@reventlessdev/reventless-aws 3.0.0-alpha.288 → 3.0.0-alpha.291

package/CHANGELOG.md

@@ -3,12 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-# 3.0.0-alpha.288 (2026-08-12)
+# 3.0.0-alpha.291 (2026-08-13)
 
-**Note:** Version bump only for package @reventlessdev/reventless-aws
+### Features
+
+* **aws:** bake the component manifest after every plugin stack is up ([2fff09a](https://github.com/ReventlessDev/reventless-core/commit/2fff09aa32b77cc8e33a65414c58c12026ca009e))
+
+
+# 3.0.0-alpha.290 (2026-08-13)
+
+### Bug Fixes
+
+* **aws:** move past a version number that already names other content ([bffba4f](https://github.com/ReventlessDev/reventless-core/commit/bffba4f15eff4a9c30bbf2e28484bb549b865cfc))
 
 
+# 3.0.0-alpha.288 (2026-08-12)
+
+### Bug Fixes
 
+* **aws:** carry the elevated groups into every Lambda ([ced4d92](https://github.com/ReventlessDev/reventless-core/commit/ced4d9211c3cebe70702757ab331c8a1fa773fca))
 
 
 # 3.0.0-alpha.287 (2026-08-12)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.288",
+  "version": "3.0.0-alpha.291",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.72",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.71",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.229",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.137",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.93",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.138",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.230",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.111"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.94",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1454,17 +1454,24 @@ module MakeWithConfig = (
     // Also register the Plugin RM table with the AllAggregates Lambda runtime
     // so its in-Lambda plugin status gate can read plugin status at command
     // dispatch time (Part 2.3 of the resolver plan).
-    switch pluginReadModelTableName {
+    // Handed back so the host-UI half of this deploy can grant the bake its write
+    // into the bucket it creates, and so the function name can be exported for
+    // the post-deploy step. `None` when there is no Plugin RM to scan — there is
+    // then no function, and nothing downstream to grant.
+    let componentDefinitions = switch pluginReadModelTableName {
     | Some(tableName) =>
       AggregateRuntime_Builder_Single.setPluginReadModelTable(~name=tableName)
-      Platform_ComponentDefinitions_Lambda.make(
-        ~api=platformApi,
-        ~pluginReadModelTableName=tableName,
-        ~offloadBucketName,
-        ~schemaReady=admin.adminSchemaPushed,
-        ~opts={},
+      Some(
+        Platform_ComponentDefinitions_Lambda.make(
+          ~api=platformApi,
+          ~pluginReadModelTableName=tableName,
+          ~offloadBucketName,
+          ~schemaReady=admin.adminSchemaPushed,
+          ~bakedManifest=?hostUiBundle->Option.flatMap(cfg => cfg.bakedManifest),
+          ~opts={},
+        ),
       )
-    | None => ()
+    | None => None
     }
 
     // Mount the Platform_UIFragments Lambda resolver — scans the UiFragments
@@ -2163,6 +2170,7 @@ module MakeWithConfig = (
           Util_ShellConfig.fields(
             ~computed=withEvents,
             ~viewModes=?cfg.viewModes,
+            ~bakedManifest=?cfg.bakedManifest,
             ~shellConfig=?cfg.shellConfig,
           )
           ->JSON.Encode.object
@@ -2202,6 +2210,50 @@ module MakeWithConfig = (
         )
       }
 
+      // The bake's write, granted here because here is where both facts are
+      // known: which bucket serves the shell, and that this deployment declared a
+      // manifest at all. Scoped to the one key the deploy told the shell to fetch
+      // — a function that may rewrite the bundle would be a much larger grant
+      // than "keep one generated file current".
+      //
+      // Exported alongside so the post-deploy step has the function and the
+      // target without reading either out of the deploy program.
+      switch (componentDefinitions, cfg.bakedManifest) {
+      | (Some(fn), Some(bake)) =>
+        let manifestKey = bake.key->Option.getOr(
+          ReventlessCore.Platform_BakedManifest.defaultKey,
+        )
+        let _ =
+          (fn.roleId, bucketName)
+          ->Pulumi.Output.all2
+          ->Pulumi.Output.apply(((roleId, bucket)) => {
+            open PulumiAws.PolicyDocument
+            let _ = PulumiAws.IAM.RolePolicy.make(
+              ~name="PlatformUIDefinitionsBake",
+              ~args={
+                PulumiAws.IAM.RolePolicy.policy: PulumiAws.PolicyDocument.make(
+                  ~id="PlatformUIDefinitionsBakePolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowWriteBakedManifest",
+                      effect: Allow,
+                      actions: Actions(["s3:PutObject"]),
+                      resources: Resource(`arn:aws:s3:::${bucket}/${manifestKey}`),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: roleId->Pulumi.Input.make,
+              },
+            )
+          })
+        Pulumi.Pulumi.export("bakedManifestFunction", fn.functionName)
+        Pulumi.Pulumi.export("bakedManifestBucket", bucketName)
+        Pulumi.Pulumi.export("bakedManifestKey", Pulumi.Output.make(manifestKey))
+      | _ => ()
+      }
+
       Pulumi.Pulumi.export("hostShellUrl", distributionUrl)
     }
 

package/src/Platform.res.mjs

@@ -22,6 +22,7 @@ import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
 import * as Aggregate$ReventlessCore from "@reventlessdev/reventless-core/src/components/Aggregate/Aggregate.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as DcbBackend$ReventlessAws from "./adapter/DcbEventLog/DcbBackend.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
@@ -70,6 +71,7 @@ import * as AutomationSlice_Builder$ReventlessAws from "./components/AutomationS
 import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/EventTopicPublisher_SNS.res.mjs";
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateViewSlice/UiFragments_Projection.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
@@ -859,10 +861,7 @@ function MakeWithConfig(Config) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
-    if (pluginReadModelTableName !== undefined) {
-      AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, {});
-    }
+    let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
       let r$1 = rm.queryDb.resources[0];
@@ -1189,7 +1188,7 @@ function MakeWithConfig(Config) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -1207,6 +1206,27 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
+      let match$5 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$5 !== undefined) {
+        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        Pulumi.all([
+          componentDefinitions.roleId,
+          bucketName
+        ]).apply(param => {
+          new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
+            policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
+                Sid: "AllowWriteBakedManifest",
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+              }])),
+            role: param[0]
+          });
+        });
+        Pulumi$Pulumi.$$export("bakedManifestFunction", componentDefinitions.functionName);
+        Pulumi$Pulumi.$$export("bakedManifestBucket", bucketName);
+        Pulumi$Pulumi.$$export("bakedManifestKey", Pulumi.output(manifestKey));
+      }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
@@ -2098,10 +2118,7 @@ function Make($star) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
-    if (pluginReadModelTableName !== undefined) {
-      AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, {});
-    }
+    let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
       let r$1 = rm.queryDb.resources[0];
@@ -2422,7 +2439,7 @@ function Make($star) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -2440,6 +2457,27 @@ function Make($star) {
           contentType: "application/json"
         });
       }
+      let match$5 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$5 !== undefined) {
+        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        Pulumi.all([
+          componentDefinitions.roleId,
+          bucketName
+        ]).apply(param => {
+          new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
+            policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
+                Sid: "AllowWriteBakedManifest",
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+              }])),
+            role: param[0]
+          });
+        });
+        Pulumi$Pulumi.$$export("bakedManifestFunction", componentDefinitions.functionName);
+        Pulumi$Pulumi.$$export("bakedManifestBucket", bucketName);
+        Pulumi$Pulumi.$$export("bakedManifestKey", Pulumi.output(manifestKey));
+      }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();

package/src/adapter/Api/Platform_AdminScan_Ops.res

@@ -108,13 +108,17 @@ let compareVersions = (a: string, b: string): int => {
 // `nameVersionOf` reads the row's `name@version` string; `toEntry` builds the
 // output entry for a surviving row (returning None drops a malformed row). The
 // name/version split mirrors ReventlessCore.Plugin.name / compareVersions.
+// Generic in what an entry is: the GraphQL fields collapse to encoded JSON, the
+// bake collapses to the decoded structure it curates. One version-collapse rule
+// either way — a second copy would be a second chance to disagree about which
+// version of a plugin is the deployed one.
 let latestByName = (
   items: array<dict<JSON.t>>,
   ~nameVersionOf: dict<JSON.t> => option<string>,
-  ~toEntry: (dict<JSON.t>, ~name: string) => option<JSON.t>,
-): array<JSON.t> => {
+  ~toEntry: (dict<JSON.t>, ~name: string) => option<'entry>,
+): array<'entry> => {
   // bare plugin name -> (version, entry); highest version wins.
-  let latest: dict<(string, JSON.t)> = Dict.make()
+  let latest: dict<(string, 'entry)> = Dict.make()
   items->Array.forEach(item =>
     switch item->nameVersionOf {
     | None => ()

package/src/adapter/Api/Platform_AdminScan_Ops.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
 import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
 
@@ -83,7 +84,7 @@ function latestByName(items, nameVersionOf, toEntry) {
     }
     latest[name] = [
       version,
-      entry
+      Primitive_option.valFromOption(entry)
     ];
   });
   return Object.values(latest).map(param => param[1]);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -37,6 +37,22 @@ export function response(ctx) {
 }
 `->Pulumi.Input.make
 
+/**
+ What the platform needs back to finish wiring the bake.
+
+ The manifest is written into the host-UI bucket, and that bucket is created in a
+ later half of the same deploy — so the grant cannot be attached here. Handing the
+ role back is what lets the caller attach it at the point both facts are known,
+ rather than widening this function's write scope to "some bucket, later".
+
+ `functionName` is exported so the post-deploy step has something to invoke
+ without guessing at a generated name.
+ */
+type t = {
+  roleId: Pulumi.Output.t<string>,
+  functionName: Pulumi.Output.t<string>,
+}
+
 let make = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~pluginReadModelTableName: Pulumi.Output.t<string>,
@@ -47,8 +63,13 @@ let make = (
   // first ships it. `Platform_ComponentDefinitions` predates the gate and is left
   // ungated so this change adds no dependency edge to an already-deployed resource.
   ~schemaReady: Pulumi.Output.t<unit>,
+  // The deployment's include-list, when it declares one. Carried into the
+  // function's environment so the bake curates what the platform program
+  // declared and not what its caller asked for — the invocation supplies only
+  // where to write.
+  ~bakedManifest: option<ReventlessInfra.Platform.bakedManifest>=?,
   ~opts: Pulumi.ComponentResource.options,
-) => {
+): t => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
   let name = "PlatformUIDefinitions"
 
@@ -106,6 +127,28 @@ let make = (
       )
     })
 
+  // The include-list as the handler reads it. Encoded here rather than passed
+  // as a record so the deploy input and the runtime input are the same shape —
+  // `views`/`commands` absent means "every public component", which a record
+  // with explicit nulls would not say.
+  let bakeSelectionsJson = switch bakedManifest {
+  | None => ""
+  | Some(bake) =>
+    bake.components
+    ->Array.map(sel => {
+      let entry = Dict.fromArray([("plugin", JSON.Encode.string(sel.plugin))])
+      let strings = (key, value) =>
+        value->Option.forEach(names =>
+          entry->Dict.set(key, names->Array.map(JSON.Encode.string)->JSON.Encode.array)
+        )
+      strings("views", sel.views)
+      strings("commands", sel.commands)
+      entry->JSON.Encode.object
+    })
+    ->JSON.Encode.array
+    ->JSON.stringify
+  }
+
   let adminEntryJson =
     ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
@@ -167,6 +210,11 @@ let make = (
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
             ("OFFLOAD_BUCKET", offloadBucketName->Pulumi.Output.asInput),
+            // Absent declaration ⇒ empty string ⇒ a bake invocation fails saying
+            // this platform declares none, rather than writing an empty shop.
+            // An include-list is names only, so it stays far from the 4096-byte
+            // total the admin entry already pushed out of this dict.
+            ("BAKE_SELECTIONS", bakeSelectionsJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),
@@ -256,4 +304,6 @@ let make = (
         ~opts,
       )
     )
+
+  {roleId: lambdaRole.id, functionName: lambda.name}
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -38,7 +38,7 @@ export function response(ctx) {
 }
 `;
 
-function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opts) {
+function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bakedManifest, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let name = "PlatformUIDefinitions";
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
@@ -70,6 +70,18 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
       role: lambdaRole.id
     }, opts$1);
   });
+  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(bakedManifest.components.map(sel => {
+      let entry = Object.fromEntries([[
+          "plugin",
+          sel.plugin
+        ]]);
+      let strings = (key, value) => Stdlib_Option.forEach(value, names => {
+        entry[key] = names.map(prim => prim);
+      });
+      strings("views", sel.views);
+      strings("commands", sel.commands);
+      return entry;
+    })) : "";
   let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, Platform_Admin_Structure$ReventlessCore.structure));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
@@ -104,6 +116,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
           "OFFLOAD_BUCKET",
           offloadBucketName
         ],
+        [
+          "BAKE_SELECTIONS",
+          bakeSelectionsJson
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions
@@ -143,6 +159,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
   }, opts$1);
   AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Resolver", api, dataSource.name, "Query", "Platform_ComponentDefinitions", resolverCode, opts$1);
   schemaReady.apply(() => AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "StructuresResolver", api, dataSource.name, "Query", "Platform_PluginStructures", completeResolverCode, opts$1));
+  return {
+    roleId: lambdaRole.id,
+    functionName: lambda.name
+  };
 }
 
 export {

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -236,14 +236,162 @@ let isComplete = (event: JSON.t): bool =>
   ->Option.flatMap(JSON.Decode.bool)
   ->Option.getOr(false)
 
+// ── Bake mode ────────────────────────────────────────────────────────────────
+// The third thing this function does with the same scan: write the curated
+// manifest as a static object instead of answering a query with it.
+//
+// It belongs here rather than in a tool of its own for the reason the two GraphQL
+// fields already share a data source — there is one place that decides what a
+// deployed plugin's structure is, and the scan, the offload resolution and the
+// version collapse are that decision. A separate reader would be a second copy of
+// all three, free to drift about which version of a plugin is deployed.
+//
+// Invoked directly, after every plugin stack is up: the manifest describes the
+// whole deployment, and no single stack's deploy is the moment that is settled.
+
+// The persisted structure is served raw on the query paths — nothing decodes it —
+// but curation filters the RECORD and re-encodes through the shared encoder,
+// which is what makes an include-list naming everything produce the bytes the
+// query returns. So the bake decodes, and heals first: healing fills the list
+// fields an older persisted structure simply has no key for, and those are
+// exactly the fields the schema requires.
+//
+// A structure that still fails to decode fails the bake, naming the plugin. The
+// alternative — skipping it — ships a shop silently missing a section.
+let structureOf = (item: dict<JSON.t>, ~name as _: string): option<(
+  string,
+  Reventless.Plugin.pluginStructure,
+)> =>
+  switch (item->str("name"), item->Dict.get("structure")->Option.flatMap(JSON.Decode.object)) {
+  | (Some(pluginId), Some(structure)) =>
+    let healed = structure->healStructure->JSON.Encode.object
+    switch healed->S.parseJsonOrThrow(Reventless.Plugin.pluginStructureSchema) {
+    | decoded => Some((pluginId, decoded))
+    | exception _ =>
+      JsError.throwWithMessage(
+        `baked manifest: the structure persisted for "${pluginId}" cannot be decoded — ` ++
+        `it was written by a framework version this platform can no longer read. ` ++
+        `Redeploy that plugin, or drop it from the include-list.`,
+      )
+    }
+  | _ => None
+  }
+
+let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest.selection> => {
+  let strings = (o, key) =>
+    o
+    ->Dict.get(key)
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.map(a => a->Array.filterMap(JSON.Decode.string))
+  json
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    o
+    ->Dict.get("plugin")
+    ->Option.flatMap(JSON.Decode.string)
+    ->Option.map(plugin => {
+      ReventlessCore.Platform_BakedManifest.plugin,
+      views: strings(o, "views"),
+      commands: strings(o, "commands"),
+    })
+  )
+}
+
+// The declaration travels as an env var because it is deploy input — stated once
+// in the platform program, beside the bucket it is written to. The target travels
+// in the invocation payload instead: the bucket only exists inside the host-UI
+// half of the deploy, long after this function is built, and a caller that had to
+// know the include-list as well would be free to bake something the deployment
+// never declared.
+let bakeSelections = (): array<ReventlessCore.Platform_BakedManifest.selection> =>
+  switch NodeProcess.env->Dict.get("BAKE_SELECTIONS") {
+  | None | Some("") => []
+  | Some(raw) =>
+    switch raw->JSON.parseOrThrow->JSON.Decode.array {
+    | Some(entries) => entries->Array.filterMap(bakeSelection)
+    | None => []
+    | exception _ =>
+      JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array")
+    }
+  }
+
+type bakeTarget = {bucket: string, key: string}
+
+let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
+  event
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    switch (
+      o->Dict.get("bake")->Option.flatMap(JSON.Decode.bool),
+      o->Dict.get("bucket")->Option.flatMap(JSON.Decode.string),
+    ) {
+    | (Some(true), Some(bucket)) =>
+      Some({
+        bucket,
+        key: o
+        ->Dict.get("key")
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.getOr(ReventlessCore.Platform_BakedManifest.defaultKey),
+      })
+    | _ => None
+    }
+  )
+
+// Every failure mode here is the deployment's own mistake — a name matching no
+// component, a structure too old to read, a bucket the function may not write —
+// and every one of them produces the same symptom if swallowed: a shop that
+// renders nothing, with no line anywhere saying why. So the bake throws, and the
+// pipeline step that invoked it fails.
+let runBake = async (
+  ~target: bakeTarget,
+  ~structures: array<(string, Reventless.Plugin.pluginStructure)>,
+): array<JSON.t> => {
+  let selections = bakeSelections()
+  if selections->Array.length == 0 {
+    JsError.throwWithMessage(
+      "baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, " ++
+      "so there is nothing to write and a shell pointed at the file would find none.",
+    )
+  }
+  switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
+  | Error(e) =>
+    JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
+  | Ok(manifest) =>
+    let body = JSON.stringify(manifest, ~space=2)
+    let _ = await AwsSdk.S3.PutObjectCommand.make({
+      bucket: target.bucket,
+      key: target.key,
+      body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
+      contentType: "application/json",
+    })->AwsSdk.S3.PutObjectCommand.send
+    [
+      Dict.fromArray([
+        ("baked", JSON.Encode.bool(true)),
+        ("bucket", JSON.Encode.string(target.bucket)),
+        ("key", JSON.Encode.string(target.key)),
+        ("plugins", JSON.Encode.int(selections->Array.length)),
+        ("bytes", JSON.Encode.int(body->String.length)),
+      ])->JSON.Encode.object,
+    ]
+  }
+}
+
 let handler = async (event: JSON.t): array<JSON.t> => {
   let complete = isComplete(event)
+  let bakeTarget = bakeTargetOf(event)
   let toEntry = (item, ~name) => toEntryWith(~filter=!complete, item, ~name)
   let admin = adminEntry->Option.mapOr([], e => [e])
   switch NodeProcess.env->Dict.get("PLUGIN_RM_TABLE") {
   | None | Some("") =>
     Console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set")
-    admin
+    switch bakeTarget {
+    | Some(_) =>
+      JsError.throwWithMessage(
+        "baked manifest: PLUGIN_RM_TABLE env var not set — the bake would write an " ++
+        "empty shop rather than fail.",
+      )
+    | None => admin
+    }
   | Some(table) =>
     let rawItems = await Platform_AdminScan_Ops.scanAll(
       ~tableName=table,
@@ -257,8 +405,25 @@ let handler = async (event: JSON.t): array<JSON.t> => {
       AwsSdk.S3.GetObjectCommand.getString(~bucket, ~key)
     )
     let items = await Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
-    let userEntries =
-      Platform_AdminScan_Ops.latestByName(items, ~nameVersionOf=item => item->str("name"), ~toEntry)
-    Array.concat(admin, userEntries)
+    switch bakeTarget {
+    | Some(target) =>
+      // The built-in admin entry is deliberately absent: it never enters the
+      // Plugin read model, and the in-memory bake curates the composed plugins
+      // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
+      let structures = Platform_AdminScan_Ops.latestByName(
+        items,
+        ~nameVersionOf=item => item->str("name"),
+        ~toEntry=structureOf,
+      )
+      await runBake(~target, ~structures)
+    | None =>
+      let userEntries =
+        Platform_AdminScan_Ops.latestByName(
+          items,
+          ~nameVersionOf=item => item->str("name"),
+          ~toEntry,
+        )
+      Array.concat(admin, userEntries)
+    }
   }
 }