@reventlessdev/reventless-aws 3.0.0-alpha.290 → 3.0.0-alpha.292

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -38,7 +38,7 @@ export function response(ctx) {
 }
 `;
 
-function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opts) {
+function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bakedManifest, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let name = "PlatformUIDefinitions";
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
@@ -46,6 +46,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
     pluginReadModelTableName,
     offloadBucketName
   ]).apply(param => {
+    let offloadBucket = param[1];
     new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
         {
@@ -64,12 +65,30 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
           Sid: "AllowOffloadGet",
           Effect: "Allow",
           Action: ["s3:GetObject"],
-          Resource: "arn:aws:s3:::" + param[1] + "/*"
+          Resource: "arn:aws:s3:::" + offloadBucket + "/*"
+        },
+        {
+          Sid: "AllowOffloadList",
+          Effect: "Allow",
+          Action: ["s3:ListBucket"],
+          Resource: "arn:aws:s3:::" + offloadBucket
         }
       ])),
       role: lambdaRole.id
     }, opts$1);
   });
+  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(bakedManifest.components.map(sel => {
+      let entry = Object.fromEntries([[
+          "plugin",
+          sel.plugin
+        ]]);
+      let strings = (key, value) => Stdlib_Option.forEach(value, names => {
+        entry[key] = names.map(prim => prim);
+      });
+      strings("views", sel.views);
+      strings("commands", sel.commands);
+      return entry;
+    })) : "";
   let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, Platform_Admin_Structure$ReventlessCore.structure));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
@@ -104,6 +123,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
           "OFFLOAD_BUCKET",
           offloadBucketName
         ],
+        [
+          "BAKE_SELECTIONS",
+          bakeSelectionsJson
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions
@@ -143,6 +166,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, opt
   }, opts$1);
   AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Resolver", api, dataSource.name, "Query", "Platform_ComponentDefinitions", resolverCode, opts$1);
   schemaReady.apply(() => AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "StructuresResolver", api, dataSource.name, "Query", "Platform_PluginStructures", completeResolverCode, opts$1));
+  return {
+    roleId: lambdaRole.id,
+    functionName: lambda.name
+  };
 }
 
 export {

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -216,7 +216,18 @@ let resolveStructure = (
     ->Option.flatMap(JSON.Decode.string) {
     | None => Promise.resolve(item)
     | Some(key) =>
-      fetch(key)->Promise.then(bytes => {
+      fetch(key)
+      // The bucket answers for the whole platform, so a failure here says which
+      // plugin's ref could not be read — otherwise the S3 error names the key
+      // and the bucket, and finding the row it came from is a table scan by hand.
+      ->Promise.catch(e => {
+        let plugin = item->str("name")->Option.getOr("<unnamed>")
+        JsError.throwWithMessage(
+          `offloaded structure for plugin ${plugin} is unreadable at ${key}: ` ++
+          e->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error"),
+        )
+      })
+      ->Promise.then(bytes => {
         let resolved = Dict.fromArray(item->Dict.toArray)
         resolved->Dict.set("structure", JSON.parseOrThrow(bytes))
         Promise.resolve(resolved)
@@ -236,14 +247,214 @@ let isComplete = (event: JSON.t): bool =>
   ->Option.flatMap(JSON.Decode.bool)
   ->Option.getOr(false)
 
+// ── Bake mode ────────────────────────────────────────────────────────────────
+// The third thing this function does with the same scan: write the curated
+// manifest as a static object instead of answering a query with it.
+//
+// It belongs here rather than in a tool of its own for the reason the two GraphQL
+// fields already share a data source — there is one place that decides what a
+// deployed plugin's structure is, and the scan, the offload resolution and the
+// version collapse are that decision. A separate reader would be a second copy of
+// all three, free to drift about which version of a plugin is deployed.
+//
+// Invoked directly, after every plugin stack is up: the manifest describes the
+// whole deployment, and no single stack's deploy is the moment that is settled.
+
+// The persisted structure is served raw on the query paths — nothing decodes it —
+// but curation filters the RECORD and re-encodes through the shared encoder,
+// which is what makes an include-list naming everything produce the bytes the
+// query returns. So the bake decodes, and heals first: healing fills the list
+// fields an older persisted structure simply has no key for, and those are
+// exactly the fields the schema requires.
+//
+// A structure that still fails to decode fails the bake, naming the plugin. The
+// alternative — skipping it — ships a shop silently missing a section.
+let structureOf = (item: dict<JSON.t>, ~name as _: string): option<(
+  string,
+  Reventless.Plugin.pluginStructure,
+)> =>
+  switch (item->str("name"), item->Dict.get("structure")->Option.flatMap(JSON.Decode.object)) {
+  | (Some(pluginId), Some(structure)) =>
+    let healed = structure->healStructure->JSON.Encode.object
+    switch healed->S.parseJsonOrThrow(Reventless.Plugin.pluginStructureSchema) {
+    | decoded => Some((pluginId, decoded))
+    | exception _ =>
+      JsError.throwWithMessage(
+        `baked manifest: the structure persisted for "${pluginId}" cannot be decoded — ` ++
+        `it was written by a framework version this platform can no longer read. ` ++
+        `Redeploy that plugin, or drop it from the include-list.`,
+      )
+    }
+  | _ => None
+  }
+
+let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest.selection> => {
+  let strings = (o, key) =>
+    o
+    ->Dict.get(key)
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.map(a => a->Array.filterMap(JSON.Decode.string))
+  json
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    o
+    ->Dict.get("plugin")
+    ->Option.flatMap(JSON.Decode.string)
+    ->Option.map(plugin => {
+      ReventlessCore.Platform_BakedManifest.plugin,
+      views: strings(o, "views"),
+      commands: strings(o, "commands"),
+    })
+  )
+}
+
+// The declaration travels as an env var because it is deploy input — stated once
+// in the platform program, beside the bucket it is written to. The target travels
+// in the invocation payload instead: the bucket only exists inside the host-UI
+// half of the deploy, long after this function is built, and a caller that had to
+// know the include-list as well would be free to bake something the deployment
+// never declared.
+let bakeSelections = (): array<ReventlessCore.Platform_BakedManifest.selection> =>
+  switch NodeProcess.env->Dict.get("BAKE_SELECTIONS") {
+  | None | Some("") => []
+  | Some(raw) =>
+    switch raw->JSON.parseOrThrow->JSON.Decode.array {
+    | Some(entries) => entries->Array.filterMap(bakeSelection)
+    | None => []
+    | exception _ =>
+      JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array")
+    }
+  }
+
+type bakeTarget = {bucket: string, key: string}
+
+let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
+  event
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    switch (
+      o->Dict.get("bake")->Option.flatMap(JSON.Decode.bool),
+      o->Dict.get("bucket")->Option.flatMap(JSON.Decode.string),
+    ) {
+    | (Some(true), Some(bucket)) =>
+      Some({
+        bucket,
+        key: o
+        ->Dict.get("key")
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.getOr(ReventlessCore.Platform_BakedManifest.defaultKey),
+      })
+    | _ => None
+    }
+  )
+
+// ── Registration freshness ───────────────────────────────────────────────────
+// The read model this bake scans is updated asynchronously: the plugin stack
+// publishes a re-detect, the plugin answers with its definition, the projection
+// lands. Invoked seconds after the last stack finished, the scan can still
+// describe the deploy before it — and a manifest baked from that is wrong in the
+// one way nothing downstream can detect, because it is a perfectly well-formed
+// description of the wrong deployment.
+//
+// So the invocation carries the structure key each plugin stack just wrote. That
+// is an equality check rather than an inference from timestamps, and it costs
+// nothing for a plugin that was not redeployed: its key already matches. A caller
+// that supplies no expectations bakes whatever is current — the query paths never
+// send any, and a hand-run bake should not need to.
+let bakeExpectations = (event: JSON.t): dict<string> =>
+  event
+  ->JSON.Decode.object
+  ->Option.flatMap(o => o->Dict.get("expect"))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.mapOr(Dict.make(), o =>
+    o
+    ->Dict.toArray
+    ->Array.filterMap(((plugin, key)) => key->JSON.Decode.string->Option.map(k => (plugin, k)))
+    ->Dict.fromArray
+  )
+
+// The offload key a scanned row carries. None for a structure held inline, which
+// on a deployed platform means the row predates offloading — it cannot match an
+// expectation, and saying so beats baking it.
+let structureRefKey = (item: dict<JSON.t>): option<string> =>
+  item
+  ->Dict.get("structure")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(o => o->Dict.get(Reventless.Offload.sentinelKey))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(r => r->Dict.get("key"))
+  ->Option.flatMap(JSON.Decode.string)
+
+// Compared against the collapsed latest version per plugin, the same view the
+// bake itself takes — an older version's row lingering on the table is not the
+// registration anyone is waiting for.
+let pendingRegistrations = (items: array<dict<JSON.t>>, ~expect: dict<string>): array<string> => {
+  let current =
+    Platform_AdminScan_Ops.latestByName(
+      items,
+      ~nameVersionOf=item => item->str("name"),
+      ~toEntry=(item, ~name) => item->structureRefKey->Option.map(key => (name, key)),
+    )->Dict.fromArray
+  expect
+  ->Dict.toArray
+  ->Array.filterMap(((plugin, key)) => current->Dict.get(plugin) == Some(key) ? None : Some(plugin))
+}
+
+// Every failure mode here is the deployment's own mistake — a name matching no
+// component, a structure too old to read, a bucket the function may not write —
+// and every one of them produces the same symptom if swallowed: a shop that
+// renders nothing, with no line anywhere saying why. So the bake throws, and the
+// pipeline step that invoked it fails.
+let runBake = async (
+  ~target: bakeTarget,
+  ~structures: array<(string, Reventless.Plugin.pluginStructure)>,
+): array<JSON.t> => {
+  let selections = bakeSelections()
+  if selections->Array.length == 0 {
+    JsError.throwWithMessage(
+      "baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, " ++
+      "so there is nothing to write and a shell pointed at the file would find none.",
+    )
+  }
+  switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
+  | Error(e) =>
+    JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
+  | Ok(manifest) =>
+    let body = JSON.stringify(manifest, ~space=2)
+    let _ = await AwsSdk.S3.PutObjectCommand.make({
+      bucket: target.bucket,
+      key: target.key,
+      body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
+      contentType: "application/json",
+    })->AwsSdk.S3.PutObjectCommand.send
+    [
+      Dict.fromArray([
+        ("baked", JSON.Encode.bool(true)),
+        ("bucket", JSON.Encode.string(target.bucket)),
+        ("key", JSON.Encode.string(target.key)),
+        ("plugins", JSON.Encode.int(selections->Array.length)),
+        ("bytes", JSON.Encode.int(body->String.length)),
+      ])->JSON.Encode.object,
+    ]
+  }
+}
+
 let handler = async (event: JSON.t): array<JSON.t> => {
   let complete = isComplete(event)
+  let bakeTarget = bakeTargetOf(event)
   let toEntry = (item, ~name) => toEntryWith(~filter=!complete, item, ~name)
   let admin = adminEntry->Option.mapOr([], e => [e])
   switch NodeProcess.env->Dict.get("PLUGIN_RM_TABLE") {
   | None | Some("") =>
     Console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set")
-    admin
+    switch bakeTarget {
+    | Some(_) =>
+      JsError.throwWithMessage(
+        "baked manifest: PLUGIN_RM_TABLE env var not set — the bake would write an " ++
+        "empty shop rather than fail.",
+      )
+    | None => admin
+    }
   | Some(table) =>
     let rawItems = await Platform_AdminScan_Ops.scanAll(
       ~tableName=table,
@@ -256,9 +467,40 @@ let handler = async (event: JSON.t): array<JSON.t> => {
     let fetch = Reventless.Offload.cachedFetch(key =>
       AwsSdk.S3.GetObjectCommand.getString(~bucket, ~key)
     )
-    let items = await Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
-    let userEntries =
-      Platform_AdminScan_Ops.latestByName(items, ~nameVersionOf=item => item->str("name"), ~toEntry)
-    Array.concat(admin, userEntries)
+    let resolveAll = () => Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
+    switch bakeTarget {
+    | Some(target) =>
+      // Checked on the raw rows: the refs are what the deploy can predict, and a
+      // row that is behind should not have its structure fetched at all.
+      switch pendingRegistrations(rawItems, ~expect=bakeExpectations(event)) {
+      | [] =>
+        // The built-in admin entry is deliberately absent: it never enters the
+        // Plugin read model, and the in-memory bake curates the composed plugins
+        // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
+        let structures = Platform_AdminScan_Ops.latestByName(
+          await resolveAll(),
+          ~nameVersionOf=item => item->str("name"),
+          ~toEntry=structureOf,
+        )
+        await runBake(~target, ~structures)
+      | pending =>
+        // Not an error — the deploy just has not finished arriving. Reported so the
+        // caller can invoke again rather than bake the previous deployment.
+        [
+          Dict.fromArray([
+            ("baked", JSON.Encode.bool(false)),
+            ("pending", pending->Array.map(JSON.Encode.string)->JSON.Encode.array),
+          ])->JSON.Encode.object,
+        ]
+      }
+    | None =>
+      let userEntries =
+        Platform_AdminScan_Ops.latestByName(
+          await resolveAll(),
+          ~nameVersionOf=item => item->str("name"),
+          ~toEntry,
+        )
+      Array.concat(admin, userEntries)
+    }
   }
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -1,12 +1,21 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S from "sury/src/S.res.mjs";
 import * as Nodefs from "node:fs";
 import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
+import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
 import * as Platform_AdminScan_Ops$ReventlessAws from "./Platform_AdminScan_Ops.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 function str(item, key) {
   return Stdlib_Option.flatMap(item[key], Stdlib_JSON.Decode.string);
@@ -210,7 +219,10 @@ function resolveStructure(fetch, item) {
   }
   let key = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(refJson), r => r["key"]), Stdlib_JSON.Decode.string);
   if (key !== undefined) {
-    return fetch(key).then(bytes => {
+    return Stdlib_Promise.$$catch(fetch(key), e => {
+      let plugin = Stdlib_Option.getOr(str(item, "name"), "<unnamed>");
+      return Stdlib_JsError.throwWithMessage(`offloaded structure for plugin ` + plugin + ` is unreadable at ` + key + `: ` + Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(e), Stdlib_JsExn.message), "unknown error"));
+    }).then(bytes => {
       let resolved = Object.fromEntries(Object.entries(item));
       resolved["structure"] = JSON.parse(bytes);
       return Promise.resolve(resolved);
@@ -224,16 +236,147 @@ function isComplete(event) {
   return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => o["complete"]), Stdlib_JSON.Decode.bool), false);
 }
 
+function structureOf(item, param) {
+  let match = str(item, "name");
+  let match$1 = Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object);
+  if (match === undefined) {
+    return;
+  }
+  if (match$1 === undefined) {
+    return;
+  }
+  let healed = healStructure(match$1);
+  let decoded;
+  try {
+    decoded = S.parseJsonOrThrow(healed, Plugin$Reventless.pluginStructureSchema);
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage(`baked manifest: the structure persisted for "` + match + `" cannot be decoded — it was written by a framework version this platform can no longer read. Redeploy that plugin, or drop it from the include-list.`);
+  }
+  return [
+    match,
+    decoded
+  ];
+}
+
+function bakeSelection(json) {
+  let strings = (o, key) => Stdlib_Option.map(Stdlib_Option.flatMap(o[key], Stdlib_JSON.Decode.array), a => Stdlib_Array.filterMap(a, Stdlib_JSON.Decode.string));
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => Stdlib_Option.map(Stdlib_Option.flatMap(o["plugin"], Stdlib_JSON.Decode.string), plugin => ({
+    plugin: plugin,
+    views: strings(o, "views"),
+    commands: strings(o, "commands")
+  })));
+}
+
+function bakeSelections() {
+  let raw = process.env["BAKE_SELECTIONS"];
+  if (raw === undefined) {
+    return [];
+  }
+  if (raw === "") {
+    return [];
+  }
+  let entries;
+  try {
+    entries = Stdlib_JSON.Decode.array(JSON.parse(raw));
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+  }
+  if (entries !== undefined) {
+    return Stdlib_Array.filterMap(entries, bakeSelection);
+  } else {
+    return [];
+  }
+}
+
+function bakeTargetOf(event) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => {
+    let match = Stdlib_Option.flatMap(o["bake"], Stdlib_JSON.Decode.bool);
+    let match$1 = Stdlib_Option.flatMap(o["bucket"], Stdlib_JSON.Decode.string);
+    if (match !== undefined && match && match$1 !== undefined) {
+      return {
+        bucket: match$1,
+        key: Stdlib_Option.getOr(Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string), Platform_BakedManifest$ReventlessCore.defaultKey)
+      };
+    }
+  });
+}
+
+function bakeExpectations(event) {
+  return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => o["expect"]), Stdlib_JSON.Decode.object), {}, o => Object.fromEntries(Stdlib_Array.filterMap(Object.entries(o), param => {
+    let plugin = param[0];
+    return Stdlib_Option.map(Stdlib_JSON.Decode.string(param[1]), k => [
+      plugin,
+      k
+    ]);
+  })));
+}
+
+function structureRefKey(item) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object), o => o[Offload$Reventless.sentinelKey]), Stdlib_JSON.Decode.object), r => r["key"]), Stdlib_JSON.Decode.string);
+}
+
+function pendingRegistrations(items, expect) {
+  let current = Object.fromEntries(Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), (item, name) => Stdlib_Option.map(structureRefKey(item), key => [
+    name,
+    key
+  ])));
+  return Stdlib_Array.filterMap(Object.entries(expect), param => {
+    let plugin = param[0];
+    if (Primitive_object.equal(current[plugin], param[1])) {
+      return;
+    } else {
+      return plugin;
+    }
+  });
+}
+
+async function runBake(target, structures) {
+  let selections = bakeSelections();
+  if (selections.length === 0) {
+    Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, so there is nothing to write and a shell pointed at the file would find none.");
+  }
+  let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
+  if (e.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
+  }
+  let body = JSON.stringify(e._0, undefined, 2);
+  await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
+    Bucket: target.bucket,
+    Key: target.key,
+    Body: body,
+    ContentType: "application/json"
+  }));
+  return [Object.fromEntries([
+      [
+        "baked",
+        true
+      ],
+      [
+        "bucket",
+        target.bucket
+      ],
+      [
+        "key",
+        target.key
+      ],
+      [
+        "plugins",
+        selections.length
+      ],
+      [
+        "bytes",
+        body.length
+      ]
+    ])];
+}
+
 async function handler(event) {
   let complete = isComplete(event);
+  let bakeTarget = bakeTargetOf(event);
   let toEntry = (item, name) => toEntryWith(!complete, item, name);
   let admin = Stdlib_Option.mapOr(adminEntry, [], e => [e]);
   let table = process.env["PLUGIN_RM_TABLE"];
-  if (table !== undefined) {
-    if (table === "") {
-      console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
-      return admin;
-    }
+  if (table !== undefined && table !== "") {
     let rawItems = await Platform_AdminScan_Ops$ReventlessAws.scanAll(table, "contains(#status, :connected)", Object.fromEntries([[
         "#status",
         "status"
@@ -243,12 +386,33 @@ async function handler(event) {
       ]]));
     let bucket = Stdlib_Option.getOr(process.env["OFFLOAD_BUCKET"], "");
     let fetch = Offload$Reventless.cachedFetch(key => S3$AwsSdk.GetObjectCommand.getString(bucket, key));
-    let items = await Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
-    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), toEntry);
+    let resolveAll = () => Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
+    if (bakeTarget !== undefined) {
+      let pending = pendingRegistrations(rawItems, bakeExpectations(event));
+      if (pending.length !== 0) {
+        return [Object.fromEntries([
+            [
+              "baked",
+              false
+            ],
+            [
+              "pending",
+              pending.map(prim => prim)
+            ]
+          ])];
+      }
+      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), structureOf);
+      return await runBake(bakeTarget, structures);
+    }
+    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), toEntry);
     return admin.concat(userEntries);
   }
   console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
-  return admin;
+  if (bakeTarget !== undefined) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: PLUGIN_RM_TABLE env var not set — the bake would write an empty shop rather than fail.");
+  } else {
+    return admin;
+  }
 }
 
 export {
@@ -266,6 +430,14 @@ export {
   adminEntry,
   resolveStructure,
   isComplete,
+  structureOf,
+  bakeSelection,
+  bakeSelections,
+  bakeTargetOf,
+  bakeExpectations,
+  structureRefKey,
+  pendingRegistrations,
+  runBake,
   handler,
 }
 /* adminEntry Not a pure module */

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -186,6 +186,20 @@ let heartbeatConfigRef: ref<heartbeatConfig> = ref({
 let registerHeartbeatConfig = (~pluginId, ~heartbeatTimeout, ~epQueueUrl=?, ()) =>
   heartbeatConfigRef := {pluginId, heartbeatTimeout, epQueueUrl}
 
+// Resolves once this plugin's EventCollector Lambda exists at its new code.
+// `Platform.deployPlugin` gates the deploy-time re-detect on it: the re-detect
+// only asks the platform to re-run the connect handshake, and this is the Lambda
+// that ANSWERS it, with the `pluginDefinition` its deployed code carries. Fired
+// before this Lambda is updated, the plugin answers with the previous deploy's
+// definition, `Connect` sees a definition it already holds and emits nothing, and
+// the row keeps the old structure — with no second re-detect to correct it.
+//
+// A bare `Output<unit>` rather than an `option<Output<_>>`: an Output is a
+// JS Proxy, and wrapping one in a ReScript option produces the nested-Some
+// sentinel instead of the value. Empty until `forPluginEventCollector` runs,
+// which the gate reads only after `P.make()` has returned.
+let eventCollectorReadyRef: ref<Pulumi.Output.t<unit>> = ref(Pulumi.Output.make())
+
 // Per-flavor commandHandlerConfig override for the two DCB command-handler Lambdas
 // (`<Plugin>DcbCmdHandler` sync / `<Plugin>DcbAsyncCmdHandler` async); populated by
 // Platform.MakeWithConfig from `commandHandlerConfig.stateChanges.{sync,async}`.
@@ -624,6 +638,8 @@ module Make = (
       ~opts,
     )
 
+    eventCollectorReadyRef := runtime.parts.lambda->Pulumi.Output.apply(_ => ())
+
     // Admin-only cross-plugin SNS subscription permissions. The admin EC
     // Lambda's manageSubscriptions hook (Phase 3 Step 1) creates SNS
     // subscriptions at runtime as plugins connect/disconnect; that needs

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -149,6 +149,10 @@ function registerHeartbeatConfig(pluginId, heartbeatTimeout, epQueueUrl, param)
   };
 }
 
+let eventCollectorReadyRef = {
+  contents: Pulumi.output()
+};
+
 let syncStateChangesConfigRef = {
   contents: {}
 };
@@ -381,6 +385,7 @@ function Make(EventCollectorChannel) {
         eventTopics: eventTopics,
         resources: resources
       }], runtime, opts);
+    eventCollectorReadyRef.contents = runtime.parts.lambda.apply(param => {});
     let isAdminEventCollector = Stdlib_Option.isNone(Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name]);
     if (isAdminEventCollector) {
       new (Aws.iam.RolePolicy)(name + `-snsManageSubs`, {
@@ -542,6 +547,7 @@ export {
   registerDcbTableName,
   heartbeatConfigRef,
   registerHeartbeatConfig,
+  eventCollectorReadyRef,
   syncStateChangesConfigRef,
   asyncStateChangesConfigRef,
   setStateChangesConfig,