@reventlessdev/reventless-aws 3.0.0-alpha.290 → 3.0.0-alpha.292

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.292 (2026-08-13)
+
+### Bug Fixes
+
+* **aws:** re-detect once the Lambda that answers the handshake is up ([597e174](https://github.com/ReventlessDev/reventless-core/commit/597e174059e25461d66db35118c933d2ffce7e1f))
+* **aws:** retain offloaded plugin structures so refs cannot dangle ([120a1a7](https://github.com/ReventlessDev/reventless-core/commit/120a1a7228087dd79f8bcfdd2fddc7b6dbdaf296))
+
+
+# 3.0.0-alpha.291 (2026-08-13)
+
+### Features
+
+* **aws:** bake the component manifest after every plugin stack is up ([2fff09a](https://github.com/ReventlessDev/reventless-core/commit/2fff09aa32b77cc8e33a65414c58c12026ca009e))
+
+
 # 3.0.0-alpha.290 (2026-08-13)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.290",
+  "version": "3.0.0-alpha.292",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.71",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.73",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.229",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.137",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.111",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.93"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.231",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.95",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1454,17 +1454,24 @@ module MakeWithConfig = (
     // Also register the Plugin RM table with the AllAggregates Lambda runtime
     // so its in-Lambda plugin status gate can read plugin status at command
     // dispatch time (Part 2.3 of the resolver plan).
-    switch pluginReadModelTableName {
+    // Handed back so the host-UI half of this deploy can grant the bake its write
+    // into the bucket it creates, and so the function name can be exported for
+    // the post-deploy step. `None` when there is no Plugin RM to scan — there is
+    // then no function, and nothing downstream to grant.
+    let componentDefinitions = switch pluginReadModelTableName {
     | Some(tableName) =>
       AggregateRuntime_Builder_Single.setPluginReadModelTable(~name=tableName)
-      Platform_ComponentDefinitions_Lambda.make(
-        ~api=platformApi,
-        ~pluginReadModelTableName=tableName,
-        ~offloadBucketName,
-        ~schemaReady=admin.adminSchemaPushed,
-        ~opts={},
+      Some(
+        Platform_ComponentDefinitions_Lambda.make(
+          ~api=platformApi,
+          ~pluginReadModelTableName=tableName,
+          ~offloadBucketName,
+          ~schemaReady=admin.adminSchemaPushed,
+          ~bakedManifest=?hostUiBundle->Option.flatMap(cfg => cfg.bakedManifest),
+          ~opts={},
+        ),
       )
-    | None => ()
+    | None => None
     }
 
     // Mount the Platform_UIFragments Lambda resolver — scans the UiFragments
@@ -2163,6 +2170,7 @@ module MakeWithConfig = (
           Util_ShellConfig.fields(
             ~computed=withEvents,
             ~viewModes=?cfg.viewModes,
+            ~bakedManifest=?cfg.bakedManifest,
             ~shellConfig=?cfg.shellConfig,
           )
           ->JSON.Encode.object
@@ -2202,6 +2210,50 @@ module MakeWithConfig = (
         )
       }
 
+      // The bake's write, granted here because here is where both facts are
+      // known: which bucket serves the shell, and that this deployment declared a
+      // manifest at all. Scoped to the one key the deploy told the shell to fetch
+      // — a function that may rewrite the bundle would be a much larger grant
+      // than "keep one generated file current".
+      //
+      // Exported alongside so the post-deploy step has the function and the
+      // target without reading either out of the deploy program.
+      switch (componentDefinitions, cfg.bakedManifest) {
+      | (Some(fn), Some(bake)) =>
+        let manifestKey = bake.key->Option.getOr(
+          ReventlessCore.Platform_BakedManifest.defaultKey,
+        )
+        let _ =
+          (fn.roleId, bucketName)
+          ->Pulumi.Output.all2
+          ->Pulumi.Output.apply(((roleId, bucket)) => {
+            open PulumiAws.PolicyDocument
+            let _ = PulumiAws.IAM.RolePolicy.make(
+              ~name="PlatformUIDefinitionsBake",
+              ~args={
+                PulumiAws.IAM.RolePolicy.policy: PulumiAws.PolicyDocument.make(
+                  ~id="PlatformUIDefinitionsBakePolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowWriteBakedManifest",
+                      effect: Allow,
+                      actions: Actions(["s3:PutObject"]),
+                      resources: Resource(`arn:aws:s3:::${bucket}/${manifestKey}`),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: roleId->Pulumi.Input.make,
+              },
+            )
+          })
+        Pulumi.Pulumi.export("bakedManifestFunction", fn.functionName)
+        Pulumi.Pulumi.export("bakedManifestBucket", bucketName)
+        Pulumi.Pulumi.export("bakedManifestKey", Pulumi.Output.make(manifestKey))
+      | _ => ()
+      }
+
       Pulumi.Pulumi.export("hostShellUrl", distributionUrl)
     }
 
@@ -2244,11 +2296,34 @@ module MakeWithConfig = (
       ->Pulumi.Output.apply(o => o->Option.getOr("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY"))
     | None => Pulumi.Output.make("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")
     }
+    // The key this deploy wrote for the plugin's structure, exported below. The
+    // Plugin read model is what the manifest bake reads and it is updated
+    // asynchronously, so the bake needs to know which structure "current" means;
+    // an equality check against the key the stack just wrote says that without
+    // timestamps, and passes immediately for a plugin whose structure did not
+    // change.
+    let structureOffloadKey = ref(None)
+
     ReventlessCore.Plugin_Helpers.registerOffload((~store, ~bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes)
       let key = "sha256/" ++ hash
+      if store == "pluginStructures" {
+        structureOffloadKey := Some(key)
+      }
       // Content-addressed: the name and key are the hash, so re-deploying an
       // unchanged field writes the same object (idempotent, deduplicating).
+      //
+      // `retainOnDelete`: the only readers of these objects are the persisted
+      // refs on the Plugin read model, and that row is updated asynchronously —
+      // the deploy publishes a re-detect, the Plugin aggregate handles it, the
+      // projection lands, minutes later. A changed field means a new hash, so
+      // without this Pulumi DELETES the previous object as part of the same
+      // update, and every reference still on the read model dangles until
+      // registration catches up. S3 answers a GET for a deleted key with
+      // AccessDenied (it masks the 404 unless the caller may ListBucket), so the
+      // window shows up as an authorization failure in the manifest bake and in
+      // the AutoUI definitions query. Content-addressed objects are immutable
+      // and cost kilobytes; keeping them closes the window outright.
       let _ = PulumiAws.S3.BucketObject.make(
         ~name="offload-" ++ hash,
         ~args={
@@ -2257,6 +2332,7 @@ module MakeWithConfig = (
           content: Pulumi.Input.make(bytes),
           contentType: Pulumi.Input.make("application/json"),
         },
+        ~opts={retainOnDelete: true},
       )
       {Reventless.Offload.store, key, hash, bytes: bytes->String.length}
     })
@@ -2309,6 +2385,23 @@ module MakeWithConfig = (
     let pluginOutputs = pluginComponent->ReventlessCore.Component.outputs
     ReventlessCore.Plugin_Helpers.exportPluginOutputs(pluginOutputs)
 
+    // What the manifest bake compares the read model against. Keyed by the bare
+    // plugin name because that is how the Plugin read model keys its rows — the
+    // stack's own id carries the version, which the bake has no opinion about.
+    switch structureOffloadKey.contents {
+    | Some(key) =>
+      Pulumi.Pulumi.export(
+        "pluginStructureRef",
+        pluginOutputs.id->Pulumi.Output.apply(id =>
+          Dict.fromArray([
+            ("plugin", JSON.Encode.string(ReventlessCore.Plugin.name(id))),
+            ("key", JSON.Encode.string(key)),
+          ])->JSON.Encode.object
+        ),
+      )
+    | None => ()
+    }
+
     // ── Merged-API association (merged-api plan, Phase 4) ───────────────────
     // Associate this plugin's source API with the platform's merged API —
     // this replaces the SigV4 RegisterApiFragment handshake + reactive push +
@@ -2487,7 +2580,20 @@ module MakeWithConfig = (
     // synchronously always saw the initial empty config, so the publish was skipped
     // on every deploy. `pluginOutputs.heartbeat` derives from that same callback's
     // output, so applying to it is the earliest point the config is populated.
-    let _ = pluginOutputs.heartbeat->Pulumi.Output.apply(_ => {
+    //
+    // The EventCollector Lambda is the other half of the gate because it is what
+    // ANSWERS the handshake: the re-detect only asks the platform to re-run it,
+    // and the definition that comes back is the one compiled into that Lambda
+    // (PluginConnectExtension_Mapping's UnknownPluginDetected branch). Published
+    // before it carries the new code, the plugin answers with the PREVIOUS
+    // deploy's definition, `Connect` sees a definition it already holds and emits
+    // nothing, and the row keeps the old structure — silently, and with no second
+    // re-detect coming to correct it. Waiting on the heartbeat alone gated on a
+    // Lambda that has no part in the answer.
+    let redetectReady =
+      (pluginOutputs.heartbeat, PluginRuntime_Builder.eventCollectorReadyRef.contents)
+      ->Pulumi.Output.all2
+    let _ = redetectReady->Pulumi.Output.apply(_ => {
       let hbConfig = PluginRuntime_Builder.heartbeatConfigRef.contents
       switch (Pulumi.Pulumi.isDryRun(), hbConfig.epQueueUrl) {
       | (true, _) => () // `pulumi preview` — no deploy-time side effects

package/src/Platform.res.mjs

@@ -16,12 +16,14 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
 import * as Aggregate$ReventlessCore from "@reventlessdev/reventless-core/src/components/Aggregate/Aggregate.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as DcbBackend$ReventlessAws from "./adapter/DcbEventLog/DcbBackend.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
@@ -70,6 +72,7 @@ import * as AutomationSlice_Builder$ReventlessAws from "./components/AutomationS
 import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/EventTopicPublisher_SNS.res.mjs";
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateViewSlice/UiFragments_Projection.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
@@ -859,10 +862,7 @@ function MakeWithConfig(Config) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
-    if (pluginReadModelTableName !== undefined) {
-      AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, {});
-    }
+    let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
       let r$1 = rm.queryDb.resources[0];
@@ -1189,7 +1189,7 @@ function MakeWithConfig(Config) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -1207,6 +1207,27 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
+      let match$5 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$5 !== undefined) {
+        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        Pulumi.all([
+          componentDefinitions.roleId,
+          bucketName
+        ]).apply(param => {
+          new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
+            policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
+                Sid: "AllowWriteBakedManifest",
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+              }])),
+            role: param[0]
+          });
+        });
+        Pulumi$Pulumi.$$export("bakedManifestFunction", componentDefinitions.functionName);
+        Pulumi$Pulumi.$$export("bakedManifestBucket", bucketName);
+        Pulumi$Pulumi.$$export("bakedManifestKey", Pulumi.output(manifestKey));
+      }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
@@ -1228,14 +1249,22 @@ function MakeWithConfig(Config) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -1253,6 +1282,19 @@ function MakeWithConfig(Config) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -1315,7 +1357,11 @@ function MakeWithConfig(Config) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;
@@ -2098,10 +2144,7 @@ function Make($star) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
-    if (pluginReadModelTableName !== undefined) {
-      AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
-      Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, {});
-    }
+    let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
       let r$1 = rm.queryDb.resources[0];
@@ -2422,7 +2465,7 @@ function Make($star) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -2440,6 +2483,27 @@ function Make($star) {
           contentType: "application/json"
         });
       }
+      let match$5 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$5 !== undefined) {
+        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        Pulumi.all([
+          componentDefinitions.roleId,
+          bucketName
+        ]).apply(param => {
+          new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
+            policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
+                Sid: "AllowWriteBakedManifest",
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+              }])),
+            role: param[0]
+          });
+        });
+        Pulumi$Pulumi.$$export("bakedManifestFunction", componentDefinitions.functionName);
+        Pulumi$Pulumi.$$export("bakedManifestBucket", bucketName);
+        Pulumi$Pulumi.$$export("bakedManifestKey", Pulumi.output(manifestKey));
+      }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
@@ -2461,14 +2525,22 @@ function Make($star) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -2486,6 +2558,19 @@ function Make($star) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -2548,7 +2633,11 @@ function Make($star) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;

package/src/adapter/Api/Platform_AdminScan_Ops.res

@@ -108,13 +108,17 @@ let compareVersions = (a: string, b: string): int => {
 // `nameVersionOf` reads the row's `name@version` string; `toEntry` builds the
 // output entry for a surviving row (returning None drops a malformed row). The
 // name/version split mirrors ReventlessCore.Plugin.name / compareVersions.
+// Generic in what an entry is: the GraphQL fields collapse to encoded JSON, the
+// bake collapses to the decoded structure it curates. One version-collapse rule
+// either way — a second copy would be a second chance to disagree about which
+// version of a plugin is the deployed one.
 let latestByName = (
   items: array<dict<JSON.t>>,
   ~nameVersionOf: dict<JSON.t> => option<string>,
-  ~toEntry: (dict<JSON.t>, ~name: string) => option<JSON.t>,
-): array<JSON.t> => {
+  ~toEntry: (dict<JSON.t>, ~name: string) => option<'entry>,
+): array<'entry> => {
   // bare plugin name -> (version, entry); highest version wins.
-  let latest: dict<(string, JSON.t)> = Dict.make()
+  let latest: dict<(string, 'entry)> = Dict.make()
   items->Array.forEach(item =>
     switch item->nameVersionOf {
     | None => ()

package/src/adapter/Api/Platform_AdminScan_Ops.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
 import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
 
@@ -83,7 +84,7 @@ function latestByName(items, nameVersionOf, toEntry) {
     }
     latest[name] = [
       version,
-      entry
+      Primitive_option.valFromOption(entry)
     ];
   });
   return Object.values(latest).map(param => param[1]);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -37,6 +37,22 @@ export function response(ctx) {
 }
 `->Pulumi.Input.make
 
+/**
+ What the platform needs back to finish wiring the bake.
+
+ The manifest is written into the host-UI bucket, and that bucket is created in a
+ later half of the same deploy — so the grant cannot be attached here. Handing the
+ role back is what lets the caller attach it at the point both facts are known,
+ rather than widening this function's write scope to "some bucket, later".
+
+ `functionName` is exported so the post-deploy step has something to invoke
+ without guessing at a generated name.
+ */
+type t = {
+  roleId: Pulumi.Output.t<string>,
+  functionName: Pulumi.Output.t<string>,
+}
+
 let make = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~pluginReadModelTableName: Pulumi.Output.t<string>,
@@ -47,8 +63,13 @@ let make = (
   // first ships it. `Platform_ComponentDefinitions` predates the gate and is left
   // ungated so this change adds no dependency edge to an already-deployed resource.
   ~schemaReady: Pulumi.Output.t<unit>,
+  // The deployment's include-list, when it declares one. Carried into the
+  // function's environment so the bake curates what the platform program
+  // declared and not what its caller asked for — the invocation supplies only
+  // where to write.
+  ~bakedManifest: option<ReventlessInfra.Platform.bakedManifest>=?,
   ~opts: Pulumi.ComponentResource.options,
-) => {
+): t => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
   let name = "PlatformUIDefinitions"
 
@@ -96,6 +117,16 @@ let make = (
                 actions: Actions(["s3:GetObject"]),
                 resources: Resource("arn:aws:s3:::" ++ offloadBucket ++ "/*"),
               },
+              // Read-only on the bucket itself, purely so a key that is not there
+              // says so: S3 answers GET for a missing key with AccessDenied unless
+              // the caller may list the bucket, which reports a ref the handler
+              // cannot resolve as an IAM problem it does not have.
+              {
+                sid: "AllowOffloadList",
+                effect: Allow,
+                actions: Actions(["s3:ListBucket"]),
+                resources: Resource("arn:aws:s3:::" ++ offloadBucket),
+              },
             ],
           )
           ->PolicyDocument.toJsonString
@@ -106,6 +137,28 @@ let make = (
       )
     })
 
+  // The include-list as the handler reads it. Encoded here rather than passed
+  // as a record so the deploy input and the runtime input are the same shape —
+  // `views`/`commands` absent means "every public component", which a record
+  // with explicit nulls would not say.
+  let bakeSelectionsJson = switch bakedManifest {
+  | None => ""
+  | Some(bake) =>
+    bake.components
+    ->Array.map(sel => {
+      let entry = Dict.fromArray([("plugin", JSON.Encode.string(sel.plugin))])
+      let strings = (key, value) =>
+        value->Option.forEach(names =>
+          entry->Dict.set(key, names->Array.map(JSON.Encode.string)->JSON.Encode.array)
+        )
+      strings("views", sel.views)
+      strings("commands", sel.commands)
+      entry->JSON.Encode.object
+    })
+    ->JSON.Encode.array
+    ->JSON.stringify
+  }
+
   let adminEntryJson =
     ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
@@ -167,6 +220,11 @@ let make = (
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
             ("OFFLOAD_BUCKET", offloadBucketName->Pulumi.Output.asInput),
+            // Absent declaration ⇒ empty string ⇒ a bake invocation fails saying
+            // this platform declares none, rather than writing an empty shop.
+            // An include-list is names only, so it stays far from the 4096-byte
+            // total the admin entry already pushed out of this dict.
+            ("BAKE_SELECTIONS", bakeSelectionsJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),
@@ -256,4 +314,6 @@ let make = (
         ~opts,
       )
     )
+
+  {roleId: lambdaRole.id, functionName: lambda.name}
 }