@reventlessdev/reventless-aws 3.0.0-alpha.343 → 3.0.0-alpha.345

package/src/plugin/stack/Plugin_Stack.res

@@ -59,9 +59,7 @@ let _getUsEast1Provider = (): PulumiAws.Aws.Provider.t =>
 // `no-cache` here a redeploy uploads the new entry file to S3 while CloudFront
 // (and browsers) keep serving the previous build: the "deployed but stale" trap.
 let cacheControlFor = (relativePath: string): string =>
-  relativePath->String.startsWith("assets/")
-    ? "public, max-age=31536000, immutable"
-    : "no-cache"
+  relativePath->String.startsWith("assets/") ? "public, max-age=31536000, immutable" : "no-cache"
 
 // ── Inline CloudFront SDK binding (deploy-time cache invalidation) ───────────
 // Mirrors AppSync_Adapter's inline `@aws-sdk` binding pattern. Runs in the
@@ -103,7 +101,10 @@ let invalidateDistribution = async (~distributionId: string, ~paths: array<strin
       },
     }
     let _ = await client->cfSend(input->makeCreateInvalidationCommand)
-    log.info(~comp="makeUiBundleDistribution", `CloudFront invalidation submitted for ${distributionId}`)
+    log.info(
+      ~comp="makeUiBundleDistribution",
+      `CloudFront invalidation submitted for ${distributionId}`,
+    )
   } catch {
   | exn =>
     let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
@@ -212,7 +213,9 @@ let makeUiBundleDistribution = (
   // policy. Always cover `remoteEntry.js` (federation manifest) and, for SPA
   // shells, `index.html` + `config.json`. Hashed assets fall through to the
   // CachingOptimized default behavior since their URL changes on every build.
-  let noCacheBehavior = (pattern: string): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
+  let noCacheBehavior = (
+    pattern: string,
+  ): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
     pathPattern: Pulumi.Input.make(pattern),
     targetOriginId: Pulumi.Input.make(originId),
     viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
@@ -330,27 +333,27 @@ let makeUiBundleDistribution = (
       | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
       },
       origins: (bucket.bucketRegionalDomainName, oac.id)
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply(((domainName, oacId)) =>
-          Array.concat(
-            [
-              {
-                PulumiAws.CloudFront.Distribution.domainName: Pulumi.Input.make(domainName),
-                originId: Pulumi.Input.make(originId),
-                originAccessControlId: Pulumi.Input.make(oacId),
-              },
-            ],
-            // One S3 origin per served bucket, sharing the same OAC as the bundle
-            // origin (the OAC only authorizes CloudFront→S3 sigv4 signing; the
-            // per-bucket read grant is the served bucket's own BucketPolicy below).
-            servedBuckets->Array.map(sb => {
-              PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
-              originId: Pulumi.Input.make(servedOriginId(sb.id)),
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((domainName, oacId)) =>
+        Array.concat(
+          [
+            {
+              PulumiAws.CloudFront.Distribution.domainName: Pulumi.Input.make(domainName),
+              originId: Pulumi.Input.make(originId),
               originAccessControlId: Pulumi.Input.make(oacId),
-            }),
-          )
+            },
+          ],
+          // One S3 origin per served bucket, sharing the same OAC as the bundle
+          // origin (the OAC only authorizes CloudFront→S3 sigv4 signing; the
+          // per-bucket read grant is the served bucket's own BucketPolicy below).
+          servedBuckets->Array.map(sb => {
+            PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
+            originId: Pulumi.Input.make(servedOriginId(sb.id)),
+            originAccessControlId: Pulumi.Input.make(oacId),
+          }),
         )
-        ->Pulumi.Output.asInput,
+      )
+      ->Pulumi.Output.asInput,
       defaultCacheBehavior: Pulumi.Input.make(
         (
           {
@@ -413,27 +416,27 @@ let makeUiBundleDistribution = (
     ~args={
       bucket: bucket.id->Pulumi.Output.asInput,
       policy: (bucket.arn, distribution.arn)
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-          {
-            "Version": "2012-10-17",
-            "Statement": [
-              {
-                "Sid": "AllowCloudFrontServicePrincipal",
-                "Effect": "Allow",
-                "Principal": {"Service": "cloudfront.amazonaws.com"},
-                "Action": "s3:GetObject",
-                "Resource": bucketArn ++ "/*",
-                "Condition": {
-                  "StringEquals": {"AWS:SourceArn": distributionArn},
-                },
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "AllowCloudFrontServicePrincipal",
+              "Effect": "Allow",
+              "Principal": {"Service": "cloudfront.amazonaws.com"},
+              "Action": "s3:GetObject",
+              "Resource": bucketArn ++ "/*",
+              "Condition": {
+                "StringEquals": {"AWS:SourceArn": distributionArn},
               },
-            ],
-          }
-          ->JSON.stringifyAny
-          ->Option.getUnsafe
-        )
-        ->Pulumi.Output.asInput,
+            },
+          ],
+        }
+        ->JSON.stringifyAny
+        ->Option.getUnsafe
+      )
+      ->Pulumi.Output.asInput,
     },
   )
 
@@ -461,27 +464,27 @@ let makeUiBundleDistribution = (
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
-          ->Pulumi.Output.all2
-          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-            {
-              "Version": "2012-10-17",
-              "Statement": [
-                {
-                  "Sid": "AllowCloudFrontServicePrincipal",
-                  "Effect": "Allow",
-                  "Principal": {"Service": "cloudfront.amazonaws.com"},
-                  "Action": "s3:GetObject",
-                  "Resource": bucketArn ++ "/*",
-                  "Condition": {
-                    "StringEquals": {"AWS:SourceArn": distributionArn},
-                  },
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+          {
+            "Version": "2012-10-17",
+            "Statement": [
+              {
+                "Sid": "AllowCloudFrontServicePrincipal",
+                "Effect": "Allow",
+                "Principal": {"Service": "cloudfront.amazonaws.com"},
+                "Action": "s3:GetObject",
+                "Resource": bucketArn ++ "/*",
+                "Condition": {
+                  "StringEquals": {"AWS:SourceArn": distributionArn},
                 },
-              ],
-            }
-            ->JSON.stringifyAny
-            ->Option.getUnsafe
-          )
-          ->Pulumi.Output.asInput,
+              },
+            ],
+          }
+          ->JSON.stringifyAny
+          ->Option.getUnsafe
+        )
+        ->Pulumi.Output.asInput,
       },
     )
   })
@@ -491,9 +494,7 @@ let makeUiBundleDistribution = (
   | Some(dir) =>
     let allEntries = Util.StaticBundle.walk(dir)
     if allEntries->Array.length == 0 {
-      JsError.throwWithMessage(
-        `Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ${dir}`,
-      )
+      JsError.throwWithMessage(`Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ${dir}`)
     }
     // Drop excluded relative paths before BucketObject creation. Used so the
     // host-shell deploy can skip the dev-mode `public/config.json` it ships
@@ -502,21 +503,20 @@ let makeUiBundleDistribution = (
     // upload (whichever Pulumi applies last wins).
     let entries =
       allEntries->Array.filter(entry => !(excludeFiles->Array.includes(entry.relativePath)))
-    let objectEtags =
-      entries->Array.map(entry => {
-        let obj = PulumiAws.S3.BucketObject.make(
-          ~name=name ++ "-asset-" ++ Util.StaticBundle.sanitizeName(entry.relativePath),
-          ~args={
-            bucket: bucket.id->Pulumi.Output.asInput,
-            key: Pulumi.Input.make(entry.relativePath),
-            source: Pulumi.Input.make(entry.fileAsset),
-            contentType: Pulumi.Input.make(Util.StaticBundle.contentTypeFor(entry.relativePath)),
-            cacheControl: Pulumi.Input.make(cacheControlFor(entry.relativePath)),
-            etag: Pulumi.Input.make(entry.contentHash),
-          },
-        )
-        obj.etag
-      })
+    let objectEtags = entries->Array.map(entry => {
+      let obj = PulumiAws.S3.BucketObject.make(
+        ~name=name ++ "-asset-" ++ Util.StaticBundle.sanitizeName(entry.relativePath),
+        ~args={
+          bucket: bucket.id->Pulumi.Output.asInput,
+          key: Pulumi.Input.make(entry.relativePath),
+          source: Pulumi.Input.make(entry.fileAsset),
+          contentType: Pulumi.Input.make(Util.StaticBundle.contentTypeFor(entry.relativePath)),
+          cacheControl: Pulumi.Input.make(cacheControlFor(entry.relativePath)),
+          etag: Pulumi.Input.make(entry.contentHash),
+        },
+      )
+      obj.etag
+    })
 
     // Auto-invalidate CloudFront once every object is (re)uploaded. Stable-named
     // entry files (index.html, the module-federation mf-entry-bootstrap-*.js)
@@ -629,7 +629,8 @@ let makeServedBucketDistribution = (
       | None => None
       | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
       },
-      origins: oac.id->Pulumi.Output.apply(oacId =>
+      origins: oac.id
+      ->Pulumi.Output.apply(oacId =>
         servedBuckets->Array.map(sb => {
           PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
           originId: Pulumi.Input.make(originIdFor(sb.id)),
@@ -710,27 +711,27 @@ let makeServedBucketDistribution = (
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
-          ->Pulumi.Output.all2
-          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-            {
-              "Version": "2012-10-17",
-              "Statement": [
-                {
-                  "Sid": "AllowCloudFrontServicePrincipal",
-                  "Effect": "Allow",
-                  "Principal": {"Service": "cloudfront.amazonaws.com"},
-                  "Action": "s3:GetObject",
-                  "Resource": bucketArn ++ "/*",
-                  "Condition": {
-                    "StringEquals": {"AWS:SourceArn": distributionArn},
-                  },
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+          {
+            "Version": "2012-10-17",
+            "Statement": [
+              {
+                "Sid": "AllowCloudFrontServicePrincipal",
+                "Effect": "Allow",
+                "Principal": {"Service": "cloudfront.amazonaws.com"},
+                "Action": "s3:GetObject",
+                "Resource": bucketArn ++ "/*",
+                "Condition": {
+                  "StringEquals": {"AWS:SourceArn": distributionArn},
                 },
-              ],
-            }
-            ->JSON.stringifyAny
-            ->Option.getUnsafe
-          )
-          ->Pulumi.Output.asInput,
+              },
+            ],
+          }
+          ->JSON.stringifyAny
+          ->Option.getUnsafe
+        )
+        ->Pulumi.Output.asInput,
       },
     )
   })

package/src/util/Util_AlarmSpec.res

@@ -30,7 +30,8 @@ type t = {
     a slow deploy or a throttle cannot trip it, close enough that a stopped
     scheduler is caught within the hour rather than by its consequences days
     later. Deployments that set a long `heartbeatInterval` should raise it. */
-let defaultSilenceWindowSeconds = 60 * 60
+let defaultSilenceWindowSeconds =
+  60 * 60
 
 let errorsAlarm = {
   metricName: "Errors",

package/src/util/Util_AppSync.res

@@ -11,7 +11,10 @@ let toResource: Types.AppSync.resolver => ReventlessInfra.Adapter.resource = ({
     ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
     ~resourceInfo=(type_, field)
     ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((type_, field)) => ReventlessInfra.Adapter.ApiResolver({typeName: type_, fieldName: field})),
+    ->Pulumi.Output.apply(((type_, field)) => ReventlessInfra.Adapter.ApiResolver({
+      typeName: type_,
+      fieldName: field,
+    })),
     ~resourceType="aws:appsync:Resolver"->Pulumi.Output.make,
   )
 
@@ -31,6 +34,9 @@ let toResourceNative: PulumiAws.AwsNative.AppSync.Resolver.t => ReventlessInfra.
     ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
     ~resourceInfo=(typeName, fieldName)
     ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((t, f)) => ReventlessInfra.Adapter.ApiResolver({typeName: t, fieldName: f})),
+    ->Pulumi.Output.apply(((t, f)) => ReventlessInfra.Adapter.ApiResolver({
+      typeName: t,
+      fieldName: f,
+    })),
     ~resourceType="aws-native:appsync:Resolver"->Pulumi.Output.make,
   )

package/src/util/Util_AppSync_Caller.res

@@ -21,7 +21,7 @@ type awsCredentials = {
 // defaultProvider() returns a credential-provider function.
 // It resolves credentials from env vars → SSO → ini files → IMDSv2.
 @module("@aws-sdk/credential-provider-node")
-external defaultProvider: unit => (unit => promise<awsCredentials>) = "defaultProvider"
+external defaultProvider: unit => unit => promise<awsCredentials> = "defaultProvider"
 
 // ── SigV4 signer ──────────────────────────────────────────────────────────────
 
@@ -139,10 +139,12 @@ let buildQuery = (
 
 // Signs and sends a GraphQL query; returns the `data` object or None on error.
 // ~queryString must be a complete "query { field(...) { ... } }" string.
-let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string): option<JSON.t> => {
+let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string): option<
+  JSON.t,
+> => {
   let url = parseUrl(endpoint)
-  let hostname: string = (url)["hostname"]
-  let path: string = (url)["pathname"]
+  let hostname: string = url["hostname"]
+  let path: string = url["pathname"]
 
   let body =
     Dict.fromArray([("query", queryString->JSON.Encode.string)])
@@ -186,19 +188,18 @@ let sendMutation = async (
   ~variables: 'a,
 ) => {
   let url = parseUrl(endpoint)
-  let hostname: string = (url)["hostname"]
-  let path: string = (url)["pathname"]
+  let hostname: string = url["hostname"]
+  let path: string = url["pathname"]
 
   // Normalise variables to a JSON.t dict (strips undefined optional fields)
-  let variablesDict: dict<JSON.t> =
-    switch variables->JSON.stringifyAny {
-    | Some(str) =>
-      switch str->JSON.parseOrThrow {
-      | Object(d) => d
-      | _ => Dict.make()
-      }
-    | None => Dict.make()
+  let variablesDict: dict<JSON.t> = switch variables->JSON.stringifyAny {
+  | Some(str) =>
+    switch str->JSON.parseOrThrow {
+    | Object(d) => d
+    | _ => Dict.make()
     }
+  | None => Dict.make()
+  }
 
   let query = buildQuery(~mutation, ~selection, ~variablesDict)
   let body =

package/src/util/Util_Bundle.res

@@ -92,8 +92,9 @@ let resolvePackageRoot = (~fromPulumiProject: bool=false, packageName: string):
     let viaFramework = () => NodePath.dirname(localRequire->NodeModule.requireResolve(request))
     let viaPulumiProject = () =>
       NodePath.dirname(
-        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")
-        ->NodeModule.requireResolve(request),
+        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")->NodeModule.requireResolve(
+          request,
+        ),
       )
     let (preferred, fallback) = fromPulumiProject
       ? (viaPulumiProject, viaFramework)
@@ -204,7 +205,11 @@ let rec walkDir = (
         let newPrefix = prefix == "" ? entryName : prefix ++ "/" ++ entryName
         walkDir(~dir=NodePath.join([dir, entryName]), ~prefix=newPrefix, ~assets, ~paths)
       }
-    } else if entryName == "package.json" || entryName->String.endsWith(".mjs") || entryName->String.endsWith(".js") {
+    } else if (
+      entryName == "package.json" ||
+      entryName->String.endsWith(".mjs") ||
+      entryName->String.endsWith(".js")
+    ) {
       let relPath = prefix == "" ? entryName : prefix ++ "/" ++ entryName
       let absPath = NodePath.join([dir, entryName])
       assets->Dict.set(
@@ -339,42 +344,42 @@ let isRuntimeProvided = (specifier: string, ~pkgName: string): bool =>
   nodeBuiltins->Set.has(specifier) ||
   nodeBuiltins->Set.has(pkgName) ||
   pkgName->String.startsWith("@aws-sdk/") ||
-  pkgName->String.startsWith("@smithy/") ||
-  (
-    try {
-      let _ = resolvePackageRoot(pkgName)
-      true
-    } catch {
-    | _ => false
-    }
-  )
-
-// Memo for isFrameworkPackage — one require.resolve per package name per deploy.
-let frameworkPackageCache: dict<bool> = Dict.make()
+  pkgName->String.startsWith("@smithy/") || try {
+    let _ = resolvePackageRoot(pkgName)
+    true
+  } catch {
+  | _ => false
+  }
 
-/**
- * Whether the framework's own module resolution reaches this package: the
- * deploy-time stand-in for "the Lambda layer already carries it", since the
- * layer is built from reventless-aws's dependency closure.
- *
- * Deliberately framework-rooted only — no Pulumi-project fallback. The question
- * here is the opposite of `resolvePackageRoot`'s: a package the *project*
- * resolves but the framework does not is precisely a user package, which is
- * what the closure walk below must treat as a starting point rather than as
- * something the runtime provides.
- */
-let isFrameworkPackage = (pkgName: string): bool =>
-  switch frameworkPackageCache->Dict.get(pkgName) {
-  | Some(known) => known
-  | None =>
-    let known = try {
-      let _ = localRequire->NodeModule.requireResolve(pkgName ++ "/package.json")
-      true
-    } catch {
-    | _ => false
+/** The framework's own package root: this module ships inside reventless-aws, so
+    the nearest package.json walking up from it is reventless-aws's own. */
+let frameworkPackageRoot: string = {
+  let filePath = newURL(%raw("import.meta.url"))->pathname
+  let dirRef = ref(NodePath.dirname(filePath))
+  let foundRef: ref<option<string>> = ref(None)
+  while dirRef.contents != "/" && foundRef.contents->Option.isNone {
+    if NodeFs.existsSync(NodePath.join([dirRef.contents, "package.json"])) {
+      foundRef := Some(dirRef.contents)
+    } else {
+      dirRef := NodePath.dirname(dirRef.contents)
     }
-    frameworkPackageCache->Dict.set(pkgName, known)
-    known
+  }
+  foundRef.contents->Option.getOr(NodePath.dirname(filePath))
+}
+
+/** The `dependencies` a package declares — the edges the layer's own npm install
+    follows. devDependencies are deliberately not read: the layer is a production
+    install, so a dev-only package is not in it. */
+let declaredDependencies = (packageRoot: string): array<string> =>
+  try {
+    NodeFs.readFileSync(NodePath.join([packageRoot, "package.json"]))
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+    ->Option.flatMap(o => o->Dict.get("dependencies"))
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.mapOr([], Dict.keysToArray)
+  } catch {
+  | _ => []
   }
 
 // The distinct bare packages a package's own bundled files import, memoised per
@@ -419,14 +424,85 @@ let resolvePackageRootFrom = (~fromRoot: string, pkgName: string): option<string
   try {
     Some(
       NodePath.dirname(
-        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))
-        ->NodeModule.requireResolve(pkgName ++ "/package.json"),
+        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))->NodeModule.requireResolve(
+          pkgName ++ "/package.json",
+        ),
       ),
     )
   } catch {
   | _ => None
   }
 
+/** Packages the layer carries that reventless-aws does not declare, mirroring
+    `includeModules` in the layer builder's config. `@rescript/runtime` is the
+    case that matters: it is a transitive of `rescript`, which the layer excludes
+    as a build tool, so the production closure misses it while the layer holds
+    it. Without this the walk would add 19 MB to every archive.
+
+    The layer's `excludeModules` are deliberately NOT mirrored. Those are
+    deploy-time-only packages (the @pulumi bindings, esbuild, the SSH stack); the
+    walk is import-driven, so a package no runtime file imports never comes up. */
+let layerIncludedModules = Set.fromArray(["@rescript/runtime"])
+
+// Memo for the framework's dependency closure — one walk per deploy.
+let frameworkClosureCache: ref<option<dict<bool>>> = ref(None)
+
+/**
+ * The packages the Lambda layer carries: reventless-aws and its transitive
+ * `dependencies`, which is exactly what the layer builder npm-installs.
+ *
+ * Membership rather than resolvability, and the distinction is the whole point.
+ * Resolvability asked whether `require.resolve` reaches a package from this
+ * module — but Node resolution walks *up*, so in a consumer repo with a hoisted
+ * `node_modules` every package at the workspace root answers yes, including the
+ * plugin packages and their traits. That made this predicate true for packages
+ * the layer has never held: they were dropped from the archive as
+ * layer-provided, and the plugin package itself was filtered out of the closure
+ * walk's starting points, so its imports were never walked at all. The failure
+ * lands at the first command as `Cannot find package`, on a green deploy.
+ *
+ * Declared edges are followed from the declaring package's own directory, so a
+ * pnpm layout resolves the same way the runtime would. A dependency that is
+ * declared but not installed still counts as the layer's: the archive is not the
+ * place to compensate for an incomplete install.
+ */
+let frameworkPackages = (): dict<bool> =>
+  switch frameworkClosureCache.contents {
+  | Some(closure) => closure
+  | None =>
+    let closure = Dict.make()
+    let pending = [frameworkPackageRoot]
+    let next = ref(0)
+    while next.contents < pending->Array.length {
+      let root = pending->Array.getUnsafe(next.contents)
+      next := next.contents + 1
+      declaredDependencies(root)->Array.forEach(dep =>
+        if !(closure->Dict.has(dep)) {
+          closure->Dict.set(dep, true)
+          switch resolvePackageRootFrom(~fromRoot=root, dep) {
+          | Some(depRoot) => pending->Array.push(depRoot)
+          | None => ()
+          }
+        }
+      )
+    }
+    frameworkClosureCache := Some(closure)
+    closure
+  }
+
+/**
+ * Whether the deployed runtime already carries this package, so the archive
+ * need not: reventless-aws itself, or anything in its dependency closure.
+ *
+ * A package the *project* resolves but this does not is precisely a user
+ * package, which the closure walk below must treat as a starting point rather
+ * than as something the runtime provides.
+ */
+let isFrameworkPackage = (pkgName: string): bool =>
+  pkgName == "@reventlessdev/reventless-aws" ||
+  layerIncludedModules->Set.has(pkgName) ||
+  frameworkPackages()->Dict.has(pkgName)
+
 /**
  * Carry every package a bundled *user* package imports into the archive, and
  * every package those import in turn.
@@ -496,15 +572,16 @@ let assertRuntimeExtensionImportsResolvable = (
       if relPath->String.endsWith(".mjs") || relPath->String.endsWith(".js") {
         NodeFs.readFileSync(absPath)
         ->staticImportSpecifiers
-        ->Array.forEach(specifier =>
-          if isBareSpecifier(specifier) {
-            let dep = extractPackageName(specifier)
-            if !(bundledPackages->Dict.has(dep)) && !isRuntimeProvided(specifier, ~pkgName=dep) {
-              JsError.throwWithMessage(
-                `runtime extension package "${pkgName}" imports "${specifier}" (${relPath}), which is neither bundled into the code archive nor provided in the deployed runtime. The extension would be skipped at every cold start with "could not be loaded". Declare the package in the extension's companionModuleUrls — the import.meta.url of one of its modules — so it rides into the archive alongside the extension.`,
-              )
-            }
-          }
+        ->Array.forEach(
+          specifier =>
+            if isBareSpecifier(specifier) {
+              let dep = extractPackageName(specifier)
+              if !(bundledPackages->Dict.has(dep)) && !isRuntimeProvided(specifier, ~pkgName=dep) {
+                JsError.throwWithMessage(
+                  `runtime extension package "${pkgName}" imports "${specifier}" (${relPath}), which is neither bundled into the code archive nor provided in the deployed runtime. The extension would be skipped at every cold start with "could not be loaded". Declare the package in the extension's companionModuleUrls — the import.meta.url of one of its modules — so it rides into the archive alongside the extension.`,
+                )
+              }
+            },
         )
       }
     )
@@ -554,15 +631,16 @@ let buildCodeArchive = (
     )
   })
   // Co-bundle effect whenever reventless-aws is bundled (see comment above).
-  let allPackageDirs =
-    if packageDirs->Dict.has("@reventlessdev/reventless-aws") &&
-      !(packageDirs->Dict.has("effect")) {
-      let dirs = packageDirs->Dict.copy
-      dirs->Dict.set("effect", resolvePackageRoot("effect"))
-      dirs
-    } else {
-      packageDirs
-    }
+  let allPackageDirs = if (
+    packageDirs->Dict.has("@reventlessdev/reventless-aws") && !(packageDirs->Dict.has("effect"))
+  ) {
+    let dirs = packageDirs->Dict.copy
+    dirs->Dict.set("effect", resolvePackageRoot("effect"))
+    dirs
+  } else {
+    packageDirs
+  }
+
   // Registered runtime extensions ride along (with their declared companion
   // packages), so the entry shell can import them at cold start. No-op when
   // nothing is registered — the archive, and therefore `sourceCodeHash`, is
@@ -598,15 +676,14 @@ let buildCodeArchive = (
   })
   let code = Pulumi.Archive.assetArchive(archiveContents)
   packageContentHashes.contents->Array.sort(String.compare)
-  let sourceCodeHash =
-    hashString(
-      reExportCode ++
-      "\n---\n" ++
-      packageContentHashes.contents->Array.join(",") ++
-      "\n---\n" ++
-      extraHashEntries->Array.join("\n") ++
-      "\n---\n" ++
-      loaderHash,
-    )
+  let sourceCodeHash = hashString(
+    reExportCode ++
+    "\n---\n" ++
+    packageContentHashes.contents->Array.join(",") ++
+    "\n---\n" ++
+    extraHashEntries->Array.join("\n") ++
+    "\n---\n" ++
+    loaderHash,
+  )
   {code, sourceCodeHash}
 }