@reventlessdev/reventless-aws 3.0.0-alpha.343 → 3.0.0-alpha.345

package/src/adapter/Runtime/StreamRoutedEntryPoint_Ops.res

@@ -93,9 +93,9 @@ let addToRegistry = (
   | None => registry->Dict.set(sourceUrn, [handler])
   }
 
-let groupBySource = (
-  records: array<PulumiAws.Lambda.CallbackFunction.record>,
-): dict<array<PulumiAws.Lambda.CallbackFunction.record>> => {
+let groupBySource = (records: array<PulumiAws.Lambda.CallbackFunction.record>): dict<
+  array<PulumiAws.Lambda.CallbackFunction.record>,
+> => {
   let grouped = Dict.make()
   records->Array.forEach(record =>
     switch grouped->Dict.get(record.eventSourceARN) {
@@ -110,47 +110,42 @@ let groupBySource = (
 // handler registered for each source (independent storage, so concurrent is
 // safe). Each handler carries its own comp so the shared Lambda's log lines
 // stay separable per component.
-let makeRoutedHandler = (
-  ~comp: string,
-  registryPromise: promise<dict<array<registeredHandler>>>,
-) =>
+let makeRoutedHandler = (~comp: string, registryPromise: promise<dict<array<registeredHandler>>>) =>
   async (event: PulumiAws.Lambda.CallbackFunction.event, context: PulumiAws.Lambda.context) => {
     setRequestId(context.awsRequestId)
     let registry = await registryPromise
-    let _ =
-      await groupBySource(event.records)
-      ->Dict.toArray
-      ->Array.map(async ((arn, subRecords)) =>
-        switch registry->Dict.get(arn)->Option.filter(hs => hs->Array.length > 0) {
-        | Some(streamHandlers) =>
-          logDebug(
-            `found ${streamHandlers->Array.length->Int.toString} handler(s) for ${arn}`,
-            {comp: comp},
+    let _ = await groupBySource(event.records)
+    ->Dict.toArray
+    ->Array.map(async ((arn, subRecords)) =>
+      switch registry->Dict.get(arn)->Option.filter(hs => hs->Array.length > 0) {
+      | Some(streamHandlers) =>
+        logDebug(
+          `found ${streamHandlers->Array.length->Int.toString} handler(s) for ${arn}`,
+          {comp: comp},
+        )
+        let correlationId = extractMetaField(subRecords, "correlationId")
+        let causationId = extractMetaField(subRecords, "causationId")
+        let timestamp = extractSentTimestamp(subRecords)
+        let retryCount = extractRetryCount(subRecords)
+        let subEvent: PulumiAws.Lambda.CallbackFunction.event = {records: subRecords}
+        let _ = await streamHandlers
+        ->Array.map(registered =>
+          runEffect(
+            registered.handler(subEvent, context),
+            {
+              ?correlationId,
+              ?causationId,
+              comp: ?registered.comp,
+              plugin: ?registered.plugin,
+              ?timestamp,
+              retryCount,
+            },
           )
-          let correlationId = extractMetaField(subRecords, "correlationId")
-          let causationId = extractMetaField(subRecords, "causationId")
-          let timestamp = extractSentTimestamp(subRecords)
-          let retryCount = extractRetryCount(subRecords)
-          let subEvent: PulumiAws.Lambda.CallbackFunction.event = {records: subRecords}
-          let _ =
-            await streamHandlers
-            ->Array.map(registered =>
-              runEffect(
-                registered.handler(subEvent, context),
-                {
-                  correlationId: ?correlationId,
-                  causationId: ?causationId,
-                  comp: ?registered.comp,
-                  plugin: ?registered.plugin,
-                  timestamp: ?timestamp,
-                  retryCount,
-                },
-              )
-            )
-            ->Promise.all
-        | None => logWarn("no handler found: " ++ arn, {comp: comp})
-        }
-      )
-      ->Promise.all
+        )
+        ->Promise.all
+      | None => logWarn("no handler found: " ++ arn, {comp: comp})
+      }
+    )
+    ->Promise.all
     ""
   }

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -140,40 +140,36 @@ let dispatchTaskActions = async (
   ~publishCommands: dict<ReventlessCore.CommandTopic.publishJsons>,
   ~schedulerOps: unit => option<schedulerOps>,
 ): unit => {
-  let _ =
-    await actions
-    ->Array.map(async action =>
-      switch action {
-      | Reventless.Task.PublishCommands(aggregateName, cmdJsons) =>
-        switch publishCommands->Dict.get(aggregateName) {
-        | Some(publish) => await publish(cmdJsons)
-        | None =>
-          logWarn(
-            `no publish function for aggregate "${aggregateName}"`,
-            {comp: "TaskBucketRuntime"},
-          )
-        }
-      | CreateSchedule(schedule) =>
-        switch schedulerOps() {
-        | Some(ops) => await ops.createSchedule(schedule)
-        | None =>
-          logWarn(
-            "CreateSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
-            {comp: "TaskBucketRuntime"},
-          )
-        }
-      | DeleteSchedule(name) =>
-        switch schedulerOps() {
-        | Some(ops) => await ops.deleteSchedule(name)
-        | None =>
-          logWarn(
-            "DeleteSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
-            {comp: "TaskBucketRuntime"},
-          )
-        }
+  let _ = await actions
+  ->Array.map(async action =>
+    switch action {
+    | Reventless.Task.PublishCommands(aggregateName, cmdJsons) =>
+      switch publishCommands->Dict.get(aggregateName) {
+      | Some(publish) => await publish(cmdJsons)
+      | None =>
+        logWarn(`no publish function for aggregate "${aggregateName}"`, {comp: "TaskBucketRuntime"})
       }
-    )
-    ->Promise.all
+    | CreateSchedule(schedule) =>
+      switch schedulerOps() {
+      | Some(ops) => await ops.createSchedule(schedule)
+      | None =>
+        logWarn(
+          "CreateSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
+          {comp: "TaskBucketRuntime"},
+        )
+      }
+    | DeleteSchedule(name) =>
+      switch schedulerOps() {
+      | Some(ops) => await ops.deleteSchedule(name)
+      | None =>
+        logWarn(
+          "DeleteSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
+          {comp: "TaskBucketRuntime"},
+        )
+      }
+    }
+  )
+  ->Promise.all
 }
 
 // ── Exported Lambda handler ─────────────────────────────────────────────────
@@ -187,10 +183,8 @@ let makeHandler = (~callback: ReventlessCore.Task.bucketCallback, ~config: handl
   let publishCommands = buildPublishCommands(config.publishToAggregates)
   async (event: PulumiAws.S3.Bucket.event, context: PulumiAws.Lambda.context) => {
     let actions = await handleEvents(event, context)
-    await dispatchTaskActions(
-      ~actions,
-      ~publishCommands,
-      ~schedulerOps=() => makeSchedulerOps(config.scheduler),
+    await dispatchTaskActions(~actions, ~publishCommands, ~schedulerOps=() =>
+      makeSchedulerOps(config.scheduler)
     )
     ""
   }

package/src/adapter/Runtime/TaskRuntime_Builder_PerBucket.res

@@ -35,13 +35,14 @@ let forBucketCallback = (
   })
 
   // Build HANDLER_CONFIG JSON
-  let callbackModule =
-    callbackModulePath->JSON.stringifyAny->Option.getOr(`""`)
+  let callbackModule = callbackModulePath->JSON.stringifyAny->Option.getOr(`""`)
   let publishToAggregatesJson =
     publishToAggregatesEnvVars
     ->Dict.toArray
     ->Array.map(((aggName, envVar)) =>
-      `${aggName->JSON.stringifyAny->Option.getOr(`""`)}: ${envVar->JSON.stringifyAny->Option.getOr(`""`)}`
+      `${aggName->JSON.stringifyAny->Option.getOr(`""`)}: ${envVar
+        ->JSON.stringifyAny
+        ->Option.getOr(`""`)}`
     )
     ->Array.join(",")
 
@@ -50,14 +51,12 @@ let forBucketCallback = (
   // runtime. None for tasks without a side-effect handler.
   let handlerConfigJson = switch schedulerConfig {
   | None =>
-    `{"callbackModule":${callbackModule},"publishToAggregates":{${publishToAggregatesJson}}}`
-    ->Pulumi.Output.make
+    `{"callbackModule":${callbackModule},"publishToAggregates":{${publishToAggregatesJson}}}`->Pulumi.Output.make
   | Some({schedulerRoleUrn, targetUrn, targetName}) =>
     envVars->Dict.set("SCHEDULER_ROLE_ARN", schedulerRoleUrn->Pulumi.Output.asInput)
     envVars->Dict.set("SCHEDULER_TARGET_ARN", targetUrn->Pulumi.Output.asInput)
     envVars->Dict.set("SCHEDULER_TARGET_NAME", targetName->Pulumi.Output.asInput)
-    `{"callbackModule":${callbackModule},"publishToAggregates":{${publishToAggregatesJson}},"scheduler":{"roleArnEnv":"SCHEDULER_ROLE_ARN","targetArnEnv":"SCHEDULER_TARGET_ARN","targetNameEnv":"SCHEDULER_TARGET_NAME"}}`
-    ->Pulumi.Output.make
+    `{"callbackModule":${callbackModule},"publishToAggregates":{${publishToAggregatesJson}},"scheduler":{"roleArnEnv":"SCHEDULER_ROLE_ARN","targetArnEnv":"SCHEDULER_TARGET_ARN","targetNameEnv":"SCHEDULER_TARGET_NAME"}}`->Pulumi.Output.make
   }
   envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
 

package/src/adapter/ScheduledPublisher/ScheduledPublisher_CloudWatchEvents.res

@@ -56,11 +56,9 @@ let make: ReventlessCore.Scheduler_Adapter.scheduledPublisherMaker = (~name, ~op
       ~service="CloudWatchEvents"->Pulumi.Output.make,
       ~resourceType="aws:cloudwatch:EventRule"->Pulumi.Output.make,
     ),
-    operations: role.arn->Pulumi.Output.apply(roleArn => (
-      {
-        createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(~roleArn),
-        deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
-      }: ReventlessInfra.Scheduler.operations
-    )),
+    operations: role.arn->Pulumi.Output.apply((roleArn): ReventlessInfra.Scheduler.operations => {
+      createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(~roleArn),
+      deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
+    }),
   }
 }

package/src/adapter/ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res

@@ -28,9 +28,7 @@ let createSchedule = (~roleArn: string): ReventlessCore.Scheduler.createSchedule
     | [] =>
       let err = "createSchedule not possible: no Queue configured !"
       ReventlessCore.EffectLogger.logError(~comp=__MODULE__, err)
-      ->Effect.flatMap(_ =>
-        Effect.sync(() => JsError.throwWithMessage(err))
-      )
+      ->Effect.flatMap(_ => Effect.sync(() => JsError.throwWithMessage(err)))
       ->Effect.runPromise
     | resources =>
       let resource = resources->Array.getUnsafe(0) // FIXME
@@ -69,9 +67,7 @@ let deleteSchedule: ReventlessCore.Scheduler.deleteSchedule = (queueResources, n
   | [] =>
     let err = "deleteSchedule not possible: no Queue configured !"
     ReventlessCore.EffectLogger.logError(~comp=__MODULE__, err)
-    ->Effect.flatMap(_ =>
-      Effect.sync(() => JsError.throwWithMessage(err))
-    )
+    ->Effect.flatMap(_ => Effect.sync(() => JsError.throwWithMessage(err)))
     ->Effect.runPromise
   | resources =>
     let resource = resources->Array.getUnsafe(0) // FIXME

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -126,7 +126,6 @@ let registry: dict<array<streamEntry>> = Dict.make()
 // Uses native Node.js crypto + fetch with SigV4 — no extra SDK packages needed.
 // Credentials come from the Lambda execution role via the process.env AWS_* variables.
 
-
 // ── Registration ──────────────────────────────────────────────────────────────
 
 /** Register any stream-enabled DynamoDB table with the relay. Read-model and
@@ -206,10 +205,7 @@ let make = (
 
 // ── Finalize: build the shared Lambda + IAM + ESMs ────────────────────────────
 
-let finish = (
-  ~eventsApi: AppSync_EventsApi.t,
-  ~opts: Pulumi.CustomResourceOptions.t,
-) => {
+let finish = (~eventsApi: AppSync_EventsApi.t, ~opts: Pulumi.CustomResourceOptions.t) => {
   let key = eventsApi.name
   switch registry->Dict.get(key) {
   | None => ()
@@ -231,8 +227,7 @@ let finish = (
     )
 
     // IAM policy: read from every stream + publish to the events API.
-    let streamArnsOutput =
-      entries->Array.map(e => e.streamArn)->Pulumi.Output.all
+    let streamArnsOutput = entries->Array.map(e => e.streamArn)->Pulumi.Output.all
     let _ =
       (streamArnsOutput, eventsApi.api.apiArn)
       ->Pulumi.Output.all2
@@ -306,13 +301,15 @@ let finish = (
         let dict = Dict.make()
         tableNames->Array.forEachWithIndex((tableName, i) => {
           let entry = entries->Array.getUnsafe(i)
-          entry.retiredField->Option.forEach(f => {
-            let obj = Dict.fromArray([("field", f->JSON.Encode.string)])
-            entry.retiredValues->Option.forEach(vs =>
-              obj->Dict.set("values", vs->Array.map(JSON.Encode.string)->JSON.Encode.array)
-            )
-            dict->Dict.set(tableName, obj->JSON.Encode.object)
-          })
+          entry.retiredField->Option.forEach(
+            f => {
+              let obj = Dict.fromArray([("field", f->JSON.Encode.string)])
+              entry.retiredValues->Option.forEach(
+                vs => obj->Dict.set("values", vs->Array.map(JSON.Encode.string)->JSON.Encode.array),
+              )
+              dict->Dict.set(tableName, obj->JSON.Encode.object)
+            },
+          )
         })
         dict->JSON.Encode.object->JSON.stringify
       })
@@ -324,7 +321,10 @@ let finish = (
     // buildCodeArchive ships the ESM resolve-hook so `@rescript/runtime` and the
     // handler's bare @aws-sdk/util-dynamodb resolve from layer / managed runtime.
     let packageDirs = Dict.fromArray([
-      ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+      (
+        "@reventlessdev/reventless-aws",
+        Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+      ),
     ])
     let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
       ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs",
@@ -365,7 +365,12 @@ let finish = (
         memorySize: 256->Pulumi.Input.make,
         timeout: 30->Pulumi.Input.make,
         layers,
-        tags: AWS.Tags.make(~name=name ++ "StateTopic", ~kind=ReventlessCore.QueryDb.componentType, ~role=StateTopic, ~component=name),
+        tags: AWS.Tags.make(
+          ~name=name ++ "StateTopic",
+          ~kind=ReventlessCore.QueryDb.componentType,
+          ~role=StateTopic,
+          ~component=name,
+        ),
         environment: (
           {
             Lambda.Function.variables: Dict.fromArray([

package/src/adapter/StateTopic/StateTopic_AppSync_Ops.res

@@ -17,19 +17,21 @@
 // a core import can't drag deploy-time code into the Lambda's import graph — so
 // `StateChangeDescriptorParityTest` drives all three and asserts they agree.
 
-
 let endpoint = NodeProcess.env->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
 
 // STATE_TOPIC_MAP: `{ <tableName>: <topicName> }`, injected at deploy time.
-let topicMap: dict<string> =
-  switch NodeProcess.env->Dict.get("STATE_TOPIC_MAP")->Option.getOr("{}")->JSON.parseOrThrow->JSON.Decode.object {
-  | Some(obj) =>
-    obj
-    ->Dict.toArray
-    ->Array.filterMap(((k, v)) => v->JSON.Decode.string->Option.map(s => (k, s)))
-    ->Dict.fromArray
-  | None => Dict.make()
-  }
+let topicMap: dict<string> = switch NodeProcess.env
+->Dict.get("STATE_TOPIC_MAP")
+->Option.getOr("{}")
+->JSON.parseOrThrow
+->JSON.Decode.object {
+| Some(obj) =>
+  obj
+  ->Dict.toArray
+  ->Array.filterMap(((k, v)) => v->JSON.Decode.string->Option.map(s => (k, s)))
+  ->Dict.fromArray
+| None => Dict.make()
+}
 
 // ── DynamoDB stream event (only the fields this handler reads) ───────────────
 
@@ -64,34 +66,35 @@ type event = {@as("Records") records: array<record>}
 // writer the other, and the two drift the first time a state name contains the
 // separator — an argument that only gets stronger now that a lifecycle can name
 // several states.
-let retiredMap: dict<Reventless.OwnerScope.retiredScope> =
-  switch NodeProcess.env
-  ->Dict.get("STATE_RETIRED_MAP")
-  ->Option.getOr("{}")
-  ->JSON.parseOrThrow
-  ->JSON.Decode.object {
-  | Some(d) =>
-    let out = Dict.make()
-    d->Dict.forEachWithKey((v, k) =>
-      v
-      ->JSON.Decode.object
-      ->Option.flatMap(o =>
-        o
-        ->Dict.get("field")
-        ->Option.flatMap(JSON.Decode.string)
-        ->Option.map(field => {
+let retiredMap: dict<Reventless.OwnerScope.retiredScope> = switch NodeProcess.env
+->Dict.get("STATE_RETIRED_MAP")
+->Option.getOr("{}")
+->JSON.parseOrThrow
+->JSON.Decode.object {
+| Some(d) =>
+  let out = Dict.make()
+  d->Dict.forEachWithKey((v, k) =>
+    v
+    ->JSON.Decode.object
+    ->Option.flatMap(o =>
+      o
+      ->Dict.get("field")
+      ->Option.flatMap(JSON.Decode.string)
+      ->Option.map(
+        field => {
           Reventless.OwnerScope.field,
           values: o
           ->Dict.get("values")
           ->Option.flatMap(JSON.Decode.array)
           ->Option.map(vs => vs->Array.filterMap(JSON.Decode.string)),
-        })
+        },
       )
-      ->Option.forEach(scope => out->Dict.set(k, scope))
     )
-    out
-  | None => Dict.make()
-  }
+    ->Option.forEach(scope => out->Dict.set(k, scope))
+  )
+  out
+| None => Dict.make()
+}
 
 let tableNameFromEventSourceArn = (arn: string): option<string> => {
   let parts = arn->String.split("/")
@@ -166,7 +169,8 @@ let pickSortKeyValue = (image: dict<JSON.t>): option<string> =>
 /** Cap on the serialised state payload, in characters. Must match
     `LocalStateChangeDescriptor.maxStateChars` and `StateTopicPublish.mjs`'s
     MAX_STATE_CHARS — see the local module for the reasoning. */
-let maxStateChars = 60 * 1024
+let maxStateChars =
+  60 * 1024
 
 /** Build the change descriptor. Split out of `processRecord` so the wire format
     can be asserted against the other two implementations without a network call.

package/src/adapter/Task/TaskBucket_S3.res

@@ -3,7 +3,12 @@ type callbackEvent = PulumiAws.S3.Bucket.event
 type context = PulumiAws.Lambda.context
 type bucketParts = PulumiAws.S3.Bucket.t
 
-let subscribeLambda2S3Bucket = (lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>, name, bucket, opts) => {
+let subscribeLambda2S3Bucket = (
+  lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
+  name,
+  bucket,
+  opts,
+) => {
   // Coerce Function.t → CallbackFunction.t for S3 bucket notification bindings
   // (structurally compatible: both have arn, id, name)
   let handler: Pulumi.Output.t<PulumiAws.Lambda.CallbackFunction.t> = lambda->Obj.magic

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -127,8 +127,7 @@ let finish = (
     log.warn(
       ~comp="Upload_Claim",
       `event log(s) ${logs->Array.join(", ")} declare storage-ref fields but publish through an ` ++
-      `SNS event topic, which the claimer does not subscribe to — objects those events reference ` ++
-      `keep the pending tag. Do not enable a store's expiry rule while this is true.`,
+      `SNS event topic, which the claimer does not subscribe to — objects those events reference ` ++ `keep the pending tag. Do not enable a store's expiry rule while this is true.`,
     )
     unreachable->Dict.set(plugin, [])
   | _ => ()
@@ -161,8 +160,7 @@ let finish = (
       ->Pulumi.Output.all2
       ->Pulumi.Output.apply(((streamArns, stores)) => {
         open PolicyDocument
-        let objectArns =
-          stores->Array.map(s => `arn:aws:s3:::${s.bucketName}/${s.servedPrefix}/*`)
+        let objectArns = stores->Array.map(s => `arn:aws:s3:::${s.bucketName}/${s.servedPrefix}/*`)
         let _rolePolicy = IAM.RolePolicy.make(
           ~name=name ++ "Policy",
           ~args={
@@ -226,20 +224,19 @@ let finish = (
 
     // `UPLOAD_STORES` — the same qualified-name → {bucket, prefix} shape the
     // presign service reads, so mint and claim resolve a store identically.
-    let uploadStoresJson =
-      stores->Pulumi.Output.apply(stores =>
-        stores
-        ->Array.map(s => (
-          s.qualified,
-          Dict.fromArray([
-            ("bucket", JSON.Encode.string(s.bucketName)),
-            ("prefix", JSON.Encode.string(s.servedPrefix)),
-          ])->JSON.Encode.object,
-        ))
-        ->Dict.fromArray
-        ->JSON.Encode.object
-        ->JSON.stringify
-      )
+    let uploadStoresJson = stores->Pulumi.Output.apply(stores =>
+      stores
+      ->Array.map(s => (
+        s.qualified,
+        Dict.fromArray([
+          ("bucket", JSON.Encode.string(s.bucketName)),
+          ("prefix", JSON.Encode.string(s.servedPrefix)),
+        ])->JSON.Encode.object,
+      ))
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    )
 
     // Compiled EntryPoint rather than a serialized closure, for the reason the
     // presign service is one: the handler reaches the AWS SDK v3 S3 client, and
@@ -359,8 +356,8 @@ let finish = (
         ->Pulumi.Output.asInput,
         treatMissingData: "notBreaching"->Pulumi.Input.make,
         alarmDescription: (`${name} is behind on committed events. While it is behind, objects an ` ++
-        `event already references still carry the pending tag — and a store with an expiry rule ` ++
-        `enabled will delete them.`)->Pulumi.Input.make,
+        `event already references still carry the pending tag — and a store with an expiry rule ` ++ `enabled will delete them.`)
+          ->Pulumi.Input.make,
         tags: AWS.Tags.make(
           ~name=name ++ "Lag",
           ~kind=ReventlessCore.ComponentType.Plugin,

package/src/adapter/Upload/Upload_Claim_S3_Ops.res

@@ -236,7 +236,9 @@ type event = {@as("Records") records: array<record>}
     in it. */
 let targetsOfRecord = (record: record): array<target> =>
   switch (
-    record.eventSourceARN->tableNameFromEventSourceArn->Option.flatMap(t => refFieldsByTable->Dict.get(t)),
+    record.eventSourceARN
+    ->tableNameFromEventSourceArn
+    ->Option.flatMap(t => refFieldsByTable->Dict.get(t)),
     record.dynamodb->Option.flatMap(d => d.newImage),
   ) {
   | (Some(byEventType), Some(image)) =>
@@ -269,7 +271,8 @@ let targetsOfRecord = (record: record): array<target> =>
 let handler = async (event: event): unit => {
   // An append-only log only ever inserts events; MODIFY rows are fence and
   // snapshot updates, which `targetsOfRecord` would drop anyway.
-  let targets = event.records->Array.filter(r => r.eventName == "INSERT")->Array.flatMap(targetsOfRecord)
+  let targets =
+    event.records->Array.filter(r => r.eventName == "INSERT")->Array.flatMap(targetsOfRecord)
   // Sequential: a batch carries a handful of refs at most, and a failure must
   // reach the ESM as a throw so the record is retried rather than silently
   // leaving an object tagged.

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -111,58 +111,60 @@ let make = (
   // presigned request runs with the *signer's* permissions, so tag-on-put fails
   // with AccessDenied without it — and an untagged object is one the sweep can
   // never reach.
-  let _policy =
-    resolvedStores->Pulumi.Output.apply(list => {
-      let arns = list->Array.map(((_, bucket, prefix)) => `arn:aws:s3:::${bucket}/${prefix}/*`)
-      let _ = IAM.RolePolicy.make(
-        ~name=name ++ "LambdaPolicy",
-        ~args={
-          policy: PolicyDocument.make(
-            ~id=name ++ "LambdaPolicy",
-            ~statements=[
-              {
-                sid: "AllowLambdaLogging",
-                effect: Allow,
-                actions: Actions(["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]),
-                resources: Resource("arn:aws:logs:*:*:*"),
-              },
-              {
-                sid: "AllowUploadObjectAccess",
-                effect: Allow,
-                actions: Actions([
-                  "s3:PutObject",
-                  "s3:PutObjectTagging",
-                  "s3:DeleteObject",
-                  "s3:GetObject",
-                ]),
-                resources: Resources(arns),
-              },
-            ],
-          )
-          ->PolicyDocument.toJsonString
-          ->Pulumi.Input.make,
-          role: lambdaRole.id->Pulumi.Output.asInput,
-        },
-        ~opts,
-      )
-    })
+  let _policy = resolvedStores->Pulumi.Output.apply(list => {
+    let arns = list->Array.map(((_, bucket, prefix)) => `arn:aws:s3:::${bucket}/${prefix}/*`)
+    let _ = IAM.RolePolicy.make(
+      ~name=name ++ "LambdaPolicy",
+      ~args={
+        policy: PolicyDocument.make(
+          ~id=name ++ "LambdaPolicy",
+          ~statements=[
+            {
+              sid: "AllowLambdaLogging",
+              effect: Allow,
+              actions: Actions([
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ]),
+              resources: Resource("arn:aws:logs:*:*:*"),
+            },
+            {
+              sid: "AllowUploadObjectAccess",
+              effect: Allow,
+              actions: Actions([
+                "s3:PutObject",
+                "s3:PutObjectTagging",
+                "s3:DeleteObject",
+                "s3:GetObject",
+              ]),
+              resources: Resources(arns),
+            },
+          ],
+        )
+        ->PolicyDocument.toJsonString
+        ->Pulumi.Input.make,
+        role: lambdaRole.id->Pulumi.Output.asInput,
+      },
+      ~opts,
+    )
+  })
 
   // `UPLOAD_STORES` — the qualified-name → {bucket, prefix} map the handler resolves
   // the caller's `store` argument against.
-  let uploadStoresJson =
-    resolvedStores->Pulumi.Output.apply(list =>
-      list
-      ->Array.map(((qualified, bucket, prefix)) => (
-        qualified,
-        Dict.fromArray([
-          ("bucket", JSON.Encode.string(bucket)),
-          ("prefix", JSON.Encode.string(prefix)),
-        ])->JSON.Encode.object,
-      ))
-      ->Dict.fromArray
-      ->JSON.Encode.object
-      ->JSON.stringify
-    )
+  let uploadStoresJson = resolvedStores->Pulumi.Output.apply(list =>
+    list
+    ->Array.map(((qualified, bucket, prefix)) => (
+      qualified,
+      Dict.fromArray([
+        ("bucket", JSON.Encode.string(bucket)),
+        ("prefix", JSON.Encode.string(prefix)),
+      ])->JSON.Encode.object,
+    ))
+    ->Dict.fromArray
+    ->JSON.Encode.object
+    ->JSON.stringify
+  )
 
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
   // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook.