@reventlessdev/reventless-aws 3.0.0-alpha.256 → 3.0.0-alpha.258

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.258 (2026-08-02)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
+# 3.0.0-alpha.257 (2026-08-02)
+
+### Features
+
+* **aws:** activate [@offload](https://github.com/offload) for plugin payloads across platform + plugin stacks ([3d9e91c](https://github.com/ReventlessDev/reventless-core/commit/3d9e91c382504f9bbb71e653dd96c503ec25a566))
+* **aws:** S3 GetObject->string binding + structure offload resolver ([1274bcc](https://github.com/ReventlessDev/reventless-core/commit/1274bcce29f8a1b70db362a10585c508710e7b56))
+
+
 # 3.0.0-alpha.256 (2026-08-02)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.256",
+  "version": "3.0.0-alpha.258",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,18 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.1",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.2",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.63",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.64",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.202",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.119",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.204",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.66",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.94"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.68",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.121",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.96"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1355,6 +1355,44 @@ module MakeWithConfig = (
       (),
     )
 
+    // ── Content-addressed offload bucket (@offload primitive) ─────────────────
+    //
+    // One platform-level bucket holds the large `pluginDefinition` fields
+    // (`structure` ~74 KB, `apiSchemaFragment` ~32 KB) keyed by their SHA-256
+    // (`sha256/<hash>`). Content-addressed and immutable, so it needs no CORS,
+    // lifecycle, or versioning — identical payloads across versions land on one
+    // object (free dedupe). Plugin stacks PUT to it (a `BucketObject` in the
+    // plugin deploy, via the offload hook) and the ComponentDefinitions Lambda
+    // GETs from it to resolve an offloaded `structure`. Kept out of the declared
+    // `@storageRef` stores and their pending-claim/expiry machinery: offload
+    // objects are written durably up front and are never "pending".
+    let offloadProtection = Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName())
+    let offloadBucket = PulumiAws.S3.Bucket.make(
+      ~name="reventless-offload",
+      ~args={
+        forceDestroy: (offloadProtection == Unprotected)->Pulumi.Input.make,
+        tags: AWS.Tags.make(
+          ~name="reventless-offload",
+          ~kind=ReventlessCore.ComponentType.Platform,
+          ~role=Other("Offload"),
+          ~scope=Platform,
+        ),
+      },
+      ~opts={protect: offloadProtection == Protected},
+    )
+    let offloadBucketName = offloadBucket.bucket
+    let _offloadPab = PulumiAws.S3.BucketPublicAccessBlock.make(
+      ~name="reventless-offload-pab",
+      ~args={
+        bucket: offloadBucket.id->Pulumi.Output.asInput,
+        blockPublicAcls: Pulumi.Input.make(true),
+        blockPublicPolicy: Pulumi.Input.make(true),
+        ignorePublicAcls: Pulumi.Input.make(true),
+        restrictPublicBuckets: Pulumi.Input.make(true),
+      },
+    )
+    Pulumi.Pulumi.export("offloadBucket", offloadBucketName)
+
     // Mount the Platform_ComponentDefinitions Lambda resolver on the Platform API
     // (split mode) or Domain API (unified mode — platformApi == domainApi above).
     // Also register the Plugin RM table with the AllAggregates Lambda runtime
@@ -1366,6 +1404,7 @@ module MakeWithConfig = (
       Platform_ComponentDefinitions_Lambda.make(
         ~api=platformApi,
         ~pluginReadModelTableName=tableName,
+        ~offloadBucketName,
         ~opts={},
       )
     | None => ()
@@ -2112,8 +2151,39 @@ module MakeWithConfig = (
     hooks.api := Some(targetApi->wrapHookedValue)
     hooks.apiRole := Some(targetApiRole->wrapHookedValue)
 
+    // Register the deploy-time offload hook so Plugin_Builder content-addresses
+    // the two large pluginDefinition fields (`structure`, `apiSchemaFragment`)
+    // into the platform's offload bucket and carries them as references instead
+    // of inline. The hook fires synchronously during P.make() (both values are
+    // concrete at graph construction), writing a content-addressed BucketObject
+    // and returning its ref; cleared after the build so nothing else offloads.
+    // The bucket name comes from the platform stack (deploy the platform first).
+    let offloadBucketName: Pulumi.Output.t<string> = switch platformStackRef {
+    | Some(stackRef) =>
+      (stackRef->Pulumi.StackReference.getOutput("offloadBucket"): Pulumi.Output.t<option<string>>)
+      ->Pulumi.Output.apply(o => o->Option.getOr("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY"))
+    | None => Pulumi.Output.make("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")
+    }
+    ReventlessCore.Plugin_Helpers.registerOffload((~store, ~bytes) => {
+      let hash = NodeCrypto.sha256Hex(bytes)
+      let key = "sha256/" ++ hash
+      // Content-addressed: the name and key are the hash, so re-deploying an
+      // unchanged field writes the same object (idempotent, deduplicating).
+      let _ = PulumiAws.S3.BucketObject.make(
+        ~name="offload-" ++ hash,
+        ~args={
+          bucket: offloadBucketName->Pulumi.Output.asInput,
+          key: Pulumi.Input.make(key),
+          content: Pulumi.Input.make(bytes),
+          contentType: Pulumi.Input.make("application/json"),
+        },
+      )
+      {Reventless.Offload.store, key, hash, bytes: bytes->String.length}
+    })
+
     module P = unpack(plugin)
     let pluginComponent = P.make()
+    ReventlessCore.Plugin_Helpers.clearOffload()
     currentDeployTarget := Domain // reset after build
 
     // Note: StateTopic_AppSync.finish runs from inside subscriptionInfraHook —

package/src/Platform.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as S from "sury/src/S.res.mjs";
+import * as NodeCrypto from "@reventlessdev/rescript-node/src/NodeCrypto.res.mjs";
 import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
@@ -15,6 +16,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
 import * as Aggregate$ReventlessCore from "@reventlessdev/reventless-core/src/components/Aggregate/Aggregate.res.mjs";
@@ -833,9 +835,28 @@ function MakeWithConfig(Config) {
       }
     });
     PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, Config.cloner, undefined);
+    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined);
+    let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
+      forceDestroy: offloadProtection === "Unprotected",
+      tags: AWS_Tags$ReventlessAws.make("reventless-offload", "Platform", {
+        TAG: "Other",
+        _0: "Offload"
+      }, "Platform", undefined, undefined, undefined, undefined)
+    }, {
+      protect: offloadProtection === "Protected"
+    });
+    let offloadBucketName = offloadBucket.bucket;
+    new (Aws.s3.BucketPublicAccessBlock)("reventless-offload-pab", {
+      bucket: offloadBucket.id,
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+      ignorePublicAcls: true,
+      restrictPublicBuckets: true
+    });
+    Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
     if (pluginReadModelTableName !== undefined) {
       AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, {});
+      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, {});
     }
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
@@ -1201,7 +1222,25 @@ function MakeWithConfig(Config) {
     let targetApiRole = resolveTargetApiRole();
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
+    let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
+      let hash = NodeCrypto.sha256Hex(bytes);
+      let key = "sha256/" + hash;
+      new (Aws.s3.BucketObject)("offload-" + hash, {
+        bucket: offloadBucketName,
+        key: key,
+        content: bytes,
+        contentType: "application/json"
+      });
+      return {
+        store: store,
+        key: key,
+        hash: hash,
+        bytes: bytes.length
+      };
+    });
     let pluginComponent = plugin.make();
+    Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
@@ -2028,9 +2067,28 @@ function Make($star) {
       }
     });
     PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, false, undefined);
+    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined);
+    let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
+      forceDestroy: offloadProtection === "Unprotected",
+      tags: AWS_Tags$ReventlessAws.make("reventless-offload", "Platform", {
+        TAG: "Other",
+        _0: "Offload"
+      }, "Platform", undefined, undefined, undefined, undefined)
+    }, {
+      protect: offloadProtection === "Protected"
+    });
+    let offloadBucketName = offloadBucket.bucket;
+    new (Aws.s3.BucketPublicAccessBlock)("reventless-offload-pab", {
+      bucket: offloadBucket.id,
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+      ignorePublicAcls: true,
+      restrictPublicBuckets: true
+    });
+    Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
     if (pluginReadModelTableName !== undefined) {
       AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, {});
+      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, {});
     }
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
@@ -2390,7 +2448,25 @@ function Make($star) {
     let targetApiRole = resolveTargetApiRole();
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
+    let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
+      let hash = NodeCrypto.sha256Hex(bytes);
+      let key = "sha256/" + hash;
+      new (Aws.s3.BucketObject)("offload-" + hash, {
+        bucket: offloadBucketName,
+        key: key,
+        content: bytes,
+        contentType: "application/json"
+      });
+      return {
+        store: store,
+        key: key,
+        hash: hash,
+        bytes: bytes.length
+      };
+    });
     let pluginComponent = plugin.make();
+    Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -27,6 +27,7 @@ export function response(ctx) {
 let make = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~pluginReadModelTableName: Pulumi.Output.t<string>,
+  ~offloadBucketName: Pulumi.Output.t<string>,
   ~opts: Pulumi.ComponentResource.options,
 ) => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
@@ -45,7 +46,9 @@ let make = (
   )
 
   let _ =
-    pluginReadModelTableName->Pulumi.Output.apply(tableName => {
+    (pluginReadModelTableName, offloadBucketName)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((tableName, offloadBucket)) => {
       open PolicyDocument
       let _rolePolicy = IAM.RolePolicy.make(
         ~name=name ++ "LambdaPolicy",
@@ -65,6 +68,15 @@ let make = (
                 actions: Actions(["dynamodb:Scan"]),
                 resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
               },
+              // Offloaded `structure` payloads live in the platform's
+              // content-addressed offload bucket; the handler GETs them by their
+              // `sha256/<hash>` key and substitutes before filtering.
+              {
+                sid: "AllowOffloadGet",
+                effect: Allow,
+                actions: Actions(["s3:GetObject"]),
+                resources: Resource("arn:aws:s3:::" ++ offloadBucket ++ "/*"),
+              },
             ],
           )
           ->PolicyDocument.toJsonString
@@ -117,6 +129,7 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
+            ("OFFLOAD_BUCKET", offloadBucketName->Pulumi.Output.asInput),
             ("ADMIN_ENTRY_JSON", adminEntryJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -27,11 +27,14 @@ export function response(ctx) {
 }
 `;
 
-function make(api, pluginReadModelTableName, opts) {
+function make(api, pluginReadModelTableName, offloadBucketName, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let name = "PlatformUIDefinitions";
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
-  pluginReadModelTableName.apply(tableName => {
+  Pulumi.all([
+    pluginReadModelTableName,
+    offloadBucketName
+  ]).apply(param => {
     new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
         {
@@ -44,7 +47,13 @@ function make(api, pluginReadModelTableName, opts) {
           Sid: "AllowScanPluginRm",
           Effect: "Allow",
           Action: ["dynamodb:Scan"],
-          Resource: "arn:aws:dynamodb:*:*:table/" + tableName
+          Resource: "arn:aws:dynamodb:*:*:table/" + param[0]
+        },
+        {
+          Sid: "AllowOffloadGet",
+          Effect: "Allow",
+          Action: ["s3:GetObject"],
+          Resource: "arn:aws:s3:::" + param[1] + "/*"
         }
       ])),
       role: lambdaRole.id
@@ -76,6 +85,10 @@ function make(api, pluginReadModelTableName, opts) {
           "PLUGIN_RM_TABLE",
           pluginReadModelTableName
         ],
+        [
+          "OFFLOAD_BUCKET",
+          offloadBucketName
+        ],
         [
           "ADMIN_ENTRY_JSON",
           adminEntryJson

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -65,6 +65,35 @@ let adminEntry: option<JSON.t> =
   | _ => None
   }
 
+// Resolve an offloaded `structure`: a large structure is content-addressed to the
+// offload bucket at deploy time and persisted as an `{$offload: {...}}` reference,
+// so fetch the object's bytes and substitute the real structure JSON before it is
+// filtered. Inline (or absent) structures pass through untouched. The `fetch` is
+// per-hash cached, so an identical structure shared across versions is read once.
+let resolveStructure = (
+  fetch: string => promise<string>,
+  item: dict<JSON.t>,
+): promise<dict<JSON.t>> =>
+  switch item
+  ->Dict.get("structure")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(o => o->Dict.get(Reventless.Offload.sentinelKey)) {
+  | None => Promise.resolve(item)
+  | Some(refJson) =>
+    switch refJson
+    ->JSON.Decode.object
+    ->Option.flatMap(r => r->Dict.get("key"))
+    ->Option.flatMap(JSON.Decode.string) {
+    | None => Promise.resolve(item)
+    | Some(key) =>
+      fetch(key)->Promise.then(bytes => {
+        let resolved = Dict.fromArray(item->Dict.toArray)
+        resolved->Dict.set("structure", JSON.parseOrThrow(bytes))
+        Promise.resolve(resolved)
+      })
+    }
+  }
+
 let handler = async (_event: JSON.t): array<JSON.t> => {
   let admin = adminEntry->Option.mapOr([], e => [e])
   switch NodeProcess.env->Dict.get("PLUGIN_RM_TABLE") {
@@ -72,12 +101,18 @@ let handler = async (_event: JSON.t): array<JSON.t> => {
     Console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set")
     admin
   | Some(table) =>
-    let items = await Platform_AdminScan_Ops.scanAll(
+    let rawItems = await Platform_AdminScan_Ops.scanAll(
       ~tableName=table,
       ~filterExpression="contains(#status, :connected)",
       ~expressionAttributeNames=Dict.fromArray([("#status", "status")]),
       ~expressionAttributeValues=Dict.fromArray([(":connected", JSON.Encode.string("Connected"))]),
     )
+    // Substitute any offloaded structure references with their bytes before filtering.
+    let bucket = NodeProcess.env->Dict.get("OFFLOAD_BUCKET")->Option.getOr("")
+    let fetch = Reventless.Offload.cachedFetch(key =>
+      AwsSdk.S3.GetObjectCommand.getString(~bucket, ~key)
+    )
+    let items = await Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
     let userEntries =
       Platform_AdminScan_Ops.latestByName(items, ~nameVersionOf=item => item->str("name"), ~toEntry)
     Array.concat(admin, userEntries)

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -1,7 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
 import * as Platform_AdminScan_Ops$ReventlessAws from "./Platform_AdminScan_Ops.res.mjs";
 
 function str(item, key) {
@@ -46,6 +48,23 @@ let s = process.env["ADMIN_ENTRY_JSON"];
 
 let adminEntry = s !== undefined && s !== "" ? JSON.parse(s) : undefined;
 
+function resolveStructure(fetch, item) {
+  let refJson = Stdlib_Option.flatMap(Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object), o => o[Offload$Reventless.sentinelKey]);
+  if (refJson === undefined) {
+    return Promise.resolve(item);
+  }
+  let key = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(refJson), r => r["key"]), Stdlib_JSON.Decode.string);
+  if (key !== undefined) {
+    return fetch(key).then(bytes => {
+      let resolved = Object.fromEntries(Object.entries(item));
+      resolved["structure"] = JSON.parse(bytes);
+      return Promise.resolve(resolved);
+    });
+  } else {
+    return Promise.resolve(item);
+  }
+}
+
 async function handler(_event) {
   let admin = Stdlib_Option.mapOr(adminEntry, [], e => [e]);
   let table = process.env["PLUGIN_RM_TABLE"];
@@ -54,13 +73,16 @@ async function handler(_event) {
       console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
       return admin;
     }
-    let items = await Platform_AdminScan_Ops$ReventlessAws.scanAll(table, "contains(#status, :connected)", Object.fromEntries([[
+    let rawItems = await Platform_AdminScan_Ops$ReventlessAws.scanAll(table, "contains(#status, :connected)", Object.fromEntries([[
         "#status",
         "status"
       ]]), Object.fromEntries([[
         ":connected",
         "Connected"
       ]]));
+    let bucket = Stdlib_Option.getOr(process.env["OFFLOAD_BUCKET"], "");
+    let fetch = Offload$Reventless.cachedFetch(key => S3$AwsSdk.GetObjectCommand.getString(bucket, key));
+    let items = await Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
     let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), toEntry);
     return admin.concat(userEntries);
   }
@@ -74,6 +96,7 @@ export {
   filterStructure,
   toEntry,
   adminEntry,
+  resolveStructure,
   handler,
 }
 /* s Not a pure module */