+      ->JSON.stringify,
+    }
+  }
+}
+
+// ── Deploy-time factory ─────────────────────────────────────────────────────
+
+type serviceOutputs = {
+  url: Pulumi.Output.t<string>,
+  resources: array<Pulumi.Output.t<string>>,
+}
+
+let make = (
+  ~bucketName: Pulumi.Input.t<string>,
+  ~corsOrigins: array<string>=["*"],
+  // Prefix the presigned object keys are rooted at; must match the served
+  // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
+  // resolves. Defaults to `uploads`.
+  ~servedPrefix: string="uploads",
+  ~opts=?,
+): serviceOutputs => {
+  let serviceName = "UploadPresignService"
+  let opts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=serviceName,
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=serviceName,
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts?,
+  )
+
+  // Least-privilege: PutObject on any key under the target bucket.
+  let _policy =
+    bucketName
+    ->Pulumi.Output.fromInput
+    ->Pulumi.Output.apply(b => {
+      let arn = `arn:aws:s3:::${b}/*`
+      let _ = IAM.RolePolicy.make(
+        ~name=`${serviceName}Policy`,
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=`${serviceName}Policy`,
+            ~statements=[
+              {
+                sid: "AllowUploadPut",
+                effect: Allow,
+                actions: Action("s3:PutObject"),
+                resources: Resource(arn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts?,
+      )
+    })
+
+  let environment: Lambda.CallbackFunction.Args.functionEnvironment = {
+    // CallbackFunction under-types env values as `dict<string>`; Pulumi resolves
+    // Output-valued variables at deploy time, so bridge the Input here.
+    variables: Dict.fromArray([
+      ("UPLOAD_BUCKET", bucketName),
+      ("SERVED_PREFIX", Pulumi.Input.make(servedPrefix)),
+    ])->Obj.magic,
+  }
+
+  let lambda = Lambda.CallbackFunction.make(
+    ~name=serviceName,
+    ~args=Lambda.CallbackFunction.Args.make(
+      ~callback=handlePresign,
+      ~role=lambdaRole,
+      ~environment,
+      ~timeout=30->Pulumi.Input.make,
+      ~tags=AWS.Tags.make(
+        ~name=serviceName,
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Runtime,
+        ~scope=Platform,
+      ),
+    ),
+    ~opts?,
+  )
+
+  let functionUrl = FunctionUrl.make(
+    ~name=`${serviceName}Url`,
+    ~args={
+      authorizationType: FunctionUrl.None,
+      functionName: lambda.name->Pulumi.Output.asInput,
+      cors: (
+        {
+          allowMethods: ["POST"]->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
+          allowOrigins: corsOrigins->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
+          allowHeaders: ["*"]->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
+        }: FunctionUrl.cors
+      )->Pulumi.Input.make,
+    },
+    ~opts?,
+  )
+
+  {
+    url: functionUrl.functionUrl,
+    resources: [lambda.arn, functionUrl.functionArn],
+  }
+}