@reventlessdev/reventless-aws 3.0.0-alpha.382 → 3.0.0-alpha.384

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -8,7 +8,10 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Schedule$Reventless from "@reventlessdev/reventless-spec/src/types/Schedule.res.mjs";
+import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
@@ -22,6 +25,7 @@ import * as Util_LambdaEnvBudget$ReventlessAws from "../../util/Util_LambdaEnvBu
 import * as PluginRuntime_Builder$ReventlessAws from "../../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
+import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -52,11 +56,12 @@ function getDcbQueueUrl() {
   return dcbQueueUrlRef.contents;
 }
 
-function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName) {
+function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName, schedule, schedulesResourcesOpt) {
   let callbackType = callbackTypeOpt !== undefined ? callbackTypeOpt : "automation";
   let queryDbResources = queryDbResourcesOpt !== undefined ? queryDbResourcesOpt : [];
   let sourceTopics = sourceTopicsOpt !== undefined ? sourceTopicsOpt : ({});
   let consumesDcbLog = consumesDcbLogOpt !== undefined ? consumesDcbLogOpt : true;
+  let schedulesResources = schedulesResourcesOpt !== undefined ? schedulesResourcesOpt : [];
   bundledInfos[name] = {
     specModulePath: specModulePath,
     bodyModulePath: bodyModulePath,
@@ -66,7 +71,9 @@ function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackT
     context: context,
     sourceTopics: sourceTopics,
     consumesDcbLog: consumesDcbLog,
-    commandTargetName: commandTargetName
+    commandTargetName: commandTargetName,
+    schedule: schedule,
+    schedulesResources: schedulesResources
   };
 }
 
@@ -168,6 +175,73 @@ function makeMessagingGrant(runtime, opts) {
   }, customOpts);
 }
 
+function makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts) {
+  let name = "AllAutomationSlices";
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, l => l.arn);
+  let manage = new (Aws.iam.RolePolicy)(name + `SchedulerPolicy`, {
+    policy: schedulerRoleArn.apply(arn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `SchedulerPolicy`, [
+      {
+        Sid: "AllowManageSchedules",
+        Effect: "Allow",
+        Action: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.manageActions,
+        Resource: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.schedulesOfRoleArn(arn)
+      },
+      {
+        Sid: "AllowPassSchedulerRole",
+        Effect: "Allow",
+        Action: "iam:PassRole",
+        Resource: arn
+      },
+      {
+        Sid: "AllowListSchedules",
+        Effect: "Allow",
+        Action: ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.listActions,
+        Resource: "*"
+      }
+    ]))),
+    role: runtime.parts.lambdaRole.id
+  }, customOpts);
+  let invoke = new (Aws.iam.RolePolicy)(name + `SchedulerInvokePolicy`, {
+    policy: lambdaArn.apply(arn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `SchedulerInvokePolicy`, [{
+        Sid: "AllowSchedulerToInvokeAutomations",
+        Effect: "Allow",
+        Action: "lambda:InvokeFunction",
+        Resource: arn
+      }]))),
+    role: schedulerRoleArn.apply(ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws.groupOfRoleArn)
+  }, customOpts);
+  let declared = Object.fromEntries(Stdlib_Array.filterMap(Object.entries(bundledInfos), param => {
+    let slice = param[0];
+    return Stdlib_Option.map(param[1].schedule, time => [
+      slice,
+      Util_Sury$Reventless.toJson(time, Schedule$Reventless.timeSchema)
+    ]);
+  }).toSorted((param, param$1) => Primitive_string.compare(param[0], param$1[0])));
+  let input = JSON.stringify(Object.fromEntries([
+    [
+      "reventlessReconcile",
+      true
+    ],
+    [
+      "declared",
+      declared
+    ],
+    [
+      "code",
+      sourceCodeHash
+    ]
+  ]));
+  let newrecord = {...customOpts};
+  new (Aws.lambda.Invocation)(name + `ReconcileSchedules`, {
+    functionName: Output$Pulumi.flatMap(runtime.parts.lambda, l => l.name),
+    input: input
+  }, (newrecord.dependsOn = [
+    manage,
+    invoke
+  ], newrecord));
+}
+
 let finished = {
   contents: false
 };
@@ -235,7 +309,7 @@ function finish() {
   finished.contents = true;
 }
 
-function finishWithDcbEventLog(dcbEventLog) {
+function finishWithDcbEventLog(schedulerRoleArn, dcbEventLog) {
   if (finished.contents) {
     return;
   }
@@ -290,6 +364,9 @@ function finishWithDcbEventLog(dcbEventLog) {
         info.queryDbResources.forEach(r => {
           allQueryDbResources.push(r);
         });
+        info.schedulesResources.forEach(r => {
+          allQueryDbResources.push(r);
+        });
         let target = Stdlib_Option.flatMap(info.commandTargetName, CommandTopicRegistry$ReventlessAws.get);
         if (target !== undefined) {
           allQueryDbResources.push(target.resource);
@@ -316,16 +393,21 @@ function finishWithDcbEventLog(dcbEventLog) {
           ];
         let commandQueueIsFifo = match[1];
         let hasOwnUrns = !info.consumesDcbLog || Object.keys(info.sourceTopics).length !== 0;
+        let resource = info.schedulesResources[0];
+        let schedulesTableName = resource !== undefined ? resource.name : Pulumi.output("");
         let handlerJson = Pulumi.all([
           info.queryDbTableName,
           match[0],
-          sourceUrnsFor(info)
+          sourceUrnsFor(info),
+          schedulesTableName
         ]).apply(param => {
+          let schedulesTable = param[3];
           let urnsFragment = hasOwnUrns ? `,"u":` + JSON.stringify(param[2].map(prim => prim)) : "";
           let queueFragment = target !== undefined ? `,"k":"` + param[1] + `","f":` + (
               commandQueueIsFifo ? "true" : "false"
             ) : "";
-          return `{"n":` + nameJson + `,"q":"` + param[0] + `"` + urnsFragment + queueFragment + `}`;
+          let schedulesFragment = schedulesTable === "" ? "" : `,"s":"` + schedulesTable + `"`;
+          return `{"n":` + nameJson + `,"q":"` + param[0] + `"` + urnsFragment + queueFragment + schedulesFragment + `}`;
         });
         handlerOutputs.push(handlerJson);
       });
@@ -355,16 +437,19 @@ function finishWithDcbEventLog(dcbEventLog) {
       PluginRuntime_Builder$ReventlessAws.capabilityEnv().forEach(param => {
         envVars[param[0]] = param[1];
       });
+      envVars["SCHEDULER_ROLE_ARN"] = schedulerRoleArn;
       let extraStringAssets = {};
       extraStringAssets["automationSliceModules.json"] = `{` + sliceModuleEntries.join(",") + `}`;
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AutomationSliceEntryPoint.mjs", packageDirs, extraStringAssets, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAutomationSlices", "Reactor", "AutomationSlice", match.code, match.sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, opts);
+      let sourceCodeHash = match.sourceCodeHash;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAutomationSlices", "Reactor", "AutomationSlice", match.code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, opts);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllAutomationSlices", [{
           channel: channel,
           eventTopics: eventTopics,
           resources: allQueryDbResources
         }], runtime, opts);
       makeSweepSchedule(runtime, opts);
+      makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts);
       makeGeocoderGrant(runtime, opts);
       makeMessagingGrant(runtime, opts);
     } else {
@@ -398,6 +483,7 @@ export {
   makeSweepSchedule,
   makeGeocoderGrant,
   makeMessagingGrant,
+  makeAutomationSchedules,
   finished,
   finish,
   finishWithDcbEventLog,

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res

@@ -57,20 +57,33 @@ let failWithoutQueue = action => {
   ->Effect.runPromise
 }
 
+let putSchedule = async (~roleArn, ~targetArn, schedule: Reventless.Schedule.schedule) => {
+  ReventlessCore.ScheduleTime.validate(schedule.time)
+  let input = schedule->scheduleInput(~roleArn, ~targetArn, ~setAt=Date.now())
+  switch await CreateScheduleCommand.make(input)->CreateScheduleCommand.send {
+  | _ => ()
+  | exception JsExn(err) if err->ErrorName.is(ErrorName.conflict) =>
+    let _ = await UpdateScheduleCommand.make(input)->UpdateScheduleCommand.send
+  }
+}
+
+let removeSchedule = async (~roleArn, name) =>
+  switch await DeleteScheduleCommand.make({
+    name,
+    groupName: roleArn->groupOfRoleArn,
+  })->DeleteScheduleCommand.send {
+  | _ => ()
+  | exception JsExn(err) if err->ErrorName.is(ErrorName.resourceNotFound) => ()
+  }
+
 /** Creates the schedule, or replaces the one of that name, as a classic rule's `PutRule` did. */
 let createSchedule = (~roleArn: string): ReventlessCore.Scheduler.createSchedule =>
   async (queueResources, schedule) =>
     switch queueResources {
     | [] => await failWithoutQueue("createSchedule")
     | resources =>
-      ReventlessCore.ScheduleTime.validate(schedule.time)
       let resource = resources->Array.getUnsafe(0) // FIXME
-      let input = schedule->scheduleInput(~roleArn, ~targetArn=resource.urn, ~setAt=Date.now())
-      switch await CreateScheduleCommand.make(input)->CreateScheduleCommand.send {
-      | _ => ()
-      | exception JsExn(err) if err->ErrorName.is(ErrorName.conflict) =>
-        let _ = await UpdateScheduleCommand.make(input)->UpdateScheduleCommand.send
-      }
+      await putSchedule(~roleArn, ~targetArn=resource.urn, schedule)
     }
 
 /** Deletes the schedule; one already gone, such as a once-only time that fired, is no error. */
@@ -78,12 +91,88 @@ let deleteSchedule = (~roleArn: string): ReventlessCore.Scheduler.deleteSchedule
   async (queueResources, name) =>
     switch queueResources {
     | [] => await failWithoutQueue("deleteSchedule")
-    | _ =>
-      switch await DeleteScheduleCommand.make({
-        name,
-        groupName: roleArn->groupOfRoleArn,
-      })->DeleteScheduleCommand.send {
-      | _ => ()
-      | exception JsExn(err) if err->ErrorName.is(ErrorName.resourceNotFound) => ()
-      }
+    | _ => await removeSchedule(~roleArn, name)
     }
+
+// ── An automation's schedules ───────────────────────────────────────────────
+
+let validName = /^[0-9a-zA-Z\-_.]{1,64}$/
+
+/**
+The platform name of an automation's schedule: `<slice>.<key>`, or, when that is too
+long or holds a character EventBridge refuses, the slice's name cut to 40 characters
+and a hash of the key.
+*/
+let tickScheduleName = (~slice, ~key) => {
+  let name = `${slice}.${key}`
+  validName->RegExp.test(name)
+    ? name
+    : {
+        let hash =
+          NodeCrypto.createHash("sha256")
+          ->NodeCrypto.hashUpdate(key)
+          ->NodeCrypto.hashDigest("hex")
+          ->String.slice(~start=0, ~end=16)
+        `${slice->String.slice(~start=0, ~end=40)}.${hash}`
+      }
+}
+
+/** What the Scheduler sends the automation Lambda: the slice, the key and the scheduled time. */
+let tickInput = (~slice, ~key) =>
+  JSON.Encode.object(
+    Dict.fromArray([
+      (
+        "reventlessTick",
+        JSON.Encode.object(
+          Dict.fromArray([
+            ("slice", slice->JSON.Encode.string),
+            ("key", key->JSON.Encode.string),
+            ("at", "<aws.scheduler.scheduled-time>"->JSON.Encode.string),
+          ]),
+        ),
+      ),
+    ]),
+  )->JSON.stringify
+
+/** Sets the slice's schedule of that key, invoking `lambdaArn` with `tickInput` at each firing. */
+let putTickSchedule = (~roleArn, ~lambdaArn, ~slice, ~key, time) =>
+  putSchedule(
+    ~roleArn,
+    ~targetArn=lambdaArn,
+    {name: tickScheduleName(~slice, ~key), time, payload: tickInput(~slice, ~key)},
+  )
+
+/** The actions a Lambda that reconciles an automation's schedules is granted on every
+    resource: listing schedules has no resource-level permission. */
+let listActions = ["scheduler:ListSchedules"]
+
+// Hashed names start with the slice's name cut to 40 characters.
+let sliceNamePrefix = slice => slice->String.slice(~start=0, ~end=40)
+
+let isSliceSchedule = (name, ~slice) => {
+  let cut = slice->sliceNamePrefix
+  name->String.startsWith(`${slice}.`) ||
+    (cut != slice &&
+    name->String.startsWith(`${cut}.`) &&
+    name->String.length == cut->String.length + 17)
+}
+
+/** The slice's schedules in the scheduler group of `roleArn`, invoking `lambdaArn`. */
+let platformSchedules = (
+  ~roleArn,
+  ~lambdaArn,
+  ~slice,
+): ReventlessInfra.AutomationSlice.platformSchedules => {
+  put: (~key, time) => putTickSchedule(~roleArn, ~lambdaArn, ~slice, ~key, time),
+  removeName: name => removeSchedule(~roleArn, name),
+  names: async () =>
+    (
+      await ListSchedulesCommand.all({
+        groupName: roleArn->groupOfRoleArn,
+        namePrefix: slice->sliceNamePrefix,
+      })
+    )
+    ->Array.map(s => s.name)
+    ->Array.filter(isSliceSchedule(_, ~slice)),
+  nameOf: key => tickScheduleName(~slice, ~key),
+}

package/src/adapter/ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
@@ -62,52 +63,129 @@ function failWithoutQueue(action) {
   return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logError("ScheduledPublisher_EventBridgeScheduler_Runtime-ReventlessAws", undefined, err), () => Effect.sync(() => Stdlib_JsError.throwWithMessage(err))));
 }
 
+async function putSchedule(roleArn, targetArn, schedule) {
+  ScheduleTime$ReventlessCore.validate(schedule.time);
+  let input = scheduleInput(roleArn, targetArn, Date.now(), schedule);
+  try {
+    await EventBridgeScheduler$AwsSdk.CreateScheduleCommand.send(new ClientScheduler.CreateScheduleCommand(input));
+    return;
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.conflict)) {
+        await EventBridgeScheduler$AwsSdk.UpdateScheduleCommand.send(new ClientScheduler.UpdateScheduleCommand(input));
+        return;
+      }
+      throw err;
+    }
+    throw err;
+  }
+}
+
+async function removeSchedule(roleArn, name) {
+  try {
+    await EventBridgeScheduler$AwsSdk.DeleteScheduleCommand.send(new ClientScheduler.DeleteScheduleCommand({
+      Name: name,
+      GroupName: groupOfRoleArn(roleArn)
+    }));
+    return;
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.resourceNotFound)) {
+        return;
+      }
+      throw err;
+    }
+    throw err;
+  }
+}
+
 function createSchedule(roleArn) {
   return async (queueResources, schedule) => {
     if (queueResources.length === 0) {
       return await failWithoutQueue("createSchedule");
     }
-    ScheduleTime$ReventlessCore.validate(schedule.time);
     let resource = queueResources[0];
-    let input = scheduleInput(roleArn, resource.urn, Date.now(), schedule);
-    try {
-      await EventBridgeScheduler$AwsSdk.CreateScheduleCommand.send(new ClientScheduler.CreateScheduleCommand(input));
-      return;
-    } catch (raw_err) {
-      let err = Primitive_exceptions.internalToException(raw_err);
-      if (err.RE_EXN_ID === "JsExn") {
-        if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.conflict)) {
-          await EventBridgeScheduler$AwsSdk.UpdateScheduleCommand.send(new ClientScheduler.UpdateScheduleCommand(input));
-          return;
-        }
-        throw err;
-      }
-      throw err;
-    }
+    return await putSchedule(roleArn, resource.urn, schedule);
   };
 }
 
 function deleteSchedule(roleArn) {
   return async (queueResources, name) => {
-    if (queueResources.length === 0) {
+    if (queueResources.length !== 0) {
+      return await removeSchedule(roleArn, name);
+    } else {
       return await failWithoutQueue("deleteSchedule");
     }
-    try {
-      await EventBridgeScheduler$AwsSdk.DeleteScheduleCommand.send(new ClientScheduler.DeleteScheduleCommand({
-        Name: name,
-        GroupName: groupOfRoleArn(roleArn)
-      }));
-      return;
-    } catch (raw_err) {
-      let err = Primitive_exceptions.internalToException(raw_err);
-      if (err.RE_EXN_ID === "JsExn") {
-        if (EventBridgeScheduler$AwsSdk.ErrorName.is(err._1, EventBridgeScheduler$AwsSdk.ErrorName.resourceNotFound)) {
-          return;
-        }
-        throw err;
-      }
-      throw err;
-    }
+  };
+}
+
+let validName = /^[0-9a-zA-Z\-_.]{1,64}$/;
+
+function tickScheduleName(slice, key) {
+  let name = slice + `.` + key;
+  if (validName.test(name)) {
+    return name;
+  }
+  let hash = Nodecrypto.createHash("sha256").update(key).digest("hex").slice(0, 16);
+  return slice.slice(0, 40) + `.` + hash;
+}
+
+function tickInput(slice, key) {
+  return JSON.stringify(Object.fromEntries([[
+      "reventlessTick",
+      Object.fromEntries([
+        [
+          "slice",
+          slice
+        ],
+        [
+          "key",
+          key
+        ],
+        [
+          "at",
+          "<aws.scheduler.scheduled-time>"
+        ]
+      ])
+    ]]));
+}
+
+function putTickSchedule(roleArn, lambdaArn, slice, key, time) {
+  return putSchedule(roleArn, lambdaArn, {
+    name: tickScheduleName(slice, key),
+    time: time,
+    payload: tickInput(slice, key)
+  });
+}
+
+let listActions = ["scheduler:ListSchedules"];
+
+function sliceNamePrefix(slice) {
+  return slice.slice(0, 40);
+}
+
+function isSliceSchedule(name, slice) {
+  let cut = slice.slice(0, 40);
+  if (name.startsWith(slice + `.`)) {
+    return true;
+  } else if (cut !== slice && name.startsWith(cut + `.`)) {
+    return name.length === (cut.length + 17 | 0);
+  } else {
+    return false;
+  }
+}
+
+function platformSchedules(roleArn, lambdaArn, slice) {
+  return {
+    put: (key, time) => putTickSchedule(roleArn, lambdaArn, slice, key, time),
+    removeName: name => removeSchedule(roleArn, name),
+    names: async () => (await EventBridgeScheduler$AwsSdk.ListSchedulesCommand.all({
+      GroupName: groupOfRoleArn(roleArn),
+      NamePrefix: slice.slice(0, 40)
+    })).map(s => s.Name).filter(__x => isSliceSchedule(__x, slice)),
+    nameOf: key => tickScheduleName(slice, key)
   };
 }
 
@@ -120,7 +198,17 @@ export {
   isFifoQueue,
   scheduleInput,
   failWithoutQueue,
+  putSchedule,
+  removeSchedule,
   createSchedule,
   deleteSchedule,
+  validName,
+  tickScheduleName,
+  tickInput,
+  putTickSchedule,
+  listActions,
+  sliceNamePrefix,
+  isSliceSchedule,
+  platformSchedules,
 }
-/* effect/Effect Not a pure module */
+/* node:crypto Not a pure module */

package/src/components/Api/AppSync_Adapter.res

@@ -309,21 +309,18 @@ let injectAwsAuth = (
       iamQueryFieldPrefixes->Array.push(entry.listFieldName)
       iamTypePrefixes->Array.push(entry.returnTypeName)
     }
+    // Every door the entry emits: the resolvers here do not check the rule, so a
+    // by-ids or by-index field left to the open directive reads the gated rows.
+    let fieldNames = ReventlessCore.GraphQL_FragmentGenerator.queryFieldNamesOf(entry)
     switch entry.authorization {
-    | Some({group}) =>
-      queryAuthMap->Dict.set(entry.singleFieldName, [group])
-      queryAuthMap->Dict.set(entry.listFieldName, [group])
+    | Some({group}) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, [group]))
     | None => ()
     }
     switch entry.permission {
     | Some(permission) =>
       switch AppSync_SdlDecorate.permissionToGate(permission) {
-      | Groups(groups) =>
-        queryAuthMap->Dict.set(entry.singleFieldName, groups)
-        queryAuthMap->Dict.set(entry.listFieldName, groups)
-      | AnyAuthenticated =>
-        queryAuthMap->Dict.delete(entry.singleFieldName)
-        queryAuthMap->Dict.delete(entry.listFieldName)
+      | Groups(groups) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, groups))
+      | AnyAuthenticated => fieldNames->Array.forEach(f => queryAuthMap->Dict.delete(f))
       | Anonymous =>
         // Both derived field names, because the spec declares one permission and
         // the generator emits two fields from it; naming only one would send the

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -154,11 +154,13 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
       iamQueryFieldPrefixes.push(entry.listFieldName);
       iamTypePrefixes.push(entry.returnTypeName);
     }
+    let fieldNames = GraphQL_FragmentGenerator$ReventlessCore.queryFieldNamesOf(entry);
     let match = entry.authorization;
     if (match !== undefined) {
       let group = match.group;
-      queryAuthMap[entry.singleFieldName] = [group];
-      queryAuthMap[entry.listFieldName] = [group];
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = [group];
+      });
     }
     let permission = entry.permission;
     if (permission === undefined) {
@@ -167,16 +169,17 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(permission);
     if (typeof groups !== "object") {
       if (groups === "AnyAuthenticated") {
-        Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
-        return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+        fieldNames.forEach(f => Stdlib_Dict.$$delete(queryAuthMap, f));
+        return;
       }
       anonymousFields.push(entry.singleFieldName);
       anonymousFields.push(entry.listFieldName);
       return;
     } else {
       let groups$1 = groups._0;
-      queryAuthMap[entry.singleFieldName] = groups$1;
-      queryAuthMap[entry.listFieldName] = groups$1;
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = groups$1;
+      });
       return;
     }
   });

package/src/components/AutomationSlice_Builder.res

@@ -5,6 +5,23 @@ module EventCollectorChannel = EventCollectorChannel.DynamoDbStream
 module RuntimeEnvironment = RuntimeEnvironment.Lambda
 module EventCollectorRuntimeBuilder = AutomationSliceRuntime_Builder_Single
 
+// The core builder's operations never run on AWS: the automation Lambda drives the
+// callback itself (AutomationSliceEntryPoint_Ops).
+module DeployTimeSchedules = {
+  let platformFor = (~slice): ReventlessInfra.AutomationSlice.platformSchedules => {
+    let refuse = () =>
+      JsError.throwWithMessage(
+        `AutomationSlice(${slice}): schedules are set by its Lambda, not at deploy`,
+      )
+    {
+      put: async (~key as _, _) => refuse(),
+      removeName: async _ => refuse(),
+      names: async () => refuse(),
+      nameOf: key => key,
+    }
+  }
+}
+
 module Make = (
   Api: {
     let api: unit => Types.AppSync.api
@@ -18,6 +35,7 @@ module Make = (
     EventCollectorChannel,
     EventCollectorRuntimeBuilder,
     Api,
+    DeployTimeSchedules,
   )
 
   module Make = (
@@ -30,6 +48,7 @@ module Make = (
     module Automation = Automation
     type component = InnerMake.component
     let queryDbName = InnerMake.queryDbName
+    let schedulesDbName = InnerMake.schedulesDbName
     let sourceNames = InnerMake.sourceNames
 
     let make = (~allEventTopics, ~publishJsons, ~context, ~runtime=?, ~opts=?): component => {
@@ -60,6 +79,11 @@ module Make = (
         ~context,
         ~sourceTopics,
         ~consumesDcbLog,
+        ~schedule=?Spec.schedule,
+        ~schedulesResources=(as_->ReventlessCore.Component.outputs).schedulesDb->Option.mapOr(
+          [],
+          db => db.resources,
+        ),
       )
 
       as_