@reventlessdev/reventless-aws 3.0.0-alpha.380 → 3.0.0-alpha.381

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler.res

@@ -0,0 +1,65 @@
+let make: ReventlessCore.Scheduler_Adapter.scheduledPublisherMaker = (~name, ~opts) => {
+  let tags = name =>
+    AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    )
+
+  // The role EventBridge Scheduler assumes to deliver a schedule's payload to its queue.
+  let role = PulumiAws.IAM.Role.makeWithDefaultPolicy(
+    ~name=ScheduledPublisher_EventBridgeScheduler_Runtime.roleName,
+    ~servicePrincipal=AWS.EventBridgeScheduler.principal->Pulumi.Output.make,
+    ~tags=tags(ScheduledPublisher_EventBridgeScheduler_Runtime.roleName),
+    ~opts,
+  )
+
+  let _sendPolicy = PulumiAws.IAM.RolePolicy.make(
+    ~name=name ++ "SchedulerSendPolicy",
+    ~args={
+      policy: {
+        open PulumiAws.PolicyDocument
+        PulumiAws.PolicyDocument.make(
+          ~id=name ++ "SchedulerSendPolicy",
+          ~statements=[
+            {
+              sid: "AllowSchedulerToSendToQueues",
+              effect: Allow,
+              actions: Action("sqs:SendMessage"),
+              resources: AllResources,
+            },
+          ],
+        )->toJsonString
+      }->Pulumi.Input.make,
+      role: role.id->Pulumi.Output.asInput,
+    },
+    ~opts,
+  )
+
+  // Named after the role: the runtime finds the group from the role ARN it is given.
+  let _group = PulumiAws.Scheduler.ScheduleGroup.make(
+    ~name=name ++ "ScheduleGroup",
+    ~args={
+      name: role.name->Pulumi.Output.asInput,
+      tags: tags(name ++ "ScheduleGroup"),
+    },
+    ~opts,
+  )
+
+  {
+    resource: ReventlessInfra.Adapter.make(
+      // urn carries the scheduler role ARN — bundled Lambdas read it via
+      // Scheduler.outputs.resource.urn, for the target's role and the group's name.
+      ~name=role.name,
+      ~id=role.id,
+      ~urn=role.arn,
+      ~service="EventBridgeScheduler"->Pulumi.Output.make,
+      ~resourceType="aws:scheduler:ScheduleGroup"->Pulumi.Output.make,
+    ),
+    operations: role.arn->Pulumi.Output.apply((roleArn): ReventlessInfra.Scheduler.operations => {
+      createSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.createSchedule(~roleArn),
+      deleteSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime.deleteSchedule(~roleArn),
+    }),
+  }
+}

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler.res.mjs

@@ -0,0 +1,40 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "./ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
+
+function make(name, opts) {
+  let tags = name => AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined);
+  let role = IAM$PulumiAws.Role.makeWithDefaultPolicy(ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.roleName, Pulumi.output(AWS$ReventlessAws.EventBridgeScheduler.principal), tags(ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.roleName), opts);
+  new (Aws.iam.RolePolicy)(name + "SchedulerSendPolicy", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "SchedulerSendPolicy", [{
+        Sid: "AllowSchedulerToSendToQueues",
+        Effect: "Allow",
+        Action: "sqs:SendMessage",
+        Resource: "*"
+      }])),
+    role: role.id
+  }, opts);
+  new (Aws.scheduler.ScheduleGroup)(name + "ScheduleGroup", {
+    name: role.name,
+    tags: tags(name + "ScheduleGroup")
+  }, opts);
+  return {
+    resource: Adapter$ReventlessInfra.make(role.name, role.id, role.arn, Pulumi.output("EventBridgeScheduler"), undefined, undefined, undefined, Pulumi.output("aws:scheduler:ScheduleGroup"), undefined, undefined),
+    operations: role.arn.apply(roleArn => ({
+      createSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.createSchedule(roleArn),
+      deleteSchedule: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.deleteSchedule(roleArn)
+    }))
+  };
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res

@@ -0,0 +1,89 @@
+open AwsSdk.EventBridgeScheduler
+
+// The schedule group is named after the scheduler role, so the role ARN every caller
+// already receives also names the group its schedules go into. Pulumi names the role
+// `<roleName>-<suffix>`.
+let roleName = "SchedulerRole"
+
+let groupOfRoleArn = roleArn => roleArn->String.split("/")->Array.at(-1)->Option.getOr("")
+
+/** What a Lambda that sets schedules is granted: these actions on `schedulesOfRoleArn`. */
+let manageActions = [
+  "scheduler:CreateSchedule",
+  "scheduler:UpdateSchedule",
+  "scheduler:DeleteSchedule",
+]
+
+/** The schedules in the group of the scheduler role `roleArn` (`arn:aws:iam::<account>:role/<name>`). */
+let schedulesOfRoleArn = roleArn => {
+  let account = roleArn->String.split(":")->Array.get(4)->Option.getOr("*")
+  `arn:aws:scheduler:*:${account}:schedule/${roleArn->groupOfRoleArn}/*`
+}
+
+/** The schedules in every scheduler group of `account`, for a grant that cannot know the role. */
+let schedulesOfAccount = account => `arn:aws:scheduler:*:${account}:schedule/${roleName}-*/*`
+
+// A FIFO queue refuses a message without a group id.
+let isFifoQueue = arn => arn->String.endsWith(".fifo")
+
+let scheduleInput = (
+  ~roleArn,
+  ~targetArn,
+  ~setAt,
+  schedule: Reventless.Schedule.schedule,
+): scheduleInput => {
+  let aws = schedule.time->ReventlessCore.ScheduleTime.toAws(~setAt)
+  {
+    name: schedule.name,
+    groupName: roleArn->groupOfRoleArn,
+    scheduleExpression: aws.expression,
+    scheduleExpressionTimezone: ?aws.timezone,
+    startDate: ?(aws.startDate->Option.map(Date.fromTime)),
+    flexibleTimeWindow: {mode: "OFF"},
+    actionAfterCompletion: aws.deleteAfterCompletion ? "DELETE" : "NONE",
+    target: {
+      arn: targetArn,
+      roleArn,
+      input: schedule.payload,
+      sqsParameters: ?(targetArn->isFifoQueue ? Some({messageGroupId: schedule.name}) : None),
+    },
+  }
+}
+
+let failWithoutQueue = action => {
+  let err = `${action} not possible: no Queue configured !`
+  ReventlessCore.EffectLogger.logError(~comp=__MODULE__, err)
+  ->Effect.flatMap(_ => Effect.sync(() => JsError.throwWithMessage(err)))
+  ->Effect.runPromise
+}
+
+/** Creates the schedule, or replaces the one of that name, as a classic rule's `PutRule` did. */
+let createSchedule = (~roleArn: string): ReventlessCore.Scheduler.createSchedule =>
+  async (queueResources, schedule) =>
+    switch queueResources {
+    | [] => await failWithoutQueue("createSchedule")
+    | resources =>
+      ReventlessCore.ScheduleTime.validate(schedule.time)
+      let resource = resources->Array.getUnsafe(0) // FIXME
+      let input = schedule->scheduleInput(~roleArn, ~targetArn=resource.urn, ~setAt=Date.now())
+      switch await CreateScheduleCommand.make(input)->CreateScheduleCommand.send {
+      | _ => ()
+      | exception JsExn(err) if err->ErrorName.is(ErrorName.conflict) =>
+        let _ = await UpdateScheduleCommand.make(input)->UpdateScheduleCommand.send
+      }
+    }
+
+/** Deletes the schedule; one already gone, such as a once-only time that fired, is no error. */
+let deleteSchedule = (~roleArn: string): ReventlessCore.Scheduler.deleteSchedule =>
+  async (queueResources, name) =>
+    switch queueResources {
+    | [] => await failWithoutQueue("deleteSchedule")
+    | _ =>
+      switch await DeleteScheduleCommand.make({
+        name,
+        groupName: roleArn->groupOfRoleArn,
+      })->DeleteScheduleCommand.send {
+      | _ => ()
+      | exception JsExn(err) if err->ErrorName.is(ErrorName.resourceNotFound) => ()
+      }
+    }

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs

@@ -0,0 +1,126 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Effect from "effect/Effect";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as ClientScheduler from "@aws-sdk/client-scheduler";
+import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
+import * as EventBridgeScheduler$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/EventBridgeScheduler.res.mjs";
+import * as ScheduleTime$ReventlessCore from "@reventlessdev/reventless-core/src/util/ScheduleTime.res.mjs";
+
+let roleName = "SchedulerRole";
+
+function groupOfRoleArn(roleArn) {
+  return Stdlib_Option.getOr(roleArn.split("/").at(-1), "");
+}
+
+let manageActions = [
+  "scheduler:CreateSchedule",
+  "scheduler:UpdateSchedule",
+  "scheduler:DeleteSchedule"
+];
+
+function schedulesOfRoleArn(roleArn) {
+  let account = Stdlib_Option.getOr(roleArn.split(":")[4], "*");
+  return `arn:aws:scheduler:*:` + account + `:schedule/` + groupOfRoleArn(roleArn) + `/*`;
+}
+
+function schedulesOfAccount(account) {
+  return `arn:aws:scheduler:*:` + account + `:schedule/` + roleName + `-*/*`;
+}
+
+function isFifoQueue(arn) {
+  return arn.endsWith(".fifo");
+}
+
+function scheduleInput(roleArn, targetArn, setAt, schedule) {
+  let aws = ScheduleTime$ReventlessCore.toAws(schedule.time, setAt);
+  return {
+    Name: schedule.name,
+    GroupName: groupOfRoleArn(roleArn),
+    ScheduleExpression: aws.expression,
+    ScheduleExpressionTimezone: aws.timezone,
+    StartDate: Stdlib_Option.map(aws.startDate, prim => new Date(prim)),
+    FlexibleTimeWindow: {
+      Mode: "OFF"
+    },
+    ActionAfterCompletion: aws.deleteAfterCompletion ? "DELETE" : "NONE",
+    Target: {
+      Arn: targetArn,
+      RoleArn: roleArn,
+      Input: schedule.payload,
+      SqsParameters: targetArn.endsWith(".fifo") ? ({
+          MessageGroupId: schedule.name
+        }) : undefined
+    }
+  };
+}
+
+function failWithoutQueue(action) {
+  let err = action + ` not possible: no Queue configured !`;
+  return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logError("ScheduledPublisher_EventBridgeScheduler_Runtime-ReventlessAws", undefined, err), () => Effect.sync(() => Stdlib_JsError.throwWithMessage(err))));
+}
+
+function createSchedule(roleArn) {
+  return async (queueResources, schedule) => {
+    if (queueResources.length === 0) {
+      return await failWithoutQueue("createSchedule");
+    }
+    ScheduleTime$ReventlessCore.validate(schedule.time);
+    let resource = queueResources[0];
+    let input = scheduleInput(roleArn, resource.urn, Date.now(), schedule);
+    try {
+      await EventBridgeScheduler$AwsSdk.CreateScheduleCommand.send(new ClientScheduler.CreateScheduleCommand(input));
+      return;
+    } catch (raw_err) {
+      let err = Primitive_exceptions.internalToException(raw_err);
+      if (err.RE_EXN_ID === "JsExn") {
+        if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.conflict)) {
+          await EventBridgeScheduler$AwsSdk.UpdateScheduleCommand.send(new ClientScheduler.UpdateScheduleCommand(input));
+          return;
+        }
+        throw err;
+      }
+      throw err;
+    }
+  };
+}
+
+function deleteSchedule(roleArn) {
+  return async (queueResources, name) => {
+    if (queueResources.length === 0) {
+      return await failWithoutQueue("deleteSchedule");
+    }
+    try {
+      await EventBridgeScheduler$AwsSdk.DeleteScheduleCommand.send(new ClientScheduler.DeleteScheduleCommand({
+        Name: name,
+        GroupName: groupOfRoleArn(roleArn)
+      }));
+      return;
+    } catch (raw_err) {
+      let err = Primitive_exceptions.internalToException(raw_err);
+      if (err.RE_EXN_ID === "JsExn") {
+        if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.resourceNotFound)) {
+          return;
+        }
+        throw err;
+      }
+      throw err;
+    }
+  };
+}
+
+export {
+  roleName,
+  groupOfRoleArn,
+  manageActions,
+  schedulesOfRoleArn,
+  schedulesOfAccount,
+  isFifoQueue,
+  scheduleInput,
+  failWithoutQueue,
+  createSchedule,
+  deleteSchedule,
+}
+/* effect/Effect Not a pure module */

package/src/components/Scheduler.res

@@ -1 +1 @@
-include ReventlessCore.Scheduler_Builder.Make(ScheduledPublisher_CloudWatchEvents)
+include ReventlessCore.Scheduler_Builder.Make(ScheduledPublisher_EventBridgeScheduler)

package/src/components/Scheduler.res.mjs

@@ -1,9 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Scheduler_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/components/Scheduler/Scheduler_Builder.res.mjs";
-import * as ScheduledPublisher_CloudWatchEvents$ReventlessAws from "../adapter/ScheduledPublisher/ScheduledPublisher_CloudWatchEvents.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler$ReventlessAws from "../adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler.res.mjs";
 
-let include = Scheduler_Builder$ReventlessCore.Make(ScheduledPublisher_CloudWatchEvents$ReventlessAws);
+let include = Scheduler_Builder$ReventlessCore.Make(ScheduledPublisher_EventBridgeScheduler$ReventlessAws);
 
 let make = include.make;
 

package/tests/CommandTopicQueuePolicyTest.res

@@ -1,10 +1,8 @@
 open JestGlobals
 
-// Guards the CommandTopic queue policy's service-principal scoping. The
-// EventBridge grant cannot name a single rule ARN — ScheduledPublisher creates
-// rules at runtime and EventBridge authorises SQS targets against the queue's
-// resource policy — so the condition keys are the only bound on who may send
-// into a command topic. A dropped condition is invisible at deploy time.
+// Guards the CommandTopic queue policy. EventBridge Scheduler sends as the
+// scheduler role, which holds sqs:SendMessage itself, so the queue admits no
+// service but its consuming Lambda. A widened policy is invisible at deploy time.
 
 let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050"
 let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4"
@@ -32,26 +30,15 @@ let condition = (sid, operator, key) =>
   ->Option.flatMap(o => o->field(key))
   ->Option.flatMap(JSON.Decode.string)
 
-describe("CommandTopic queue policy — EventBridge grant", () => {
-  testSync("is scoped to this account", () => {
-    expect(
-      condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount"),
-    )->toEqual(Some("123456789012"))
-  })
-
-  testSync("is scoped to EventBridge rule ARNs in this account", () => {
-    expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn"))->toEqual(
-      Some("arn:aws:events:*:123456789012:rule/*"),
-    )
-  })
-
-  testSync("names the EventBridge service principal", () => {
-    let principal =
-      statement("AllowCloudWatchEventsToSendToQueue")
-      ->Option.flatMap(s => s->field("Principal"))
-      ->Option.flatMap(p => p->field("Service"))
-      ->Option.flatMap(JSON.Decode.string)
-    expect(principal)->toEqual(Some("events.amazonaws.com"))
+describe("CommandTopic queue policy — services", () => {
+  testSync("admits only the consuming Lambda", () => {
+    let sids =
+      policy
+      ->field("Statement")
+      ->Option.flatMap(JSON.Decode.array)
+      ->Option.getOr([])
+      ->Array.filterMap(s => s->field("Sid")->Option.flatMap(JSON.Decode.string))
+    expect(sids)->toEqual(["AllowLambdaToAccessQueue"])
   })
 })
 

package/tests/CommandTopicQueuePolicyTest.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as CommandTopicChannel_Helpers$ReventlessAws from "../src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs";
@@ -23,16 +24,10 @@ function condition(sid, operator, key) {
   return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement(sid), s => field(s, "Condition")), c => field(c, operator)), o => field(o, key)), Stdlib_JSON.Decode.string);
 }
 
-globalThis.describe("CommandTopic queue policy — EventBridge grant", () => {
-  globalThis.test("is scoped to this account", () => {
-    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount")).toEqual("123456789012");
-  });
-  globalThis.test("is scoped to EventBridge rule ARNs in this account", () => {
-    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn")).toEqual("arn:aws:events:*:123456789012:rule/*");
-  });
-  globalThis.test("names the EventBridge service principal", () => {
-    let principal = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement("AllowCloudWatchEventsToSendToQueue"), s => field(s, "Principal")), p => field(p, "Service")), Stdlib_JSON.Decode.string);
-    globalThis.expect(principal).toEqual("events.amazonaws.com");
+globalThis.describe("CommandTopic queue policy — services", () => {
+  globalThis.test("admits only the consuming Lambda", () => {
+    let sids = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), []), s => Stdlib_Option.flatMap(field(s, "Sid"), Stdlib_JSON.Decode.string));
+    globalThis.expect(sids).toEqual(["AllowLambdaToAccessQueue"]);
   });
 });
 

package/tests/ScheduledPublisher_EventBridgeSchedulerTest.res

@@ -0,0 +1,60 @@
+open JestGlobals
+open AwsSdk.EventBridgeScheduler
+
+// What EventBridge Scheduler is given for a schedule; the times themselves are
+// ScheduleTime's, tested in core.
+
+module Runtime = ScheduledPublisher_EventBridgeScheduler_Runtime
+
+let roleArn = "arn:aws:iam::123456789012:role/SchedulerRole-1a2b3c4"
+let queueArn = "arn:aws:sqs:eu-central-1:123456789012:CatalogAggrCmdTopic-5150050"
+let fifoArn = "arn:aws:sqs:eu-central-1:123456789012:CatalogAggrCmdTopic-5150050.fifo"
+let setAt = Date.fromString("2026-10-15T14:02:00Z")->Date.getTime
+
+let input = (~targetArn=queueArn, time) =>
+  {Reventless.Schedule.name: "disconnect-p1", time, payload: `{"a":1}`}->Runtime.scheduleInput(
+    ~roleArn,
+    ~targetArn,
+    ~setAt,
+  )
+
+describe("ScheduledPublisher_EventBridgeScheduler_Runtime", () => {
+  testSync("puts the schedule into the group named after the role", () => {
+    let i = input(Every(Minutes(5)))
+    expect(i.groupName)->toEqual(Some("SchedulerRole-1a2b3c4"))
+    expect(i.target.roleArn)->toBe(roleArn)
+    expect(i.target.input)->toEqual(Some(`{"a":1}`))
+    expect(i.flexibleTimeWindow.mode)->toBe("OFF")
+  })
+
+  testSync("starts an interval one interval after it is set", () => {
+    let i = input(Every(Minutes(5)))
+    expect(i.scheduleExpression)->toBe("rate(5 minutes)")
+    expect(i.startDate->Option.map(Date.getTime))->toEqual(Some(setAt +. 5. *. 60_000.))
+    expect(i.actionAfterCompletion)->toEqual(Some("NONE"))
+  })
+
+  testSync("deletes a once-only schedule after it fires, read in its zone", () => {
+    let i = input(Once({moment: After(Minutes(10)), zone: "Europe/Berlin"}))
+    expect(i.scheduleExpression)->toBe("at(2026-10-15T16:12:00)")
+    expect(i.scheduleExpressionTimezone)->toEqual(Some("Europe/Berlin"))
+    expect(i.actionAfterCompletion)->toEqual(Some("DELETE"))
+  })
+
+  testSync("gives a FIFO queue a message group, a standard queue none", () => {
+    let fifo = input(~targetArn=fifoArn, Every(Hours(1)))
+    expect(fifo.target.sqsParameters->Option.flatMap(p => p.messageGroupId))->toEqual(
+      Some("disconnect-p1"),
+    )
+    expect(input(Every(Hours(1))).target.sqsParameters)->toEqual(None)
+  })
+
+  testSync("grants the schedules of the role's group, or of every group in the account", () => {
+    expect(roleArn->Runtime.schedulesOfRoleArn)->toBe(
+      "arn:aws:scheduler:*:123456789012:schedule/SchedulerRole-1a2b3c4/*",
+    )
+    expect("123456789012"->Runtime.schedulesOfAccount)->toBe(
+      "arn:aws:scheduler:*:123456789012:schedule/SchedulerRole-*/*",
+    )
+  })
+})

package/tests/ScheduledPublisher_EventBridgeSchedulerTest.res.mjs

@@ -0,0 +1,98 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
+
+let roleArn = "arn:aws:iam::123456789012:role/SchedulerRole-1a2b3c4";
+
+let queueArn = "arn:aws:sqs:eu-central-1:123456789012:CatalogAggrCmdTopic-5150050";
+
+let fifoArn = "arn:aws:sqs:eu-central-1:123456789012:CatalogAggrCmdTopic-5150050.fifo";
+
+let setAt = new Date("2026-10-15T14:02:00Z").getTime();
+
+function input(targetArnOpt, time) {
+  let targetArn = targetArnOpt !== undefined ? targetArnOpt : queueArn;
+  return ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.scheduleInput(roleArn, targetArn, setAt, {
+    name: "disconnect-p1",
+    time: time,
+    payload: `{"a":1}`
+  });
+}
+
+globalThis.describe("ScheduledPublisher_EventBridgeScheduler_Runtime", () => {
+  globalThis.test("puts the schedule into the group named after the role", () => {
+    let i = input(undefined, {
+      TAG: "Every",
+      _0: {
+        TAG: "Minutes",
+        _0: 5
+      }
+    });
+    globalThis.expect(i.GroupName).toEqual("SchedulerRole-1a2b3c4");
+    globalThis.expect(i.Target.RoleArn).toBe(roleArn);
+    globalThis.expect(i.Target.Input).toEqual(`{"a":1}`);
+    globalThis.expect(i.FlexibleTimeWindow.Mode).toBe("OFF");
+  });
+  globalThis.test("starts an interval one interval after it is set", () => {
+    let i = input(undefined, {
+      TAG: "Every",
+      _0: {
+        TAG: "Minutes",
+        _0: 5
+      }
+    });
+    globalThis.expect(i.ScheduleExpression).toBe("rate(5 minutes)");
+    globalThis.expect(Stdlib_Option.map(i.StartDate, prim => prim.getTime())).toEqual(setAt + 5 * 60000);
+    globalThis.expect(i.ActionAfterCompletion).toEqual("NONE");
+  });
+  globalThis.test("deletes a once-only schedule after it fires, read in its zone", () => {
+    let i = input(undefined, {
+      TAG: "Once",
+      moment: {
+        TAG: "After",
+        _0: {
+          TAG: "Minutes",
+          _0: 10
+        }
+      },
+      zone: "Europe/Berlin"
+    });
+    globalThis.expect(i.ScheduleExpression).toBe("at(2026-10-15T16:12:00)");
+    globalThis.expect(i.ScheduleExpressionTimezone).toEqual("Europe/Berlin");
+    globalThis.expect(i.ActionAfterCompletion).toEqual("DELETE");
+  });
+  globalThis.test("gives a FIFO queue a message group, a standard queue none", () => {
+    let fifo = input(fifoArn, {
+      TAG: "Every",
+      _0: {
+        TAG: "Hours",
+        _0: 1
+      }
+    });
+    globalThis.expect(Stdlib_Option.flatMap(fifo.Target.SqsParameters, p => p.MessageGroupId)).toEqual("disconnect-p1");
+    globalThis.expect(input(undefined, {
+      TAG: "Every",
+      _0: {
+        TAG: "Hours",
+        _0: 1
+      }
+    }).Target.SqsParameters).toEqual(undefined);
+  });
+  globalThis.test("grants the schedules of the role's group, or of every group in the account", () => {
+    globalThis.expect(ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.schedulesOfRoleArn(roleArn)).toBe("arn:aws:scheduler:*:123456789012:schedule/SchedulerRole-1a2b3c4/*");
+    globalThis.expect(ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.schedulesOfAccount("123456789012")).toBe("arn:aws:scheduler:*:123456789012:schedule/SchedulerRole-*/*");
+  });
+});
+
+let Runtime;
+
+export {
+  Runtime,
+  roleArn,
+  queueArn,
+  fifoArn,
+  setAt,
+  input,
+}
+/* setAt Not a pure module */

package/tests/TaskBucketEntryPoint_OpsTest.res

@@ -62,7 +62,7 @@ describe("TaskBucketEntryPoint_Ops.buildPublishCommands", () => {
 describe("TaskBucketEntryPoint_Ops.dispatchTaskActions", () => {
   let schedule: Reventless.Schedule.schedule = {
     name: "sweep",
-    rate: Reventless.Schedule.Minutes(5),
+    time: Reventless.Schedule.Every(Minutes(5)),
     payload: "{}",
   }
 

package/tests/TaskBucketEntryPoint_OpsTest.res.mjs

@@ -91,9 +91,12 @@ globalThis.describe("TaskBucketEntryPoint_Ops.buildPublishCommands", () => {
 globalThis.describe("TaskBucketEntryPoint_Ops.dispatchTaskActions", () => {
   let schedule = {
     name: "sweep",
-    rate: {
-      TAG: "Minutes",
-      _0: 5
+    time: {
+      TAG: "Every",
+      _0: {
+        TAG: "Minutes",
+        _0: 5
+      }
     },
     payload: "{}"
   };

package/src/adapter/ScheduledPublisher/ScheduledPublisher_CloudWatchEvents.res

@@ -1,64 +0,0 @@
-let make: ReventlessCore.Scheduler_Adapter.scheduledPublisherMaker = (~name, ~opts) => {
-  let role = PulumiAws.IAM.Role.makeWithDefaultPolicy(
-    ~name="CloudWatchEventsRole",
-    ~servicePrincipal=AWS.CloudwatchEventRule.principal->Pulumi.Output.make,
-    ~tags=AWS.Tags.make(
-      ~name="CloudWatchEventsRole",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Identity,
-      ~scope=Platform,
-    ),
-    ~opts,
-  )
-
-  let _policy = PulumiAws.IAM.Policy.make(
-    ~name=name ++ "CloudWatchEventsPolicy",
-    ~args={
-      PulumiAws.IAM.Policy.policy: role.arn
-      ->Pulumi.Output.apply(roleArn => {
-        open PulumiAws.PolicyDocument
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "CloudWatchEventsPolicy",
-          ~statements=[
-            {
-              sid: "AllowCloudWatchEvents",
-              effect: Allow,
-              actions: Action("events:*"),
-              resources: AllResources,
-            },
-            {
-              sid: "AllowPassRole",
-              effect: Allow,
-              actions: Action("iam:PassRole"),
-              resources: Resource(`${roleArn}`),
-            },
-          ],
-        )->toJsonString
-      })
-      ->Pulumi.Output.asInput,
-      tags: AWS.Tags.make(
-        ~name=name ++ "CloudWatchEventsPolicy",
-        ~kind=ReventlessCore.ComponentType.Platform,
-        ~role=Identity,
-        ~scope=Platform,
-      ),
-    },
-    ~opts,
-  )
-
-  {
-    resource: ReventlessInfra.Adapter.make(
-      // urn carries the CloudWatch Events role ARN — bundled Lambdas read it
-      // via Scheduler.outputs.resource.urn to call PutRule with the right roleArn.
-      ~name=role.name,
-      ~id=role.id,
-      ~urn=role.arn,
-      ~service="CloudWatchEvents"->Pulumi.Output.make,
-      ~resourceType="aws:cloudwatch:EventRule"->Pulumi.Output.make,
-    ),
-    operations: role.arn->Pulumi.Output.apply((roleArn): ReventlessInfra.Scheduler.operations => {
-      createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(~roleArn),
-      deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
-    }),
-  }
-}