@reventlessdev/reventless-aws 3.0.0-alpha.278 → 3.0.0-alpha.280

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.280 (2026-08-10)
+
+### Bug Fixes
+
+* **aws:** keep the interceptor data source out of an option ([d908126](https://github.com/ReventlessDev/reventless-core/commit/d90812626d64b5c408c8185ac58a63db448e4082))
+
+
+# 3.0.0-alpha.279 (2026-08-10)
+
+### Bug Fixes
+
+* **aws:** load runtime extensions in the query interceptor, not just in entry shells ([d686407](https://github.com/ReventlessDev/reventless-core/commit/d686407239136c7370f5200c45b462109f94fdbe))
+* **aws:** stop an unknown view table from deleting the collector's ESMs ([569e0b9](https://github.com/ReventlessDev/reventless-core/commit/569e0b9c86adca4286d82286ca58e096e62ffee5))
+### Features
+
+* **aws:** admit non-read-model tables to the state-topic relay ([9f7084f](https://github.com/ReventlessDev/reventless-core/commit/9f7084f4eb4040cafaead1c27044ae99e703dd97))
+* **aws:** route every top-level Query field through the interceptor, not only the generated ones ([db709a9](https://github.com/ReventlessDev/reventless-core/commit/db709a9bf2f665642b5d48ef4a83e18978e9d9d7))
+
+
 # 3.0.0-alpha.278 (2026-08-09)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.278",
+  "version": "3.0.0-alpha.280",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,17 +12,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.6",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.3",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.6",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.3",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.69",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.221",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.222",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.132",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.85",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.86",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.106"
   },
   "devDependencies": {

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -118,21 +118,29 @@ let connectLambda = (
   resources: array<ReventlessInfra.Adapter.resource>,
   opts: Pulumi.CustomResourceOptions.t,
 ) => {
-  let _ =
-    (
-      eventTopics->toResources,
-      queues->Array.map(queue => queue.arn)->Pulumi.Output.all,
-      resources->ReventlessCore.Adapter.resourcesToResolvedOutput,
-    )
+  // The three input sets are resolved SEPARATELY, and each resource is gated on
+  // the narrowest one it actually needs.
+  //
+  // They used to share one `Pulumi.Output.all3` apply that created the role policy
+  // and every EventSourceMapping. An apply whose inputs are unknown does not run
+  // during preview, and a resource the program never registers reads as a DELETE —
+  // so an unknown in ANY of the three deleted ALL of them, including mappings that
+  // do not depend on it. `targetResources` (the collector's own view tables) is the
+  // one that goes unknown in practice: switching a plugin's slices to the stream
+  // builder gives each view table a computed `streamArn`, which Pulumi cannot know
+  // in the preview that enables it, so the plugin's event-log mapping and role
+  // policy — neither of which reads a view table — vanished from that preview.
+  let eventTopicResourcesOutput = eventTopics->toResources
+  let queueArnsOutput = queues->Array.map(queue => queue.arn)->Pulumi.Output.all
+  let targetResourcesOutput = resources->ReventlessCore.Adapter.resourcesToResolvedOutput
+
+  // Only the policy DOCUMENT needs all three. The RolePolicy resource itself is
+  // registered at top level with the document as an Output input, so an unknown
+  // input previews as "update, value unknown" instead of removing the policy.
+  let lambdaPolicyJson =
+    (eventTopicResourcesOutput, queueArnsOutput, targetResourcesOutput)
     ->Pulumi.Output.all3
-    // Provisions the collector's role, policies and event-source mappings, so it
-    // carries the plugin's attribution across the apply — by the time this runs
-    // the builder's construct has returned and the ambient context is empty.
-    ->ReventlessCore.ResourceAttribution_Deploytime.applyAttributed(((
-      eventTopicResources,
-      queueArns,
-      resources,
-    )) => {
+    ->Pulumi.Output.flatMap(((eventTopicResources, queueArns, resources)) => {
       log.debug(
         ~comp="EventCollector",
         `connectLambda ${name}: ${eventTopicResources->Array.length->Int.toString} topic resource(s), ${resources->Array.length->Int.toString} resource(s)`,
@@ -246,27 +254,42 @@ let connectLambda = (
             )
           : None
 
-      let _lambdaPolicy = PulumiAws.IAM.RolePolicy.make(
-        ~name,
-        ~args={
-          policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
-            name ++ "LambdaPolicy",
-            [
-              Some(PulumiAws.Lambda.defaultLoggingPolicyDocument),
-              allowLambdaReceiveSQS,
-              allowLambdaReadDynamoDbStream,
-              allowLambdaReadWriteDynamoDb,
-              allowLambdaPublishSNS,
-              allowLambdaSendSQS,
-            ]->Array.keepSome,
-          )->Pulumi.Output.asInput,
-          role: lambdaRole.id->Pulumi.Output.asInput,
-        },
-        ~opts,
+      PulumiAws.PolicyDocument.mergePolicyDocuments(
+        name ++ "LambdaPolicy",
+        [
+          Some(PulumiAws.Lambda.defaultLoggingPolicyDocument),
+          allowLambdaReceiveSQS,
+          allowLambdaReadDynamoDbStream,
+          allowLambdaReadWriteDynamoDb,
+          allowLambdaPublishSNS,
+          allowLambdaSendSQS,
+        ]->Array.keepSome,
       )
+    })
 
-      let _eventSourceMappings =
-        dynamoDbStreamResources->Array.map(dynamoDbStreamResource =>
+  let _lambdaPolicy = PulumiAws.IAM.RolePolicy.make(
+    ~name,
+    ~args={
+      policy: lambdaPolicyJson->Pulumi.Output.asInput,
+      role: lambdaRole.id->Pulumi.Output.asInput,
+    },
+    ~opts,
+  )
+
+  // The mappings read nothing but the event topics, so that is all they wait for.
+  // They cannot be hoisted out of an apply the way the policy can: an ESM's Pulumi
+  // name is derived from the resolved source name, so a brand-new event log still
+  // previews without them — inherent, and no longer reachable from a view table.
+  //
+  // Attribution is captured at THIS call, not inside the callback: by the time an
+  // apply runs, the builder's construct has returned and the ambient context is
+  // empty. (The top-level policy above is created while it is still ambient.)
+  let _ =
+    eventTopicResourcesOutput->ReventlessCore.ResourceAttribution_Deploytime.applyAttributed(
+      eventTopicResources =>
+        eventTopicResources
+        ->dynamoDbStreamResources
+        ->Array.map(dynamoDbStreamResource =>
           Util_EventSourceMapping.subscribe(
             ~lambda,
             ~targetName=name,
@@ -278,8 +301,8 @@ let connectLambda = (
             ),
             ~opts,
           )
-        )
-    })
+        ),
+    )
 
   let subscriptionResources = queues->Array.mapWithIndex((queue, idx) => {
     let esmName = queues->Array.length > 1 ? `${name}Sqs${Int.toString(idx)}` : name

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -77,10 +78,13 @@ function esmTags(name, esmName) {
 }
 
 function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
-  ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(Pulumi.all([
-    toResources(eventTopics),
-    Pulumi.all(queues.map(queue => queue.arn)),
-    Adapter$ReventlessCore.resourcesToResolvedOutput(resources)
+  let eventTopicResourcesOutput = toResources(eventTopics);
+  let queueArnsOutput = Pulumi.all(queues.map(queue => queue.arn));
+  let targetResourcesOutput = Adapter$ReventlessCore.resourcesToResolvedOutput(resources);
+  let lambdaPolicyJson = Output$Pulumi.flatMap(Pulumi.all([
+    eventTopicResourcesOutput,
+    queueArnsOutput,
+    targetResourcesOutput
   ]), param => {
     let resources = param[2];
     let queueArns = param[1];
@@ -138,19 +142,20 @@ function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources,
           ],
           Resource: queueArns
         }]) : undefined;
-    new (Aws.iam.RolePolicy)(name, {
-      policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "LambdaPolicy", Stdlib_Array.keepSome([
-        Lambda$PulumiAws.defaultLoggingPolicyDocument,
-        allowLambdaReceiveSQS,
-        allowLambdaReadDynamoDbStream,
-        allowLambdaReadWriteDynamoDb,
-        allowLambdaPublishSNS,
-        allowLambdaSendSQS
-      ])),
-      role: lambdaRole.id
-    }, opts);
-    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), esmTags(name, Util$ReventlessCore.baseName(dynamoDbStreamResource.name) + ("2" + name)), opts));
+    return PolicyDocument$PulumiAws.mergePolicyDocuments(name + "LambdaPolicy", Stdlib_Array.keepSome([
+      Lambda$PulumiAws.defaultLoggingPolicyDocument,
+      allowLambdaReceiveSQS,
+      allowLambdaReadDynamoDbStream,
+      allowLambdaReadWriteDynamoDb,
+      allowLambdaPublishSNS,
+      allowLambdaSendSQS
+    ]));
   });
+  new (Aws.iam.RolePolicy)(name, {
+    policy: lambdaPolicyJson,
+    role: lambdaRole.id
+  }, opts);
+  ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(eventTopicResourcesOutput, eventTopicResources => Adapter_Helpers$ReventlessAws.dynamoDbStreamResources(eventTopicResources).map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), esmTags(name, Util$ReventlessCore.baseName(dynamoDbStreamResource.name) + ("2" + name)), opts)));
   return queues.map((queue, idx) => {
     let esmName = queues.length > 1 ? name + `Sqs` + idx.toString() : name;
     return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, esmTags(name, esmName), opts);

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -96,13 +96,38 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   | None => true
   }
 
+  // The interceptor step for one Query resolver, or `None` when this deployment
+  // did not switch interception on. Provisioning it is the framework's job — see
+  // `QueryInterceptor_Provisioning`; the first Query resolver under a plugin
+  // creates the data source and the rest reuse it.
+  //
+  // **Every top-level Query field on this read model gets one when interception
+  // is on, whatever its access path.** The hook reports `readModelName`, so all
+  // of them resolve the SAME read model and a consumer counting resolutions must
+  // see all of them or its number is a function of which access paths a model
+  // happens to expose — two models with identical traffic would report different
+  // totals because one is queried through an index. A partial pipeline here would
+  // make that skew invisible rather than absent.
+  let interceptorFunction = (~resolverName) =>
+    switch QueryInterceptor_Provisioning.dataSourceName(~api, ~opts) {
+    | Off => None
+    | On(interceptorDsName) =>
+      Some(
+        Function.makeJs(
+          ~name=resolverName ++ "Interceptor",
+          ~api,
+          ~dataSource=interceptorDsName,
+          ~code=interceptorCode(name),
+          ~opts,
+        ),
+      )
+    }
+
   // Creates either a unit resolver (no interceptor) or a pipeline resolver
-  // (interceptor Lambda → DynamoDB query), depending on whether an extension
-  // switched interception on for this deployment. Provisioning the interceptor
-  // is the framework's job — see `QueryInterceptor_Provisioning`; the first
-  // Query resolver under a plugin creates it and the rest reuse it.
+  // (interceptor Lambda → DynamoDB query), for the Query fields that have no
+  // second step of their own.
   let makeQueryResolver = (~resolverName, ~field, ~code) =>
-    switch QueryInterceptor_Provisioning.dataSourceName(~api, ~opts) {
+    switch interceptorFunction(~resolverName) {
     | None =>
       Resolver.makeUnitJsResolver(
         ~name=resolverName,
@@ -113,14 +138,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         ~code,
         ~opts,
       )
-    | Some(interceptorDsName) =>
-      let interceptorFn = Function.makeJs(
-        ~name=resolverName ++ "Interceptor",
-        ~api,
-        ~dataSource=interceptorDsName,
-        ~code=interceptorCode(name),
-        ~opts,
-      )
+    | Some(interceptorFn) =>
       let queryFn = Function.makeJs(
         ~name=resolverName ++ "Query",
         ~api,
@@ -258,18 +276,14 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       let idField = indexConfig.idField->Option.getOr(index)
       switch indexConfig.authorization {
       | None =>
-        Resolver.makeUnitJsResolver(
-          ~name=resolverName,
-          ~api,
-          ~dataSourceName,
-          ~type_="Query"->Pulumi.Input.make,
+        makeQueryResolver(
+          ~resolverName,
           ~field=fieldName->Pulumi.Input.make,
           ~code=switch indexConfig.subIdField {
           | Some(sortField) =>
             Resolver.Functions.queryByIndexSortFiltered(~index, ~idField, ~sortField)
           | None => Resolver.Functions.queryByIndexFiltered(~index, ~idField)
           },
-          ~opts,
         )
       | Some({tableName, group}) =>
         let authDataSource = DataSource.makeDynamoDBDataSourceWithTableName(
@@ -297,13 +311,25 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~code=Resolver.Functions.queryByIndexFiltered(~index, ~idField),
           ~opts,
         )
+        // The interceptor leads the chain, as it does in every other Query
+        // pipeline. That position means an attempt refused by the row-level index
+        // authorization below has still been counted — the same "attempts, not
+        // outcomes" bound the hook has everywhere, since it fires before the read
+        // and never learns how it ended. Putting it after the auth step would buy
+        // outcome-accurate counts and cost the property that matters more: the
+        // interceptor is the one place a read can be REFUSED, so it has to be
+        // reachable before the pipeline spends a second table read deciding
+        // whether this caller may use the index.
         Resolver.makePipelineJsResolver(
           ~name=resolverName,
           ~api,
           ~type_="Query"->Pulumi.Input.make,
           ~field=fieldName->Pulumi.Input.make,
           ~code=Resolver.Functions.pipelinePassThrough,
-          ~functions=[authFunction, queryFunction],
+          ~functions=switch interceptorFunction(~resolverName) {
+          | None => [authFunction, queryFunction]
+          | Some(interceptorFn) => [interceptorFn, authFunction, queryFunction]
+          },
           ~opts,
         )
       }

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -66,12 +66,19 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   let fieldNameForSingle = registryEntry !== undefined ? registryEntry.singleFieldName : AppSync_Resolver_Functions$PulumiAws.uncapitalize(name$1);
   let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
   let connectionSpec = registryEntry !== undefined ? registryEntry.connectionSpec : true;
-  let makeQueryResolver = (resolverName, field, code) => {
+  let interceptorFunction = resolverName => {
     let interceptorDsName = QueryInterceptor_Provisioning$ReventlessAws.dataSourceName(api, opts);
-    if (interceptorDsName === undefined) {
+    if (typeof interceptorDsName !== "object") {
+      return;
+    } else {
+      return AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, interceptorDsName._0, interceptorCode(name$1), opts);
+    }
+  };
+  let makeQueryResolver = (resolverName, field, code) => {
+    let interceptorFn = interceptorFunction(resolverName);
+    if (interceptorFn === undefined) {
       return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, code, opts);
     }
-    let interceptorFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Interceptor", api, interceptorDsName, interceptorCode(name$1), opts);
     let queryFn = AppSync_Function$PulumiAws.makeJs(resolverName + "Query", api, dataSourceName, code, opts);
     return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", field, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, [
       interceptorFn,
@@ -117,13 +124,18 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
         let authDataSource = AppSync_DataSource$PulumiAws.makeDynamoDBDataSourceWithTableName(resolverName + "Auth", api, Util_DynamoDb$ReventlessAws.findResource(Util_QueryDb$ReventlessCore.getLocalStorageResources(allQueryDbs, match.tableName)).name, apiRole, opts);
         let authFunction = AppSync_Function$PulumiAws.makeJs(resolverName + "Auth", api, authDataSource.name, AppSync_Resolver_Functions$PulumiAws.authorizeIndexedAccess(index, match.group), opts);
         let queryFunction = AppSync_Function$PulumiAws.makeJs(resolverName, api, dataSourceName, AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField), opts);
-        return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", fieldName, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, [
-          authFunction,
-          queryFunction
-        ], opts);
+        let interceptorFn = interceptorFunction(resolverName);
+        return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", fieldName, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, interceptorFn !== undefined ? [
+            interceptorFn,
+            authFunction,
+            queryFunction
+          ] : [
+            authFunction,
+            queryFunction
+          ], opts);
       }
       let sortField = indexConfig.subIdField;
-      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", fieldName, sortField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered(index, idField, sortField) : AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField), opts);
+      return makeQueryResolver(resolverName, fieldName, sortField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered(index, idField, sortField) : AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField));
     });
     let storageResource = (pluginName, tableName) => Adapter$ReventlessCore.outputToResource(Util_DynamoDb$ReventlessAws.findResourceInOutput(Plugin_Helpers$ReventlessCore.getStorageResources(allQueryDbs, pluginName, tableName)));
     let generateCode = (storageResource, template) => storageResource.name.apply(realTableName => template(realTableName));

package/src/adapter/QueryDb/QueryInterceptor_Lambda.res

@@ -1,10 +1,31 @@
+// The runtime that `QueryInterception.use` puts in front of every DynamoDB-backed
+// Query resolver — one pipeline step whose only job is to consult the hook.
+//
+// The hook is a module-level `ref`, and in a deployed runtime the only thing that
+// ever fills it is a `RuntimeExtension`'s `onColdStart`. Every other runtime
+// reaches those through a compiled entry shell that awaits `runtimeExtensionsReady`
+// before it serves anything; this handler is not built by a shell, so it awaits
+// the same promise itself. Without it the extensions the archive already carries
+// are never imported, the hook stays `None`, and interception degrades to a
+// passthrough that costs an invocation on every read and observes nothing — the
+// one failure mode this path cannot afford, because it is silent and its whole
+// price has already been paid.
+//
+// Awaited from the small module rather than from `HandlerFactoryHelpers`, which
+// re-exports the same binding behind the Effect runtime and the DynamoDB clients:
+// this runtime is sized for a decision, not for work.
+
 type payload = {
   readModelName: string,
   arguments: JSON.t,
   identity: Reventless.Identity.t,
 }
 
+@module("../Runtime/RuntimeExtensionsReady.mjs")
+external runtimeExtensionsReady: promise<unit> = "runtimeExtensionsReady"
+
 let handler = async (event: payload, _context) => {
+  await runtimeExtensionsReady
   switch ReventlessCore.QueryDb_Callback.queryInterceptorHook.contents {
   | None => true
   | Some(interceptor) =>

package/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs

@@ -2,8 +2,12 @@
 
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
+import * as RuntimeExtensionsReadyMjs from "../Runtime/RuntimeExtensionsReady.mjs";
+
+let runtimeExtensionsReady = RuntimeExtensionsReadyMjs.runtimeExtensionsReady;
 
 async function handler(event, _context) {
+  await runtimeExtensionsReady;
   let interceptor = QueryDb_Callback$ReventlessCore.queryInterceptorHook.contents;
   if (interceptor === undefined) {
     return true;
@@ -17,6 +21,7 @@ async function handler(event, _context) {
 }
 
 export {
+  runtimeExtensionsReady,
   handler,
 }
-/* No side effect */
+/* runtimeExtensionsReady Not a pure module */

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res

@@ -138,18 +138,34 @@ let buildInterceptor = (~api: Types.AppSync.api, ~opts) => {
   dataSource.name->Pulumi.Output.asInput
 }
 
-/** The data source a Query resolver should put in front of its DynamoDB read, or
-    `None` when interception is off — in which case the caller builds the unit
-    resolver it always did and nothing here is provisioned. */
-let dataSourceName = (~api: Types.AppSync.api, ~opts): option<Pulumi.Input.t<string>> =>
+/** Whether a Query resolver fronts its DynamoDB read with the interceptor, and
+    the data source to front it with. `Off` means interception is switched off —
+    the caller builds the unit resolver it always did and nothing here is
+    provisioned.
+
+    A variant rather than an `option`, and that is load-bearing. The payload is a
+    Pulumi `Output`, which is a JS `Proxy` answering *every* property read with a
+    derived `Output`. The generic option runtime unwraps by probing the payload
+    for `BS_PRIVATE_NESTED_SOME_NONE`; on a `Proxy` that probe never reads
+    `undefined`, so it takes the nested-option branch and yields a wrapper object
+    where a data-source name belongs. AppSync then rejects the resource with
+    "Attribute must be a single value, not a map" — at deploy time, naming a
+    field the source never mentions. A variant keeps that runtime off the path
+    entirely, so no caller can reintroduce the fault by reaching for
+    `Option.map`. */
+type t =
+  | Off
+  | On(Pulumi.Input.t<string>)
+
+let dataSourceName = (~api: Types.AppSync.api, ~opts): t =>
   if !ReventlessCore.QueryInterception.isEnabled() {
-    None
+    Off
   } else {
     switch byApi->Map.get(api) {
-    | Some(existing) => Some(existing)
+    | Some(existing) => On(existing)
     | None =>
       let created = buildInterceptor(~api, ~opts)
       byApi->Map.set(api, created)
-      Some(created)
+      On(created)
     }
   }

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res.mjs

@@ -71,15 +71,21 @@ function buildInterceptor(api, opts) {
 
 function dataSourceName(api, opts) {
   if (!QueryInterception$ReventlessCore.isEnabled()) {
-    return;
+    return "Off";
   }
   let existing = byApi.get(api);
   if (existing !== undefined) {
-    return existing;
+    return {
+      TAG: "On",
+      _0: existing
+    };
   }
   let created = buildInterceptor(api, opts);
   byApi.set(api, created);
-  return created;
+  return {
+    TAG: "On",
+    _0: created
+  };
 }
 
 export {

package/src/adapter/Runtime/HandlerFactoryHelpers.mjs

@@ -8,11 +8,11 @@ import {
 } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
-import {
-  parseConfig as parseRuntimeExtensionConfig,
-  fire as fireRuntimeExtensions,
-  reportLoadFailure as reportRuntimeExtensionLoadFailure,
-} from "./RuntimeExtensionEntryPoint_Ops.res.mjs";
+
+// Re-exported, not defined here: the seam must fire once per process, and a
+// runtime too small to want this module's other imports awaits the same binding
+// straight from its own module. See RuntimeExtensionsReady.mjs.
+export { runtimeExtensionsReady } from "./RuntimeExtensionsReady.mjs";
 
 // ─── Structured logging from the .mjs entry-point shims ─────────────────────
 // Mirrors ReScript's Logger.t API and Logger.emit's JSON sink shape (time,
@@ -197,48 +197,6 @@ export function extractRetryCount(records) {
   return Number.isFinite(count) && count > 0 ? count : 1;
 }
 
-// ─── Runtime extension cold start ───────────────────────────────────────────
-// Extension packages are bundled into the code archive next to the spec and
-// behavior packages, so they resolve from /var/task/node_modules by the same
-// absolute path every shell uses for user modules.
-const dynamicImport = (specifier) => import("/var/task/node_modules/" + specifier);
-
-// The framework ships four runtime callback hooks (command interception, query
-// interception, before/after publish) whose registrars are module-level refs.
-// They are only reachable if something calls them in this process before the
-// first request, and the entry shells import framework and domain modules only —
-// so an out-of-tree extension had no way in. RUNTIME_EXTENSIONS closes that: it
-// names the extension modules the archive carries (see
-// ReventlessCore.RuntimeExtension and Util_Bundle.addRuntimeExtensionPackages),
-// and each one's `onColdStart` runs here, once, before any handler is built.
-//
-// This is the seam's one untyped step: the modules are named at deploy time and
-// their types are unknowable here. Parsing and invocation live in the typed
-// RuntimeExtensionEntryPoint_Ops.res, so the call's arity is compiler-checked.
-//
-// Started at module load and exported as a promise every entry shell awaits in
-// its own cold-start init — that is what makes "before the first request" a fact
-// rather than a hope, and it holds for the shells that build handlers lazily.
-// Absent env var ⇒ resolves immediately, having done nothing.
-export const runtimeExtensionsReady = (async () => {
-  const config = parseRuntimeExtensionConfig(process.env["RUNTIME_EXTENSIONS"]);
-  if (config === undefined) return;
-  const hooks = [];
-  for (const specifier of config.modules) {
-    try {
-      const mod = await dynamicImport(specifier);
-      if (typeof mod.onColdStart === "function") {
-        hooks.push(mod.onColdStart);
-      } else {
-        reportRuntimeExtensionLoadFailure(specifier, "module exports no onColdStart function");
-      }
-    } catch (err) {
-      reportRuntimeExtensionLoadFailure(specifier, err?.message ?? String(err));
-    }
-  }
-  fireRuntimeExtensions(config, hooks);
-})();
-
 // Patch a spec module's Id field to use IdString if undefined.
 // Workaround for `module Id = Id.String` not producing an ESM export.
 export const patchSpecId = (specModule) => ({ ...specModule, Id: specModule.Id || IdString });

package/src/adapter/Runtime/RuntimeExtensionsReady.mjs

@@ -0,0 +1,59 @@
+// The runtime-extension cold start, on its own so a runtime can await it without
+// pulling the rest of the entry-point toolkit in behind it.
+//
+// It lived in HandlerFactoryHelpers because every compiled entry shell wants it
+// alongside the Effect runtime, the DynamoDB clients and the logging shims it
+// already imports from there. The query interceptor is the first runtime that
+// wants ONLY this: it sits in front of every read and is sized for a decision
+// rather than for work, so paying that whole import graph on each cold start to
+// reach one promise is the wrong trade.
+//
+// A module-level singleton, which is why HandlerFactoryHelpers re-exports this
+// binding rather than keeping a copy: two definitions would fire the seam twice
+// in any runtime that reached both.
+
+import {
+  parseConfig as parseRuntimeExtensionConfig,
+  fire as fireRuntimeExtensions,
+  reportLoadFailure as reportRuntimeExtensionLoadFailure,
+} from "./RuntimeExtensionEntryPoint_Ops.res.mjs";
+
+// Extension packages ride in the code archive rather than beside this module, so
+// they resolve under /var/task and not relative to here.
+const dynamicImport = (specifier) => import("/var/task/node_modules/" + specifier);
+
+// The framework ships four runtime callback hooks (command interception, query
+// interception, before/after publish) whose registrars are module-level refs.
+// They are only reachable if something calls them in this process before the
+// first request, and the entry shells import framework and domain modules only —
+// so an out-of-tree extension had no way in. RUNTIME_EXTENSIONS closes that: it
+// names the extension modules the archive carries (see
+// ReventlessCore.RuntimeExtension and Util_Bundle.addRuntimeExtensionPackages),
+// and each one's `onColdStart` runs here, once, before any handler is built.
+//
+// This is the seam's one untyped step: the modules are named at deploy time and
+// their types are unknowable here. Parsing and invocation live in the typed
+// RuntimeExtensionEntryPoint_Ops.res, so the call's arity is compiler-checked.
+//
+// Started at module load and exported as a promise every entry shell awaits in
+// its own cold-start init — that is what makes "before the first request" a fact
+// rather than a hope, and it holds for the shells that build handlers lazily.
+// Absent env var ⇒ resolves immediately, having done nothing.
+export const runtimeExtensionsReady = (async () => {
+  const config = parseRuntimeExtensionConfig(process.env["RUNTIME_EXTENSIONS"]);
+  if (config === undefined) return;
+  const hooks = [];
+  for (const specifier of config.modules) {
+    try {
+      const mod = await dynamicImport(specifier);
+      if (typeof mod.onColdStart === "function") {
+        hooks.push(mod.onColdStart);
+      } else {
+        reportRuntimeExtensionLoadFailure(specifier, "module exports no onColdStart function");
+      }
+    } catch (err) {
+      reportRuntimeExtensionLoadFailure(specifier, err?.message ?? String(err));
+    }
+  }
+  fireRuntimeExtensions(config, hooks);
+})();