@reventlessdev/reventless-aws 3.0.0-alpha.248 → 3.0.0-alpha.249

package/src/util/Util_Bundle.res

@@ -1,38 +1,11 @@
-// Node.js path bindings
-@module("path") external dirname: string => string = "dirname"
-@module("path") external join2: (string, string) => string = "join"
-@module("path") external relative: (string, string) => string = "relative"
-
-// Node.js fs bindings
-@module("fs") external existsSync: string => bool = "existsSync"
-@module("fs") external readFileSync: (string, string) => string = "readFileSync"
-type dirent
-@module("fs") external readdirSync: (string, {"withFileTypes": bool}) => array<dirent> = "readdirSync"
-@send external isDirectory: dirent => bool = "isDirectory"
-@get external direntName: dirent => string = "name"
-
-// Node.js crypto bindings
-type hashObj
-@module("crypto") external createHash: string => hashObj = "createHash"
-@send external update: (hashObj, string) => hashObj = "update"
-@send external digest: (hashObj, string) => string = "digest"
-
 // URL global
 type urlObj
 @new external newURL: string => urlObj = "URL"
 @get external pathname: urlObj => string = "pathname"
 
-// module.createRequire
-type requireFn
-@module("module") external createRequire: string => requireFn = "createRequire"
-@send external requireResolve: (requireFn, string) => string = "resolve"
-
-// process.cwd
-@val @scope("process") external cwd: unit => string = "cwd"
-
 // Module-level state: cache populated by getModuleSpecifier
 let packageRootCache: dict<string> = Dict.make()
-let localRequire: requireFn = createRequire(%raw("import.meta.url"))
+let localRequire: NodeModule.require = NodeModule.createRequire(%raw("import.meta.url"))
 
 /**
  * Convert an import.meta.url file URL to an npm module specifier.
@@ -44,26 +17,26 @@ let getModuleSpecifier = (importMetaUrl: string): string => {
     importMetaUrl
   } else {
     let filePath = newURL(importMetaUrl)->pathname
-    let dirRef = ref(dirname(filePath))
+    let dirRef = ref(NodePath.dirname(filePath))
     let resultRef: ref<option<string>> = ref(None)
     while dirRef.contents != "/" && resultRef.contents->Option.isNone {
       let dir = dirRef.contents
-      let pkgPath = join2(dir, "package.json")
-      if existsSync(pkgPath) {
-        let pkgText = readFileSync(pkgPath, "utf-8")
+      let pkgPath = NodePath.join([dir, "package.json"])
+      if NodeFs.existsSync(pkgPath) {
+        let pkgText = NodeFs.readFileSync(pkgPath)
         switch pkgText->JSON.parseOrThrow->JSON.Decode.object {
         | Some(obj) =>
           switch obj->Dict.get("name")->Option.flatMap(JSON.Decode.string) {
           | Some(pkgName) =>
             packageRootCache->Dict.set(pkgName, dir)
-            let relPath = relative(dir, filePath)
+            let relPath = NodePath.relative(dir, filePath)
             resultRef := Some(pkgName ++ "/" ++ relPath)
-          | None => dirRef := dirname(dir)
+          | None => dirRef := NodePath.dirname(dir)
           }
-        | None => dirRef := dirname(dir)
+        | None => dirRef := NodePath.dirname(dir)
         }
       } else {
-        dirRef := dirname(dir)
+        dirRef := NodePath.dirname(dir)
       }
     }
     switch resultRef.contents {
@@ -116,8 +89,12 @@ let resolvePackageRoot = (~fromPulumiProject: bool=false, packageName: string):
   | Some(cachedRoot) => cachedRoot
   | None =>
     let request = packageName ++ "/package.json"
-    let viaFramework = () => dirname(localRequire->requireResolve(request))
-    let viaPulumiProject = () => dirname(createRequire(cwd() ++ "/index.js")->requireResolve(request))
+    let viaFramework = () => NodePath.dirname(localRequire->NodeModule.requireResolve(request))
+    let viaPulumiProject = () =>
+      NodePath.dirname(
+        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")
+        ->NodeModule.requireResolve(request),
+      )
     let (preferred, fallback) = fromPulumiProject
       ? (viaPulumiProject, viaFramework)
       : (viaFramework, viaPulumiProject)
@@ -133,7 +110,7 @@ let resolvePackageRoot = (~fromPulumiProject: bool=false, packageName: string):
  * Compute a SHA256 hash of a string, returned as base64.
  */
 let hashString = (str: string): string =>
-  createHash("sha256")->update(str)->digest("base64")
+  NodeCrypto.createHash("sha256")->NodeCrypto.hashUpdate(str)->NodeCrypto.hashDigest("base64")
 
 // ── ESM self-containment loader (Option C) ──────────────────────────────────
 // Deployed Lambda entry points are ESM (`.mjs`) and statically/dynamically import
@@ -213,28 +190,23 @@ let isSkippedDir = (n: string) =>
   n == ".git" ||
   n == "coverage"
 
-// Reads file as a string for content hashing; Buffer would be slightly more
-// efficient but utf-8 keeps the hash stable across platforms and matches what
-// Lambda will execute.
-@module("fs") external readFileAsString: (string, string) => string = "readFileSync"
-
 let rec walkDir = (
   ~dir: string,
   ~prefix: string,
   ~assets: dict<Pulumi.Archive.assetOrArchive>,
   ~paths: array<(string, string)>,
 ) => {
-  let entries = readdirSync(dir, {"withFileTypes": true})
+  let entries = NodeFs.readdirSync(dir, {withFileTypes: true})
   entries->Array.forEach(entry => {
-    let entryName = entry->direntName
-    if entry->isDirectory {
+    let entryName = entry->NodeFs.direntName
+    if entry->NodeFs.isDirectory {
       if !isSkippedDir(entryName) {
         let newPrefix = prefix == "" ? entryName : prefix ++ "/" ++ entryName
-        walkDir(~dir=join2(dir, entryName), ~prefix=newPrefix, ~assets, ~paths)
+        walkDir(~dir=NodePath.join([dir, entryName]), ~prefix=newPrefix, ~assets, ~paths)
       }
     } else if entryName == "package.json" || entryName->String.endsWith(".mjs") || entryName->String.endsWith(".js") {
       let relPath = prefix == "" ? entryName : prefix ++ "/" ++ entryName
-      let absPath = join2(dir, entryName)
+      let absPath = NodePath.join([dir, entryName])
       assets->Dict.set(
         relPath,
         Pulumi.Asset.fileAsset(absPath)->Pulumi.Archive.assetToAssetOrArchive,
@@ -256,9 +228,11 @@ let createFilteredPackageArchive = (packageRoot: string): (Pulumi.Archive.t, str
   walkDir(~dir=packageRoot, ~prefix="", ~assets, ~paths)
   // Sort so the hash is stable across filesystem traversal order.
   paths->Array.sort(((a, _), (b, _)) => String.compare(a, b))
+  // Read as a string rather than a Buffer: slightly less efficient, but utf-8
+  // keeps the hash stable across platforms and matches what Lambda executes.
   let combined =
     paths
-    ->Array.map(((relPath, absPath)) => `${relPath}:${readFileAsString(absPath, "utf-8")}`)
+    ->Array.map(((relPath, absPath)) => `${relPath}:${NodeFs.readFileSync(absPath)}`)
     ->Array.join("\n---\n")
   (Pulumi.Archive.assetArchive(assets), hashString(combined))
 }

package/src/util/Util_Bundle.res.mjs

@@ -1,11 +1,11 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as Fs from "fs";
-import * as Path from "path";
-import * as Crypto from "crypto";
-import * as Module from "module";
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Nodecrypto from "node:crypto";
+import * as Nodemodule from "node:module";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
@@ -13,35 +13,35 @@ import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js
 
 let packageRootCache = {};
 
-let localRequire = Module.createRequire(import.meta.url);
+let localRequire = Nodemodule.createRequire(import.meta.url);
 
 function getModuleSpecifier(importMetaUrl) {
   if (!importMetaUrl.startsWith("file://")) {
     return importMetaUrl;
   }
   let filePath = new URL(importMetaUrl).pathname;
-  let dirRef = Path.dirname(filePath);
+  let dirRef = Nodepath.dirname(filePath);
   let resultRef;
   while (dirRef !== "/" && Stdlib_Option.isNone(resultRef)) {
     let dir = dirRef;
-    let pkgPath = Path.join(dir, "package.json");
-    if (Fs.existsSync(pkgPath)) {
-      let pkgText = Fs.readFileSync(pkgPath, "utf-8");
+    let pkgPath = Nodepath.join(dir, "package.json");
+    if (Nodefs.existsSync(pkgPath)) {
+      let pkgText = Nodefs.readFileSync(pkgPath, "utf8");
       let obj = Stdlib_JSON.Decode.object(JSON.parse(pkgText));
       if (obj !== undefined) {
         let pkgName = Stdlib_Option.flatMap(obj["name"], Stdlib_JSON.Decode.string);
         if (pkgName !== undefined) {
           packageRootCache[pkgName] = dir;
-          let relPath = Path.relative(dir, filePath);
+          let relPath = Nodepath.relative(dir, filePath);
           resultRef = pkgName + "/" + relPath;
         } else {
-          dirRef = Path.dirname(dir);
+          dirRef = Nodepath.dirname(dir);
         }
       } else {
-        dirRef = Path.dirname(dir);
+        dirRef = Nodepath.dirname(dir);
       }
     } else {
-      dirRef = Path.dirname(dir);
+      dirRef = Nodepath.dirname(dir);
     }
   };
   let specifier = resultRef;
@@ -69,8 +69,8 @@ function resolvePackageRoot(fromPulumiProjectOpt, packageName) {
     return cachedRoot;
   }
   let request = packageName + "/package.json";
-  let viaFramework = () => Path.dirname(localRequire.resolve(request));
-  let viaPulumiProject = () => Path.dirname(Module.createRequire(process.cwd() + "/index.js").resolve(request));
+  let viaFramework = () => Nodepath.dirname(localRequire.resolve(request));
+  let viaPulumiProject = () => Nodepath.dirname(Nodemodule.createRequire(process.cwd() + "/index.js").resolve(request));
   let match = fromPulumiProject ? [
       viaPulumiProject,
       viaFramework
@@ -89,7 +89,7 @@ function resolvePackageRoot(fromPulumiProjectOpt, packageName) {
 }
 
 function hashString(str) {
-  return Crypto.createHash("sha256").update(str).digest("base64");
+  return Nodecrypto.createHash("sha256").update(str).digest("base64");
 }
 
 let registerHookFileName = "register-hook.mjs";
@@ -139,7 +139,7 @@ function isSkippedDir(n) {
 }
 
 function walkDir(dir, prefix, assets, paths) {
-  let entries = Fs.readdirSync(dir, {
+  let entries = Nodefs.readdirSync(dir, {
     withFileTypes: true
   });
   entries.forEach(entry => {
@@ -149,13 +149,13 @@ function walkDir(dir, prefix, assets, paths) {
         return;
       }
       let newPrefix = prefix === "" ? entryName : prefix + "/" + entryName;
-      return walkDir(Path.join(dir, entryName), newPrefix, assets, paths);
+      return walkDir(Nodepath.join(dir, entryName), newPrefix, assets, paths);
     }
     if (!(entryName === "package.json" || entryName.endsWith(".mjs") || entryName.endsWith(".js"))) {
       return;
     }
     let relPath = prefix === "" ? entryName : prefix + "/" + entryName;
-    let absPath = Path.join(dir, entryName);
+    let absPath = Nodepath.join(dir, entryName);
     assets[relPath] = new (Pulumi.asset.FileAsset)(absPath);
     paths.push([
       relPath,
@@ -169,7 +169,7 @@ function createFilteredPackageArchive(packageRoot) {
   let paths = [];
   walkDir(packageRoot, "", assets, paths);
   paths.sort((param, param$1) => Primitive_string.compare(param[0], param$1[0]));
-  let combined = paths.map(param => param[0] + `:` + Fs.readFileSync(param[1], "utf-8")).join("\n---\n");
+  let combined = paths.map(param => param[0] + `:` + Nodefs.readFileSync(param[1], "utf8")).join("\n---\n");
   return [
     new (Pulumi.asset.AssetArchive)(assets),
     hashString(combined)

package/src/util/Util_LocalConfig.res

@@ -19,13 +19,6 @@
 // ignored. Not a full YAML parser — only this subset is supported by
 // design (no nesting, no arrays, no multi-line scalars).
 
-@module("fs") external existsSync: string => bool = "existsSync"
-@module("fs") external readFileSync: (string, string) => string = "readFileSync"
-@module("path") external pathJoin: (string, string) => string = "join"
-@module("path") external pathDirname: string => string = "dirname"
-@val @scope("process") external processCwd: unit => string = "cwd"
-@val external processEnv: Dict.t<string> = "process.env"
-
 let _filename = "Pulumi.local.yaml"
 let _projectFile = "Pulumi.yaml"
 let _cache: ref<option<Dict.t<string>>> = ref(None)
@@ -35,15 +28,15 @@ let _cache: ref<option<Dict.t<string>>> = ref(None)
 // find Pulumi.yaml, then read Pulumi.local.yaml next to it.
 let _findSidecar = (): option<string> => {
   let rec find = dir => {
-    if existsSync(pathJoin(dir, _projectFile)) {
-      let candidate = pathJoin(dir, _filename)
-      existsSync(candidate) ? Some(candidate) : None
+    if NodeFs.existsSync(NodePath.join([dir, _projectFile])) {
+      let candidate = NodePath.join([dir, _filename])
+      NodeFs.existsSync(candidate) ? Some(candidate) : None
     } else {
-      let parent = pathDirname(dir)
+      let parent = NodePath.dirname(dir)
       parent == dir ? None : find(parent)
     }
   }
-  find(processCwd())
+  find(NodeProcess.cwd())
 }
 
 let _stripQuotes = (s: string): string => {
@@ -88,7 +81,7 @@ let _load = (): Dict.t<string> =>
   | Some(d) => d
   | None =>
     let d = switch _findSidecar() {
-    | Some(path) => _parse(readFileSync(path, "utf-8"))
+    | Some(path) => _parse(NodeFs.readFileSync(path))
     | None => Dict.make()
     }
     _cache := Some(d)
@@ -113,7 +106,7 @@ let _envVarName = (key: string): string => {
 }
 
 let get = (key: string): option<string> =>
-  switch Dict.get(processEnv, _envVarName(key)) {
+  switch Dict.get(NodeProcess.env, _envVarName(key)) {
   | Some(v) if v !== "" => Some(v)
   | _ => Dict.get(_load(), key)
   }

package/src/util/Util_LocalConfig.res.mjs

@@ -1,7 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as Fs from "fs";
-import * as Path from "path";
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
 
 let _filename = "Pulumi.local.yaml";
 
@@ -15,15 +15,15 @@ function _findSidecar() {
   let _dir = process.cwd();
   while (true) {
     let dir = _dir;
-    if (Fs.existsSync(Path.join(dir, _projectFile))) {
-      let candidate = Path.join(dir, _filename);
-      if (Fs.existsSync(candidate)) {
+    if (Nodefs.existsSync(Nodepath.join(dir, _projectFile))) {
+      let candidate = Nodepath.join(dir, _filename);
+      if (Nodefs.existsSync(candidate)) {
         return candidate;
       } else {
         return;
       }
     }
-    let parent = Path.dirname(dir);
+    let parent = Nodepath.dirname(dir);
     if (parent === dir) {
       return;
     }
@@ -71,7 +71,7 @@ function _load() {
     return d;
   }
   let path = _findSidecar();
-  let d$1 = path !== undefined ? _parse(Fs.readFileSync(path, "utf-8")) : ({});
+  let d$1 = path !== undefined ? _parse(Nodefs.readFileSync(path, "utf8")) : ({});
   _cache.contents = d$1;
   return d$1;
 }
@@ -109,4 +109,4 @@ export {
   _envVarName,
   get,
 }
-/* fs Not a pure module */
+/* node:fs Not a pure module */

package/src/util/Util_SQS_Runtime.res

@@ -13,10 +13,6 @@ let toResolvedQueue = ({id, name, urn}: ReventlessCore.Adapter.resolvedResource)
   arn: urn,
 }
 
-@module("node:crypto") external _createHash: string => 'h = "createHash"
-@send external _update: ('h, string) => 'h = "update"
-@send external _digest: ('h, string) => string = "digest"
-
 /** Returns `id` unchanged if ≤ 128 chars; otherwise its SHA-256 hex digest (64 chars).
     SQS FIFO MessageGroupId is limited to 128 characters. Using a hash instead of
     truncation avoids false-grouping of distinct keys that share a long prefix. */
@@ -24,7 +20,7 @@ let safeGroupId = (id: string): string =>
   if id->String.length <= 128 {
     id
   } else {
-    _createHash("sha256")->_update(id)->_digest("hex")
+    NodeCrypto.createHash("sha256")->NodeCrypto.hashUpdate(id)->NodeCrypto.hashDigest("hex")
   }
 
 let sendMessage = (queue, ~delay=?, messageBody) =>

package/src/util/Util_StaticBundle.res

@@ -1,22 +1,5 @@
 let log = ReventlessCore.Logger.fromEnv()
 
-@module("path") external join2: (string, string) => string = "join"
-@module("path") external relative: (string, string) => string = "relative"
-
-@module("fs") external existsSync: string => bool = "existsSync"
-@module("fs") external readFileSync: string => Js.TypedArray2.Uint8Array.t = "readFileSync"
-@module("fs") external readFileSyncUtf8: (string, string) => string = "readFileSync"
-type dirent
-@module("fs")
-external readdirSync: (string, {"withFileTypes": bool}) => array<dirent> = "readdirSync"
-@send external isDirectory: dirent => bool = "isDirectory"
-@get external direntName: dirent => string = "name"
-
-type hashObj
-@module("crypto") external createHash: string => hashObj = "createHash"
-@send external updateBuffer: (hashObj, Js.TypedArray2.Uint8Array.t) => hashObj = "update"
-@send external digest: (hashObj, string) => string = "digest"
-
 type fileEntry = {
   relativePath: string,
   absolutePath: string,
@@ -29,22 +12,22 @@ let toForwardSlashes = (p: string): string => p->String.replaceAll("\\", "/")
 let isHidden = (name: string): bool => name->String.startsWith(".")
 
 let rec walkInto = (~dir: string, ~prefix: string, acc: array<fileEntry>): unit => {
-  let entries = readdirSync(dir, {"withFileTypes": true})
+  let entries = NodeFs.readdirSync(dir, {withFileTypes: true})
   entries->Array.forEach(entry => {
-    let entryName = entry->direntName
+    let entryName = entry->NodeFs.direntName
     if isHidden(entryName) {
       ()
-    } else if entry->isDirectory {
+    } else if entry->NodeFs.isDirectory {
       let nextPrefix = prefix == "" ? entryName : prefix ++ "/" ++ entryName
-      walkInto(~dir=join2(dir, entryName), ~prefix=nextPrefix, acc)
+      walkInto(~dir=NodePath.join([dir, entryName]), ~prefix=nextPrefix, acc)
     } else {
-      let absolutePath = join2(dir, entryName)
+      let absolutePath = NodePath.join([dir, entryName])
       let relativePath = prefix == "" ? entryName : prefix ++ "/" ++ entryName
-      let bytes = readFileSync(absolutePath)
+      let bytes = NodeFs.readFileSyncBuffer(absolutePath)
       let contentHash =
-        createHash("sha256")
-        ->updateBuffer(bytes)
-        ->digest("hex")
+        NodeCrypto.createHash("sha256")
+        ->NodeCrypto.hashUpdateBuffer(bytes)
+        ->NodeCrypto.hashDigest("hex")
       acc->Array.push({
         relativePath: relativePath->toForwardSlashes,
         absolutePath,
@@ -60,7 +43,7 @@ let rec walkInto = (~dir: string, ~prefix: string, acc: array<fileEntry>): unit
  * relative S3 key, content hash, and a Pulumi FileAsset. Skips dotfiles.
  */
 let walk = (assetsDir: string): array<fileEntry> => {
-  if !existsSync(assetsDir) {
+  if !NodeFs.existsSync(assetsDir) {
     JsError.throwWithMessage(
       `Util_StaticBundle.walk: assetsDir does not exist: ${assetsDir}`,
     )
@@ -78,10 +61,10 @@ let walk = (assetsDir: string): array<fileEntry> => {
  * re-serialised) so formatting/key order the author chose is preserved.
  */
 let readJsonFileVerbatim = (~path: string, ~label: string): string => {
-  if !existsSync(path) {
+  if !NodeFs.existsSync(path) {
     JsError.throwWithMessage(`${label}: file does not exist: ${path}`)
   }
-  let content = readFileSyncUtf8(path, "utf8")
+  let content = NodeFs.readFileSync(path)
   try {
     let _ = JSON.parseOrThrow(content)
     content

package/src/util/Util_StaticBundle.res.mjs

@@ -1,8 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as Fs from "fs";
-import * as Path from "path";
-import * as Crypto from "crypto";
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Nodecrypto from "node:crypto";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
@@ -18,7 +18,7 @@ function isHidden(name) {
 }
 
 function walkInto(dir, prefix, acc) {
-  let entries = Fs.readdirSync(dir, {
+  let entries = Nodefs.readdirSync(dir, {
     withFileTypes: true
   });
   entries.forEach(entry => {
@@ -28,12 +28,12 @@ function walkInto(dir, prefix, acc) {
     }
     if (entry.isDirectory()) {
       let nextPrefix = prefix === "" ? entryName : prefix + "/" + entryName;
-      return walkInto(Path.join(dir, entryName), nextPrefix, acc);
+      return walkInto(Nodepath.join(dir, entryName), nextPrefix, acc);
     }
-    let absolutePath = Path.join(dir, entryName);
+    let absolutePath = Nodepath.join(dir, entryName);
     let relativePath = prefix === "" ? entryName : prefix + "/" + entryName;
-    let bytes = Fs.readFileSync(absolutePath);
-    let contentHash = Crypto.createHash("sha256").update(bytes).digest("hex");
+    let bytes = Nodefs.readFileSync(absolutePath);
+    let contentHash = Nodecrypto.createHash("sha256").update(bytes).digest("hex");
     acc.push({
       relativePath: relativePath.replaceAll("\\", "/"),
       absolutePath: absolutePath,
@@ -44,7 +44,7 @@ function walkInto(dir, prefix, acc) {
 }
 
 function walk(assetsDir) {
-  if (!Fs.existsSync(assetsDir)) {
+  if (!Nodefs.existsSync(assetsDir)) {
     Stdlib_JsError.throwWithMessage(`Util_StaticBundle.walk: assetsDir does not exist: ` + assetsDir);
   }
   let acc = [];
@@ -53,10 +53,10 @@ function walk(assetsDir) {
 }
 
 function readJsonFileVerbatim(path, label) {
-  if (!Fs.existsSync(path)) {
+  if (!Nodefs.existsSync(path)) {
     Stdlib_JsError.throwWithMessage(label + `: file does not exist: ` + path);
   }
-  let content = Fs.readFileSync(path, "utf8");
+  let content = Nodefs.readFileSync(path, "utf8");
   try {
     JSON.parse(content);
     return content;

package/tests/ExtensionPointEntryPoint_OpsTest.res

@@ -9,7 +9,6 @@
 
 open JestGlobals
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 describe("ExtensionPointEntryPoint_Ops.parseHandlerConfig", () => {
   testSync("reads the builder's field names", () => {
@@ -26,7 +25,7 @@ describe("ExtensionPointEntryPoint_Ops.parseHandlerConfig", () => {
 
 describe("ExtensionPointEntryPoint_Ops.makeCallbackSpec", () => {
   testSync("resolves publishToAggregates queue URLs via env vars", () => {
-    processEnv->Dict.set("EP_TEST_PRODUCT_QUEUE", "https://sqs/product")
+    NodeProcess.env->Dict.set("EP_TEST_PRODUCT_QUEUE", "https://sqs/product")
     let spec = ExtensionPointEntryPoint_Ops.makeCallbackSpec({
       queueUrl: "https://sqs/ep",
       publishToAggregates: Dict.fromArray([("Product", "EP_TEST_PRODUCT_QUEUE")]),

package/tests/PgChangeFeedRelay_IntegrationTest.res

@@ -17,7 +17,6 @@ open JestGlobals
 open ReventlessCore
 open Reventless
 
-@val external processEnv: dict<string> = "process.env"
 let opts: Pulumi.CustomResourceOptions.t = {}
 
 let jsonObj = pairs => JSON.Encode.object(Dict.fromArray(pairs))
@@ -35,7 +34,7 @@ let capturingSendBatch = sink => async jsons => sink := sink.contents->Array.con
 let idOf = json =>
   json->JSON.Decode.object->Option.flatMap(o => o->Dict.get("id"))->Option.flatMap(JSON.Decode.string)
 
-switch processEnv->Dict.get("PG_URL") {
+switch NodeProcess.env->Dict.get("PG_URL") {
 | None =>
   testSync("Postgres relay integration (skipped — set PG_URL to run)", () =>
     expect(true)->toBe(true)

package/tests/PgMigrationEntryPoint_IntegrationTest.res

@@ -14,7 +14,6 @@
 
 open JestGlobals
 
-@val external processEnv: dict<string> = "process.env"
 
 // Drive the real ReScript `runMigration` with the pool injected — the guard
 // rejects a HANDLER_CONFIG with no pgConnection; the real fields below are
@@ -46,7 +45,7 @@ describe("PgMigrationEntryPoint.runMigration", () => {
     expect(threw)->toBe(true)
   })
 
-  switch processEnv->Dict.get("PG_URL") {
+  switch NodeProcess.env->Dict.get("PG_URL") {
   | None =>
     testSync("live migration (skipped — set PG_URL to run)", () => expect(true)->toBe(true))
   | Some(url) =>

package/tests/PgPipeline_IntegrationTest.res

@@ -15,7 +15,6 @@
 open JestGlobals
 open ReventlessCore
 
-@val external processEnv: dict<string> = "process.env"
 
 // --- Fixtures: one classic source, one read model, one projection mapping ---
 
@@ -94,7 +93,7 @@ let asSqsEvent = (bodies: array<JSON.t>): PulumiAws.Lambda.CallbackFunction.even
     ),
   })
 
-switch processEnv->Dict.get("PG_URL") {
+switch NodeProcess.env->Dict.get("PG_URL") {
 | None =>
   testSync("Postgres pipeline integration (skipped — set PG_URL to run)", () =>
     expect(true)->toBe(true)

package/tests/TaskBucketEntryPoint_OpsTest.res

@@ -11,7 +11,6 @@ open JestGlobals
 let str = JSON.Encode.string
 let obj = pairs => JSON.Encode.object(Dict.fromArray(pairs))
 
-@val @scope("process") external processEnv: dict<string> = "env"
 
 describe("TaskBucketEntryPoint_Ops.parseHandlerConfig", () => {
   testSync("empty raw config decodes to empty defaults", () => {
@@ -46,8 +45,8 @@ describe("TaskBucketEntryPoint_Ops.parseHandlerConfig", () => {
 
 describe("TaskBucketEntryPoint_Ops.buildPublishCommands", () => {
   testSync("resolves queue URLs via env vars, skipping unset or empty ones", () => {
-    processEnv->Dict.set("TB_TEST_QUEUE_A", "https://sqs/a.fifo")
-    processEnv->Dict.set("TB_TEST_QUEUE_EMPTY", "")
+    NodeProcess.env->Dict.set("TB_TEST_QUEUE_A", "https://sqs/a.fifo")
+    NodeProcess.env->Dict.set("TB_TEST_QUEUE_EMPTY", "")
     let map = Dict.fromArray([
       ("AggA", "TB_TEST_QUEUE_A"),
       ("AggEmpty", "TB_TEST_QUEUE_EMPTY"),

package/tests/Util_BundleResolveTest.res

@@ -1,43 +1,37 @@
 open JestGlobals
 
-@module("fs") external mkdtempSync: string => string = "mkdtempSync"
-@module("fs") external mkdirSync: (string, {"recursive": bool}) => unit = "mkdirSync"
-@module("fs") external writeFileSync: (string, string) => unit = "writeFileSync"
-@module("fs") external rmSync: (string, {"recursive": bool, "force": bool}) => unit = "rmSync"
-@module("fs") external realpathSync: string => string = "realpathSync"
-@module("path") external join2: (string, string) => string = "join"
-@module("os") external tmpdir: unit => string = "tmpdir"
-@val @scope("process") external chdir: string => unit = "chdir"
-@val @scope("process") external cwd: unit => string = "cwd"
-
 // A Pulumi project that pins a package the framework does not depend on: the
 // shape of a host-shell bundle, which is the platform's deploy input rather
 // than one of reventless-aws's own dependencies. realpath because macOS hands
 // out /var/... symlinks for tmpdir while require.resolve reports /private/var.
 let makeProject = (pkgName: string): (string, string) => {
-  let project = realpathSync(mkdtempSync(join2(tmpdir(), "pulumi-project-")))
-  let pkgDir = join2(join2(project, "node_modules"), pkgName)
-  mkdirSync(pkgDir, {"recursive": true})
-  writeFileSync(join2(pkgDir, "package.json"), `{"name":"${pkgName}","version":"9.9.9"}`)
+  let project =
+    NodeFs.realpathSync(NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "pulumi-project-"])))
+  let pkgDir = NodePath.join([NodePath.join([project, "node_modules"]), pkgName])
+  NodeFs.mkdirSync(pkgDir, {recursive: true})
+  NodeFs.writeFileSync(
+    NodePath.join([pkgDir, "package.json"]),
+    `{"name":"","version":"9.9.9"}`,
+  )
   (project, pkgDir)
 }
 
 describe("Util_Bundle.resolvePackageRoot", () => {
   let pkgName = "pinned-by-the-project"
   let (project, pkgDir) = makeProject(pkgName)
-  let originalCwd = cwd()
+  let originalCwd = NodeProcess.cwd()
   // The framework fast path: what getModuleSpecifier would have cached from
   // walking reventless-aws's own tree.
   let frameworkRoot = "/resolved/from/the/framework"
 
   beforeAll(() => {
-    chdir(project)
+    NodeProcess.chdir(project)
     Util_Bundle.packageRootCache->Dict.set(pkgName, frameworkRoot)
   })
 
   afterAll(() => {
-    chdir(originalCwd)
-    rmSync(project, {"recursive": true, "force": true})
+    NodeProcess.chdir(originalCwd)
+    NodeFs.rmSync(project, {recursive: true, force: true})
   })
 
   testSync("framework-rooted by default", () =>