@reventlessdev/reventless-aws 3.0.0-alpha.280 → 3.0.0-alpha.282

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.282 (2026-08-10)
+
+### Bug Fixes
+
+* **aws:** load query-interceptor extensions in init, and let it log ([c93612b](https://github.com/ReventlessDev/reventless-core/commit/c93612b3d2208cdc3f1c4b4dbef615b974c5e74a))
+
+
+# 3.0.0-alpha.281 (2026-08-10)
+
+### Features
+
+* **admin:** carry Internal queryables on their own manifest field ([f5aa03d](https://github.com/ReventlessDev/reventless-core/commit/f5aa03d60b0b2554d116fe9b3784d30f2c4ef356))
+
+
 # 3.0.0-alpha.280 (2026-08-10)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.280",
+  "version": "3.0.0-alpha.282",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -19,11 +19,11 @@
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.69",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.222",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.132",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.133",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.87",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.107",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.86",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.106"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.223"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -114,19 +114,33 @@ let isPublicQueryable = (q: JSON.t): bool =>
   | _ => true
   }
 
-// Drop Internal ReadModels / StateViewSlices from a persisted structure. A
-// missing/non-array field defaults to `[]` (mirrors the JS `?? []`).
+// Drop Internal ReadModels / StateViewSlices from a persisted structure, and
+// carry what was dropped on `internalQueryables` — the complement, so a client
+// can resolve a reference to an Internal view without any enumeration site
+// being able to see it. A missing/non-array field defaults to `[]` (mirrors the
+// JS `?? []`), which also covers a structure persisted before this field
+// existed: the complement is recomputed here, never read off the structure.
+//
+// The `~filter=false` path (Platform_PluginStructures) deliberately does not go
+// through here — it serves Internal components inline and must not grow a
+// duplicate list.
 let filterStructure = (structure: dict<JSON.t>): dict<JSON.t> => {
   let out = Dict.fromArray(structure->Dict.toArray)
-  let filterArr = key =>
-    out
-    ->Dict.get(key)
-    ->Option.flatMap(JSON.Decode.array)
-    ->Option.getOr([])
-    ->Array.filter(isPublicQueryable)
-    ->JSON.Encode.array
-  out->Dict.set("readModels", filterArr("readModels"))
-  out->Dict.set("stateViewSlices", filterArr("stateViewSlices"))
+  let arrAt = key =>
+    out->Dict.get(key)->Option.flatMap(JSON.Decode.array)->Option.getOr([])
+  let readModels = arrAt("readModels")
+  let stateViewSlices = arrAt("stateViewSlices")
+  out->Dict.set("readModels", readModels->Array.filter(isPublicQueryable)->JSON.Encode.array)
+  out->Dict.set(
+    "stateViewSlices",
+    stateViewSlices->Array.filter(isPublicQueryable)->JSON.Encode.array,
+  )
+  out->Dict.set(
+    "internalQueryables",
+    Array.concat(readModels, stateViewSlices)
+    ->Array.filter(q => !isPublicQueryable(q))
+    ->JSON.Encode.array,
+  )
   out
 }
 

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -166,9 +166,12 @@ function isPublicQueryable(q) {
 
 function filterStructure(structure) {
   let out = Object.fromEntries(Object.entries(structure));
-  let filterArr = key => Stdlib_Option.getOr(Stdlib_Option.flatMap(out[key], Stdlib_JSON.Decode.array), []).filter(isPublicQueryable);
-  out["readModels"] = filterArr("readModels");
-  out["stateViewSlices"] = filterArr("stateViewSlices");
+  let arrAt = key => Stdlib_Option.getOr(Stdlib_Option.flatMap(out[key], Stdlib_JSON.Decode.array), []);
+  let readModels = arrAt("readModels");
+  let stateViewSlices = arrAt("stateViewSlices");
+  out["readModels"] = readModels.filter(isPublicQueryable);
+  out["stateViewSlices"] = stateViewSlices.filter(isPublicQueryable);
+  out["internalQueryables"] = readModels.concat(stateViewSlices).filter(q => !isPublicQueryable(q));
   return out;
 }
 

package/src/adapter/QueryDb/QueryInterceptor_Lambda.res

@@ -2,18 +2,24 @@
 // Query resolver — one pipeline step whose only job is to consult the hook.
 //
 // The hook is a module-level `ref`, and in a deployed runtime the only thing that
-// ever fills it is a `RuntimeExtension`'s `onColdStart`. Every other runtime
-// reaches those through a compiled entry shell that awaits `runtimeExtensionsReady`
-// before it serves anything; this handler is not built by a shell, so it awaits
-// the same promise itself. Without it the extensions the archive already carries
-// are never imported, the hook stays `None`, and interception degrades to a
-// passthrough that costs an invocation on every read and observes nothing — the
-// one failure mode this path cannot afford, because it is silent and its whole
-// price has already been paid.
+// ever fills it is a `RuntimeExtension`'s `onColdStart`. So the handler awaits
+// `runtimeExtensionsReady` before reading it. Without that the extensions the
+// archive already carries are never imported, the hook stays `None`, and
+// interception degrades to a passthrough that costs an invocation on every read
+// and observes nothing — the one failure mode this path cannot afford, because it
+// is silent and its whole price has already been paid.
+//
+// The await is kept here even though `QueryInterceptorEntryPoint.mjs` now awaits
+// the same promise at top level, because the two are answering different
+// questions. The shell's await decides WHEN the seam fires — init rather than
+// invoke, which is what keeps the load off the read path. This one is the
+// module's own contract: it does not consult a hook it has not waited for,
+// however it was entered. On the path they share, the second await is a settled
+// promise and costs a microtask.
 //
 // Awaited from the small module rather than from `HandlerFactoryHelpers`, which
 // re-exports the same binding behind the Effect runtime and the DynamoDB clients:
-// this runtime is sized for a decision, not for work.
+// there is no reason to pull that graph in to reach one promise.
 
 type payload = {
   readModelName: string,

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res

@@ -64,23 +64,56 @@ let buildInterceptor = (~api: Types.AppSync.api, ~opts) => {
     ),
   ])
   let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
-    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs",
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs",
     ~packageDirs,
   )
 
-  // Sits in front of every read, so it is sized for a decision rather than for
-  // work: small memory, short timeout. A hook that needs longer than this is
-  // doing something a read path cannot afford anyway.
+  // Framework default sizing, deliberately, and it took an outage to get here.
+  //
+  // What this runtime DECIDES is trivial — consult a hook, return a verdict — and
+  // it was once sized for exactly that: 256MB and a 10-second timeout, on the
+  // reasoning that a read path cannot afford anything more. But a runtime is not
+  // sized for what it decides, it is sized for what it LOADS, and this one loads
+  // whatever module graph the registered extensions drag behind them. An
+  // accounting extension reaching a DynamoDB client is enough to put the whole
+  // cloud SDK in that graph. Lambda CPU scales with memory, so at 256MB the load
+  // ran at a fraction of a core and did not finish inside ten seconds — and
+  // because an unfinished import neither completes nor throws, the failure was a
+  // bare timeout on EVERY read, with an empty log group to explain it.
+  //
+  // The defaults are also close to cost-neutral for the thing being paid for
+  // here. Lambda bills memory×duration, so a decision that fits in single-digit
+  // milliseconds costs about the same at either size; what changes is whether the
+  // cold start fits. The entry shell spends it in init (see its own docstring),
+  // where the timeout is headroom for the retry Lambda performs when init
+  // overruns its own budget, rather than a ceiling on the read.
   let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
     ~name,
     ~unitKind=ReventlessCore.Monitoring.Other("QueryInterceptor"),
     ~componentKind=ReventlessCore.ComponentType.Plugin,
     ~code,
     ~sourceCodeHash,
-    ~memorySize=256,
-    ~timeout=10,
     ~opts=componentOpts,
   )
+
+  // The execution role's logging grant, which `makeFromCodeAsset` does NOT give
+  // it: every runtime builder in the framework attaches this at its own call
+  // site, and this one — hand-rolled rather than grown from a builder — was the
+  // one that forgot. The result was a component sitting in front of every read on
+  // the platform whose log group never had a single stream, so the timeout above
+  // could only be found by invoking the function by hand and reading the tail of
+  // a response. Silence on the read path is not a small defect; it is the thing
+  // that decides how long the next outage lasts.
+  let _logging = IAM.RolePolicy.make(
+    ~name=name ++ "Logging",
+    ~args={
+      IAM.RolePolicy.policy: PulumiAws.Lambda.defaultLoggingPolicyDocument
+      ->PolicyDocument.toJsonString
+      ->Pulumi.Input.make,
+      role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+    },
+    ~opts,
+  )
   let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(lambda => lambda.arn)
 
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res.mjs

@@ -5,6 +5,7 @@ import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.r
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
@@ -38,11 +39,15 @@ function buildInterceptor(api, opts) {
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs", packageDirs, undefined, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs", packageDirs, undefined, undefined);
   let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, {
     TAG: "Other",
     _0: "QueryInterceptor"
-  }, "Plugin", match.code, match.sourceCodeHash, undefined, 256, 10, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  }, "Plugin", match.code, match.sourceCodeHash, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  new (Aws.iam.RolePolicy)(name + "Logging", {
+    policy: PolicyDocument$PulumiAws.toJsonString(Lambda$PulumiAws.defaultLoggingPolicyDocument),
+    role: runtime.parts.lambdaRole.id
+  }, opts);
   let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, lambda => lambda.arn);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Plugin", "Identity", "Plugin", undefined, undefined, undefined, undefined), opts);
   Pulumi.all([

package/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs

@@ -0,0 +1,29 @@
+// Query-interceptor Lambda entry point.
+//
+// One job, and it is a scheduling one: pull the runtime-extension cold start
+// into the INIT phase.
+//
+// `runtimeExtensionsReady` is an async IIFE started at module load and awaited
+// by nobody, so evaluating a module that merely imports it does not wait for it.
+// Awaiting it from the handler instead — which is what this runtime did before
+// there was a shell — leaves the whole extension load in the INVOKE phase, where
+// it runs without the init CPU boost and against the function timeout. An
+// extension whose module graph reaches a cloud SDK does not finish inside a
+// budget sized for a decision, and the way that fails is the worst shape
+// available: the load neither completes nor throws, so every read times out
+// having logged nothing at all.
+//
+// A top-level await is what moves it. It propagates to the generated `index.mjs`
+// re-export, so init is not finished until the seam has fired — which is also
+// the only way the handler's own await can be a formality rather than the place
+// the work happens.
+//
+// It cannot reject: the seam catches and reports each extension's load failure
+// individually, and resolves having skipped it. So a broken extension still
+// costs interception nothing more than the counting it was going to do.
+
+import { runtimeExtensionsReady } from "./RuntimeExtensionsReady.mjs";
+
+await runtimeExtensionsReady;
+
+export { handler } from "../QueryDb/QueryInterceptor_Lambda.res.mjs";

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -112,3 +112,67 @@ describe("toEntryWith heals a structure persisted before a required list existed
     expect(names)->toEqual(["Products"])
   })
 })
+
+// The persisted structure is pre-filter, so this handler is a twin of the
+// in-memory `encodePluginStructureEntry` rather than a consequence of it. A shell
+// reading `internalQueryables` against a platform that emits it on only one
+// transport gets working pickers locally and silent text inputs when deployed —
+// which is why the split is asserted here as well as in core.
+describe("toEntryWith carries Internal queryables on the filtered field", () => {
+  let mixed = Dict.fromArray([
+    (
+      "readModels",
+      JSON.Encode.array([
+        JSON.parseOrThrow(`{"name": "AvailableProducts", "visibility": "Internal"}`),
+        JSON.parseOrThrow(`{"name": "Products"}`),
+      ]),
+    ),
+    (
+      "stateViewSlices",
+      JSON.Encode.array([
+        JSON.parseOrThrow(`{"name": "PendingShipments", "visibility": "Internal"}`),
+      ]),
+    ),
+  ])->JSON.Encode.object
+
+  let namesAt = (~filter, collection) =>
+    entry(~filter, mixed)
+    ->Option.map(members(_, collection))
+    ->Option.getOr([])
+    ->Array.filterMap(m => m->Dict.get("name")->Option.flatMap(JSON.Decode.string))
+
+  testSync("emits the complement of the filter, fed by both source arrays", () =>
+    expect(namesAt(~filter=true, "internalQueryables"))->toEqual([
+      "AvailableProducts",
+      "PendingShipments",
+    ])
+  )
+
+  testSync("keeps the surface lists public-only", () => {
+    expect(namesAt(~filter=true, "readModels"))->toEqual(["Products"])
+    expect(namesAt(~filter=true, "stateViewSlices"))->toEqual([])
+  })
+
+  // Platform_PluginStructures serves Internal components inline; a duplicate list
+  // there would be a second answer to a question that already has one.
+  testSync("adds nothing to the complete field", () =>
+    expect(
+      entry(~filter=false, mixed)->Option.flatMap(o => o->Dict.get("internalQueryables")),
+    )->toEqual(None)
+  )
+
+  // A structure persisted before the field existed has no key for it, and must not
+  // grow one from its own contents — the complement is always recomputed.
+  testSync("computes the complement rather than reading it off the structure", () => {
+    let stale = Dict.fromArray([
+      ("internalQueryables", JSON.parseOrThrow(`[{"name": "Stale"}]`)),
+      ("readModels", JSON.parseOrThrow(`[{"name": "Products"}]`)),
+    ])->JSON.Encode.object
+    let names =
+      entry(~filter=true, stale)
+      ->Option.map(members(_, "internalQueryables"))
+      ->Option.getOr([])
+      ->Array.filterMap(m => m->Dict.get("name")->Option.flatMap(JSON.Decode.string))
+    expect(names)->toEqual([])
+  })
+})

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -64,6 +64,50 @@ globalThis.describe("toEntryWith heals a structure persisted before a required l
   });
 });
 
+globalThis.describe("toEntryWith carries Internal queryables on the filtered field", () => {
+  let mixed = Object.fromEntries([
+    [
+      "readModels",
+      [
+        JSON.parse(`{"name": "AvailableProducts", "visibility": "Internal"}`),
+        JSON.parse(`{"name": "Products"}`)
+      ]
+    ],
+    [
+      "stateViewSlices",
+      [JSON.parse(`{"name": "PendingShipments", "visibility": "Internal"}`)]
+    ]
+  ]);
+  let namesAt = (filter, collection) => Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.map(entry(filter, mixed), __x => members(__x, collection)), []), m => Stdlib_Option.flatMap(m["name"], Stdlib_JSON.Decode.string));
+  globalThis.test("emits the complement of the filter, fed by both source arrays", () => {
+    globalThis.expect(namesAt(true, "internalQueryables")).toEqual([
+      "AvailableProducts",
+      "PendingShipments"
+    ]);
+  });
+  globalThis.test("keeps the surface lists public-only", () => {
+    globalThis.expect(namesAt(true, "readModels")).toEqual(["Products"]);
+    globalThis.expect(namesAt(true, "stateViewSlices")).toEqual([]);
+  });
+  globalThis.test("adds nothing to the complete field", () => {
+    globalThis.expect(Stdlib_Option.flatMap(entry(false, mixed), o => o["internalQueryables"])).toEqual(undefined);
+  });
+  globalThis.test("computes the complement rather than reading it off the structure", () => {
+    let stale = Object.fromEntries([
+      [
+        "internalQueryables",
+        JSON.parse(`[{"name": "Stale"}]`)
+      ],
+      [
+        "readModels",
+        JSON.parse(`[{"name": "Products"}]`)
+      ]
+    ]);
+    let names = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.map(entry(true, stale), __x => members(__x, "internalQueryables")), []), m => Stdlib_Option.flatMap(m["name"], Stdlib_JSON.Decode.string));
+    globalThis.expect(names).toEqual([]);
+  });
+});
+
 export {
   entry,
   members,