@reventlessdev/reventless-aws 3.0.0-alpha.291 → 3.0.0-alpha.292

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.292 (2026-08-13)
+
+### Bug Fixes
+
+* **aws:** re-detect once the Lambda that answers the handshake is up ([597e174](https://github.com/ReventlessDev/reventless-core/commit/597e174059e25461d66db35118c933d2ffce7e1f))
+* **aws:** retain offloaded plugin structures so refs cannot dangle ([120a1a7](https://github.com/ReventlessDev/reventless-core/commit/120a1a7228087dd79f8bcfdd2fddc7b6dbdaf296))
+
+
 # 3.0.0-alpha.291 (2026-08-13)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.291",
+  "version": "3.0.0-alpha.292",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,16 +13,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.73",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.72",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.138",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.230",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.94",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.231",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.95",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {

package/src/Platform.res

@@ -2296,11 +2296,34 @@ module MakeWithConfig = (
       ->Pulumi.Output.apply(o => o->Option.getOr("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY"))
     | None => Pulumi.Output.make("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")
     }
+    // The key this deploy wrote for the plugin's structure, exported below. The
+    // Plugin read model is what the manifest bake reads and it is updated
+    // asynchronously, so the bake needs to know which structure "current" means;
+    // an equality check against the key the stack just wrote says that without
+    // timestamps, and passes immediately for a plugin whose structure did not
+    // change.
+    let structureOffloadKey = ref(None)
+
     ReventlessCore.Plugin_Helpers.registerOffload((~store, ~bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes)
       let key = "sha256/" ++ hash
+      if store == "pluginStructures" {
+        structureOffloadKey := Some(key)
+      }
       // Content-addressed: the name and key are the hash, so re-deploying an
       // unchanged field writes the same object (idempotent, deduplicating).
+      //
+      // `retainOnDelete`: the only readers of these objects are the persisted
+      // refs on the Plugin read model, and that row is updated asynchronously —
+      // the deploy publishes a re-detect, the Plugin aggregate handles it, the
+      // projection lands, minutes later. A changed field means a new hash, so
+      // without this Pulumi DELETES the previous object as part of the same
+      // update, and every reference still on the read model dangles until
+      // registration catches up. S3 answers a GET for a deleted key with
+      // AccessDenied (it masks the 404 unless the caller may ListBucket), so the
+      // window shows up as an authorization failure in the manifest bake and in
+      // the AutoUI definitions query. Content-addressed objects are immutable
+      // and cost kilobytes; keeping them closes the window outright.
       let _ = PulumiAws.S3.BucketObject.make(
         ~name="offload-" ++ hash,
         ~args={
@@ -2309,6 +2332,7 @@ module MakeWithConfig = (
           content: Pulumi.Input.make(bytes),
           contentType: Pulumi.Input.make("application/json"),
         },
+        ~opts={retainOnDelete: true},
       )
       {Reventless.Offload.store, key, hash, bytes: bytes->String.length}
     })
@@ -2361,6 +2385,23 @@ module MakeWithConfig = (
     let pluginOutputs = pluginComponent->ReventlessCore.Component.outputs
     ReventlessCore.Plugin_Helpers.exportPluginOutputs(pluginOutputs)
 
+    // What the manifest bake compares the read model against. Keyed by the bare
+    // plugin name because that is how the Plugin read model keys its rows — the
+    // stack's own id carries the version, which the bake has no opinion about.
+    switch structureOffloadKey.contents {
+    | Some(key) =>
+      Pulumi.Pulumi.export(
+        "pluginStructureRef",
+        pluginOutputs.id->Pulumi.Output.apply(id =>
+          Dict.fromArray([
+            ("plugin", JSON.Encode.string(ReventlessCore.Plugin.name(id))),
+            ("key", JSON.Encode.string(key)),
+          ])->JSON.Encode.object
+        ),
+      )
+    | None => ()
+    }
+
     // ── Merged-API association (merged-api plan, Phase 4) ───────────────────
     // Associate this plugin's source API with the platform's merged API —
     // this replaces the SigV4 RegisterApiFragment handshake + reactive push +
@@ -2539,7 +2580,20 @@ module MakeWithConfig = (
     // synchronously always saw the initial empty config, so the publish was skipped
     // on every deploy. `pluginOutputs.heartbeat` derives from that same callback's
     // output, so applying to it is the earliest point the config is populated.
-    let _ = pluginOutputs.heartbeat->Pulumi.Output.apply(_ => {
+    //
+    // The EventCollector Lambda is the other half of the gate because it is what
+    // ANSWERS the handshake: the re-detect only asks the platform to re-run it,
+    // and the definition that comes back is the one compiled into that Lambda
+    // (PluginConnectExtension_Mapping's UnknownPluginDetected branch). Published
+    // before it carries the new code, the plugin answers with the PREVIOUS
+    // deploy's definition, `Connect` sees a definition it already holds and emits
+    // nothing, and the row keeps the old structure — silently, and with no second
+    // re-detect coming to correct it. Waiting on the heartbeat alone gated on a
+    // Lambda that has no part in the answer.
+    let redetectReady =
+      (pluginOutputs.heartbeat, PluginRuntime_Builder.eventCollectorReadyRef.contents)
+      ->Pulumi.Output.all2
+    let _ = redetectReady->Pulumi.Output.apply(_ => {
       let hbConfig = PluginRuntime_Builder.heartbeatConfigRef.contents
       switch (Pulumi.Pulumi.isDryRun(), hbConfig.epQueueUrl) {
       | (true, _) => () // `pulumi preview` — no deploy-time side effects

package/src/Platform.res.mjs

@@ -16,6 +16,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
@@ -1248,14 +1249,22 @@ function MakeWithConfig(Config) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -1273,6 +1282,19 @@ function MakeWithConfig(Config) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -1335,7 +1357,11 @@ function MakeWithConfig(Config) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;
@@ -2499,14 +2525,22 @@ function Make($star) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -2524,6 +2558,19 @@ function Make($star) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -2586,7 +2633,11 @@ function Make($star) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -117,6 +117,16 @@ let make = (
                 actions: Actions(["s3:GetObject"]),
                 resources: Resource("arn:aws:s3:::" ++ offloadBucket ++ "/*"),
               },
+              // Read-only on the bucket itself, purely so a key that is not there
+              // says so: S3 answers GET for a missing key with AccessDenied unless
+              // the caller may list the bucket, which reports a ref the handler
+              // cannot resolve as an IAM problem it does not have.
+              {
+                sid: "AllowOffloadList",
+                effect: Allow,
+                actions: Actions(["s3:ListBucket"]),
+                resources: Resource("arn:aws:s3:::" ++ offloadBucket),
+              },
             ],
           )
           ->PolicyDocument.toJsonString

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -46,6 +46,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
     pluginReadModelTableName,
     offloadBucketName
   ]).apply(param => {
+    let offloadBucket = param[1];
     new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
         {
@@ -64,7 +65,13 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
           Sid: "AllowOffloadGet",
           Effect: "Allow",
           Action: ["s3:GetObject"],
-          Resource: "arn:aws:s3:::" + param[1] + "/*"
+          Resource: "arn:aws:s3:::" + offloadBucket + "/*"
+        },
+        {
+          Sid: "AllowOffloadList",
+          Effect: "Allow",
+          Action: ["s3:ListBucket"],
+          Resource: "arn:aws:s3:::" + offloadBucket
         }
       ])),
       role: lambdaRole.id

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -216,7 +216,18 @@ let resolveStructure = (
     ->Option.flatMap(JSON.Decode.string) {
     | None => Promise.resolve(item)
     | Some(key) =>
-      fetch(key)->Promise.then(bytes => {
+      fetch(key)
+      // The bucket answers for the whole platform, so a failure here says which
+      // plugin's ref could not be read — otherwise the S3 error names the key
+      // and the bucket, and finding the row it came from is a table scan by hand.
+      ->Promise.catch(e => {
+        let plugin = item->str("name")->Option.getOr("<unnamed>")
+        JsError.throwWithMessage(
+          `offloaded structure for plugin ${plugin} is unreadable at ${key}: ` ++
+          e->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error"),
+        )
+      })
+      ->Promise.then(bytes => {
         let resolved = Dict.fromArray(item->Dict.toArray)
         resolved->Dict.set("structure", JSON.parseOrThrow(bytes))
         Promise.resolve(resolved)
@@ -337,6 +348,58 @@ let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
     }
   )
 
+// ── Registration freshness ───────────────────────────────────────────────────
+// The read model this bake scans is updated asynchronously: the plugin stack
+// publishes a re-detect, the plugin answers with its definition, the projection
+// lands. Invoked seconds after the last stack finished, the scan can still
+// describe the deploy before it — and a manifest baked from that is wrong in the
+// one way nothing downstream can detect, because it is a perfectly well-formed
+// description of the wrong deployment.
+//
+// So the invocation carries the structure key each plugin stack just wrote. That
+// is an equality check rather than an inference from timestamps, and it costs
+// nothing for a plugin that was not redeployed: its key already matches. A caller
+// that supplies no expectations bakes whatever is current — the query paths never
+// send any, and a hand-run bake should not need to.
+let bakeExpectations = (event: JSON.t): dict<string> =>
+  event
+  ->JSON.Decode.object
+  ->Option.flatMap(o => o->Dict.get("expect"))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.mapOr(Dict.make(), o =>
+    o
+    ->Dict.toArray
+    ->Array.filterMap(((plugin, key)) => key->JSON.Decode.string->Option.map(k => (plugin, k)))
+    ->Dict.fromArray
+  )
+
+// The offload key a scanned row carries. None for a structure held inline, which
+// on a deployed platform means the row predates offloading — it cannot match an
+// expectation, and saying so beats baking it.
+let structureRefKey = (item: dict<JSON.t>): option<string> =>
+  item
+  ->Dict.get("structure")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(o => o->Dict.get(Reventless.Offload.sentinelKey))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(r => r->Dict.get("key"))
+  ->Option.flatMap(JSON.Decode.string)
+
+// Compared against the collapsed latest version per plugin, the same view the
+// bake itself takes — an older version's row lingering on the table is not the
+// registration anyone is waiting for.
+let pendingRegistrations = (items: array<dict<JSON.t>>, ~expect: dict<string>): array<string> => {
+  let current =
+    Platform_AdminScan_Ops.latestByName(
+      items,
+      ~nameVersionOf=item => item->str("name"),
+      ~toEntry=(item, ~name) => item->structureRefKey->Option.map(key => (name, key)),
+    )->Dict.fromArray
+  expect
+  ->Dict.toArray
+  ->Array.filterMap(((plugin, key)) => current->Dict.get(plugin) == Some(key) ? None : Some(plugin))
+}
+
 // Every failure mode here is the deployment's own mistake — a name matching no
 // component, a structure too old to read, a bucket the function may not write —
 // and every one of them produces the same symptom if swallowed: a shop that
@@ -404,22 +467,36 @@ let handler = async (event: JSON.t): array<JSON.t> => {
     let fetch = Reventless.Offload.cachedFetch(key =>
       AwsSdk.S3.GetObjectCommand.getString(~bucket, ~key)
     )
-    let items = await Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
+    let resolveAll = () => Promise.all(rawItems->Array.map(item => resolveStructure(fetch, item)))
     switch bakeTarget {
     | Some(target) =>
-      // The built-in admin entry is deliberately absent: it never enters the
-      // Plugin read model, and the in-memory bake curates the composed plugins
-      // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
-      let structures = Platform_AdminScan_Ops.latestByName(
-        items,
-        ~nameVersionOf=item => item->str("name"),
-        ~toEntry=structureOf,
-      )
-      await runBake(~target, ~structures)
+      // Checked on the raw rows: the refs are what the deploy can predict, and a
+      // row that is behind should not have its structure fetched at all.
+      switch pendingRegistrations(rawItems, ~expect=bakeExpectations(event)) {
+      | [] =>
+        // The built-in admin entry is deliberately absent: it never enters the
+        // Plugin read model, and the in-memory bake curates the composed plugins
+        // only. A deployment naming it gets `UnknownPlugin`, on both platforms.
+        let structures = Platform_AdminScan_Ops.latestByName(
+          await resolveAll(),
+          ~nameVersionOf=item => item->str("name"),
+          ~toEntry=structureOf,
+        )
+        await runBake(~target, ~structures)
+      | pending =>
+        // Not an error — the deploy just has not finished arriving. Reported so the
+        // caller can invoke again rather than bake the previous deployment.
+        [
+          Dict.fromArray([
+            ("baked", JSON.Encode.bool(false)),
+            ("pending", pending->Array.map(JSON.Encode.string)->JSON.Encode.array),
+          ])->JSON.Encode.object,
+        ]
+      }
     | None =>
       let userEntries =
         Platform_AdminScan_Ops.latestByName(
-          items,
+          await resolveAll(),
           ~nameVersionOf=item => item->str("name"),
           ~toEntry,
         )

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -6,8 +6,11 @@ import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
 import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Offload$Reventless from "@reventlessdev/reventless-spec/src/semantic/Offload.res.mjs";
@@ -216,7 +219,10 @@ function resolveStructure(fetch, item) {
   }
   let key = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(refJson), r => r["key"]), Stdlib_JSON.Decode.string);
   if (key !== undefined) {
-    return fetch(key).then(bytes => {
+    return Stdlib_Promise.$$catch(fetch(key), e => {
+      let plugin = Stdlib_Option.getOr(str(item, "name"), "<unnamed>");
+      return Stdlib_JsError.throwWithMessage(`offloaded structure for plugin ` + plugin + ` is unreadable at ` + key + `: ` + Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(e), Stdlib_JsExn.message), "unknown error"));
+    }).then(bytes => {
       let resolved = Object.fromEntries(Object.entries(item));
       resolved["structure"] = JSON.parse(bytes);
       return Promise.resolve(resolved);
@@ -295,6 +301,35 @@ function bakeTargetOf(event) {
   });
 }
 
+function bakeExpectations(event) {
+  return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(event), o => o["expect"]), Stdlib_JSON.Decode.object), {}, o => Object.fromEntries(Stdlib_Array.filterMap(Object.entries(o), param => {
+    let plugin = param[0];
+    return Stdlib_Option.map(Stdlib_JSON.Decode.string(param[1]), k => [
+      plugin,
+      k
+    ]);
+  })));
+}
+
+function structureRefKey(item) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(item["structure"], Stdlib_JSON.Decode.object), o => o[Offload$Reventless.sentinelKey]), Stdlib_JSON.Decode.object), r => r["key"]), Stdlib_JSON.Decode.string);
+}
+
+function pendingRegistrations(items, expect) {
+  let current = Object.fromEntries(Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), (item, name) => Stdlib_Option.map(structureRefKey(item), key => [
+    name,
+    key
+  ])));
+  return Stdlib_Array.filterMap(Object.entries(expect), param => {
+    let plugin = param[0];
+    if (Primitive_object.equal(current[plugin], param[1])) {
+      return;
+    } else {
+      return plugin;
+    }
+  });
+}
+
 async function runBake(target, structures) {
   let selections = bakeSelections();
   if (selections.length === 0) {
@@ -351,12 +386,25 @@ async function handler(event) {
       ]]));
     let bucket = Stdlib_Option.getOr(process.env["OFFLOAD_BUCKET"], "");
     let fetch = Offload$Reventless.cachedFetch(key => S3$AwsSdk.GetObjectCommand.getString(bucket, key));
-    let items = await Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
+    let resolveAll = () => Promise.all(rawItems.map(item => resolveStructure(fetch, item)));
     if (bakeTarget !== undefined) {
-      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), structureOf);
+      let pending = pendingRegistrations(rawItems, bakeExpectations(event));
+      if (pending.length !== 0) {
+        return [Object.fromEntries([
+            [
+              "baked",
+              false
+            ],
+            [
+              "pending",
+              pending.map(prim => prim)
+            ]
+          ])];
+      }
+      let structures = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), structureOf);
       return await runBake(bakeTarget, structures);
     }
-    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(items, item => str(item, "name"), toEntry);
+    let userEntries = Platform_AdminScan_Ops$ReventlessAws.latestByName(await resolveAll(), item => str(item, "name"), toEntry);
     return admin.concat(userEntries);
   }
   console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
@@ -386,6 +434,9 @@ export {
   bakeSelection,
   bakeSelections,
   bakeTargetOf,
+  bakeExpectations,
+  structureRefKey,
+  pendingRegistrations,
   runBake,
   handler,
 }

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -186,6 +186,20 @@ let heartbeatConfigRef: ref<heartbeatConfig> = ref({
 let registerHeartbeatConfig = (~pluginId, ~heartbeatTimeout, ~epQueueUrl=?, ()) =>
   heartbeatConfigRef := {pluginId, heartbeatTimeout, epQueueUrl}
 
+// Resolves once this plugin's EventCollector Lambda exists at its new code.
+// `Platform.deployPlugin` gates the deploy-time re-detect on it: the re-detect
+// only asks the platform to re-run the connect handshake, and this is the Lambda
+// that ANSWERS it, with the `pluginDefinition` its deployed code carries. Fired
+// before this Lambda is updated, the plugin answers with the previous deploy's
+// definition, `Connect` sees a definition it already holds and emits nothing, and
+// the row keeps the old structure — with no second re-detect to correct it.
+//
+// A bare `Output<unit>` rather than an `option<Output<_>>`: an Output is a
+// JS Proxy, and wrapping one in a ReScript option produces the nested-Some
+// sentinel instead of the value. Empty until `forPluginEventCollector` runs,
+// which the gate reads only after `P.make()` has returned.
+let eventCollectorReadyRef: ref<Pulumi.Output.t<unit>> = ref(Pulumi.Output.make())
+
 // Per-flavor commandHandlerConfig override for the two DCB command-handler Lambdas
 // (`<Plugin>DcbCmdHandler` sync / `<Plugin>DcbAsyncCmdHandler` async); populated by
 // Platform.MakeWithConfig from `commandHandlerConfig.stateChanges.{sync,async}`.
@@ -624,6 +638,8 @@ module Make = (
       ~opts,
     )
 
+    eventCollectorReadyRef := runtime.parts.lambda->Pulumi.Output.apply(_ => ())
+
     // Admin-only cross-plugin SNS subscription permissions. The admin EC
     // Lambda's manageSubscriptions hook (Phase 3 Step 1) creates SNS
     // subscriptions at runtime as plugins connect/disconnect; that needs

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -149,6 +149,10 @@ function registerHeartbeatConfig(pluginId, heartbeatTimeout, epQueueUrl, param)
   };
 }
 
+let eventCollectorReadyRef = {
+  contents: Pulumi.output()
+};
+
 let syncStateChangesConfigRef = {
   contents: {}
 };
@@ -381,6 +385,7 @@ function Make(EventCollectorChannel) {
         eventTopics: eventTopics,
         resources: resources
       }], runtime, opts);
+    eventCollectorReadyRef.contents = runtime.parts.lambda.apply(param => {});
     let isAdminEventCollector = Stdlib_Option.isNone(Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name]);
     if (isAdminEventCollector) {
       new (Aws.iam.RolePolicy)(name + `-snsManageSubs`, {
@@ -542,6 +547,7 @@ export {
   registerDcbTableName,
   heartbeatConfigRef,
   registerHeartbeatConfig,
+  eventCollectorReadyRef,
   syncStateChangesConfigRef,
   asyncStateChangesConfigRef,
   setStateChangesConfig,

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res

@@ -240,3 +240,113 @@ describe("bakeSelection", () => {
     expect(sel(`{"views": ["Orders"]}`)->Option.isNone)->toBe(true)
   )
 })
+
+// The bake reads a read model the deploy updates asynchronously, so "is this the
+// deployment I was asked to bake" is a question it has to be able to answer. The
+// answer is an equality check against the key each plugin stack just wrote.
+describe("pendingRegistrations", () => {
+  let row = (~name, ~key=?, ()) => {
+    let item = Dict.fromArray([("name", JSON.Encode.string(name))])
+    key->Option.forEach(k =>
+      item->Dict.set(
+        "structure",
+        JSON.parseOrThrow(`{"$offload": {"store": "pluginStructures", "key": "${k}"}}`),
+      )
+    )
+    item
+  }
+
+  let pending = (rows, expect) =>
+    Platform_ComponentDefinitions_Lambda_Ops.pendingRegistrations(
+      rows,
+      ~expect=Dict.fromArray(expect),
+    )
+
+  testSync("nothing is pending when every row carries the key the deploy wrote", () =>
+    expect(
+      pending(
+        [row(~name="Catalog", ~key="sha256/a", ()), row(~name="Ordering", ~key="sha256/b", ())],
+        [("Catalog", "sha256/a"), ("Ordering", "sha256/b")],
+      ),
+    )->toEqual([])
+  )
+
+  // The window this exists for: the stack wrote a new structure, the row still
+  // points at the one before it.
+  testSync("names a plugin still carrying the previous structure", () =>
+    expect(
+      pending(
+        [row(~name="Catalog", ~key="sha256/a", ()), row(~name="Ordering", ~key="sha256/old", ())],
+        [("Catalog", "sha256/a"), ("Ordering", "sha256/new")],
+      ),
+    )->toEqual(["Ordering"])
+  )
+
+  // A plugin that has never registered is behind, not absent — baking without it
+  // would ship a shop missing a section.
+  testSync("names a plugin with no row at all", () =>
+    expect(pending([], [("Ordering", "sha256/new")]))->toEqual(["Ordering"])
+  )
+
+  // Deployed before the stack exported its key, or invoked by hand: bake what is
+  // current rather than wait for an expectation nobody stated.
+  testSync("waits for nothing when the caller expects nothing", () =>
+    expect(pending([row(~name="Ordering", ~key="sha256/old", ())], []))->toEqual([])
+  )
+
+  testSync("reads the expectations off the invocation payload", () =>
+    expect(
+      Platform_ComponentDefinitions_Lambda_Ops.bakeExpectations(
+        JSON.parseOrThrow(`{"bake": true, "expect": {"Ordering": "sha256/b"}}`),
+      )->Dict.get("Ordering"),
+    )->toEqual(Some("sha256/b"))
+  )
+})
+
+describe("resolveStructure", () => {
+  let item = (structure: string) =>
+    Dict.fromArray([
+      ("name", JSON.Encode.string("Ordering")),
+      ("structure", JSON.parseOrThrow(structure)),
+    ])
+
+  let offloaded = `{"$offload": {"store": "pluginStructures", "key": "sha256/abc", "bytes": 4}}`
+
+  test("substitutes the fetched bytes for the reference", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.resolve(`{"aggregates": []}`),
+      item(offloaded),
+    )
+    expect(resolved->Dict.get("structure")->Option.map(j => JSON.stringify(j)))->toEqual(
+      Some(`{"aggregates":[]}`),
+    )
+  })
+
+  // One offload bucket serves every plugin, so the S3 error names only the key —
+  // which plugin's row carries the unreadable reference is the part worth having.
+  // A missing object is the shape a deploy leaves behind while the read model
+  // still points at the previous structure.
+  test("names the plugin whose reference cannot be read", async () => {
+    let failed = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.reject(JsExn.anyToExnInternal(JsError.make("AccessDenied"))),
+      item(offloaded),
+    )
+    ->Promise.thenResolve(_ => None)
+    ->Promise.catch(e =>
+      Promise.resolve(e->JsExn.fromException->Option.flatMap(JsExn.message))
+    )
+    expect(failed)->toEqual(
+      Some("offloaded structure for plugin Ordering is unreadable at sha256/abc: AccessDenied"),
+    )
+  })
+
+  test("passes an inline structure through untouched", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops.resolveStructure(
+      _ => Promise.reject(JsExn.anyToExnInternal(JsError.make("must not fetch"))),
+      item(`{"aggregates": []}`),
+    )
+    expect(resolved->Dict.get("structure")->Option.map(j => JSON.stringify(j)))->toEqual(
+      Some(`{"aggregates":[]}`),
+    )
+  })
+})

package/tests/Platform_ComponentDefinitions_Lambda_OpsTest.res.mjs

@@ -2,7 +2,10 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws from "../src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs";
 
 function entry(filter, structure) {
@@ -151,6 +154,90 @@ globalThis.describe("bakeSelection", () => {
   });
 });
 
+globalThis.describe("pendingRegistrations", () => {
+  let row = (name, key, param) => {
+    let item = Object.fromEntries([[
+        "name",
+        name
+      ]]);
+    Stdlib_Option.forEach(key, k => {
+      item["structure"] = JSON.parse(`{"$offload": {"store": "pluginStructures", "key": "` + k + `"}}`);
+    });
+    return item;
+  };
+  globalThis.test("nothing is pending when every row carries the key the deploy wrote", () => {
+    let rows = [
+      row("Catalog", "sha256/a", undefined),
+      row("Ordering", "sha256/b", undefined)
+    ];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([
+      [
+        "Catalog",
+        "sha256/a"
+      ],
+      [
+        "Ordering",
+        "sha256/b"
+      ]
+    ]))).toEqual([]);
+  });
+  globalThis.test("names a plugin still carrying the previous structure", () => {
+    let rows = [
+      row("Catalog", "sha256/a", undefined),
+      row("Ordering", "sha256/old", undefined)
+    ];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([
+      [
+        "Catalog",
+        "sha256/a"
+      ],
+      [
+        "Ordering",
+        "sha256/new"
+      ]
+    ]))).toEqual(["Ordering"]);
+  });
+  globalThis.test("names a plugin with no row at all", () => {
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations([], Object.fromEntries([[
+        "Ordering",
+        "sha256/new"
+      ]]))).toEqual(["Ordering"]);
+  });
+  globalThis.test("waits for nothing when the caller expects nothing", () => {
+    let rows = [row("Ordering", "sha256/old", undefined)];
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.pendingRegistrations(rows, Object.fromEntries([]))).toEqual([]);
+  });
+  globalThis.test("reads the expectations off the invocation payload", () => {
+    globalThis.expect(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.bakeExpectations(JSON.parse(`{"bake": true, "expect": {"Ordering": "sha256/b"}}`))["Ordering"]).toEqual("sha256/b");
+  });
+});
+
+globalThis.describe("resolveStructure", () => {
+  let item = structure => Object.fromEntries([
+    [
+      "name",
+      "Ordering"
+    ],
+    [
+      "structure",
+      JSON.parse(structure)
+    ]
+  ]);
+  let offloaded = `{"$offload": {"store": "pluginStructures", "key": "sha256/abc", "bytes": 4}}`;
+  globalThis.test("substitutes the fetched bytes for the reference", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.resolve(`{"aggregates": []}`), item(offloaded));
+    globalThis.expect(Stdlib_Option.map(resolved["structure"], j => JSON.stringify(j))).toEqual(`{"aggregates":[]}`);
+  });
+  globalThis.test("names the plugin whose reference cannot be read", async () => {
+    let failed = await Stdlib_Promise.$$catch(Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.reject(Primitive_exceptions.internalToException(new Error("AccessDenied"))), item(offloaded)).then(param => {}), e => Promise.resolve(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(e), Stdlib_JsExn.message)));
+    globalThis.expect(failed).toEqual("offloaded structure for plugin Ordering is unreadable at sha256/abc: AccessDenied");
+  });
+  globalThis.test("passes an inline structure through untouched", async () => {
+    let resolved = await Platform_ComponentDefinitions_Lambda_Ops$ReventlessAws.resolveStructure(param => Promise.reject(Primitive_exceptions.internalToException(new Error("must not fetch"))), item(`{"aggregates": []}`));
+    globalThis.expect(Stdlib_Option.map(resolved["structure"], j => JSON.stringify(j))).toEqual(`{"aggregates":[]}`);
+  });
+});
+
 export {
   entry,
   members,