@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.345

package/src/plugin/stack/Plugin_Stack.res

@@ -59,9 +59,7 @@ let _getUsEast1Provider = (): PulumiAws.Aws.Provider.t =>
 // `no-cache` here a redeploy uploads the new entry file to S3 while CloudFront
 // (and browsers) keep serving the previous build: the "deployed but stale" trap.
 let cacheControlFor = (relativePath: string): string =>
-  relativePath->String.startsWith("assets/")
-    ? "public, max-age=31536000, immutable"
-    : "no-cache"
+  relativePath->String.startsWith("assets/") ? "public, max-age=31536000, immutable" : "no-cache"
 
 // ── Inline CloudFront SDK binding (deploy-time cache invalidation) ───────────
 // Mirrors AppSync_Adapter's inline `@aws-sdk` binding pattern. Runs in the
@@ -103,7 +101,10 @@ let invalidateDistribution = async (~distributionId: string, ~paths: array<strin
       },
     }
     let _ = await client->cfSend(input->makeCreateInvalidationCommand)
-    log.info(~comp="makeUiBundleDistribution", `CloudFront invalidation submitted for ${distributionId}`)
+    log.info(
+      ~comp="makeUiBundleDistribution",
+      `CloudFront invalidation submitted for ${distributionId}`,
+    )
   } catch {
   | exn =>
     let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
@@ -212,7 +213,9 @@ let makeUiBundleDistribution = (
   // policy. Always cover `remoteEntry.js` (federation manifest) and, for SPA
   // shells, `index.html` + `config.json`. Hashed assets fall through to the
   // CachingOptimized default behavior since their URL changes on every build.
-  let noCacheBehavior = (pattern: string): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
+  let noCacheBehavior = (
+    pattern: string,
+  ): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
     pathPattern: Pulumi.Input.make(pattern),
     targetOriginId: Pulumi.Input.make(originId),
     viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
@@ -330,27 +333,27 @@ let makeUiBundleDistribution = (
       | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
       },
       origins: (bucket.bucketRegionalDomainName, oac.id)
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply(((domainName, oacId)) =>
-          Array.concat(
-            [
-              {
-                PulumiAws.CloudFront.Distribution.domainName: Pulumi.Input.make(domainName),
-                originId: Pulumi.Input.make(originId),
-                originAccessControlId: Pulumi.Input.make(oacId),
-              },
-            ],
-            // One S3 origin per served bucket, sharing the same OAC as the bundle
-            // origin (the OAC only authorizes CloudFront→S3 sigv4 signing; the
-            // per-bucket read grant is the served bucket's own BucketPolicy below).
-            servedBuckets->Array.map(sb => {
-              PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
-              originId: Pulumi.Input.make(servedOriginId(sb.id)),
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((domainName, oacId)) =>
+        Array.concat(
+          [
+            {
+              PulumiAws.CloudFront.Distribution.domainName: Pulumi.Input.make(domainName),
+              originId: Pulumi.Input.make(originId),
               originAccessControlId: Pulumi.Input.make(oacId),
-            }),
-          )
+            },
+          ],
+          // One S3 origin per served bucket, sharing the same OAC as the bundle
+          // origin (the OAC only authorizes CloudFront→S3 sigv4 signing; the
+          // per-bucket read grant is the served bucket's own BucketPolicy below).
+          servedBuckets->Array.map(sb => {
+            PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
+            originId: Pulumi.Input.make(servedOriginId(sb.id)),
+            originAccessControlId: Pulumi.Input.make(oacId),
+          }),
         )
-        ->Pulumi.Output.asInput,
+      )
+      ->Pulumi.Output.asInput,
       defaultCacheBehavior: Pulumi.Input.make(
         (
           {
@@ -413,27 +416,27 @@ let makeUiBundleDistribution = (
     ~args={
       bucket: bucket.id->Pulumi.Output.asInput,
       policy: (bucket.arn, distribution.arn)
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-          {
-            "Version": "2012-10-17",
-            "Statement": [
-              {
-                "Sid": "AllowCloudFrontServicePrincipal",
-                "Effect": "Allow",
-                "Principal": {"Service": "cloudfront.amazonaws.com"},
-                "Action": "s3:GetObject",
-                "Resource": bucketArn ++ "/*",
-                "Condition": {
-                  "StringEquals": {"AWS:SourceArn": distributionArn},
-                },
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "AllowCloudFrontServicePrincipal",
+              "Effect": "Allow",
+              "Principal": {"Service": "cloudfront.amazonaws.com"},
+              "Action": "s3:GetObject",
+              "Resource": bucketArn ++ "/*",
+              "Condition": {
+                "StringEquals": {"AWS:SourceArn": distributionArn},
               },
-            ],
-          }
-          ->JSON.stringifyAny
-          ->Option.getUnsafe
-        )
-        ->Pulumi.Output.asInput,
+            },
+          ],
+        }
+        ->JSON.stringifyAny
+        ->Option.getUnsafe
+      )
+      ->Pulumi.Output.asInput,
     },
   )
 
@@ -461,27 +464,27 @@ let makeUiBundleDistribution = (
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
-          ->Pulumi.Output.all2
-          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-            {
-              "Version": "2012-10-17",
-              "Statement": [
-                {
-                  "Sid": "AllowCloudFrontServicePrincipal",
-                  "Effect": "Allow",
-                  "Principal": {"Service": "cloudfront.amazonaws.com"},
-                  "Action": "s3:GetObject",
-                  "Resource": bucketArn ++ "/*",
-                  "Condition": {
-                    "StringEquals": {"AWS:SourceArn": distributionArn},
-                  },
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+          {
+            "Version": "2012-10-17",
+            "Statement": [
+              {
+                "Sid": "AllowCloudFrontServicePrincipal",
+                "Effect": "Allow",
+                "Principal": {"Service": "cloudfront.amazonaws.com"},
+                "Action": "s3:GetObject",
+                "Resource": bucketArn ++ "/*",
+                "Condition": {
+                  "StringEquals": {"AWS:SourceArn": distributionArn},
                 },
-              ],
-            }
-            ->JSON.stringifyAny
-            ->Option.getUnsafe
-          )
-          ->Pulumi.Output.asInput,
+              },
+            ],
+          }
+          ->JSON.stringifyAny
+          ->Option.getUnsafe
+        )
+        ->Pulumi.Output.asInput,
       },
     )
   })
@@ -491,9 +494,7 @@ let makeUiBundleDistribution = (
   | Some(dir) =>
     let allEntries = Util.StaticBundle.walk(dir)
     if allEntries->Array.length == 0 {
-      JsError.throwWithMessage(
-        `Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ${dir}`,
-      )
+      JsError.throwWithMessage(`Plugin_Stack.makeUiBundleDistribution: assetsDir is empty: ${dir}`)
     }
     // Drop excluded relative paths before BucketObject creation. Used so the
     // host-shell deploy can skip the dev-mode `public/config.json` it ships
@@ -502,21 +503,20 @@ let makeUiBundleDistribution = (
     // upload (whichever Pulumi applies last wins).
     let entries =
       allEntries->Array.filter(entry => !(excludeFiles->Array.includes(entry.relativePath)))
-    let objectEtags =
-      entries->Array.map(entry => {
-        let obj = PulumiAws.S3.BucketObject.make(
-          ~name=name ++ "-asset-" ++ Util.StaticBundle.sanitizeName(entry.relativePath),
-          ~args={
-            bucket: bucket.id->Pulumi.Output.asInput,
-            key: Pulumi.Input.make(entry.relativePath),
-            source: Pulumi.Input.make(entry.fileAsset),
-            contentType: Pulumi.Input.make(Util.StaticBundle.contentTypeFor(entry.relativePath)),
-            cacheControl: Pulumi.Input.make(cacheControlFor(entry.relativePath)),
-            etag: Pulumi.Input.make(entry.contentHash),
-          },
-        )
-        obj.etag
-      })
+    let objectEtags = entries->Array.map(entry => {
+      let obj = PulumiAws.S3.BucketObject.make(
+        ~name=name ++ "-asset-" ++ Util.StaticBundle.sanitizeName(entry.relativePath),
+        ~args={
+          bucket: bucket.id->Pulumi.Output.asInput,
+          key: Pulumi.Input.make(entry.relativePath),
+          source: Pulumi.Input.make(entry.fileAsset),
+          contentType: Pulumi.Input.make(Util.StaticBundle.contentTypeFor(entry.relativePath)),
+          cacheControl: Pulumi.Input.make(cacheControlFor(entry.relativePath)),
+          etag: Pulumi.Input.make(entry.contentHash),
+        },
+      )
+      obj.etag
+    })
 
     // Auto-invalidate CloudFront once every object is (re)uploaded. Stable-named
     // entry files (index.html, the module-federation mf-entry-bootstrap-*.js)
@@ -629,7 +629,8 @@ let makeServedBucketDistribution = (
       | None => None
       | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
       },
-      origins: oac.id->Pulumi.Output.apply(oacId =>
+      origins: oac.id
+      ->Pulumi.Output.apply(oacId =>
         servedBuckets->Array.map(sb => {
           PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
           originId: Pulumi.Input.make(originIdFor(sb.id)),
@@ -710,27 +711,27 @@ let makeServedBucketDistribution = (
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
-          ->Pulumi.Output.all2
-          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
-            {
-              "Version": "2012-10-17",
-              "Statement": [
-                {
-                  "Sid": "AllowCloudFrontServicePrincipal",
-                  "Effect": "Allow",
-                  "Principal": {"Service": "cloudfront.amazonaws.com"},
-                  "Action": "s3:GetObject",
-                  "Resource": bucketArn ++ "/*",
-                  "Condition": {
-                    "StringEquals": {"AWS:SourceArn": distributionArn},
-                  },
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+          {
+            "Version": "2012-10-17",
+            "Statement": [
+              {
+                "Sid": "AllowCloudFrontServicePrincipal",
+                "Effect": "Allow",
+                "Principal": {"Service": "cloudfront.amazonaws.com"},
+                "Action": "s3:GetObject",
+                "Resource": bucketArn ++ "/*",
+                "Condition": {
+                  "StringEquals": {"AWS:SourceArn": distributionArn},
                 },
-              ],
-            }
-            ->JSON.stringifyAny
-            ->Option.getUnsafe
-          )
-          ->Pulumi.Output.asInput,
+              },
+            ],
+          }
+          ->JSON.stringifyAny
+          ->Option.getUnsafe
+        )
+        ->Pulumi.Output.asInput,
       },
     )
   })

package/src/util/Util_AlarmSpec.res

@@ -30,7 +30,8 @@ type t = {
     a slow deploy or a throttle cannot trip it, close enough that a stopped
     scheduler is caught within the hour rather than by its consequences days
     later. Deployments that set a long `heartbeatInterval` should raise it. */
-let defaultSilenceWindowSeconds = 60 * 60
+let defaultSilenceWindowSeconds =
+  60 * 60
 
 let errorsAlarm = {
   metricName: "Errors",

package/src/util/Util_AppSync.res

@@ -11,7 +11,10 @@ let toResource: Types.AppSync.resolver => ReventlessInfra.Adapter.resource = ({
     ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
     ~resourceInfo=(type_, field)
     ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((type_, field)) => ReventlessInfra.Adapter.ApiResolver({typeName: type_, fieldName: field})),
+    ->Pulumi.Output.apply(((type_, field)) => ReventlessInfra.Adapter.ApiResolver({
+      typeName: type_,
+      fieldName: field,
+    })),
     ~resourceType="aws:appsync:Resolver"->Pulumi.Output.make,
   )
 
@@ -31,6 +34,9 @@ let toResourceNative: PulumiAws.AwsNative.AppSync.Resolver.t => ReventlessInfra.
     ~service=id->Pulumi.Output.apply(_ => AWS.AppSync.service),
     ~resourceInfo=(typeName, fieldName)
     ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((t, f)) => ReventlessInfra.Adapter.ApiResolver({typeName: t, fieldName: f})),
+    ->Pulumi.Output.apply(((t, f)) => ReventlessInfra.Adapter.ApiResolver({
+      typeName: t,
+      fieldName: f,
+    })),
     ~resourceType="aws-native:appsync:Resolver"->Pulumi.Output.make,
   )

package/src/util/Util_AppSync_Caller.res

@@ -21,7 +21,7 @@ type awsCredentials = {
 // defaultProvider() returns a credential-provider function.
 // It resolves credentials from env vars → SSO → ini files → IMDSv2.
 @module("@aws-sdk/credential-provider-node")
-external defaultProvider: unit => (unit => promise<awsCredentials>) = "defaultProvider"
+external defaultProvider: unit => unit => promise<awsCredentials> = "defaultProvider"
 
 // ── SigV4 signer ──────────────────────────────────────────────────────────────
 
@@ -139,10 +139,12 @@ let buildQuery = (
 
 // Signs and sends a GraphQL query; returns the `data` object or None on error.
 // ~queryString must be a complete "query { field(...) { ... } }" string.
-let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string): option<JSON.t> => {
+let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string): option<
+  JSON.t,
+> => {
   let url = parseUrl(endpoint)
-  let hostname: string = (url)["hostname"]
-  let path: string = (url)["pathname"]
+  let hostname: string = url["hostname"]
+  let path: string = url["pathname"]
 
   let body =
     Dict.fromArray([("query", queryString->JSON.Encode.string)])
@@ -186,19 +188,18 @@ let sendMutation = async (
   ~variables: 'a,
 ) => {
   let url = parseUrl(endpoint)
-  let hostname: string = (url)["hostname"]
-  let path: string = (url)["pathname"]
+  let hostname: string = url["hostname"]
+  let path: string = url["pathname"]
 
   // Normalise variables to a JSON.t dict (strips undefined optional fields)
-  let variablesDict: dict<JSON.t> =
-    switch variables->JSON.stringifyAny {
-    | Some(str) =>
-      switch str->JSON.parseOrThrow {
-      | Object(d) => d
-      | _ => Dict.make()
-      }
-    | None => Dict.make()
+  let variablesDict: dict<JSON.t> = switch variables->JSON.stringifyAny {
+  | Some(str) =>
+    switch str->JSON.parseOrThrow {
+    | Object(d) => d
+    | _ => Dict.make()
     }
+  | None => Dict.make()
+  }
 
   let query = buildQuery(~mutation, ~selection, ~variablesDict)
   let body =

package/src/util/Util_Bundle.res

@@ -92,8 +92,9 @@ let resolvePackageRoot = (~fromPulumiProject: bool=false, packageName: string):
     let viaFramework = () => NodePath.dirname(localRequire->NodeModule.requireResolve(request))
     let viaPulumiProject = () =>
       NodePath.dirname(
-        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")
-        ->NodeModule.requireResolve(request),
+        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")->NodeModule.requireResolve(
+          request,
+        ),
       )
     let (preferred, fallback) = fromPulumiProject
       ? (viaPulumiProject, viaFramework)
@@ -204,7 +205,11 @@ let rec walkDir = (
         let newPrefix = prefix == "" ? entryName : prefix ++ "/" ++ entryName
         walkDir(~dir=NodePath.join([dir, entryName]), ~prefix=newPrefix, ~assets, ~paths)
       }
-    } else if entryName == "package.json" || entryName->String.endsWith(".mjs") || entryName->String.endsWith(".js") {
+    } else if (
+      entryName == "package.json" ||
+      entryName->String.endsWith(".mjs") ||
+      entryName->String.endsWith(".js")
+    ) {
       let relPath = prefix == "" ? entryName : prefix ++ "/" ++ entryName
       let absPath = NodePath.join([dir, entryName])
       assets->Dict.set(
@@ -339,15 +344,12 @@ let isRuntimeProvided = (specifier: string, ~pkgName: string): bool =>
   nodeBuiltins->Set.has(specifier) ||
   nodeBuiltins->Set.has(pkgName) ||
   pkgName->String.startsWith("@aws-sdk/") ||
-  pkgName->String.startsWith("@smithy/") ||
-  (
-    try {
-      let _ = resolvePackageRoot(pkgName)
-      true
-    } catch {
-    | _ => false
-    }
-  )
+  pkgName->String.startsWith("@smithy/") || try {
+    let _ = resolvePackageRoot(pkgName)
+    true
+  } catch {
+  | _ => false
+  }
 
 /** The framework's own package root: this module ships inside reventless-aws, so
     the nearest package.json walking up from it is reventless-aws's own. */
@@ -422,8 +424,9 @@ let resolvePackageRootFrom = (~fromRoot: string, pkgName: string): option<string
   try {
     Some(
       NodePath.dirname(
-        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))
-        ->NodeModule.requireResolve(pkgName ++ "/package.json"),
+        NodeModule.createRequire(NodePath.join([fromRoot, "index.js"]))->NodeModule.requireResolve(
+          pkgName ++ "/package.json",
+        ),
       ),
     )
   } catch {
@@ -569,15 +572,16 @@ let assertRuntimeExtensionImportsResolvable = (
       if relPath->String.endsWith(".mjs") || relPath->String.endsWith(".js") {
         NodeFs.readFileSync(absPath)
         ->staticImportSpecifiers
-        ->Array.forEach(specifier =>
-          if isBareSpecifier(specifier) {
-            let dep = extractPackageName(specifier)
-            if !(bundledPackages->Dict.has(dep)) && !isRuntimeProvided(specifier, ~pkgName=dep) {
-              JsError.throwWithMessage(
-                `runtime extension package "${pkgName}" imports "${specifier}" (${relPath}), which is neither bundled into the code archive nor provided in the deployed runtime. The extension would be skipped at every cold start with "could not be loaded". Declare the package in the extension's companionModuleUrls — the import.meta.url of one of its modules — so it rides into the archive alongside the extension.`,
-              )
-            }
-          }
+        ->Array.forEach(
+          specifier =>
+            if isBareSpecifier(specifier) {
+              let dep = extractPackageName(specifier)
+              if !(bundledPackages->Dict.has(dep)) && !isRuntimeProvided(specifier, ~pkgName=dep) {
+                JsError.throwWithMessage(
+                  `runtime extension package "${pkgName}" imports "${specifier}" (${relPath}), which is neither bundled into the code archive nor provided in the deployed runtime. The extension would be skipped at every cold start with "could not be loaded". Declare the package in the extension's companionModuleUrls — the import.meta.url of one of its modules — so it rides into the archive alongside the extension.`,
+                )
+              }
+            },
         )
       }
     )
@@ -627,15 +631,16 @@ let buildCodeArchive = (
     )
   })
   // Co-bundle effect whenever reventless-aws is bundled (see comment above).
-  let allPackageDirs =
-    if packageDirs->Dict.has("@reventlessdev/reventless-aws") &&
-      !(packageDirs->Dict.has("effect")) {
-      let dirs = packageDirs->Dict.copy
-      dirs->Dict.set("effect", resolvePackageRoot("effect"))
-      dirs
-    } else {
-      packageDirs
-    }
+  let allPackageDirs = if (
+    packageDirs->Dict.has("@reventlessdev/reventless-aws") && !(packageDirs->Dict.has("effect"))
+  ) {
+    let dirs = packageDirs->Dict.copy
+    dirs->Dict.set("effect", resolvePackageRoot("effect"))
+    dirs
+  } else {
+    packageDirs
+  }
+
   // Registered runtime extensions ride along (with their declared companion
   // packages), so the entry shell can import them at cold start. No-op when
   // nothing is registered — the archive, and therefore `sourceCodeHash`, is
@@ -671,15 +676,14 @@ let buildCodeArchive = (
   })
   let code = Pulumi.Archive.assetArchive(archiveContents)
   packageContentHashes.contents->Array.sort(String.compare)
-  let sourceCodeHash =
-    hashString(
-      reExportCode ++
-      "\n---\n" ++
-      packageContentHashes.contents->Array.join(",") ++
-      "\n---\n" ++
-      extraHashEntries->Array.join("\n") ++
-      "\n---\n" ++
-      loaderHash,
-    )
+  let sourceCodeHash = hashString(
+    reExportCode ++
+    "\n---\n" ++
+    packageContentHashes.contents->Array.join(",") ++
+    "\n---\n" ++
+    extraHashEntries->Array.join("\n") ++
+    "\n---\n" ++
+    loaderHash,
+  )
   {code, sourceCodeHash}
 }

package/src/util/Util_CognitoGroupUser_Runtime.res

@@ -9,27 +9,26 @@ let addUserToGroup = (
   ~groupName: string,
   ~userPoolId: string,
 ) =>
-  Effect.tryPromise(
-    ~catch=Cognito_Error.classify,
-    () => {
-      open CognitoIdentityServiceProvider
-      let client: CognitoIdentityServiceProvider.client = Raw.client(
-        ~options={endpoint: Util_Cognito_Runtime.userPoolEndpoint(region, userPoolId), region},
-      )
-      let addUserToGroupCommand: AdminAddUserToGroupCommand.t = {
-        username: userName,
-        groupName,
-        userPoolId,
-      }->AdminAddUserToGroupCommand.make
-      client->AdminAddUserToGroupCommand.Raw.send(addUserToGroupCommand)
-    },
-  )
+  Effect.tryPromise(~catch=Cognito_Error.classify, () => {
+    open CognitoIdentityServiceProvider
+    let client: CognitoIdentityServiceProvider.client = Raw.client(
+      ~options={endpoint: Util_Cognito_Runtime.userPoolEndpoint(region, userPoolId), region},
+    )
+    let addUserToGroupCommand: AdminAddUserToGroupCommand.t = {
+      username: userName,
+      groupName,
+      userPoolId,
+    }->AdminAddUserToGroupCommand.make
+    client->AdminAddUserToGroupCommand.Raw.send(addUserToGroupCommand)
+  })
   ->Effect.map(_ => ())
   ->Effect.retry(Cognito_Error.retrySchedule)
   ->Effect.catchAll(err => {
     let msg = Cognito_Error.message(err)
-    ReventlessCore.EffectLogger.logError(~comp=__MODULE__, `addUserToGroup: ${msg}`)
-    ->Effect.flatMap(_ => Effect.fail(msg))
+    ReventlessCore.EffectLogger.logError(
+      ~comp=__MODULE__,
+      `addUserToGroup: ${msg}`,
+    )->Effect.flatMap(_ => Effect.fail(msg))
   })
   ->Effect.runPromise
 
@@ -40,26 +39,25 @@ let removeUserFromGroup = (
   ~groupName: string,
   ~userPoolId: string,
 ) =>
-  Effect.tryPromise(
-    ~catch=Cognito_Error.classify,
-    () => {
-      open CognitoIdentityServiceProvider
-      let client: CognitoIdentityServiceProvider.client = Raw.client(
-        ~options={endpoint: Util_Cognito_Runtime.userPoolEndpoint(region, userPoolId), region},
-      )
-      let removeUserFromGroupCommand = AdminRemoveUserFromGroupCommand.make({
-        username: userName,
-        groupName,
-        userPoolId,
-      })
-      client->AdminRemoveUserFromGroupCommand.Raw.send(removeUserFromGroupCommand)
-    },
-  )
+  Effect.tryPromise(~catch=Cognito_Error.classify, () => {
+    open CognitoIdentityServiceProvider
+    let client: CognitoIdentityServiceProvider.client = Raw.client(
+      ~options={endpoint: Util_Cognito_Runtime.userPoolEndpoint(region, userPoolId), region},
+    )
+    let removeUserFromGroupCommand = AdminRemoveUserFromGroupCommand.make({
+      username: userName,
+      groupName,
+      userPoolId,
+    })
+    client->AdminRemoveUserFromGroupCommand.Raw.send(removeUserFromGroupCommand)
+  })
   ->Effect.map(_ => ())
   ->Effect.retry(Cognito_Error.retrySchedule)
   ->Effect.catchAll(err => {
     let msg = Cognito_Error.message(err)
-    ReventlessCore.EffectLogger.logError(~comp=__MODULE__, `removeUserFromGroup: ${msg}`)
-    ->Effect.flatMap(_ => Effect.fail(msg))
+    ReventlessCore.EffectLogger.logError(
+      ~comp=__MODULE__,
+      `removeUserFromGroup: ${msg}`,
+    )->Effect.flatMap(_ => Effect.fail(msg))
   })
   ->Effect.runPromise

package/src/util/Util_Cognito_Runtime.res

@@ -33,20 +33,24 @@ let signUp = (
 /** sign up a user to a given userPool, if the user is not already present
    NOTE: should be called in runtime
 */
-// Intentionally silent on failure: user may already exist (idempotent sign-up).
-let signUpIfMissing = (
+let // Intentionally silent on failure: user may already exist (idempotent sign-up).
+signUpIfMissing = (
   ~region: string,
   ~userPoolId: string,
   ~userPoolClientId: string,
   ~userName: string,
   ~password: string,
 ) =>
-  Effect.tryPromise(
-    ~catch=Cognito_Error.classify,
-    () => signUp(~region, ~userPoolId, ~userPoolClientId, ~userName, ~password),
+  Effect.tryPromise(~catch=Cognito_Error.classify, () =>
+    signUp(~region, ~userPoolId, ~userPoolClientId, ~userName, ~password)
   )
   ->Effect.flatMap(result =>
-    ReventlessCore.EffectLogger.logInfo(~comp=__MODULE__, `Created User ${userName} ${result.userSub->Option.getOr("")}`)
+    ReventlessCore.EffectLogger.logInfo(
+      ~comp=__MODULE__,
+      `Created User ${userName} ${result.userSub->Option.getOr("")}`,
+    )
+  )
+  ->Effect.catchAll(err =>
+    ReventlessCore.EffectLogger.logInfo(~comp=__MODULE__, Cognito_Error.message(err))
   )
-  ->Effect.catchAll(err => ReventlessCore.EffectLogger.logInfo(~comp=__MODULE__, Cognito_Error.message(err)))
   ->Effect.runPromise

package/src/util/Util_DeadLetterQueue.res

@@ -158,7 +158,12 @@ let handler = Lambda.Function.make(
     memorySize: 128->Pulumi.Input.make,
     timeout: 30->Pulumi.Input.make,
     layers,
-    tags: AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Plugin, ~role=DeadLetter, ~scope=Plugin),
+    tags: AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Plugin,
+      ~role=DeadLetter,
+      ~scope=Plugin,
+    ),
     environment: (
       {
         Lambda.Function.variables: Dict.fromArray([
@@ -176,7 +181,12 @@ let handler = Lambda.Function.make(
 // kind, mechanism-agnostic resource — no-op unless a backend is registered.
 let deadLetterResource = Util_Lambda.functionToResource(
   handler,
-  ~tags=AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Plugin, ~role=DeadLetter, ~scope=Plugin)->Pulumi.Output.fromInput,
+  ~tags=AWS.Tags.make(
+    ~name,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=DeadLetter,
+    ~scope=Plugin,
+  )->Pulumi.Output.fromInput,
 )
 
 ReventlessCore.Monitoring.notify(