@reventlessdev/reventless-aws 3.0.0-alpha.271 → 3.0.0-alpha.273

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.273 (2026-08-08)
+
+### Bug Fixes
+
+* **aws:** create a Lambda's log group before the function that writes to it ([8d1e459](https://github.com/ReventlessDev/reventless-core/commit/8d1e4591127489d2ae8e84e7ade3843a1a859eb6))
+* **core:** attribute resources built after a builder's construct returns ([67d6d9c](https://github.com/ReventlessDev/reventless-core/commit/67d6d9c0ff3ff1d38cd9e8ad43a4b86121abf827))
+### Features
+
+* **aws:** adopt an existing AppSync log group instead of failing on it ([ebed6c1](https://github.com/ReventlessDev/reventless-core/commit/ebed6c1ceb77b8deebff10a9c45715c107861f04))
+* **core:** let an extension switch query interception on, and provision it ([4523b10](https://github.com/ReventlessDev/reventless-core/commit/4523b10597f1a028eedccc42391b250b25a6ddd3))
+
+
+# 3.0.0-alpha.272 (2026-08-08)
+
+### Bug Fixes
+
+* **aws:** ship the admin structure as a code asset, not an env var ([93bc8a4](https://github.com/ReventlessDev/reventless-core/commit/93bc8a4891b54efeb13b99845a96f990dea6d41c))
+
+
 # 3.0.0-alpha.271 (2026-08-08)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,27 +1,28 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.271",
+  "version": "3.0.0-alpha.273",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
     "@aws-sdk/client-appsync": "3.970.0",
     "@aws-sdk/client-cloudfront": "3.970.0",
+    "@aws-sdk/client-cloudwatch-logs": "3.970.0",
     "@aws-sdk/client-location": "3.970.0",
     "@aws-sdk/client-s3": "3.970.0",
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.4",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.2",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.66",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.216",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.67",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.2",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.128",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.217",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.80",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.128",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.81",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.102"
   },
   "devDependencies": {

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -115,14 +115,17 @@ let make = (
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
   // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook so
   // the handler's bare @aws-sdk/* specifiers resolve from the managed runtime.
-  // The admin entry is passed as an env var (ADMIN_ENTRY_JSON) rather than
-  // interpolated into the source, so the archive hash is stable across deploys.
+  // The admin entry rides the archive as `adminEntry.json` rather than an env var:
+  // it alone encodes to ~3 KB, which together with the other variables exceeds the
+  // 4096-byte UpdateFunctionConfiguration limit. Its content participates in
+  // `sourceCodeHash`, so a change to the admin structure redeploys the code.
   let packageDirs = Dict.fromArray([
     ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
   ])
   let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
     ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs",
     ~packageDirs,
+    ~extraStringAssets=Dict.fromArray([("adminEntry.json", adminEntryJson)]),
     ~bundleRuntimeExtensions=false,
   )
 
@@ -132,6 +135,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -150,30 +167,17 @@ let make = (
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
             ("OFFLOAD_BUCKET", offloadBucketName->Pulumi.Output.asInput),
-            ("ADMIN_ENTRY_JSON", adminEntryJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -75,8 +75,12 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs", packageDirs, undefined, false);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs", packageDirs, Object.fromEntries([[
+      "adminEntry.json",
+      adminEntryJson
+    ]]), false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -100,10 +104,6 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
           "OFFLOAD_BUCKET",
           offloadBucketName
         ],
-        [
-          "ADMIN_ENTRY_JSON",
-          adminEntryJson
-        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions
@@ -115,9 +115,9 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -68,17 +68,26 @@ let toEntryWith = (~filter: bool, item: dict<JSON.t>, ~name: string): option<JSO
 }
 
 
-// The built-in Platform_Admin entry, injected at deploy time as the
-// ADMIN_ENTRY_JSON env var (the admin never Connects to itself, so its structure
-// never enters the Plugin read model).
+// The built-in Platform_Admin entry, written at deploy time as an asset file in
+// the code archive (the admin never Connects to itself, so its structure never
+// enters the Plugin read model). It rides the archive rather than an env var
+// because it alone is ~3 KB and the function's variables must fit AWS's 4096-byte
+// UpdateFunctionConfiguration limit. process.cwd() is /var/task in Lambda, where
+// the archive is extracted.
 //
 // Shared by both fields. The admin structure has no Internal components and no
 // extension points, so its filtered and complete encodings carry the same
 // components; the structure-level fields the complete entry adds are absent from
 // this JSON and resolve to null, which is what `extensionPoints: None` means.
 let adminEntry: option<JSON.t> =
-  switch NodeProcess.env->Dict.get("ADMIN_ENTRY_JSON") {
-  | Some(s) if s != "" => Some(JSON.parseOrThrow(s))
+  try {
+    switch NodePath.join([NodeProcess.cwd(), "adminEntry.json"])
+    ->NodeFs.readFileSync
+    ->JSON.parseOrThrow {
+    | JSON.Null => None
+    | json => Some(json)
+    }
+  } catch {
   | _ => None
   }
 

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Nodefs from "node:fs";
 import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
+import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
@@ -50,9 +52,14 @@ function toEntryWith(filter, item, name) {
   return entry;
 }
 
-let s = process.env["ADMIN_ENTRY_JSON"];
+let adminEntry;
 
-let adminEntry = s !== undefined && s !== "" ? JSON.parse(s) : undefined;
+try {
+  let json = JSON.parse(Nodefs.readFileSync(Nodepath.join(process.cwd(), "adminEntry.json"), "utf8"));
+  adminEntry = json === null ? undefined : json;
+} catch (exn) {
+  adminEntry = undefined;
+}
 
 function resolveStructure(fetch, item) {
   let refJson = Stdlib_Option.flatMap(Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object), o => o[Offload$Reventless.sentinelKey]);
@@ -112,4 +119,4 @@ export {
   isComplete,
   handler,
 }
-/* s Not a pure module */
+/* adminEntry Not a pure module */

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -93,6 +93,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -116,23 +130,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -54,6 +54,7 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Api/Platform_UIFragments_Lambda_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -84,9 +85,9 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -125,7 +125,14 @@ let connectLambda = (
       resources->ReventlessCore.Adapter.resourcesToResolvedOutput,
     )
     ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((eventTopicResources, queueArns, resources)) => {
+    // Provisions the collector's role, policies and event-source mappings, so it
+    // carries the plugin's attribution across the apply — by the time this runs
+    // the builder's construct has returned and the ambient context is empty.
+    ->ReventlessCore.ResourceAttribution_Deploytime.applyAttributed(((
+      eventTopicResources,
+      queueArns,
+      resources,
+    )) => {
       log.debug(
         ~comp="EventCollector",
         `connectLambda ${name}: ${eventTopicResources->Array.length->Int.toString} topic resource(s), ${resources->Array.length->Int.toString} resource(s)`,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -15,6 +15,7 @@ import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as AdapterDeploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/AdapterDeploytime.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
+import * as ResourceAttribution_Deploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/ResourceAttribution_Deploytime.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -76,11 +77,11 @@ function esmTags(name, esmName) {
 }
 
 function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
-  Pulumi.all([
+  ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(Pulumi.all([
     toResources(eventTopics),
     Pulumi.all(queues.map(queue => queue.arn)),
     Adapter$ReventlessCore.resourcesToResolvedOutput(resources)
-  ]).apply(param => {
+  ]), param => {
     let resources = param[2];
     let queueArns = param[1];
     let eventTopicResources = param[0];

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver.res

@@ -118,6 +118,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -146,23 +160,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver.res.mjs

@@ -58,6 +58,7 @@ function make(api, placeIndexName, nameOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -88,9 +89,9 @@ function make(api, placeIndexName, nameOpt, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -13,15 +13,6 @@ let log = ReventlessCore.Logger.fromEnv()
 type api = Types.AppSync.api
 type role = Types.AppSync.role
 
-type interceptorConfig = {
-  dataSourceName: Pulumi.Input.t<string>,
-}
-
-/** Deploy-time config for the query interceptor. When set, all top-level Query
-    resolvers become pipeline resolvers with an interceptor Lambda function
-    preceding the DynamoDB query. Set this before calling `make`. */
-let queryInterceptorConfig: ref<option<interceptorConfig>> = ref(None)
-
 let interceptorCode = readModelName =>
   `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
@@ -106,9 +97,12 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   }
 
   // Creates either a unit resolver (no interceptor) or a pipeline resolver
-  // (interceptor Lambda → DynamoDB query) depending on queryInterceptorConfig.
+  // (interceptor Lambda → DynamoDB query), depending on whether an extension
+  // switched interception on for this deployment. Provisioning the interceptor
+  // is the framework's job — see `QueryInterceptor_Provisioning`; the first
+  // Query resolver under a plugin creates it and the rest reuse it.
   let makeQueryResolver = (~resolverName, ~field, ~code) =>
-    switch queryInterceptorConfig.contents {
+    switch QueryInterceptor_Provisioning.dataSourceName(~api, ~opts) {
     | None =>
       Resolver.makeUnitJsResolver(
         ~name=resolverName,
@@ -119,7 +113,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         ~code,
         ~opts,
       )
-    | Some({dataSourceName: interceptorDsName}) =>
+    | Some(interceptorDsName) =>
       let interceptorFn = Function.makeJs(
         ~name=resolverName ++ "Interceptor",
         ~api,

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -14,13 +14,10 @@ import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
+import * as QueryInterceptor_Provisioning$ReventlessAws from "./QueryInterceptor_Provisioning.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
-let queryInterceptorConfig = {
-  contents: undefined
-};
-
 function interceptorCode(readModelName) {
   return `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
@@ -70,11 +67,11 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
   let connectionSpec = registryEntry !== undefined ? registryEntry.connectionSpec : true;
   let makeQueryResolver = (resolverName, field, code) => {
-    let match = queryInterceptorConfig.contents;
-    if (match === undefined) {
+    let interceptorDsName = QueryInterceptor_Provisioning$ReventlessAws.dataSourceName(api, opts);
+    if (interceptorDsName === undefined) {
       return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, code, opts);
     }
-    let interceptorFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, match.dataSourceName, interceptorCode(name$1), opts);
+    let interceptorFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, interceptorDsName, interceptorCode(name$1), opts);
     let queryFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Query", api, dataSourceName, code, opts);
     return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", field, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, [
       interceptorFn,
@@ -238,7 +235,6 @@ let Resolver;
 export {
   Resolver,
   log,
-  queryInterceptorConfig,
   interceptorCode,
   internalRowRequiredAttr,
   make,

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res

@@ -0,0 +1,155 @@
+/** Provisions the query-interceptor path on AppSync, when an extension has asked
+    for it via `ReventlessCore.QueryInterception.use`.
+
+    The framework owns everything provider-shaped here — the runtime, its
+    execution role, the AppSync Lambda data source and the role that lets AppSync
+    invoke it — because all of it needs the api handle and a service role, which
+    exist only inside the plugin build. An extension supplies none of it; see the
+    seam's own docstring for why that split is the point.
+
+    **One interceptor per api, not per read model.** A data source belongs to one
+    api, so it is memoised on the api handle *by identity* — the builders thread
+    a single `api` value through every read model that resolves against it, and
+    identity is what guarantees the data source ends up attached to the very api
+    the resolver names. Keying on anything looser (the owning plugin, say) would
+    be right until one key spanned two apis, and the failure then is a resolver
+    pointing at a data source that does not exist on its api — rejected at deploy
+    time, with nothing in the message about why.
+
+    The api's *contents* are an `Output` and are unknown at
+    resolver-construction time, which is why the ambient `ResourceAttribution`
+    plugin supplies the resource NAMES instead. That is presentation, not
+    identity: a second api under one plugin gets a suffixed name rather than a
+    shared data source. Substrate built outside any plugin construct (the admin
+    read models on the platform api) is named `Platform`.
+
+    The runtime is built through `RuntimeEnvironment_Lambda.makeFromCodeAsset`
+    rather than a bespoke `Lambda.Function.make`, which is what makes the seams
+    compose: that path bundles registered runtime extensions into the archive and
+    writes `RUNTIME_EXTENSIONS`, so an extension registering its interceptor in
+    `onColdStart` reaches this runtime without a second registration. */
+
+open PulumiAws
+
+// Memoised on the api handle itself — see the module docstring for why identity
+// rather than a name. The value is the data-source name the resolver pipeline
+// references.
+let byApi: Map.t<Types.AppSync.api, Pulumi.Input.t<string>> = Map.make()
+
+// How many interceptors a given owner already named, so a second api under one
+// owner gets a distinct resource name instead of colliding with the first.
+let namesUsed: dict<int> = Dict.make()
+
+/** A stable, readable resource-name stem for the interceptor: the owning plugin,
+    or `Platform` for substrate provisioned outside any plugin construct. */
+let nameFor = () => {
+  let owner = ReventlessCore.ResourceAttribution.current.contents.plugin->Option.getOr("Platform")
+  let used = namesUsed->Dict.get(owner)->Option.getOr(0)
+  namesUsed->Dict.set(owner, used + 1)
+  used == 0
+    ? owner ++ "QueryInterceptor"
+    : owner ++ "QueryInterceptor" ++ (used + 1)->Int.toString
+}
+
+let buildInterceptor = (~api: Types.AppSync.api, ~opts) => {
+  let name = nameFor()
+  let componentOpts: Pulumi.ComponentResource.options = {
+    parent: ?(opts: Pulumi.CustomResourceOptions.t).parent,
+  }
+
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs",
+    ~packageDirs,
+  )
+
+  // Sits in front of every read, so it is sized for a decision rather than for
+  // work: small memory, short timeout. A hook that needs longer than this is
+  // doing something a read path cannot afford anyway.
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~unitKind=ReventlessCore.Monitoring.Other("QueryInterceptor"),
+    ~componentKind=ReventlessCore.ComponentType.Plugin,
+    ~code,
+    ~sourceCodeHash,
+    ~memorySize=256,
+    ~timeout=10,
+    ~opts=componentOpts,
+  )
+  let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(lambda => lambda.arn)
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Plugin,
+      ~role=Identity,
+      ~scope=Plugin,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambdaArn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      open PolicyDocument
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeInterceptor",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambdaArn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  dataSource.name->Pulumi.Output.asInput
+}
+
+/** The data source a Query resolver should put in front of its DynamoDB read, or
+    `None` when interception is off — in which case the caller builds the unit
+    resolver it always did and nothing here is provisioned. */
+let dataSourceName = (~api: Types.AppSync.api, ~opts): option<Pulumi.Input.t<string>> =>
+  if !ReventlessCore.QueryInterception.isEnabled() {
+    None
+  } else {
+    switch byApi->Map.get(api) {
+    | Some(existing) => Some(existing)
+    | None =>
+      let created = buildInterceptor(~api, ~opts)
+      byApi->Map.set(api, created)
+      Some(created)
+    }
+  }