@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/src/components/Api/AppSync_SdlDecorate.res

@@ -44,9 +44,10 @@ let injectAwsSubscribe = (
             // leaves a trailing colon on the token — drop it (same rule as
             // GraphQL_Stitcher.rootTypeFieldNames).
             let name = ReventlessCore.GraphQL_Stitcher.extractLeadingName(line)
-            let name = name->String.endsWith(":")
-              ? name->String.slice(~start=0, ~end=name->String.length - 1)
-              : name
+            let name =
+              name->String.endsWith(":")
+                ? name->String.slice(~start=0, ~end=name->String.length - 1)
+                : name
             switch sourceByField->Dict.get(name) {
             | Some(mutations) =>
               let list = mutations->Array.map(m => `"${m}"`)->Array.join(", ")
@@ -89,7 +90,11 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
 
 // The group-less Cognito directive: reachable by any authenticated Cognito
 // caller. Emitted where a field or type is deliberately open — `AllowAuthenticated`,
-// `AllowAnonymous`, a field carrying no permission at all, and every object type.
+// a field carrying no permission at all, and every object type.
+//
+// NOT for `AllowAnonymous`: "any authenticated caller" is the inverse of what
+// that declares, and emitting this for it is the defect `permissionToGate` and
+// `refuseAnonymousFields` above exist to prevent.
 //
 // Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
 // field is already reachable by any authenticated caller, so stamping it changes
@@ -111,6 +116,56 @@ let formatDualAuthDirective = (groups: option<array<string>>): string => {
   `${cognito} @aws_iam`
 }
 
+// ── What a declared permission asks this API to enforce ─────────────────────
+//
+// Lives here rather than beside the Pulumi resources because it is the same
+// concern as the directive vocabulary above: reading a spec-level rule and
+// deciding what the schema says. Keeping the mapping next to the strings it
+// maps onto is what stops a fourth spelling of a directive appearing.
+
+/** Three arms rather than an `option<array<string>>`, which is the shape this
+    had while it was wrong: the option form could not hold `AllowAuthenticated`
+    and `AllowAnonymous` apart, so both became `None` and emitted one directive.
+    AppSync can enforce the first and cannot express the second at all. */
+type fieldGate =
+  | Groups(array<string>)
+  | AnyAuthenticated
+  /** No directive can express this; the deploy is refused rather than gated
+      into its opposite. See `refuseAnonymousFields`. */
+  | Anonymous
+
+let permissionToGate = (permission: Reventless.Authorization.permission): fieldGate =>
+  switch permission {
+  | AllowGroups([]) => Groups(["__deny_all__"])
+  | AllowGroups(groups) => Groups(groups)
+  | DenyAll => Groups(["__deny_all__"])
+  | AllowAuthenticated => AnyAuthenticated
+  | AllowAnonymous => Anonymous
+  }
+
+/** The deploy-time refusal for fields declared `AllowAnonymous`, and the
+    sibling of `assertGateable` below: both refuse a schema that would claim a
+    gate it does not have. This one fires earlier, while the permission is still
+    a value — by SDL time the two permissions are indistinguishable. */
+let refuseAnonymousFields = (fieldNames: array<string>): 'a =>
+  JsError.throwWithMessage(
+    `Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` ++
+    `  ${fieldNames->Array.length->Int.toString} field(s) declare AllowAnonymous:\n` ++
+    `    ${fieldNames->Array.join(", ")}\n\n` ++
+    `AppSync has no anonymous authorization mode. This API is provisioned with\n` ++
+    `AMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\n` ++
+    `directive available is @aws_cognito_user_pools — which means ANY\n` ++
+    `AUTHENTICATED caller, the opposite of what the spec declares. Mutations have\n` ++
+    `no runtime authorization check to correct it: on this platform the directive\n` ++
+    `is the whole enforcement.\n\n` ++
+    `The local platform DOES honour AllowAnonymous (its resolvers call\n` ++
+    `Authorization.isAllowed), so a spec that passes locally can still not be\n` ++
+    `deployable here. That divergence is the reason this refuses instead of\n` ++
+    `emitting a directive that reads as gated and is not.\n\n` ++
+    `To serve anonymous callers on AWS the API needs API_KEY added as a third\n` ++
+    `auth provider, plus something to rotate the key. Until then, declare the\n` ++ `field AllowAuthenticated (or AllowGroups) and mean it.`,
+  )
+
 // Injects the Cognito group gate on ALL mutation, query, and subscription fields
 // in a fragment. `~iamFieldNames` opts the named mutation/query fields into
 // deploy-time IAM as well, appending the `@aws_iam` arm. Subscriptions are never
@@ -126,17 +181,20 @@ let injectAwsAuthAll = (
     iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
   let cognitoOnly = formatCognitoGroupsDirective([group])
 
-  let augmentedMutations = parts.mutations->Array.map(field =>
-    isIam(field)
-      ? `${field}\n    ${formatDualAuthDirective(Some([group]))}`
-      : `${field}\n    ${cognitoOnly}`
-  )
-  let augmentedQueries = parts.queries->Array.map(field =>
-    isIam(field) ? `${field} ${formatDualAuthDirective(Some([group]))}` : `${field} ${cognitoOnly}`
-  )
-  let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
-    `${field}\n    ${cognitoOnly}`
-  )
+  let augmentedMutations =
+    parts.mutations->Array.map(field =>
+      isIam(field)
+        ? `${field}\n    ${formatDualAuthDirective(Some([group]))}`
+        : `${field}\n    ${cognitoOnly}`
+    )
+  let augmentedQueries =
+    parts.queries->Array.map(field =>
+      isIam(field)
+        ? `${field} ${formatDualAuthDirective(Some([group]))}`
+        : `${field} ${cognitoOnly}`
+    )
+  let augmentedSubscriptions =
+    parts.subscriptions->Array.map(field => `${field}\n    ${cognitoOnly}`)
 
   ReventlessCore.GraphQL_Stitcher.encode({
     ...parts,
@@ -150,12 +208,7 @@ let injectAwsAuthAll = (
 // connections, injected by the stitcher) and the `CommandResult` members
 // (mutation returns). Stamped once on the ASSEMBLED SDL so an IAM system
 // caller (`@@reventless.systemCallable` fields) can traverse them.
-let sharedIamTypeNames = [
-  "PageInfo",
-  "CommandAccepted",
-  "CommandRejected",
-  "CommandPending",
-]
+let sharedIamTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
 
 let stampSharedIamTypes = (sdl: string): string =>
   sharedIamTypeNames->Array.reduce(sdl, (acc, name) =>
@@ -227,6 +280,31 @@ let stampAllTypesCognito = (sdl: string): string =>
   )
   ->Array.join("\n")
 
+// Insert the multi-auth pair into ONE type declaration's header, before its `{`.
+//
+// The sibling of `stampAllTypesCognito` and deliberately not folded into it:
+// that one sweeps a whole assembled SDL and fills in the Cognito-only arm for
+// anything undirectived, this one is applied to a declaration already chosen by
+// its caller and adds the IAM arm the traversal needs. Different input, different
+// directive, same header surgery.
+//
+// On a multi-auth API, object TYPES without auth directives are reachable only
+// via the default auth mode: a field-level `@aws_iam` admits the system caller to
+// the top-level field, but response shaping then walks the return types
+// (`…Connection` → `…Edge` → node → nested state types) and dies with "Not
+// Authorized to access <field> on type <T>" one level in. The group-less Cognito
+// arm matches the accessibility an undirectived type already has (entry gating
+// stays on the fields); the IAM arm admits the traversal.
+let stampTypeDualAuth = (decl: string): string =>
+  switch decl->String.indexOfOpt("{") {
+  | Some(i) =>
+    decl->String.slice(~start=0, ~end=i) ++
+    formatDualAuthDirective(None) ++
+    " " ++
+    decl->String.slice(~start=i, ~end=decl->String.length)
+  | None => decl
+  }
+
 // ── Deploy-time gate invariant ──────────────────────────────────────────────
 //
 // Refuse to push a schema that cannot be gated. This is the fail-closed
@@ -260,7 +338,7 @@ let rootOperationTypes = ["Query", "Mutation", "Subscription"]
 let typeDeclNameOf = (line: string): option<string> =>
   if line->String.startsWith("type ") {
     let rest = line->String.slice(~start=5, ~end=line->String.length)
-    switch rest->String.search(%re("/[\s{]/")) {
+    switch rest->String.search(/[\s{]/) {
     | -1 => Some(rest)
     | i => Some(rest->String.slice(~start=0, ~end=i))
     }
@@ -271,7 +349,7 @@ let typeDeclNameOf = (line: string): option<string> =>
 // A root-operation field line: exactly two spaces of indent then a name. Deeper
 // indents are directive continuations of the field above.
 let fieldNameOf = (line: string): option<string> =>
-  switch line->String.match(%re("/^ {2}(\w+)/")) {
+  switch line->String.match(/^ {2}(\w+)/) {
   | Some(groups) => groups->Array.get(1)->Option.flatMap(x => x)
   | None => None
   }
@@ -388,7 +466,9 @@ let assertGateable = (sdl: string): string => {
   let problems = []
   if inertDirectives->Array.length > 0 {
     problems->Array.push(
-      `  ${inertDirectives->Array.length->Int.toString} field(s) carry @aws_auth, which AppSync IGNORES on a\n` ++
+      `  ${inertDirectives
+        ->Array.length
+        ->Int.toString} field(s) carry @aws_auth, which AppSync IGNORES on a\n` ++
       `  multi-auth API (this adapter always adds AWS_IAM as an additional provider).\n` ++
       `  They are gated by nothing. Emit @aws_cognito_user_pools(cognito_groups: [...])\n` ++
       `  instead — see AppSync_SdlDecorate.formatCognitoGroupsDirective.\n` ++
@@ -397,14 +477,18 @@ let assertGateable = (sdl: string): string => {
   }
   if bareFields->Array.length > 0 {
     problems->Array.push(
-      `  ${bareFields->Array.length->Int.toString} root field(s) carry no enforced auth directive, so they are\n` ++
+      `  ${bareFields
+        ->Array.length
+        ->Int.toString} root field(s) carry no enforced auth directive, so they are\n` ++
       `  reachable by ANY authenticated Cognito caller:\n` ++
       `    ${bareFields->Array.join(", ")}`,
     )
   }
   if bareTypes->Array.length > 0 {
     problems->Array.push(
-      `  ${bareTypes->Array.length->Int.toString} object type(s) carry no enforced auth directive:\n` ++
+      `  ${bareTypes
+        ->Array.length
+        ->Int.toString} object type(s) carry no enforced auth directive:\n` ++
       `    ${bareTypes->Array.join(", ")}`,
     )
   }
@@ -416,8 +500,7 @@ let assertGateable = (sdl: string): string => {
       `\n\nEvery field and type must carry @aws_cognito_user_pools (optionally with\n` ++
       `cognito_groups) and/or @aws_iam. The sweep in stampUndirectivedFields /\n` ++
       `stampAllTypesCognito should have covered this — a failure here means a schema\n` ++
-      `reached assembly by a path that bypasses them.\n` ++
-      `See docs/plans/appsync-group-authorization-unenforced.md.`,
+      `reached assembly by a path that bypasses them.\n` ++ `See docs/plans/appsync-group-authorization-unenforced.md.`,
     )
   }
   sdl
@@ -441,9 +524,13 @@ let stampCanonicalTypes = (sdl: string): string =>
   sdl
   ->String.split("\n")
   ->Array.map(line => {
-    let isObjectDef = canonicalTypeNames->Array.some(name => line->String.startsWith(`type ${name} `))
-    let isNodeDef = line->String.startsWith("interface Node ") || line->String.startsWith("interface Node{")
-    let isUnionDef = line->String.startsWith("union CommandResult ") || line->String.startsWith("union CommandResult=")
+    let isObjectDef =
+      canonicalTypeNames->Array.some(name => line->String.startsWith(`type ${name} `))
+    let isNodeDef =
+      line->String.startsWith("interface Node ") || line->String.startsWith("interface Node{")
+    let isUnionDef =
+      line->String.startsWith("union CommandResult ") ||
+        line->String.startsWith("union CommandResult=")
     if line->String.includes("@canonical") {
       line
     } else if isObjectDef || isNodeDef {

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -51,6 +51,39 @@ function formatDualAuthDirective(groups) {
   return cognito + ` @aws_iam`;
 }
 
+function permissionToGate(permission) {
+  if (typeof permission !== "object") {
+    switch (permission) {
+      case "AllowAuthenticated" :
+        return "AnyAuthenticated";
+      case "AllowAnonymous" :
+        return "Anonymous";
+      case "DenyAll" :
+        return {
+          TAG: "Groups",
+          _0: ["__deny_all__"]
+        };
+    }
+  } else {
+    let groups = permission._0;
+    if (groups.length !== 0) {
+      return {
+        TAG: "Groups",
+        _0: groups
+      };
+    } else {
+      return {
+        TAG: "Groups",
+        _0: ["__deny_all__"]
+      };
+    }
+  }
+}
+
+function refuseAnonymousFields(fieldNames) {
+  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nTo serve anonymous callers on AWS the API needs API_KEY added as a third\nauth provider, plus something to rotate the key. Until then, declare the\nfield AllowAuthenticated (or AllowGroups) and mean it.`);
+}
+
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
@@ -122,6 +155,15 @@ function stampAllTypesCognito(sdl) {
   }).join("\n");
 }
 
+function stampTypeDualAuth(decl) {
+  let i = Stdlib_String.indexOfOpt(decl, "{");
+  if (i !== undefined) {
+    return decl.slice(0, i) + formatDualAuthDirective(undefined) + " " + decl.slice(i, decl.length);
+  } else {
+    return decl;
+  }
+}
+
 let enforcedDirectives = [
   "@aws_cognito_user_pools",
   "@aws_iam"
@@ -328,11 +370,14 @@ export {
   formatCognitoGroupsDirective,
   cognitoOpenDirective,
   formatDualAuthDirective,
+  permissionToGate,
+  refuseAnonymousFields,
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
   stampUndirectivedFields,
   stampAllTypesCognito,
+  stampTypeDualAuth,
   enforcedDirectives,
   hasEnforcedDirective,
   rootOperationTypes,

package/src/components/AutomationSlice_Builder.res

@@ -5,10 +5,12 @@ module EventCollectorChannel = EventCollectorChannel.DynamoDbStream
 module RuntimeEnvironment = RuntimeEnvironment.Lambda
 module EventCollectorRuntimeBuilder = AutomationSliceRuntime_Builder_Single
 
-module Make = (Api: {
-  let api: unit => Types.AppSync.api
-  let apiRole: unit => Types.AppSync.role
-}) => {
+module Make = (
+  Api: {
+    let api: unit => Types.AppSync.api
+    let apiRole: unit => Types.AppSync.role
+  },
+) => {
   module Inner = ReventlessCore.AutomationSlice_Builder.Make(
     RuntimeEnvironment,
     QueryDbStorage.DynamoDb,

package/src/components/ExtensionPoint_Builder.res

@@ -12,13 +12,12 @@ module Defaults: ReventlessInfra.RuntimeDefaults.T = {
 module Make = (
   Spec: ReventlessInfra.ExtensionPointMapping.Spec,
   Mappings: ReventlessInfra.ExtensionPoint.Mappings with module Spec := Spec,
-): ReventlessInfra.ExtensionPoint.T =>
-  ReventlessCore.ExtensionPoint_Builder.Make(
-    Spec,
-    Mappings,
-    RuntimeEnvironment,
-    CommandTopicChannel,
-    EventTopicPublisher.SNS,
-    ExtensionPointRuntimeBuilder,
-    Defaults,
-  )
+): ReventlessInfra.ExtensionPoint.T => ReventlessCore.ExtensionPoint_Builder.Make(
+  Spec,
+  Mappings,
+  RuntimeEnvironment,
+  CommandTopicChannel,
+  EventTopicPublisher.SNS,
+  ExtensionPointRuntimeBuilder,
+  Defaults,
+)

package/src/components/InboundTranslationSlice_Builder.res

@@ -1,10 +1,12 @@
 // InboundTranslationSlice_Builder (AWS)
 // Wires AWS adapters and delegates to the core ReventlessCore.InboundTranslationSlice_Builder.
 
-module Make = (Api: {
-  let api: unit => Types.AppSync.api
-  let apiRole: unit => Types.AppSync.role
-}) => {
+module Make = (
+  Api: {
+    let api: unit => Types.AppSync.api
+    let apiRole: unit => Types.AppSync.role
+  },
+) => {
   module Inner = ReventlessCore.InboundTranslationSlice_Builder.Make(
     QueryDbStorage.DynamoDb,
     QueryDbResolvers.AppSync,
@@ -39,10 +41,7 @@ module Make = (Api: {
         component->ReventlessCore.Component.outputs
       switch outputs.queryDb.resources->Array.get(0) {
       | Some(tableResource) =>
-        PluginRuntime_Builder.registerInboundAuditTableName(
-          ~specName=Spec.name,
-          tableResource.name,
-        )
+        PluginRuntime_Builder.registerInboundAuditTableName(~specName=Spec.name, tableResource.name)
       | None => ()
       }
       component

package/src/components/OutboundTranslationSlice_Builder.res

@@ -28,10 +28,12 @@ module DeployTimeCapabilities = {
   let capabilities = () => Reventless.Capabilities.none
 }
 
-module Make = (Api: {
-  let api: unit => Types.AppSync.api
-  let apiRole: unit => Types.AppSync.role
-}) => {
+module Make = (
+  Api: {
+    let api: unit => Types.AppSync.api
+    let apiRole: unit => Types.AppSync.role
+  },
+) => {
   module Inner = ReventlessCore.OutboundTranslationSlice_Builder.Make(
     RuntimeEnvironment,
     QueryDbStorage.DynamoDb,
@@ -53,7 +55,13 @@ module Make = (Api: {
     type component = InnerMake.component
     let queryDbName = InnerMake.queryDbName
 
-    let make = (~dcbEventLog, ~allEventTopics=Dict.make(), ~publishJsons, ~runtime=?, ~opts=?): component => {
+    let make = (
+      ~dcbEventLog,
+      ~allEventTopics=Dict.make(),
+      ~publishJsons,
+      ~runtime=?,
+      ~opts=?,
+    ): component => {
       let ots = InnerMake.make(~dcbEventLog, ~allEventTopics, ~publishJsons, ~runtime?, ~opts?)
 
       let queryDbOutputs = (ots->ReventlessCore.Component.outputs).queryDb
@@ -67,9 +75,7 @@ module Make = (Api: {
       // not carry.
       let declaredSources = Spec.sourceNames
       let sourceTopics =
-        allEventTopics->ReventlessCore.EventTopic.filter(
-          declaredSources->Belt.Set.String.fromArray,
-        )
+        allEventTopics->ReventlessCore.EventTopic.filter(declaredSources->Belt.Set.String.fromArray)
       let consumesDcbLog =
         declaredSources->Array.length == 0 ||
           declaredSources->Array.some(name => !(allEventTopics->Dict.has(name)))

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -92,4 +92,4 @@ export {
   DeployTimeCapabilities,
   Make,
 }
-/* Component-ReventlessCore Not a pure module */
+/* Capabilities-Reventless Not a pure module */

package/src/components/SideEffectHandler_Single.res

@@ -40,10 +40,10 @@ module Make = (): ReventlessCore.SideEffectHandler.T => {
     )
 
     // Derive npm specifiers from moduleUrl on each SideEffect module
-    let sideEffectModulePaths = sideEffects->Array.map(
-      (module(SE: Reventless.SideEffect.T)) =>
-        Util_Bundle.getModuleSpecifier(SE.moduleUrl),
-    )
+    let sideEffectModulePaths =
+      sideEffects->Array.map((module(SE: Reventless.SideEffect.T)) =>
+        Util_Bundle.getModuleSpecifier(SE.moduleUrl)
+      )
 
     EventCollectorRuntimeBuilder.registerSideEffectHandler(
       ~sideEffectHandlerName=name,

package/src/components/StateViewSlice_Builder.res

@@ -5,10 +5,12 @@ module EventCollectorChannel = EventCollectorChannel.DynamoDbStream
 module RuntimeEnvironment = RuntimeEnvironment.Lambda
 module EventCollectorRuntimeBuilder = StateViewSliceRuntime_Builder_Single
 
-module Make = (Api: {
-  let api: unit => Types.AppSync.api
-  let apiRole: unit => Types.AppSync.role
-}) => {
+module Make = (
+  Api: {
+    let api: unit => Types.AppSync.api
+    let apiRole: unit => Types.AppSync.role
+  },
+) => {
   module Inner = ReventlessCore.StateViewSlice_Builder.Make(
     RuntimeEnvironment,
     QueryDbStorage.Selectable,

package/src/components/StateViewSlice_Builder_Stream.res

@@ -9,10 +9,12 @@ module EventCollectorChannel = EventCollectorChannel.DynamoDbStream
 module RuntimeEnvironment = RuntimeEnvironment.Lambda
 module EventCollectorRuntimeBuilder = StateViewSliceRuntime_Builder_Single
 
-module Make = (Api: {
-  let api: unit => Types.AppSync.api
-  let apiRole: unit => Types.AppSync.role
-}) => {
+module Make = (
+  Api: {
+    let api: unit => Types.AppSync.api
+    let apiRole: unit => Types.AppSync.role
+  },
+) => {
   module Inner = ReventlessCore.StateViewSlice_Builder.Make(
     RuntimeEnvironment,
     QueryDbStorage.SelectableStream,

package/src/components/Task_Builder_PerBucket.res

@@ -17,14 +17,13 @@ module Defaults: ReventlessInfra.RuntimeDefaults.T = {
 
 module Make = (Spec: ReventlessCore.Task.Spec): (
   ReventlessCore.Task.T with module Spec = Spec
-) =>
-  ReventlessCore.Task_Builder.Make(
-    Spec,
-    RuntimeEnvironment,
-    EventCollectorChannel,
-    EventCollectorRuntimeBuilder,
-    TaskRuntimeBuilder,
-    TaskBucket,
-    SideEffectHandler,
-    Defaults,
-  )
+) => ReventlessCore.Task_Builder.Make(
+  Spec,
+  RuntimeEnvironment,
+  EventCollectorChannel,
+  EventCollectorRuntimeBuilder,
+  TaskRuntimeBuilder,
+  TaskBucket,
+  SideEffectHandler,
+  Defaults,
+)

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -243,14 +243,8 @@ export const handler = async (event) => {
               Lambda.Function.variables: Dict.fromArray([
                 ("TASK_DEFINITION_ARN", taskDefinition.arn->Pulumi.Output.asInput),
                 ("CLUSTER_ARN", cluster.arn->Pulumi.Output.asInput),
-                (
-                  "STACK_ORG",
-                  fullQualifiedStackName.organization->Pulumi.Input.make,
-                ),
-                (
-                  "STACK_PROJECT",
-                  fullQualifiedStackName.project->Pulumi.Input.make,
-                ),
+                ("STACK_ORG", fullQualifiedStackName.organization->Pulumi.Input.make),
+                ("STACK_PROJECT", fullQualifiedStackName.project->Pulumi.Input.make),
                 ("STACK_STACK", fullQualifiedStackName.stack->Pulumi.Input.make),
                 (
                   "SUBNETS",
@@ -361,8 +355,7 @@ export const handler = async (event) => {
         ~opts,
       )
 
-      let invokeCloneCode =
-        `import { util } from '@aws-appsync/utils';
+      let invokeCloneCode = `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   return {
     operation: 'Invoke',

package/src/plugin/cloner/ClonerRunner_Fargate_Runtime.res

@@ -14,10 +14,7 @@ let clone = async (~taskDefinition, ~cluster, ~fullQualifiedStackName, ~subnets,
 
   log.info(
     ~comp="ClonerRunner",
-    "clone: requested by user " ++
-    payload["meta"]["user"] ++
-    " from ip " ++
-    payload["meta"]["ip"],
+    "clone: requested by user " ++ payload["meta"]["user"] ++ " from ip " ++ payload["meta"]["ip"],
   )
 
   let _ = await {

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res

@@ -57,10 +57,7 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
       ~args={
         policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
           name ++ "Policy",
-          [
-            PulumiAws.Lambda.defaultLoggingPolicyDocument,
-            heartbeatLambdaSendMessagePolicyDocument,
-          ],
+          [PulumiAws.Lambda.defaultLoggingPolicyDocument, heartbeatLambdaSendMessagePolicyDocument],
         )->Pulumi.Output.asInput,
         role: lambdaRole.id->Pulumi.Output.asInput,
       },
@@ -70,7 +67,10 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
   // The Lambda permission and CloudWatch event target genuinely need the
   // Lambda's resolved arn/name, so they stay inside an apply.
   let _permissionAndEventTarget =
-    (lambda->Pulumi.Output.flatMap(lambda => lambda.arn), lambda->Pulumi.Output.flatMap(lambda => lambda.name))
+    (
+      lambda->Pulumi.Output.flatMap(lambda => lambda.arn),
+      lambda->Pulumi.Output.flatMap(lambda => lambda.name),
+    )
     ->Pulumi.Output.all2
     ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
       let _addHeartbeatLambdaPermission = PulumiAws.Lambda.Permission.make(

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res

@@ -66,32 +66,30 @@ let forCommandTopic = (
     publishToAggregatesEnvVars
     ->Dict.toArray
     ->Array.map(((aggName, envVar)) =>
-      `${aggName->JSON.stringifyAny->Option.getOr(`""`)}: ${envVar->JSON.stringifyAny->Option.getOr(`""`)}`
+      `${aggName->JSON.stringifyAny->Option.getOr(`""`)}: ${envVar
+        ->JSON.stringifyAny
+        ->Option.getOr(`""`)}`
     )
     ->Array.join(",")
 
   // Build HANDLER_CONFIG JSON
   let queueName =
-    queue.id->Pulumi.Output.apply(id =>
-      id->String.split("/")->Array.at(-1)->Option.getOr(id)
-    )
-
-  let handlerConfigJson =
-    Pulumi.Output.all([
-      queue.id,
-      extras.pluginReadModelTableName->outputOrPlaceholder->Obj.magic,
-      extras.schedulerRoleArn->outputOrPlaceholder->Obj.magic,
-      queue.arn,
-      queueName,
-    ])
-    ->Pulumi.Output.apply(values => {
-      let queueUrl = values->Array.getUnsafe(0)
-      let rmTable = values->Array.getUnsafe(1)
-      let schedRoleArn = values->Array.getUnsafe(2)
-      let schedQueueArn = values->Array.getUnsafe(3)
-      let schedQueueName = values->Array.getUnsafe(4)
-      `{"queueUrl":"${queueUrl}","pluginReadModelTableName":"${rmTable}","schedulerRoleArn":"${schedRoleArn}","schedulerQueueArn":"${schedQueueArn}","schedulerQueueName":"${schedQueueName}","publishToAggregates":{${publishToAggregatesJson}}}`
-    })
+    queue.id->Pulumi.Output.apply(id => id->String.split("/")->Array.at(-1)->Option.getOr(id))
+
+  let handlerConfigJson = Pulumi.Output.all([
+    queue.id,
+    extras.pluginReadModelTableName->outputOrPlaceholder->Obj.magic,
+    extras.schedulerRoleArn->outputOrPlaceholder->Obj.magic,
+    queue.arn,
+    queueName,
+  ])->Pulumi.Output.apply(values => {
+    let queueUrl = values->Array.getUnsafe(0)
+    let rmTable = values->Array.getUnsafe(1)
+    let schedRoleArn = values->Array.getUnsafe(2)
+    let schedQueueArn = values->Array.getUnsafe(3)
+    let schedQueueName = values->Array.getUnsafe(4)
+    `{"queueUrl":"${queueUrl}","pluginReadModelTableName":"${rmTable}","schedulerRoleArn":"${schedRoleArn}","schedulerQueueArn":"${schedQueueArn}","schedulerQueueName":"${schedQueueName}","publishToAggregates":{${publishToAggregatesJson}}}`
+  })
   envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
 
   // No user packages — all framework imports are in the Layer