@reventlessdev/reventless-aws 3.0.0-alpha.269 → 3.0.0-alpha.270

package/src/adapter/Runtime/PgMigrationEntryPoint.res

@@ -47,7 +47,16 @@ let runMigration = async (
   }
 }
 
+// Runtime extension seam: HandlerFactoryHelpers loads and fires any registered
+// out-of-tree extension once, at module load. Awaiting its promise before this
+// handler does any work is what makes "before the first request" a fact rather
+// than a hope; it is already resolved on every invocation after the first, and
+// resolves immediately when nothing is registered.
+@module("./HandlerFactoryHelpers.mjs")
+external runtimeExtensionsReady: promise<unit> = "runtimeExtensionsReady"
+
 let handler = async (_event: JSON.t, _context: PulumiAws.Lambda.context) => {
+  await runtimeExtensionsReady
   let config = NodeProcess.env->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
   await runMigration(config)
 }

package/src/adapter/Runtime/PgMigrationEntryPoint.res.mjs

@@ -24,7 +24,10 @@ async function runMigration(config, makePoolOpt) {
   return "ok";
 }
 
+let runtimeExtensionsReady = HandlerFactoryHelpersMjs.runtimeExtensionsReady;
+
 async function handler(_event, _context) {
+  await runtimeExtensionsReady;
   let config = JSON.parse(Stdlib_Option.getOr(process.env["HANDLER_CONFIG"], "{}"));
   return await runMigration(config, undefined);
 }
@@ -32,6 +35,7 @@ async function handler(_event, _context) {
 export {
   logInfo,
   runMigration,
+  runtimeExtensionsReady,
   handler,
 }
-/* PgRuntime-ReventlessAws Not a pure module */
+/* runtimeExtensionsReady Not a pure module */

package/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs

@@ -17,12 +17,17 @@
 // live type-checked in PgQueryResolverEntryPoint_Ops.res.
 
 import { handler as dispatchHandler } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs";
-import { patchSpecId, log } from "./HandlerFactoryHelpers.mjs";
+import { patchSpecId, log, runtimeExtensionsReady } from "./HandlerFactoryHelpers.mjs";
 import * as Ops from "./PgQueryResolverEntryPoint_Ops.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
 
 async function buildAllBindings() {
+  // Runtime extension seam: any registered out-of-tree extension gets its
+  // onColdStart before a single handler is built, which is what makes the
+  // framework's interception/publish hooks reachable here. No-op unless the
+  // deployment registered one.
+  await runtimeExtensionsReady;
   const config = Ops.parseResolverConfig(process.env["QUERY_RESOLVER_CONFIG"] || "");
   const pgConnection = config.pgConnection;
   if (!pgConnection) {

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -211,7 +211,16 @@ let comp = `ExtensionPoint(${ReventlessInfra.PluginExtensionPointSpec.name})`
 
 // === Exported handler ===
 
+// Runtime extension seam: HandlerFactoryHelpers loads and fires any registered
+// out-of-tree extension once, at module load. Awaiting its promise before this
+// handler does any work is what makes "before the first request" a fact rather
+// than a hope; it is already resolved on every invocation after the first, and
+// resolves immediately when nothing is registered.
+@module("./HandlerFactoryHelpers.mjs")
+external runtimeExtensionsReady: promise<unit> = "runtimeExtensionsReady"
+
 let handler = async (event: PulumiAws.SQS.Queue.event, context: PulumiAws.Lambda.context) => {
+  await runtimeExtensionsReady
   setRequestId(context.awsRequestId)
   let records = event.records
 

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs

@@ -179,7 +179,10 @@ let sqsHandler = CommandTopicChannel_SQS_Runtime$ReventlessAws.handleQueueEvent(
 
 let comp = `ExtensionPoint(` + PluginExtensionPointSpec$ReventlessInfra.name + `)`;
 
+let runtimeExtensionsReady = HandlerFactoryHelpersMjs.runtimeExtensionsReady;
+
 async function handler(event, context) {
+  await runtimeExtensionsReady;
   HandlerFactoryHelpersMjs.setRequestId(context.awsRequestId);
   let records = event.Records;
   let prim0 = `processing ` + records.length.toString() + ` record(s)`;
@@ -221,6 +224,7 @@ export {
   queue,
   sqsHandler,
   comp,
+  runtimeExtensionsReady,
   handler,
 }
 /* config Not a pure module */

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -13,7 +13,7 @@
 // boundary) lives type-checked in ReadModelEntryPoint_Ops.res /
 // ProjectionEntryPoint_Ops.res / StreamRoutedEntryPoint_Ops.res.
 
-import { patchSpecId } from "./HandlerFactoryHelpers.mjs";
+import { patchSpecId, runtimeExtensionsReady } from "./HandlerFactoryHelpers.mjs";
 import { Make as readModelCallbackMake } from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel_Callback.res.mjs";
 import * as StreamOps from "./StreamRoutedEntryPoint_Ops.res.mjs";
 import * as Ops from "./ReadModelEntryPoint_Ops.res.mjs";
@@ -33,6 +33,11 @@ function fixMappingsModule(mod) {
 }
 
 async function buildAllHandlers() {
+  // Runtime extension seam: any registered out-of-tree extension gets its
+  // onColdStart before a single handler is built, which is what makes the
+  // framework's interception/publish hooks reachable here. No-op unless the
+  // deployment registered one.
+  await runtimeExtensionsReady;
   const handlers = {};
   const entries = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
 

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -257,6 +257,34 @@ let makeFromCodeAsset: (
   variables->Dict.set("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make)
   variables->Dict.set("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make)
 
+  // Runtime extension seam: the modules a cold start imports plus this runtime's
+  // identity, so an out-of-tree extension can register the framework's runtime
+  // callback hooks before the first request (see
+  // ReventlessCore.RuntimeExtension). Emitted here rather than folded into
+  // HANDLER_CONFIG for two reasons: every runtime builder already routes through
+  // makeFromCodeAsset with the kind and name the seam needs, so no call site
+  // changes; and HANDLER_CONFIG is already close to the 5120-byte
+  // UpdateFunctionConfiguration limit. Absent entirely when nothing is
+  // registered — an extension-free deployment gets the env it always had.
+  if !ReventlessCore.RuntimeExtension.isEmpty() {
+    let {ReventlessCore.ResourceAttribution.plugin: plugin, platform} =
+      ReventlessCore.ResourceAttribution.current.contents
+    let orNull = o => o->Option.mapOr(JSON.Null, s => JSON.String(s))
+    let config = JSON.Object(
+      Dict.fromArray([
+        (
+          "modules",
+          JSON.Array(Util_Bundle.runtimeExtensionSpecifiers()->Array.map(s => JSON.String(s))),
+        ),
+        ("runtimeKind", JSON.String(componentKind->ReventlessCore.ComponentType.toString)),
+        ("component", JSON.String(name)),
+        ("plugin", plugin->orNull),
+        ("platform", platform->orNull),
+      ]),
+    )
+    variables->Dict.set("RUNTIME_EXTENSIONS", config->JSON.stringify->Pulumi.Input.make)
+  }
+
   let tags = tagsFor(~resourceName=name, ~role=Runtime)
   let lambda = Lambda.Function.make(
     ~name,

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -20,11 +20,14 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_IAM_Role$ReventlessAws from "../../util/Util_IAM_Role.res.mjs";
+import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
 import * as Util_DcbMetrics$ReventlessAws from "../../util/Util_DcbMetrics.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
+import * as RuntimeExtension$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/RuntimeExtension/RuntimeExtension.res.mjs";
 import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
 import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
 
 let additionalEnvVars = {};
 
@@ -106,6 +109,33 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
+  if (!RuntimeExtension$ReventlessCore.isEmpty()) {
+    let match = ResourceAttribution$ReventlessCore.current.contents;
+    let orNull = o => Stdlib_Option.mapOr(o, null, s => (s));
+    let config = Object.fromEntries([
+      [
+        "modules",
+        Util_Bundle$ReventlessAws.runtimeExtensionSpecifiers().map(s => (s))
+      ],
+      [
+        "runtimeKind",
+        ComponentType$ReventlessCore.toString(componentKind)
+      ],
+      [
+        "component",
+        name
+      ],
+      [
+        "plugin",
+        orNull(match.plugin)
+      ],
+      [
+        "platform",
+        orNull(match.platform)
+      ]
+    ]);
+    variables["RUNTIME_EXTENSIONS"] = JSON.stringify(config);
+  }
   let tags = tagsFor(name, "Runtime");
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",
@@ -126,9 +156,9 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     })),
     vpcConfig: vpcConfig
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  let match = Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks);
+  let match$1 = Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks);
   let managedRetention = logRetentionDays !== undefined ? logRetentionDays : (
-      match ? Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))) : undefined
+      match$1 ? Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))) : undefined
     );
   Stdlib_Option.forEach(managedRetention, days => {
     let logGroup = new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {

package/src/adapter/Runtime/RuntimeExtensionEntryPoint_Ops.res

@@ -0,0 +1,123 @@
+// Typed cold-start core for the runtime extension seam.
+//
+// The `.mjs` entry shells own one untyped seam — dynamically `import()`-ing the
+// extension modules named in `RUNTIME_EXTENSIONS`, whose types are unknowable
+// there. Everything either side of that lives here: parsing the env var, and
+// invoking each module's `onColdStart` with the right arity.
+//
+// The invocation in particular must not sit in a shell. ReScript labelled
+// arguments compile to positional ones, so a hand-written `.mjs` call is pinned
+// to a signature the compiler never checks — the arity drift that cost this repo
+// a production incident on the DCB command path (see the header of
+// DcbCommandTopicEntryPoint_Ops.res). Typing the hooks as
+// `ReventlessCore.RuntimeExtension.coldStartHook` makes the call site and the
+// `Extension` module type move together.
+
+let log = ReventlessCore.Logger.fromEnv()
+
+/**
+`RUNTIME_EXTENSIONS` as the deployed runtime receives it, written by
+`RuntimeEnvironment_Lambda.makeFromCodeAsset`. The env var is absent whenever no
+extension is registered, which is the only reason a runtime skips the seam.
+
+`modules` are npm specifiers resolvable under `/var/task/node_modules` — the
+extension packages ride in the code archive alongside the spec and behavior
+packages. The remaining fields are this runtime's identity, resolved at
+provisioning time from the ambient `ResourceAttribution` context.
+*/
+type config = {
+  modules: array<string>,
+  runtimeKind: string,
+  component: string,
+  plugin: option<string>,
+  platform: option<string>,
+}
+
+let decodeString = (obj: dict<JSON.t>, key: string): option<string> =>
+  obj->Dict.get(key)->Option.flatMap(JSON.Decode.string)
+
+/**
+Parse the `RUNTIME_EXTENSIONS` env var. `None` for an absent, empty, malformed or
+module-less value — all of which mean "no seam to fire", the default state.
+Deliberately total: a config the runtime cannot read must not stop it from
+serving requests.
+*/
+let parseConfig = (raw: option<string>): option<config> =>
+  switch raw {
+  | None | Some("") => None
+  | Some(raw) =>
+    switch try raw->JSON.parseOrThrow->JSON.Decode.object catch {
+    | _ => None
+    } {
+    | None =>
+      log.error(~comp="RuntimeExtension", "RUNTIME_EXTENSIONS is not a JSON object; ignored")
+      None
+    | Some(obj) =>
+      let modules =
+        obj
+        ->Dict.get("modules")
+        ->Option.flatMap(JSON.Decode.array)
+        ->Option.getOr([])
+        ->Array.filterMap(JSON.Decode.string)
+      switch (modules->Array.length, obj->decodeString("runtimeKind"), obj->decodeString("component")) {
+      | (0, _, _) => None
+      | (_, Some(runtimeKind), Some(component)) =>
+        Some({
+          modules,
+          runtimeKind,
+          component,
+          plugin: obj->decodeString("plugin"),
+          platform: obj->decodeString("platform"),
+        })
+      | _ =>
+        log.error(
+          ~comp="RuntimeExtension",
+          "RUNTIME_EXTENSIONS is missing runtimeKind or component; ignored",
+        )
+        None
+      }
+    }
+  }
+
+/**
+Fire every loaded extension's `onColdStart`, in the order the deploy program
+registered them, each isolated from the others (see
+`ReventlessCore.RuntimeExtension`).
+
+An unrecognised `runtimeKind` means the layer's `ComponentType` and the
+deploy-time one disagree — a framework version skew, not anything an extension
+can fix. Logged at ERROR and skipped rather than fired under a guessed kind: an
+extension that routes on kind would otherwise attach to the wrong runtime
+silently.
+*/
+let fire = (config: config, hooks: array<ReventlessCore.RuntimeExtension.coldStartHook>) =>
+  switch config.runtimeKind->ReventlessCore.ComponentType.ofString {
+  | None =>
+    log.error(
+      ~comp="RuntimeExtension",
+      `unknown runtimeKind "${config.runtimeKind}" in RUNTIME_EXTENSIONS; cold-start extensions skipped`,
+    )
+  | Some(runtimeKind) =>
+    log.debug(
+      ~comp="RuntimeExtension",
+      `firing ${hooks->Array.length->Int.toString} cold-start extension(s) for ${config.runtimeKind}(${config.component})`,
+    )
+    ReventlessCore.RuntimeExtension.notifyColdStartHooks(
+      ~hooks,
+      ~runtimeKind,
+      ~component=config.component,
+      ~plugin=config.plugin,
+      ~platform=config.platform,
+    )
+  }
+
+/**
+Report an extension module that could not be loaded, or that exports no
+`onColdStart`. The shell owns the `import()`, so it owns the failure; this keeps
+the message and level in one place with the rest of the seam's diagnostics.
+*/
+let reportLoadFailure = (~specifier: string, ~reason: string) =>
+  log.error(
+    ~comp="RuntimeExtension",
+    `cold-start extension "${specifier}" could not be loaded; skipped: ${reason}`,
+  )

package/src/adapter/Runtime/RuntimeExtensionEntryPoint_Ops.res.mjs

@@ -0,0 +1,75 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
+import * as RuntimeExtension$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/RuntimeExtension/RuntimeExtension.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function decodeString(obj, key) {
+  return Stdlib_Option.flatMap(obj[key], Stdlib_JSON.Decode.string);
+}
+
+function parseConfig(raw) {
+  if (raw === undefined) {
+    return;
+  }
+  if (raw === "") {
+    return;
+  }
+  let obj;
+  try {
+    obj = Stdlib_JSON.Decode.object(JSON.parse(raw));
+  } catch (exn) {
+    obj = undefined;
+  }
+  if (obj !== undefined) {
+    let modules = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(obj["modules"], Stdlib_JSON.Decode.array), []), Stdlib_JSON.Decode.string);
+    let match = modules.length;
+    let match$1 = decodeString(obj, "runtimeKind");
+    let match$2 = decodeString(obj, "component");
+    if (match !== 0) {
+      if (match$1 !== undefined && match$2 !== undefined) {
+        return {
+          modules: modules,
+          runtimeKind: match$1,
+          component: match$2,
+          plugin: decodeString(obj, "plugin"),
+          platform: decodeString(obj, "platform")
+        };
+      } else {
+        log.error("RuntimeExtension", undefined, "RUNTIME_EXTENSIONS is missing runtimeKind or component; ignored");
+        return;
+      }
+    } else {
+      return;
+    }
+  }
+  log.error("RuntimeExtension", undefined, "RUNTIME_EXTENSIONS is not a JSON object; ignored");
+}
+
+function fire(config, hooks) {
+  let runtimeKind = ComponentType$ReventlessCore.ofString(config.runtimeKind);
+  if (runtimeKind !== undefined) {
+    log.debug("RuntimeExtension", undefined, `firing ` + hooks.length.toString() + ` cold-start extension(s) for ` + config.runtimeKind + `(` + config.component + `)`);
+    return RuntimeExtension$ReventlessCore.notifyColdStartHooks(hooks, runtimeKind, config.component, config.plugin, config.platform);
+  } else {
+    return log.error("RuntimeExtension", undefined, `unknown runtimeKind "` + config.runtimeKind + `" in RUNTIME_EXTENSIONS; cold-start extensions skipped`);
+  }
+}
+
+function reportLoadFailure(specifier, reason) {
+  log.error("RuntimeExtension", undefined, `cold-start extension "` + specifier + `" could not be loaded; skipped: ` + reason);
+}
+
+export {
+  log,
+  decodeString,
+  parseConfig,
+  fire,
+  reportLoadFailure,
+}
+/* log Not a pure module */

package/src/adapter/Runtime/SideEffectEntryPoint.mjs

@@ -13,10 +13,16 @@
 import { Make as sideEffectHandlerCallbackMake } from "@reventlessdev/reventless-core/src/components/SideEffectHandler/SideEffectHandler_Callback.res.mjs";
 import * as StreamOps from "./StreamRoutedEntryPoint_Ops.res.mjs";
 import * as Ops from "./SideEffectEntryPoint_Ops.res.mjs";
+import { runtimeExtensionsReady } from "./HandlerFactoryHelpers.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
 
 async function buildAllHandlers() {
+  // Runtime extension seam: any registered out-of-tree extension gets its
+  // onColdStart before a single handler is built, which is what makes the
+  // framework's interception/publish hooks reachable here. No-op unless the
+  // deployment registered one.
+  await runtimeExtensionsReady;
   const handlers = {};
   const entries = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
 

package/src/adapter/Runtime/SideEffectHandlerRuntime_Builder_Single.res.mjs

@@ -118,7 +118,7 @@ function finish() {
           return;
         }
       });
-      let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/SideEffectEntryPoint.mjs", packageDirs, undefined);
+      let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/SideEffectEntryPoint.mjs", packageDirs, undefined, undefined);
       let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllSideEffectHandlers", "Reactor", "SideEffectHandler", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
       if (Object.keys(extraEnvVarsAll).length !== 0) {
         new (Aws.iam.RolePolicy)("AllSideEffectHandlers-appsyncSchemaPush", {

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -97,7 +97,7 @@ function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginNa
   });
   packageDirs["@reventlessdev/reventless-aws"] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws");
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-core");
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs", packageDirs, undefined, undefined);
   Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS$ReventlessAws.setBatchSize);
   let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
       subnetIds: pgSelection.subnetIds,

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -15,10 +15,16 @@
 
 import * as StreamOps from "./StreamRoutedEntryPoint_Ops.res.mjs";
 import * as Ops from "./StateViewSliceEntryPoint_Ops.res.mjs";
+import { runtimeExtensionsReady } from "./HandlerFactoryHelpers.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
 
 async function buildAllHandlers() {
+  // Runtime extension seam: any registered out-of-tree extension gets its
+  // onColdStart before a single handler is built, which is what makes the
+  // framework's interception/publish hooks reachable here. No-op unless the
+  // deployment registered one.
+  await runtimeExtensionsReady;
   const handlers = {};
   const entries = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
 

package/src/adapter/Runtime/StateViewSliceRuntime_Builder_Single.res.mjs

@@ -153,7 +153,7 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueu
   }
   packageDirs["@reventlessdev/reventless-aws"] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws");
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-core");
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/StateViewSliceEntryPoint.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/StateViewSliceEntryPoint.mjs", packageDirs, undefined, undefined);
   let vpcConfig = qdbSelection !== undefined ? qdbSelection.securityGroupId.apply(sgId => ({
       subnetIds: qdbSelection.subnetIds,
       securityGroupIds: [sgId]

package/src/adapter/Runtime/TaskBucketEntryPoint.mjs

@@ -13,10 +13,16 @@
 // TaskBucketEntryPoint_Ops.res.
 
 import * as Ops from "./TaskBucketEntryPoint_Ops.res.mjs";
+import { runtimeExtensionsReady } from "./HandlerFactoryHelpers.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
 
 async function buildHandler() {
+  // Runtime extension seam: any registered out-of-tree extension gets its
+  // onColdStart before a single handler is built, which is what makes the
+  // framework's interception/publish hooks reachable here. No-op unless the
+  // deployment registered one.
+  await runtimeExtensionsReady;
   const config = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
   const callbackModule = await dynamicImport(config.callbackModule);
   return Ops.makeHandler(callbackModule.callback, config);

package/src/adapter/Runtime/TaskRuntime_Builder_PerBucket.res.mjs

@@ -28,7 +28,7 @@ function forBucketCallback(param, connect, memorySizeOpt, timeoutOpt, name, call
   let packageDirs = {};
   let pkg = Util_Bundle$ReventlessAws.extractPackageName(callbackModulePath);
   packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, pkg);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/TaskBucketEntryPoint.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/TaskBucketEntryPoint.mjs", packageDirs, undefined, undefined);
   let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(fullName, "Task", "Task", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, {
     parent: resource
   });

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -207,6 +207,7 @@ let finish = (
     let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
       ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs",
       ~packageDirs,
+      ~bundleRuntimeExtensions=false,
     )
 
     let layers =

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -87,7 +87,7 @@ function finish(eventsApi, opts) {
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let appsyncEndpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(eventsApi);
   let lambda = new (Aws.lambda.Function)(name + "StateTopicPublisher", {

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -257,6 +257,7 @@ let finish = (
     let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
       ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs",
       ~packageDirs,
+      ~bundleRuntimeExtensions=false,
     )
 
     let layers =

package/src/adapter/Upload/Upload_Claim_S3.res.mjs

@@ -123,7 +123,7 @@ function finish(plugin, stores, iteratorAgeAlarmMsOpt, opts) {
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -175,6 +175,7 @@ let make = (
   let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
     ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs",
     ~packageDirs,
+    ~bundleRuntimeExtensions=false,
   )
 
   let layers =

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -92,7 +92,7 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res.mjs

@@ -65,7 +65,7 @@ function forCommandTopic(param, connect, memorySizeOpt, timeoutOpt, param$1, par
     return `{"queueUrl":"` + queueUrl + `","pluginReadModelTableName":"` + rmTable + `","schedulerRoleArn":"` + schedRoleArn + `","schedulerQueueArn":"` + schedQueueArn + `","schedulerQueueName":"` + schedQueueName + `","publishToAggregates":{` + publishToAggregatesJson + `}}`;
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs", {}, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs", {}, undefined, undefined);
   return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, "CommandHandler", "ExtensionPoint", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
 }
 

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -371,7 +371,7 @@ function Make(EventCollectorChannel) {
       let extraStringAssets = {};
       extraStringAssets["pluginDefinition.json"] = param[0];
       extraStringAssets["uiFragments.json"] = param[1];
-      return Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventCollectorEntryPoint.mjs", packageDirs, extraStringAssets);
+      return Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventCollectorEntryPoint.mjs", packageDirs, extraStringAssets, undefined);
     });
     let codeOutput = bundleOutput.apply(b => b.code);
     let sourceCodeHashOutput = bundleOutput.apply(b => b.sourceCodeHash);
@@ -486,7 +486,7 @@ function Make(EventCollectorChannel) {
     envVars["EP_QUEUE_URL"] = epQueueUrl;
     envVars["PLUGIN_ID"] = Pulumi.output(hbConfig.pluginId);
     envVars["HEARTBEAT_TIMEOUT"] = Pulumi.output(hbConfig.heartbeatTimeout.toString());
-    let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.res.mjs", {}, undefined);
+    let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.res.mjs", {}, undefined, undefined);
     connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, "Scheduler", "Scheduler", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
   };
   let forDcbCommandTopic = (param, connect, memorySizeOpt, timeoutOpt, dcbCommandTopic) => {