@reventlessdev/reventless-aws 3.0.0-alpha.272 → 3.0.0-alpha.274

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.274 (2026-08-08)
+
+### Bug Fixes
+
+* **aws:** scope a managed log group by project as well as stack ([f3ea01a](https://github.com/ReventlessDev/reventless-core/commit/f3ea01a254465012becf6a27b401f10382439864))
+
+
+# 3.0.0-alpha.273 (2026-08-08)
+
+### Bug Fixes
+
+* **aws:** create a Lambda's log group before the function that writes to it ([8d1e459](https://github.com/ReventlessDev/reventless-core/commit/8d1e4591127489d2ae8e84e7ade3843a1a859eb6))
+* **core:** attribute resources built after a builder's construct returns ([67d6d9c](https://github.com/ReventlessDev/reventless-core/commit/67d6d9c0ff3ff1d38cd9e8ad43a4b86121abf827))
+### Features
+
+* **aws:** adopt an existing AppSync log group instead of failing on it ([ebed6c1](https://github.com/ReventlessDev/reventless-core/commit/ebed6c1ceb77b8deebff10a9c45715c107861f04))
+* **core:** let an extension switch query interception on, and provision it ([4523b10](https://github.com/ReventlessDev/reventless-core/commit/4523b10597f1a028eedccc42391b250b25a6ddd3))
+
+
 # 3.0.0-alpha.272 (2026-08-08)
 
 ### Bug Fixes

package/package.json

@@ -1,28 +1,29 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.272",
+  "version": "3.0.0-alpha.274",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
     "@aws-sdk/client-appsync": "3.970.0",
     "@aws-sdk/client-cloudfront": "3.970.0",
+    "@aws-sdk/client-cloudwatch-logs": "3.970.0",
     "@aws-sdk/client-location": "3.970.0",
     "@aws-sdk/client-s3": "3.970.0",
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.66",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.4",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.2",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.67",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.217",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.80",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.128",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.102",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.216"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.81",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.102"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -135,6 +135,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -159,23 +173,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -80,6 +80,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
       adminEntryJson
     ]]), false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -114,9 +115,9 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -93,6 +93,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -116,23 +130,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -54,6 +54,7 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Api/Platform_UIFragments_Lambda_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -84,9 +85,9 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -125,7 +125,14 @@ let connectLambda = (
       resources->ReventlessCore.Adapter.resourcesToResolvedOutput,
     )
     ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((eventTopicResources, queueArns, resources)) => {
+    // Provisions the collector's role, policies and event-source mappings, so it
+    // carries the plugin's attribution across the apply — by the time this runs
+    // the builder's construct has returned and the ambient context is empty.
+    ->ReventlessCore.ResourceAttribution_Deploytime.applyAttributed(((
+      eventTopicResources,
+      queueArns,
+      resources,
+    )) => {
       log.debug(
         ~comp="EventCollector",
         `connectLambda ${name}: ${eventTopicResources->Array.length->Int.toString} topic resource(s), ${resources->Array.length->Int.toString} resource(s)`,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -15,6 +15,7 @@ import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as AdapterDeploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/AdapterDeploytime.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
+import * as ResourceAttribution_Deploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/ResourceAttribution_Deploytime.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -76,11 +77,11 @@ function esmTags(name, esmName) {
 }
 
 function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
-  Pulumi.all([
+  ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(Pulumi.all([
     toResources(eventTopics),
     Pulumi.all(queues.map(queue => queue.arn)),
     Adapter$ReventlessCore.resourcesToResolvedOutput(resources)
-  ]).apply(param => {
+  ]), param => {
     let resources = param[2];
     let queueArns = param[1];
     let eventTopicResources = param[0];

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver.res

@@ -118,6 +118,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -146,23 +160,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver.res.mjs

@@ -58,6 +58,7 @@ function make(api, placeIndexName, nameOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -88,9 +89,9 @@ function make(api, placeIndexName, nameOpt, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -13,15 +13,6 @@ let log = ReventlessCore.Logger.fromEnv()
 type api = Types.AppSync.api
 type role = Types.AppSync.role
 
-type interceptorConfig = {
-  dataSourceName: Pulumi.Input.t<string>,
-}
-
-/** Deploy-time config for the query interceptor. When set, all top-level Query
-    resolvers become pipeline resolvers with an interceptor Lambda function
-    preceding the DynamoDB query. Set this before calling `make`. */
-let queryInterceptorConfig: ref<option<interceptorConfig>> = ref(None)
-
 let interceptorCode = readModelName =>
   `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
@@ -106,9 +97,12 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   }
 
   // Creates either a unit resolver (no interceptor) or a pipeline resolver
-  // (interceptor Lambda → DynamoDB query) depending on queryInterceptorConfig.
+  // (interceptor Lambda → DynamoDB query), depending on whether an extension
+  // switched interception on for this deployment. Provisioning the interceptor
+  // is the framework's job — see `QueryInterceptor_Provisioning`; the first
+  // Query resolver under a plugin creates it and the rest reuse it.
   let makeQueryResolver = (~resolverName, ~field, ~code) =>
-    switch queryInterceptorConfig.contents {
+    switch QueryInterceptor_Provisioning.dataSourceName(~api, ~opts) {
     | None =>
       Resolver.makeUnitJsResolver(
         ~name=resolverName,
@@ -119,7 +113,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         ~code,
         ~opts,
       )
-    | Some({dataSourceName: interceptorDsName}) =>
+    | Some(interceptorDsName) =>
       let interceptorFn = Function.makeJs(
         ~name=resolverName ++ "Interceptor",
         ~api,

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -14,13 +14,10 @@ import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
+import * as QueryInterceptor_Provisioning$ReventlessAws from "./QueryInterceptor_Provisioning.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
-let queryInterceptorConfig = {
-  contents: undefined
-};
-
 function interceptorCode(readModelName) {
   return `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
@@ -70,11 +67,11 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
   let connectionSpec = registryEntry !== undefined ? registryEntry.connectionSpec : true;
   let makeQueryResolver = (resolverName, field, code) => {
-    let match = queryInterceptorConfig.contents;
-    if (match === undefined) {
+    let interceptorDsName = QueryInterceptor_Provisioning$ReventlessAws.dataSourceName(api, opts);
+    if (interceptorDsName === undefined) {
       return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, code, opts);
     }
-    let interceptorFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, match.dataSourceName, interceptorCode(name$1), opts);
+    let interceptorFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, interceptorDsName, interceptorCode(name$1), opts);
     let queryFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Query", api, dataSourceName, code, opts);
     return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", field, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, [
       interceptorFn,
@@ -238,7 +235,6 @@ let Resolver;
 export {
   Resolver,
   log,
-  queryInterceptorConfig,
   interceptorCode,
   internalRowRequiredAttr,
   make,

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res

@@ -0,0 +1,155 @@
+/** Provisions the query-interceptor path on AppSync, when an extension has asked
+    for it via `ReventlessCore.QueryInterception.use`.
+
+    The framework owns everything provider-shaped here — the runtime, its
+    execution role, the AppSync Lambda data source and the role that lets AppSync
+    invoke it — because all of it needs the api handle and a service role, which
+    exist only inside the plugin build. An extension supplies none of it; see the
+    seam's own docstring for why that split is the point.
+
+    **One interceptor per api, not per read model.** A data source belongs to one
+    api, so it is memoised on the api handle *by identity* — the builders thread
+    a single `api` value through every read model that resolves against it, and
+    identity is what guarantees the data source ends up attached to the very api
+    the resolver names. Keying on anything looser (the owning plugin, say) would
+    be right until one key spanned two apis, and the failure then is a resolver
+    pointing at a data source that does not exist on its api — rejected at deploy
+    time, with nothing in the message about why.
+
+    The api's *contents* are an `Output` and are unknown at
+    resolver-construction time, which is why the ambient `ResourceAttribution`
+    plugin supplies the resource NAMES instead. That is presentation, not
+    identity: a second api under one plugin gets a suffixed name rather than a
+    shared data source. Substrate built outside any plugin construct (the admin
+    read models on the platform api) is named `Platform`.
+
+    The runtime is built through `RuntimeEnvironment_Lambda.makeFromCodeAsset`
+    rather than a bespoke `Lambda.Function.make`, which is what makes the seams
+    compose: that path bundles registered runtime extensions into the archive and
+    writes `RUNTIME_EXTENSIONS`, so an extension registering its interceptor in
+    `onColdStart` reaches this runtime without a second registration. */
+
+open PulumiAws
+
+// Memoised on the api handle itself — see the module docstring for why identity
+// rather than a name. The value is the data-source name the resolver pipeline
+// references.
+let byApi: Map.t<Types.AppSync.api, Pulumi.Input.t<string>> = Map.make()
+
+// How many interceptors a given owner already named, so a second api under one
+// owner gets a distinct resource name instead of colliding with the first.
+let namesUsed: dict<int> = Dict.make()
+
+/** A stable, readable resource-name stem for the interceptor: the owning plugin,
+    or `Platform` for substrate provisioned outside any plugin construct. */
+let nameFor = () => {
+  let owner = ReventlessCore.ResourceAttribution.current.contents.plugin->Option.getOr("Platform")
+  let used = namesUsed->Dict.get(owner)->Option.getOr(0)
+  namesUsed->Dict.set(owner, used + 1)
+  used == 0
+    ? owner ++ "QueryInterceptor"
+    : owner ++ "QueryInterceptor" ++ (used + 1)->Int.toString
+}
+
+let buildInterceptor = (~api: Types.AppSync.api, ~opts) => {
+  let name = nameFor()
+  let componentOpts: Pulumi.ComponentResource.options = {
+    parent: ?(opts: Pulumi.CustomResourceOptions.t).parent,
+  }
+
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs",
+    ~packageDirs,
+  )
+
+  // Sits in front of every read, so it is sized for a decision rather than for
+  // work: small memory, short timeout. A hook that needs longer than this is
+  // doing something a read path cannot afford anyway.
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~unitKind=ReventlessCore.Monitoring.Other("QueryInterceptor"),
+    ~componentKind=ReventlessCore.ComponentType.Plugin,
+    ~code,
+    ~sourceCodeHash,
+    ~memorySize=256,
+    ~timeout=10,
+    ~opts=componentOpts,
+  )
+  let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(lambda => lambda.arn)
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Plugin,
+      ~role=Identity,
+      ~scope=Plugin,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambdaArn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      open PolicyDocument
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeInterceptor",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambdaArn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  dataSource.name->Pulumi.Output.asInput
+}
+
+/** The data source a Query resolver should put in front of its DynamoDB read, or
+    `None` when interception is off — in which case the caller builds the unit
+    resolver it always did and nothing here is provisioned. */
+let dataSourceName = (~api: Types.AppSync.api, ~opts): option<Pulumi.Input.t<string>> =>
+  if !ReventlessCore.QueryInterception.isEnabled() {
+    None
+  } else {
+    switch byApi->Map.get(api) {
+    | Some(existing) => Some(existing)
+    | None =>
+      let created = buildInterceptor(~api, ~opts)
+      byApi->Map.set(api, created)
+      Some(created)
+    }
+  }

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res.mjs

@@ -0,0 +1,92 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as QueryInterception$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/QueryInterception/QueryInterception.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+let byApi = new Map();
+
+let namesUsed = {};
+
+function nameFor() {
+  let owner = Stdlib_Option.getOr(ResourceAttribution$ReventlessCore.current.contents.plugin, "Platform");
+  let used = Stdlib_Option.getOr(namesUsed[owner], 0);
+  namesUsed[owner] = used + 1 | 0;
+  if (used === 0) {
+    return owner + "QueryInterceptor";
+  } else {
+    return owner + "QueryInterceptor" + (used + 1 | 0).toString();
+  }
+}
+
+function buildInterceptor(api, opts) {
+  let name = nameFor();
+  let componentOpts_parent = opts.parent;
+  let componentOpts = {
+    parent: componentOpts_parent
+  };
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs", packageDirs, undefined, undefined);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, {
+    TAG: "Other",
+    _0: "QueryInterceptor"
+  }, "Plugin", match.code, match.sourceCodeHash, undefined, 256, 10, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, lambda => lambda.arn);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Plugin", "Identity", "Plugin", undefined, undefined, undefined, undefined), opts);
+  Pulumi.all([
+    lambdaArn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeInterceptor",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts);
+  });
+  return new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambdaArn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts).name;
+}
+
+function dataSourceName(api, opts) {
+  if (!QueryInterception$ReventlessCore.isEnabled()) {
+    return;
+  }
+  let existing = byApi.get(api);
+  if (existing !== undefined) {
+    return existing;
+  }
+  let created = buildInterceptor(api, opts);
+  byApi.set(api, created);
+  return created;
+}
+
+export {
+  byApi,
+  namesUsed,
+  nameFor,
+  buildInterceptor,
+  dataSourceName,
+}
+/* byApi Not a pure module */