@reventlessdev/reventless-aws 3.0.0-alpha.291 → 3.0.0-alpha.293

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -216,7 +216,18 @@ let resolveStructure = (
     ->Option.flatMap(JSON.Decode.string) {
     | None => Promise.resolve(item)
     | Some(key) =>
-      fetch(key)->Promise.then(bytes => {
+      fetch(key)
+      // The bucket answers for the whole platform, so a failure here says which
+      // plugin's ref could not be read — otherwise the S3 error names the key
+      // and the bucket, and finding the row it came from is a table scan by hand.
+      ->Promise.catch(e => {
+        let plugin = item->str("name")->Option.getOr("<unnamed>")
+        JsError.throwWithMessage(
+          `offloaded structure for plugin ${plugin} is unreadable at ${key}: ` ++
+          e->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error"),
+        )
+      })
+      ->Promise.then(bytes => {
         let resolved = Dict.fromArray(item->Dict.toArray)
         resolved->Dict.set("structure", JSON.parseOrThrow(bytes))
         Promise.resolve(resolved)
@@ -337,6 +348,58 @@ let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
     }
   )
 
+// ── Registration freshness ───────────────────────────────────────────────────
+// The read model this bake scans is updated asynchronously: the plugin stack
+// publishes a re-detect, the plugin answers with its definition, the projection
+// lands. Invoked seconds after the last stack finished, the scan can still
+// describe the deploy before it — and a manifest baked from that is wrong in the
+// one way nothing downstream can detect, because it is a perfectly well-formed
+// description of the wrong deployment.
+//
+// So the invocation carries the structure key each plugin stack just wrote. That
+// is an equality check rather than an inference from timestamps, and it costs
+// nothing for a plugin that was not redeployed: its key already matches. A caller
+// that supplies no expectations bakes whatever is current — the query paths never
+// send any, and a hand-run bake should not need to.
+let bakeExpectations = (event: JSON.t): dict<string> =>
+  event
+  ->JSON.Decode.object
+  ->Option.flatMap(o => o->Dict.get("expect"))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.mapOr(Dict.make(), o =>
+    o
+    ->Dict.toArray
+    ->Array.filterMap(((plugin, key)) => key->JSON.Decode.string->Option.map(k => (plugin, k)))
+    ->Dict.fromArray
+  )
+
+// The offload key a scanned row carries. None for a structure held inline, which
+// on a deployed platform means the row predates offloading — it cannot match an
+// expectation, and saying so beats baking it.
+let structureRefKey = (item: dict<JSON.t>): option<string> =>
+  item
+  ->Dict.get("structure")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(o => o->Dict.get(Reventless.Offload.sentinelKey))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(r => r->Dict.get("key"))
+  ->Option.flatMap(JSON.Decode.string)
+
+// Compared against the collapsed latest version per plugin, the same view the
+// bake itself takes — an older version's row lingering on the table is not the
+// registration anyone is waiting for.
+let pendingRegistrations = (items: array<dict<JSON.t>>, ~expect: dict<string>): array<string> => {
+  let current =
+    Platform_AdminScan_Ops.latestByName(
+      items,
+      ~nameVersionOf=item => item->str("name"),
+      ~toEntry=(item, ~name) => item->structureRefKey->Option.map(key => (name, key)),
+    )->Dict.fromArray
+  expect
+  ->Dict.toArray
+  ->Array.filterMap(((plugin, key)) => current->Dict.get(plugin) == Some(key) ? None : Some(plugin))
+}
+
 // Every failure mode here is the deployment's own mistake — a name matching no
 // component, a structure too old to read, a bucket the function may not write —
 // and every one of them produces the same symptom if swallowed: a shop that
@@ -404,22 +467,36 @@ let handler = async (event: JSON.t): array<JSON.t> => {
     let fetch = Reventless.Offload.cachedFetch(key =>
       AwsSdk.S3.GetObjectCommand.getString(~bucket, ~key)
     )
-    let items = await Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
+    let resolveAll = () => Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
     switch bakeTarget {
     | Some(target) =>
-      // The built-in admin entry is deliberately absent: it never enters the
-      // Plugin read model, and the in-memory bake curates the composed plugins
-      // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
-      let structures = Platform_AdminScan_Ops.latestByName(
-        items,
-        ~nameVersionOf=item => item->str("name"),
-        ~toEntry=structureOf,
-      )
-      await runBake(~target, ~structures)
+      // Checked on the raw rows: the refs are what the deploy can predict, and a
+      // row that is behind should not have its structure fetched at all.
+      switch pendingRegistrations(rawItems, ~expect=bakeExpectations(event)) {
+      | [] =>
+        // The built-in admin entry is deliberately absent: it never enters the
+        // Plugin read model, and the in-memory bake curates the composed plugins
+        // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
+        let structures = Platform_AdminScan_Ops.latestByName(
+          await resolveAll(),
+          ~nameVersionOf=item => item->str("name"),
+          ~toEntry=structureOf,
+        )
+        await runBake(~target, ~structures)
+      | pending =>
+        // Not an error — the deploy just has not finished arriving. Reported so the
+        // caller can invoke again rather than bake the previous deployment.
+        [
+          Dict.fromArray([
+            ("baked", JSON.Encode.bool(false)),
+            ("pending", pending->Array.map(JSON.Encode.string)->JSON.Encode.array),
+          ])->JSON.Encode.object,
+        ]
+      }
     | None =>
       let userEntries =
         Platform_AdminScan_Ops.latestByName(
-          items,
+          await resolveAll(),
           ~nameVersionOf=item => item->str("name"),
           ~toEntry,
         )

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -6,8 +6,11 @@ import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
 import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
@@ -216,7 +219,10 @@ function resolveStructure(fetch, item) {
   }
   let key = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(refJson), r => r["key"]), Stdlib_JSON.Decode.string);
   if (key !== undefined) {
-    return fetch(key).then(bytes => {
+    return Stdlib_Promise.$$catch(fetch(key), e => {
+      let plugin = Stdlib_Option.getOr(str(item, "name"), "<unnamed>");
+      return Stdlib_JsError.throwWithMessage(`offloaded structure for plugin ` + plugin + ` is unreadable at ` + key + `: ` + Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(e), Stdlib_JsExn.message), "unknown error"));
+    }).then(bytes => {
       let resolved = Object.fromEntries(Object.entries(item));
       resolved["structure"] = JSON.parse(bytes);
       return Promise.resolve(resolved);
@@ -295,6 +301,35 @@ function bakeTargetOf(event) {
   });
 }
 
+function bakeExpectations(event) {
+  return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => o["expect"]), Stdlib_JSON.Decode.object), {}, o => Object.fromEntries(Stdlib_Array.filterMap(Object.entries(o), param => {
+    let plugin = param[0];
+    return Stdlib_Option.map(Stdlib_JSON.Decode.string(param[1]), k => [
+      plugin,
+      k
+    ]);
+  })));
+}
+
+function structureRefKey(item) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object), o => o[Offload$Reventless.sentinelKey]), Stdlib_JSON.Decode.object), r => r["key"]), Stdlib_JSON.Decode.string);
+}
+
+function pendingRegistrations(items, expect) {
+  let current = Object.fromEntries(Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), (item, name) => Stdlib_Option.map(structureRefKey(item), key => [
+    name,
+    key
+  ])));
+  return Stdlib_Array.filterMap(Object.entries(expect), param => {
+    let plugin = param[0];
+    if (Primitive_object.equal(current[plugin], param[1])) {
+      return;
+    } else {
+      return plugin;
+    }
+  });
+}
+
 async function runBake(target, structures) {
   let selections = bakeSelections();
   if (selections.length === 0) {
@@ -351,12 +386,25 @@ async function handler(event) {
       ]]));
     let bucket = Stdlib_Option.getOr(process.env["OFFLOAD_BUCKET"], "");
     let fetch = Offload$Reventless.cachedFetch(key => S3$AwsSdk.GetObjectCommand.getString(bucket, key));
-    let items = await Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
+    let resolveAll = () => Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
     if (bakeTarget !== undefined) {
-      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), structureOf);
+      let pending = pendingRegistrations(rawItems, bakeExpectations(event));
+      if (pending.length !== 0) {
+        return [Object.fromEntries([
+            [
+              "baked",
+              false
+            ],
+            [
+              "pending",
+              pending.map(prim => prim)
+            ]
+          ])];
+      }
+      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), structureOf);
       return await runBake(bakeTarget, structures);
     }
-    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), toEntry);
+    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), toEntry);
     return admin.concat(userEntries);
   }
   console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
@@ -386,6 +434,9 @@ export {
   bakeSelection,
   bakeSelections,
   bakeTargetOf,
+  bakeExpectations,
+  structureRefKey,
+  pendingRegistrations,
   runBake,
   handler,
 }

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -0,0 +1,309 @@
+/** Attaches the pre-token-generation trigger to a Cognito user pool the stack
+    does **not** own — the BYO case of `Platform_Stack.resolveCognitoUserPool`,
+    where `platform:cognitoUserPoolId` names an existing pool that is looked up
+    for its ARN and nothing more.
+
+    BYO cannot be the unsupported mode. It is the mode a customer with an
+    existing identity estate is in, and requiring the framework to own their user
+    pool before an operator can act as a role is a far larger ask than the
+    feature is worth. In **auto** mode the pool is ours and
+    `lambdaConfig.preTokenGeneration` is an ordinary property on a resource we
+    already declare — this resource is not used there.
+
+    The trigger is a property of the pool and Cognito offers no separate
+    attachment resource, so something has to call `UpdateUserPool` against a pool
+    no stack owns. That belongs in a declared resource executed at deploy time,
+    never a hand-run command against a live pool, which would leave the
+    deployment's behaviour depending on an act no source describes.
+
+    🚨 **`UpdateUserPool` resets by omission.** The API requires "a value for all
+    parameters that you don't want set to a default value". An attach that sends
+    only `LambdaConfig` silently returns every other setting on that pool to its
+    default — on a pool the framework did not create and whose configuration it
+    never described. So every call here describes first and sends the pool's own
+    configuration back whole, with one field changed. See [mergedUpdateInput].
+
+    Mirrors the dynImport + hand-rolled shape of
+    [AppSync_SourceApiAssociation_Retrying.res]: Pulumi serialises a dynamic
+    provider's whole captured closure into stack state, so the SDK is imported
+    lazily and nothing here captures a Pulumi Output. */
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// ── The merge ────────────────────────────────────────────────────────────────
+
+/** Keys `DescribeUserPool` returns that `UpdateUserPool` does not accept.
+
+    A **denylist**, deliberately, and the choice matters. An allowlist that
+    missed a field would omit it from the update and silently reset it — exactly
+    the failure this whole resource exists to prevent, and one that succeeds
+    quietly. A denylist that misses a read-only field instead makes AWS reject
+    the call, which is loud, immediate, and fixable. When the two error shapes
+    are "a customer's pool quietly loses a setting" and "the deploy fails with a
+    parameter error", the second is the one to design for.
+
+    `Name` is absent from this list because it is not dropped but *renamed* —
+    `DescribeUserPool` returns `Name`, `UpdateUserPool` takes `PoolName`. */
+let readOnlyKeys = [
+  "Id",
+  "Name",
+  "Arn",
+  "Status",
+  "CreationDate",
+  "LastModifiedDate",
+  "SchemaAttributes",
+  "AliasAttributes",
+  "UsernameAttributes",
+  "UsernameConfiguration",
+  "EstimatedNumberOfUsers",
+  "Domain",
+  "CustomDomain",
+  "SmsConfigurationFailure",
+  "EmailConfigurationFailure",
+]
+
+/** The pool's own configuration, sent back whole with `PreTokenGeneration` set
+    (or, when `preTokenGenerationArn` is `None`, removed).
+
+    Pure and total so the property that matters — a pool carrying non-default
+    settings still carries them afterwards — is checkable without a pool. */
+let mergedUpdateInput = (
+  ~described: dict<JSON.t>,
+  ~userPoolId: string,
+  ~preTokenGenerationArn: option<string>,
+): dict<JSON.t> => {
+  let out = Dict.make()
+  described->Dict.forEachWithKey((value, key) =>
+    if !(readOnlyKeys->Array.includes(key)) {
+      out->Dict.set(key, value)
+    }
+  )
+  described->Dict.get("Name")->Option.forEach(name => out->Dict.set("PoolName", name))
+  out->Dict.set("UserPoolId", JSON.Encode.string(userPoolId))
+
+  // The pool's other triggers are carried through untouched. Replacing the whole
+  // `LambdaConfig` with a single-key object would silently detach every trigger
+  // the customer already had — the reset-by-omission hazard one level down.
+  let lambdaConfig =
+    described
+    ->Dict.get("LambdaConfig")
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.mapOr(Dict.make(), existing => Dict.fromArray(existing->Dict.toArray))
+  switch preTokenGenerationArn {
+  | Some(arn) => lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
+  | None => lambdaConfig->Dict.delete("PreTokenGeneration")
+  }
+  out->Dict.set("LambdaConfig", lambdaConfig->JSON.Encode.object)
+  out
+}
+
+/** The trigger currently attached to a described pool, if any. */
+let attachedTrigger = (~described: dict<JSON.t>): option<string> =>
+  described
+  ->Dict.get("LambdaConfig")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
+  ->Option.flatMap(JSON.Decode.string)
+
+// ── AWS SDK bindings (lazily imported — see AppSync_SourceApiAssociation_Retrying) ──
+
+type cognitoClient
+
+type describeInput = {@as("UserPoolId") userPoolId: string}
+type describeResult = {@as("UserPool") userPool?: JSON.t}
+
+type describeCmd
+type updateCmd
+
+type sdkModule = {
+  @as("CognitoIdentityProviderClient") clientCtor: unit => cognitoClient,
+  @as("DescribeUserPoolCommand") describeCtor: describeInput => describeCmd,
+  @as("UpdateUserPoolCommand") updateCtor: dict<JSON.t> => updateCmd,
+}
+
+// Calls a constructor with `new` — the SDK exports plain classes.
+//
+// `%raw` here rather than a companion `.mjs` bound through `@module`, matching
+// [AppSync_SourceApiAssociation_Retrying.res]: Pulumi serialises this provider's
+// whole closure into stack state, and a helper reached through a module import
+// is a dependency that serialisation cannot carry. Inline source can be.
+let newOf1: ('ctor, 'arg) => 'r = %raw(`(C, x) => new C(x)`)
+let newOf0: 'ctor => 'r = %raw(`(C) => new C()`)
+
+@send external sendDescribe: (cognitoClient, describeCmd) => promise<describeResult> = "send"
+@send external sendUpdate: (cognitoClient, updateCmd) => promise<unit> = "send"
+
+// Emitted as a literal `import("...")` so the Pulumi serialiser does not
+// statically capture the module in the provider closure.
+@val external dynImport: string => promise<sdkModule> = "import"
+
+let _sdk: ref<option<sdkModule>> = ref(None)
+let _client: ref<option<cognitoClient>> = ref(None)
+
+let getSdk = async (): sdkModule =>
+  switch _sdk.contents {
+  | Some(m) => m
+  | None =>
+    let m = await dynImport("@aws-sdk/client-cognito-identity-provider")
+    _sdk.contents = Some(m)
+    m
+  }
+
+let getClient = async (): cognitoClient =>
+  switch _client.contents {
+  | Some(c) => c
+  | None =>
+    let sdk = await getSdk()
+    let c = newOf0(sdk.clientCtor)
+    _client.contents = Some(c)
+    c
+  }
+
+@get @return(nullable) external exnName: JsExn.t => option<string> = "name"
+
+let isPoolGoneError = (jsErr: JsExn.t): bool =>
+  switch (jsErr->exnName, JsExn.message(jsErr)) {
+  | (Some("ResourceNotFoundException"), _) => true
+  | (_, Some(msg)) => msg->String.includes("ResourceNotFoundException")
+  | _ => false
+  }
+
+// ── Describe → merge → update ────────────────────────────────────────────────
+
+let describePool = async (~userPoolId: string): option<dict<JSON.t>> => {
+  let sdk = await getSdk()
+  let client = await getClient()
+  let result = await client->sendDescribe(newOf1(sdk.describeCtor, {userPoolId: userPoolId}))
+  result.userPool->Option.flatMap(JSON.Decode.object)
+}
+
+/** Set (or clear) the pool's pre-token-generation trigger, preserving every
+    other setting the pool carries. */
+let applyTrigger = async (~userPoolId: string, ~preTokenGenerationArn: option<string>): unit => {
+  let sdk = await getSdk()
+  let client = await getClient()
+  switch await describePool(~userPoolId) {
+  | None =>
+    // Describe succeeded but returned no pool body. Sending an update built from
+    // nothing is precisely the reset this resource exists to avoid.
+    JsError.throwWithMessage(
+      `DescribeUserPool returned no pool for "${userPoolId}"; refusing to send an UpdateUserPool that would reset it`,
+    )
+  | Some(described) =>
+    let input = mergedUpdateInput(~described, ~userPoolId, ~preTokenGenerationArn)
+    await client->sendUpdate(newOf1(sdk.updateCtor, input))
+  }
+}
+
+// ── Dynamic provider ─────────────────────────────────────────────────────────
+
+type providerInputs = {
+  userPoolId: string,
+  preTokenGenerationArn: string,
+}
+
+type createOuts = {
+  userPoolId: string,
+  preTokenGenerationArn: string,
+}
+
+type createResult = {id: string, outs: createOuts}
+type updateResult = {outs: createOuts}
+type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace: bool}
+type readResult = {id?: string, props?: createOuts}
+
+let create = async (inputs: providerInputs): createResult => {
+  await applyTrigger(
+    ~userPoolId=inputs.userPoolId,
+    ~preTokenGenerationArn=Some(inputs.preTokenGenerationArn),
+  )
+  {
+    id: inputs.userPoolId,
+    outs: {userPoolId: inputs.userPoolId, preTokenGenerationArn: inputs.preTokenGenerationArn},
+  }
+}
+
+let update = async (_id: string, _olds: createOuts, news: providerInputs): updateResult => {
+  await applyTrigger(
+    ~userPoolId=news.userPoolId,
+    ~preTokenGenerationArn=Some(news.preTokenGenerationArn),
+  )
+  {outs: {userPoolId: news.userPoolId, preTokenGenerationArn: news.preTokenGenerationArn}}
+}
+
+/** Detaching on destroy is not optional. The Lambda is torn down with the rest
+    of the stack; a pool left pointing at a deleted function fails **every**
+    sign-in, and it is a pool the framework does not own — so nothing else in
+    this deployment would ever put it right. A pool that has already gone is
+    nothing to detach from. */
+let delete_ = async (_id: string, props: createOuts): unit =>
+  try {
+    await applyTrigger(~userPoolId=props.userPoolId, ~preTokenGenerationArn=None)
+  } catch {
+  | exn if exn->JsExn.fromException->Option.mapOr(false, isPoolGoneError) =>
+    log.info(
+      ~comp="Auth_ActiveRolePoolAttachment",
+      `user pool ${props.userPoolId} is gone; nothing to detach`,
+    )
+  }
+
+/** A different pool is a different attachment: the old pool must be detached
+    before the new one is attached, so this replaces rather than updates in
+    place. Changing only the function ARN is an ordinary update. */
+let diff_ = (_id: string, olds: createOuts, news: providerInputs): diffResult => {
+  let poolChanged = olds.userPoolId != news.userPoolId
+  {
+    changes: poolChanged || olds.preTokenGenerationArn != news.preTokenGenerationArn,
+    replaces: poolChanged ? ["userPoolId"] : [],
+    deleteBeforeReplace: true,
+  }
+}
+
+/** Live state for `pulumi refresh`: report what the pool actually carries, so a
+    trigger detached out of band shows as drift and the next `up` re-attaches
+    it. A missing pool drops the resource from state. */
+let read_ = async (id: string, props: createOuts): readResult =>
+  try {
+    switch await describePool(~userPoolId=props.userPoolId) {
+    | None => ({}: readResult)
+    | Some(described) => {
+        id,
+        props: {
+          userPoolId: props.userPoolId,
+          preTokenGenerationArn: attachedTrigger(~described)->Option.getOr(""),
+        },
+      }
+    }
+  } catch {
+  | exn if exn->JsExn.fromException->Option.mapOr(false, isPoolGoneError) => ({}: readResult)
+  }
+
+// Provider as a plain JS object (no Pulumi Output captures — all state flows
+// through inputs / olds / news).
+let provider = {
+  "create": create,
+  "update": update,
+  "delete": delete_,
+  "diff": diff_,
+  "read": read_,
+}
+
+// ── Pulumi dynamic resource binding ──────────────────────────────────────────
+
+type t = {id: Pulumi.Output.t<string>}
+
+type constructorProps = {
+  userPoolId: Pulumi.Input.t<string>,
+  preTokenGenerationArn: Pulumi.Input.t<string>,
+}
+
+// Explicit /index.js path because @pulumi/pulumi/dynamic is a directory import
+// not resolvable in ESM mode.
+@module("@pulumi/pulumi/dynamic/index.js") @new
+external _newResource: ('provider, string, 'props, Pulumi.CustomResourceOptions.t) => t = "Resource"
+
+let make = (
+  ~name: string="ActiveRolePoolAttachment",
+  ~props: constructorProps,
+  ~opts: Pulumi.CustomResourceOptions.t,
+): t => _newResource(provider, name, props, opts)