@reventlessdev/reventless-aws 3.0.0-alpha.371 → 3.0.0-alpha.372

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.372 (2026-10-05)
+
+### Bug Fixes
+
+* **deploy:** the pending-creates recovery runs from reventless-aws, and works ([b9e749e](https://github.com/ReventlessDev/reventless-core/commit/b9e749eb09354a559505fa6facc7f58e38afd2a9))
+### Features
+
+* **deploy:** a plugin names its own region, and can stay out of review environments ([7edd318](https://github.com/ReventlessDev/reventless-core/commit/7edd3187f51f74e57c331b1cb417b17de8067b58))
+* **deploy:** the deploy workflow names its state backend ([a370346](https://github.com/ReventlessDev/reventless-core/commit/a3703461bae9dc22c098315a09bbabcf0c5816b1))
+
+
 # 3.0.0-alpha.371 (2026-10-01)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.371",
+  "version": "3.0.0-alpha.372",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -9,7 +9,8 @@
     "provision-accounts": "./run-provision-accounts.mjs",
     "bake-manifest": "./run-bake-manifest.mjs",
     "deploy-app": "./run-deploy-app.mjs",
-    "resolve-environment": "./run-resolve-environment.mjs"
+    "resolve-environment": "./run-resolve-environment.mjs",
+    "clear-pending-creates": "./run-clear-pending-creates.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-appsync": "3.970.0",
@@ -22,18 +23,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.28",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
     "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.39"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.39",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/run-clear-pending-creates.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from "./scripts/ClearPendingCreates.res.mjs"
+await main()

package/scripts/ClearPendingCreates.res

@@ -0,0 +1,142 @@
+/***
+Before `pulumi up`, recovers a stack an interrupted deploy left behind: releases a
+stale lock, drops the pending creates known to have nothing in AWS behind them,
+and refreshes. Any other pending operation stops it: `--clear-pending-creates`
+drops them all, and would orphan a function or a role that does exist.
+*/
+
+/** Resource types with nothing in AWS behind them, so a pending create of one is
+    safe to drop. Add one only when that holds; a refusal costs one look, an
+    orphan stays until someone finds it. */
+let safeTypes = [
+  // ACM's wait for DNS validation, which gives up after 1h15m when the record is late.
+  "aws:acm/certificateValidation:CertificateValidation",
+]
+
+type pending = {urn: string, resourceType: string, operation: string}
+
+let pendingOperations = (export: JSON.t): array<pending> => {
+  let field = (json, name) => json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(name))
+  let text = (json, name) => json->field(name)->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+  export
+  ->field("deployment")
+  ->Option.flatMap(deployment => deployment->field("pending_operations"))
+  ->Option.flatMap(JSON.Decode.array)
+  ->Option.getOr([])
+  ->Array.map(operation => {
+    let resource = operation->field("resource")->Option.getOr(JSON.Null)
+    {
+      urn: resource->text("urn"),
+      resourceType: resource->text("type"),
+      operation: operation->text("type"),
+    }
+  })
+}
+
+let isSafe = (pending: pending) => safeTypes->Array.includes(pending.resourceType)
+
+type args = {stack: string, cwd: string}
+
+let parseArgs = (argv: array<string>): result<args, string> =>
+  Reventless.CliArgs.parse(~strings=["stack", "cwd"], argv)
+  ->Result.flatMap(Reventless.CliArgs.noPositionals)
+  ->Result.flatMap(a =>
+    switch a->Reventless.CliArgs.string("stack") {
+    | Some(stack) =>
+      Ok({stack, cwd: a->Reventless.CliArgs.string("cwd")->Option.getOr(NodeProcess.cwd())})
+    | None => Error("--stack names the stack to recover")
+    }
+  )
+
+let usage = `
+Usage: clear-pending-creates --stack <name> [--cwd <dir>]
+
+Recovers a stack before \`pulumi up\`: cancels a stale update, drops the pending
+creates of types with nothing in AWS behind them, and refreshes. Any other pending
+operation fails the command, for someone to resolve by hand.
+
+  --stack <name>   The stack.
+  --cwd <dir>      The Pulumi project. Defaults to the working directory.
+`
+
+let pulumi = (args: args, command: array<string>) =>
+  NodeChildProcess.spawnSync(
+    "pulumi",
+    command->Array.concat(["--stack", args.stack, "--cwd", args.cwd, "--non-interactive"]),
+    {encoding: "utf8", maxBuffer: 256 * 1024 * 1024},
+  )
+
+let succeeded = (result: NodeChildProcess.spawnSyncResult) =>
+  result.status->Nullable.toOption == Some(0)
+
+let stderrOf = (result: NodeChildProcess.spawnSyncResult) =>
+  result.stderr->Nullable.toOption->Option.getOr("")->String.trim
+
+let run = (args: args): result<unit, array<string>> => {
+  let cancel = pulumi(args, ["cancel", "--yes"])
+  switch stderrOf(cancel) {
+  | message
+    if !succeeded(cancel) &&
+    message != "" &&
+    !(message->String.toLowerCase->String.includes("no update in progress")) =>
+    Console.error(`::warning::pulumi cancel: ${message}`)
+  | _ => ()
+  }
+  let exported = pulumi(args, ["stack", "export"])
+  let state = switch exported.stdout->Nullable.toOption {
+  | Some(stdout) if succeeded(exported) =>
+    try Ok(JSON.parseOrThrow(stdout)) catch {
+    | _ => Error([`the export of stack ${args.stack} is not JSON`])
+    }
+  | _ => Error([`pulumi stack export failed: ${stderrOf(exported)}`])
+  }
+  state->Result.flatMap(state => {
+    let pending = pendingOperations(state)
+    let refused = pending->Array.filter(p => !isSafe(p))
+    if pending == [] {
+      Console.log(`No pending operations on stack ${args.stack}.`)
+    } else {
+      Console.log(
+        `${pending->Array.length->Int.toString} pending operation(s) on stack ${args.stack}.`,
+      )
+    }
+    if refused != [] {
+      Error(
+        refused->Array.map(p =>
+          `Pending ${p.operation} of ${p.urn} (${p.resourceType}): not cleared, because something may exist in AWS behind it. Resolve it by hand, or, if the type has nothing behind it, add it to ClearPendingCreates.safeTypes.`
+        ),
+      )
+    } else {
+      // Every pending operation left is safe, so the refresh may drop them all.
+      // `pulumi state delete` cannot: a pending create has no resource in the state.
+      pending->Array.forEach(p =>
+        Console.log(`::warning::Clearing pending ${p.operation} of ${p.urn} (${p.resourceType})`)
+      )
+      let clear = pending == [] ? [] : ["--clear-pending-creates"]
+      // A failed refresh is usually a stale provider serialization, which the
+      // `pulumi up` after this heals.
+      let refreshed = pulumi(args, ["refresh", "--yes", "--skip-preview"]->Array.concat(clear))
+      if !succeeded(refreshed) {
+        Console.error(
+          `::warning::pulumi refresh had errors; pulumi up runs anyway. ${stderrOf(refreshed)}`,
+        )
+      }
+      Ok()
+    }
+  })
+}
+
+let cli: Reventless.CliArgs.cli<args> = {bin: "clear-pending-creates", usage, parse: parseArgs}
+
+let main = () =>
+  Reventless.CliArgs.run(cli, async args =>
+    switch run(args) {
+    | Ok() => ()
+    | Error(messages) =>
+      messages->Array.forEach(message => Console.error(`::error::${message}`))
+      NodeProcess.exit(1)
+    }
+  )
+
+// No top-level call: `../run-clear-pending-creates.mjs` invokes [main], so a test
+// can import this module.

package/scripts/ClearPendingCreates.res.mjs

@@ -0,0 +1,187 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
+import * as Nodechild_process from "node:child_process";
+
+let safeTypes = ["aws:acm/certificateValidation:CertificateValidation"];
+
+function pendingOperations($$export) {
+  let field = (json, name) => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[name]);
+  let text = (json, name) => Stdlib_Option.getOr(Stdlib_Option.flatMap(field(json, name), Stdlib_JSON.Decode.string), "");
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(field($$export, "deployment"), deployment => field(deployment, "pending_operations")), Stdlib_JSON.Decode.array), []).map(operation => {
+    let resource = Stdlib_Option.getOr(field(operation, "resource"), null);
+    return {
+      urn: text(resource, "urn"),
+      resourceType: text(resource, "type"),
+      operation: text(operation, "type")
+    };
+  });
+}
+
+function isSafe(pending) {
+  return safeTypes.includes(pending.resourceType);
+}
+
+function parseArgs(argv) {
+  return Stdlib_Result.flatMap(Stdlib_Result.flatMap(CliArgs$Reventless.parse([
+    "stack",
+    "cwd"
+  ], undefined, undefined, undefined, argv), CliArgs$Reventless.noPositionals), a => {
+    let stack = CliArgs$Reventless.string(a, "stack");
+    if (stack !== undefined) {
+      return {
+        TAG: "Ok",
+        _0: {
+          stack: stack,
+          cwd: Stdlib_Option.getOr(CliArgs$Reventless.string(a, "cwd"), process.cwd())
+        }
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: "--stack names the stack to recover"
+      };
+    }
+  });
+}
+
+let usage = `
+Usage: clear-pending-creates --stack <name> [--cwd <dir>]
+
+Recovers a stack before \`pulumi up\`: cancels a stale update, drops the pending
+creates of types with nothing in AWS behind them, and refreshes. Any other pending
+operation fails the command, for someone to resolve by hand.
+
+  --stack <name>   The stack.
+  --cwd <dir>      The Pulumi project. Defaults to the working directory.
+`;
+
+function pulumi(args, command) {
+  return Nodechild_process.spawnSync("pulumi", command.concat([
+    "--stack",
+    args.stack,
+    "--cwd",
+    args.cwd,
+    "--non-interactive"
+  ]), {
+    encoding: "utf8",
+    maxBuffer: 268435456
+  });
+}
+
+function succeeded(result) {
+  return Primitive_object.equal(Primitive_option.fromNullable(result.status), 0);
+}
+
+function stderrOf(result) {
+  return Stdlib_Option.getOr(Primitive_option.fromNullable(result.stderr), "").trim();
+}
+
+function run(args) {
+  let cancel = pulumi(args, [
+    "cancel",
+    "--yes"
+  ]);
+  let message = stderrOf(cancel);
+  if (!succeeded(cancel) && message !== "" && !message.toLowerCase().includes("no update in progress")) {
+    console.error(`::warning::pulumi cancel: ` + message);
+  }
+  let exported = pulumi(args, [
+    "stack",
+    "export"
+  ]);
+  let stdout = exported.stdout;
+  let state;
+  let exit = 0;
+  if ((stdout == null) || !succeeded(exported)) {
+    exit = 1;
+  } else {
+    try {
+      state = {
+        TAG: "Ok",
+        _0: JSON.parse(stdout)
+      };
+    } catch (exn) {
+      state = {
+        TAG: "Error",
+        _0: [`the export of stack ` + args.stack + ` is not JSON`]
+      };
+    }
+  }
+  if (exit === 1) {
+    state = {
+      TAG: "Error",
+      _0: [`pulumi stack export failed: ` + stderrOf(exported)]
+    };
+  }
+  return Stdlib_Result.flatMap(state, state => {
+    let pending = pendingOperations(state);
+    let refused = pending.filter(p => !safeTypes.includes(p.resourceType));
+    if (Primitive_object.equal(pending, [])) {
+      console.log(`No pending operations on stack ` + args.stack + `.`);
+    } else {
+      console.log(pending.length.toString() + ` pending operation(s) on stack ` + args.stack + `.`);
+    }
+    if (Primitive_object.notequal(refused, [])) {
+      return {
+        TAG: "Error",
+        _0: refused.map(p => `Pending ` + p.operation + ` of ` + p.urn + ` (` + p.resourceType + `): not cleared, because something may exist in AWS behind it. Resolve it by hand, or, if the type has nothing behind it, add it to ClearPendingCreates.safeTypes.`)
+      };
+    }
+    pending.forEach(p => {
+      console.log(`::warning::Clearing pending ` + p.operation + ` of ` + p.urn + ` (` + p.resourceType + `)`);
+    });
+    let clear = Primitive_object.equal(pending, []) ? [] : ["--clear-pending-creates"];
+    let refreshed = pulumi(args, [
+      "refresh",
+      "--yes",
+      "--skip-preview"
+    ].concat(clear));
+    if (!succeeded(refreshed)) {
+      console.error(`::warning::pulumi refresh had errors; pulumi up runs anyway. ` + stderrOf(refreshed));
+    }
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  });
+}
+
+let cli = {
+  bin: "clear-pending-creates",
+  usage: usage,
+  parse: parseArgs
+};
+
+function main() {
+  return CliArgs$Reventless.run(cli, undefined, undefined, async args => {
+    let messages = run(args);
+    if (messages.TAG === "Ok") {
+      return;
+    }
+    messages._0.forEach(message => {
+      console.error(`::error::` + message);
+    });
+    process.exit(1);
+  });
+}
+
+export {
+  safeTypes,
+  pendingOperations,
+  isSafe,
+  parseArgs,
+  usage,
+  pulumi,
+  succeeded,
+  stderrOf,
+  run,
+  cli,
+  main,
+}
+/* CliArgs-Reventless Not a pure module */

package/scripts/DeployApp.res

@@ -86,6 +86,7 @@ type project = {
   projectName: string,
   program: string,
   stackDefaults: dict<string>,
+  region: option<string>,
 }
 
 @module("yaml") external parseYaml: string => JSON.t = "parse"
@@ -111,6 +112,7 @@ let projectOf = (p: DeployManifest.project): result<project, string> => {
         projectName,
         program: NodePath.join([p.dir, field("main")->Option.getOr("index.js")]),
         stackDefaults: p.stackDefaults,
+        region: p.region,
       })
     }
   }
@@ -150,6 +152,19 @@ let backendNeedsPassphrase = (~url: option<string>, ~env: dict<string>): bool =>
   | _ => false
   }
 
+/** A manifest that puts a stack in another region than the one `up` deploys
+    every stack to. */
+let regionProblems = (~projects: array<project>, ~region: string): array<string> =>
+  projects->Array.filterMap(p =>
+    switch p.region {
+    | Some(own) if own != region =>
+      Some(
+        `${p.label} deploys to ${own} in the manifest, and deploy-app deploys every stack to one region, ${region}. Deploy it with the deploy workflow, or from a manifest without that region.`,
+      )
+    | _ => None
+    }
+  )
+
 let unbuilt = (projects: array<project>): array<project> =>
   projects->Array.filter(p => !NodeFs.existsSync(p.program))
 
@@ -201,7 +216,7 @@ let check = async (~projects: array<project>): result<ready, array<string>> => {
         }
       | exception _ =>
         problems->Array.push(
-          "Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud) or `pulumi login --local`, and try again.",
+          "Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud), `pulumi login s3://<bucket>` (a bucket of your own) or `pulumi login --local`, and try again.",
         )
       }
     | exception _ =>
@@ -210,6 +225,9 @@ let check = async (~projects: array<project>): result<ready, array<string>> => {
       )
     }
   }
+  region->Option.forEach(region =>
+    regionProblems(~projects, ~region)->Array.forEach(p => problems->Array.push(p))
+  )
   unbuilt(projects)->Array.forEach(p =>
     problems->Array.push(
       `${p.label} is not built: ${p.program} is missing. Run \`pnpm run build\` and try again.`,

package/scripts/DeployApp.res.mjs

@@ -134,7 +134,8 @@ function projectOf(p) {
         dir: p.dir,
         projectName: projectName,
         program: Nodepath.join(p.dir, Stdlib_Option.getOr(field("main"), "index.js")),
-        stackDefaults: p.stackDefaults
+        stackDefaults: p.stackDefaults,
+        region: p.region
       }
     };
   } else {
@@ -183,6 +184,15 @@ function backendNeedsPassphrase(url, env) {
   }
 }
 
+function regionProblems(projects, region) {
+  return Stdlib_Array.filterMap(projects, p => {
+    let own = p.region;
+    if (own !== undefined && own !== region) {
+      return p.label + ` deploys to ` + own + ` in the manifest, and deploy-app deploys every stack to one region, ` + region + `. Deploy it with the deploy workflow, or from a manifest without that region.`;
+    }
+  });
+}
+
 function unbuilt(projects) {
   return projects.filter(p => !Nodefs.existsSync(p.program));
 }
@@ -243,7 +253,7 @@ async function check(projects) {
         who = await workspace.whoAmI();
         exit$3 = 2;
       } catch (exn$3) {
-        problems.push("Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud) or `pulumi login --local`, and try again.");
+        problems.push("Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud), `pulumi login s3://<bucket>` (a bucket of your own) or `pulumi login --local`, and try again.");
       }
       if (exit$3 === 2) {
         if (backendNeedsPassphrase(who.url, process.env)) {
@@ -252,6 +262,11 @@ async function check(projects) {
       }
     }
   }
+  Stdlib_Option.forEach(region, region => {
+    regionProblems(projects, region).forEach(p => {
+      problems.push(p);
+    });
+  });
   unbuilt(projects).forEach(p => {
     problems.push(p.label + ` is not built: ` + p.program + ` is missing. Run \`pnpm run build\` and try again.`);
   });
@@ -917,6 +932,7 @@ export {
   requiredNodeMajor,
   checkNode,
   backendNeedsPassphrase,
+  regionProblems,
   unbuilt,
   check,
   layerName,

package/scripts/DeployManifest.res

@@ -7,6 +7,8 @@ it here. Paths in the file are relative to the file's own folder.
 
 `stack-defaults` on an entry are the settings `deploy-app` gives a stack it
 creates for that folder — what a new stack of this app cannot deploy without.
+A plugin's `region` overrides the file's for that stack; `review: false` keeps it
+out of a pull request's review environment.
 */
 
 @module("yaml") external parseYaml: string => JSON.t = "parse"
@@ -24,6 +26,8 @@ type plugin = {
   path: string,
   @as("depends-on") dependsOn?: array<string>,
   @as("stack-defaults") stackDefaults?: dict<string>,
+  region?: string,
+  review?: bool,
 }
 
 @schema
@@ -34,7 +38,7 @@ type t = {
 }
 
 /** One stack folder, with its path made absolute. */
-type project = {name: string, dir: string, stackDefaults: dict<string>}
+type project = {name: string, dir: string, stackDefaults: dict<string>, region: option<string>}
 
 type resolved = {
   file: string,
@@ -60,6 +64,7 @@ let resolve = (manifest: t, ~file: string): resolved => {
       name: manifest.platform.name->Option.getOr("platform"),
       dir: NodePath.resolve([base, manifest.platform.path]),
       stackDefaults: manifest.platform.stackDefaults->Option.getOr(Dict.make()),
+      region: None,
     },
     plugins: manifest.plugins
     ->Option.getOr([])
@@ -67,6 +72,7 @@ let resolve = (manifest: t, ~file: string): resolved => {
       name: p.name,
       dir: NodePath.resolve([base, p.path]),
       stackDefaults: p.stackDefaults->Option.getOr(Dict.make()),
+      region: p.region,
     }),
   }
 }

package/scripts/DeployManifest.res.mjs

@@ -18,7 +18,9 @@ let pluginSchema = Sury.$schema(s => ({
   name: s.m(Sury.string),
   path: s.m(Sury.string),
   "depends-on": s.m(Sury.$option(Sury.array(Sury.string))),
-  "stack-defaults": s.m(Sury.$option(Sury.record(Sury.string)))
+  "stack-defaults": s.m(Sury.$option(Sury.record(Sury.string))),
+  region: s.m(Sury.$option(Sury.string)),
+  review: s.m(Sury.$option(Sury.boolean))
 }));
 
 let schema = Sury.$schema(s => ({
@@ -57,12 +59,14 @@ function resolve(manifest, file) {
     platform: {
       name: Stdlib_Option.getOr(manifest.platform.name, "platform"),
       dir: Nodepath.resolve(base, manifest.platform.path),
-      stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {})
+      stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {}),
+      region: undefined
     },
     plugins: Stdlib_Option.getOr(manifest.plugins, []).map(p => ({
       name: p.name,
       dir: Nodepath.resolve(base, p.path),
-      stackDefaults: Stdlib_Option.getOr(p["stack-defaults"], {})
+      stackDefaults: Stdlib_Option.getOr(p["stack-defaults"], {}),
+      region: p.region
     }))
   };
 }

package/tests/BakeManifestTest.res

@@ -21,6 +21,8 @@ plugins:
     depends-on: []
   - name: ordering
     path: ordering-aws
+    region: eu-central-1
+    review: false
 `
 
   testSync("resolves every folder against the manifest's own folder", () => {
@@ -36,10 +38,21 @@ plugins:
           name: "shop-platform",
           dir: "/repo/shop/platform-aws",
           stackDefaults: Dict.fromArray([("platform:messagingEmailProvider", "log")]),
+          region: None,
         },
         plugins: [
-          {name: "catalog", dir: "/repo/shop/catalog-aws", stackDefaults: Dict.make()},
-          {name: "ordering", dir: "/repo/shop/ordering-aws", stackDefaults: Dict.make()},
+          {
+            name: "catalog",
+            dir: "/repo/shop/catalog-aws",
+            stackDefaults: Dict.make(),
+            region: None,
+          },
+          {
+            name: "ordering",
+            dir: "/repo/shop/ordering-aws",
+            stackDefaults: Dict.make(),
+            region: Some("eu-central-1"),
+          },
         ],
       }),
     )

package/tests/BakeManifestTest.res.mjs

@@ -25,6 +25,8 @@ plugins:
     depends-on: []
   - name: ordering
     path: ordering-aws
+    region: eu-central-1
+    review: false
 `), m => DeployManifest$ReventlessAws.resolve(m, "/repo/shop/deploy-manifest.yaml"));
     globalThis.expect(resolved).toEqual({
       TAG: "Ok",
@@ -37,18 +39,21 @@ plugins:
           stackDefaults: Object.fromEntries([[
               "platform:messagingEmailProvider",
               "log"
-            ]])
+            ]]),
+          region: undefined
         },
         plugins: [
           {
             name: "catalog",
             dir: "/repo/shop/catalog-aws",
-            stackDefaults: {}
+            stackDefaults: {},
+            region: undefined
           },
           {
             name: "ordering",
             dir: "/repo/shop/ordering-aws",
-            stackDefaults: {}
+            stackDefaults: {},
+            region: "eu-central-1"
           }
         ]
       }

package/tests/ClearPendingCreatesTest.res

@@ -0,0 +1,93 @@
+open JestGlobals
+
+// Which pending operations the deploy workflow's recovery step drops and which
+// stop it. The pulumi calls around them are checked against a real backend by
+// hand; what is tested here is the decision.
+
+module Clear = ClearPendingCreates
+
+let export = (operations: string) =>
+  JSON.parseOrThrow(
+    `{"version": 3, "deployment": {"resources": [], "pending_operations": ${operations}}}`,
+  )
+
+let operation = (~urn, ~type_) =>
+  `{"resource": {"urn": "${urn}", "type": "${type_}"}, "type": "creating"}`
+
+let validation = operation(
+  ~urn="urn:pulumi:alpha::app::aws:acm/certificateValidation:CertificateValidation::cert",
+  ~type_="aws:acm/certificateValidation:CertificateValidation",
+)
+let lambda = operation(
+  ~urn="urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+  ~type_="aws:lambda/function:Function",
+)
+
+let refused = (state: JSON.t) =>
+  state
+  ->Clear.pendingOperations
+  ->Array.filter(p => !Clear.isSafe(p))
+  ->Array.map(p => p.resourceType)
+
+describe("ClearPendingCreates.pendingOperations", () => {
+  testSync("a stack with none, or with no deployment yet, has none", () => {
+    expect(Clear.pendingOperations(export("[]")))->toEqual([])
+    expect(
+      Clear.pendingOperations(JSON.parseOrThrow(`{"version": 3, "deployment": {}}`)),
+    )->toEqual([])
+    expect(Clear.pendingOperations(JSON.parseOrThrow(`{"version": 3}`)))->toEqual([])
+  })
+
+  testSync("each operation with its resource and kind", () =>
+    expect(Clear.pendingOperations(export(`[${lambda}]`)))->toEqual([
+      {
+        Clear.urn: "urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+        resourceType: "aws:lambda/function:Function",
+        operation: "creating",
+      },
+    ])
+  )
+})
+
+describe("ClearPendingCreates.isSafe", () => {
+  testSync("a certificate validation is dropped", () =>
+    expect(refused(export(`[${validation}]`)))->toEqual([])
+  )
+
+  testSync("a resource that may exist in AWS stops the deploy", () =>
+    expect(refused(export(`[${lambda}]`)))->toEqual(["aws:lambda/function:Function"])
+  )
+
+  testSync("in a mix, only the unsafe one is refused", () =>
+    expect(refused(export(`[${validation}, ${lambda}]`)))->toEqual(["aws:lambda/function:Function"])
+  )
+
+  testSync("the type must match whole, not as a prefix", () =>
+    expect(
+      refused(
+        export(
+          `[${operation(~urn="u", ~type_="aws:acm/certificateValidation:CertificateValidationX")}]`,
+        ),
+      ),
+    )->toEqual(["aws:acm/certificateValidation:CertificateValidationX"])
+  )
+})
+
+describe("ClearPendingCreates.parseArgs", () => {
+  testSync("the stack, and the project directory", () =>
+    expect(Clear.parseArgs(["--stack", "alpha", "--cwd", "platform-aws"]))->toEqual(
+      Ok({Clear.stack: "alpha", cwd: "platform-aws"}),
+    )
+  )
+
+  testSync("the project directory defaults to the working directory", () =>
+    expect(Clear.parseArgs(["--stack", "alpha"])->Result.map(a => a.cwd))->toEqual(
+      Ok(NodeProcess.cwd()),
+    )
+  )
+
+  test("no stack is a usage mistake", async () => {
+    let observed = await Reventless.CliArgs.observe(Clear.cli, [])
+    expect((observed.exitCode, observed.reachedMain))->toEqual((Some(2), false))
+  })
+})

package/tests/ClearPendingCreatesTest.res.mjs

@@ -0,0 +1,99 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
+import * as ClearPendingCreates$ReventlessAws from "../scripts/ClearPendingCreates.res.mjs";
+
+function $$export(operations) {
+  return JSON.parse(`{"version": 3, "deployment": {"resources": [], "pending_operations": ` + operations + `}}`);
+}
+
+function operation(urn, type_) {
+  return `{"resource": {"urn": "` + urn + `", "type": "` + type_ + `"}, "type": "creating"}`;
+}
+
+let validation = `{"resource": {"urn": "` + "urn:pulumi:alpha::app::aws:acm/certificateValidation:CertificateValidation::cert" + `", "type": "` + "aws:acm/certificateValidation:CertificateValidation" + `"}, "type": "creating"}`;
+
+let lambda = `{"resource": {"urn": "` + "urn:pulumi:alpha::app::aws:lambda/function:Function::handler" + `", "type": "` + "aws:lambda/function:Function" + `"}, "type": "creating"}`;
+
+function refused(state) {
+  return ClearPendingCreates$ReventlessAws.pendingOperations(state).filter(p => !ClearPendingCreates$ReventlessAws.isSafe(p)).map(p => p.resourceType);
+}
+
+globalThis.describe("ClearPendingCreates.pendingOperations", () => {
+  globalThis.test("a stack with none, or with no deployment yet, has none", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations($$export("[]"))).toEqual([]);
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations(JSON.parse(`{"version": 3, "deployment": {}}`))).toEqual([]);
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations(JSON.parse(`{"version": 3}`))).toEqual([]);
+  });
+  globalThis.test("each operation with its resource and kind", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations($$export(`[` + lambda + `]`))).toEqual([{
+        urn: "urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+        resourceType: "aws:lambda/function:Function",
+        operation: "creating"
+      }]);
+  });
+});
+
+globalThis.describe("ClearPendingCreates.isSafe", () => {
+  globalThis.test("a certificate validation is dropped", () => {
+    globalThis.expect(refused($$export(`[` + validation + `]`))).toEqual([]);
+  });
+  globalThis.test("a resource that may exist in AWS stops the deploy", () => {
+    globalThis.expect(refused($$export(`[` + lambda + `]`))).toEqual(["aws:lambda/function:Function"]);
+  });
+  globalThis.test("in a mix, only the unsafe one is refused", () => {
+    globalThis.expect(refused($$export(`[` + validation + `, ` + lambda + `]`))).toEqual(["aws:lambda/function:Function"]);
+  });
+  globalThis.test("the type must match whole, not as a prefix", () => {
+    globalThis.expect(refused($$export(`[` + (`{"resource": {"urn": "` + "u" + `", "type": "` + "aws:acm/certificateValidation:CertificateValidationX" + `"}, "type": "creating"}`) + `]`))).toEqual(["aws:acm/certificateValidation:CertificateValidationX"]);
+  });
+});
+
+globalThis.describe("ClearPendingCreates.parseArgs", () => {
+  globalThis.test("the stack, and the project directory", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.parseArgs([
+      "--stack",
+      "alpha",
+      "--cwd",
+      "platform-aws"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        stack: "alpha",
+        cwd: "platform-aws"
+      }
+    });
+  });
+  globalThis.test("the project directory defaults to the working directory", () => {
+    globalThis.expect(Stdlib_Result.map(ClearPendingCreates$ReventlessAws.parseArgs([
+      "--stack",
+      "alpha"
+    ]), a => a.cwd)).toEqual({
+      TAG: "Ok",
+      _0: process.cwd()
+    });
+  });
+  globalThis.test("no stack is a usage mistake", async () => {
+    let observed = await CliArgs$Reventless.observe(ClearPendingCreates$ReventlessAws.cli, []);
+    globalThis.expect([
+      observed.exitCode,
+      observed.reachedMain
+    ]).toEqual([
+      2,
+      false
+    ]);
+  });
+});
+
+let Clear;
+
+export {
+  Clear,
+  $$export,
+  operation,
+  validation,
+  lambda,
+  refused,
+}
+/*  Not a pure module */

package/tests/DeployAppTest.res

@@ -55,8 +55,19 @@ describe("DeployApp stacks and layer", () => {
     projectName: "shop-platform-aws",
     program: "/app/platform-aws/src/Main.res.mjs",
     stackDefaults: Dict.fromArray([("aws:region", "us-east-1"), ("platform:x", "y")]),
+    region: None,
   }
 
+  testSync("a stack the manifest puts in another region is refused", () => {
+    let ingest = {...project, label: "ingest", region: Some("eu-central-1")}
+    expect(
+      DeployApp.regionProblems(~projects=[project, ingest], ~region="eu-west-1")->Array.length,
+    )->toBe(1)
+    expect(
+      DeployApp.regionProblems(~projects=[project, ingest], ~region="eu-central-1"),
+    )->toEqual([])
+  })
+
   // The region and the try-out flag come last, so an app default cannot turn a
   // try-out into a stack `down` refuses to remove.
   testSync("a new stack gets the app's defaults, then the region and the try-out flag", () =>

package/tests/DeployAppTest.res.mjs

@@ -79,8 +79,29 @@ globalThis.describe("DeployApp stacks and layer", () => {
     dir: "/app/platform-aws",
     projectName: "shop-platform-aws",
     program: "/app/platform-aws/src/Main.res.mjs",
-    stackDefaults: project_stackDefaults
+    stackDefaults: project_stackDefaults,
+    region: undefined
   };
+  globalThis.test("a stack the manifest puts in another region is refused", () => {
+    let ingest_stackDefaults = project_stackDefaults;
+    let ingest_region = "eu-central-1";
+    let ingest = {
+      label: "ingest",
+      dir: "/app/platform-aws",
+      projectName: "shop-platform-aws",
+      program: "/app/platform-aws/src/Main.res.mjs",
+      stackDefaults: ingest_stackDefaults,
+      region: ingest_region
+    };
+    globalThis.expect(DeployApp$ReventlessAws.regionProblems([
+      project,
+      ingest
+    ], "eu-west-1").length).toBe(1);
+    globalThis.expect(DeployApp$ReventlessAws.regionProblems([
+      project,
+      ingest
+    ], "eu-central-1")).toEqual([]);
+  });
   globalThis.test("a new stack gets the app's defaults, then the region and the try-out flag", () => {
     globalThis.expect(DeployApp$ReventlessAws.newStackConfig(project, "eu-west-1")).toEqual([
       [