@reventlessdev/reventless-aws 3.0.0-alpha.291 → 3.0.0-alpha.293

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.293 (2026-08-13)
+
+### Features
+
+* **aws:** narrow the token to the role a caller chose to act as ([194332f](https://github.com/ReventlessDev/reventless-core/commit/194332fa0af8e13417f72d57904e2ed469747dde))
+
+
+# 3.0.0-alpha.292 (2026-08-13)
+
+### Bug Fixes
+
+* **aws:** re-detect once the Lambda that answers the handshake is up ([597e174](https://github.com/ReventlessDev/reventless-core/commit/597e174059e25461d66db35118c933d2ffce7e1f))
+* **aws:** retain offloaded plugin structures so refs cannot dangle ([120a1a7](https://github.com/ReventlessDev/reventless-core/commit/120a1a7228087dd79f8bcfdd2fddc7b6dbdaf296))
+
+
 # 3.0.0-alpha.291 (2026-08-13)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.291",
+  "version": "3.0.0-alpha.293",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,17 +12,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.72",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.138",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.230",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.94",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {

package/src/Platform.res

@@ -245,11 +245,12 @@ module MakeWithConfig = (
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
-    types: Array.concat(
-      ReventlessCore.Platform_AdminApi.uploadTypes,
-      ReventlessCore.Platform_AdminApi.geocodeTypes,
+    types: ReventlessCore.Platform_AdminApi.uploadTypes
+    ->Array.concat(ReventlessCore.Platform_AdminApi.geocodeTypes)
+    ->Array.concat(ReventlessCore.Platform_AdminApi.activeRoleTypes),
+    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields->Array.concat(
+      ReventlessCore.Platform_AdminApi.activeRoleMutationFields,
     ),
-    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields,
     queries: Array.concat(
       ["  Platform_ping: String"],
       ReventlessCore.Platform_AdminApi.geocodeQueryFields,
@@ -2106,6 +2107,31 @@ module MakeWithConfig = (
       | _ => ()
       }
 
+      // Where a caller records the role they want to act as
+      // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
+      // a preference; the pre-token-generation trigger reads the row and re-checks
+      // it against real membership before narrowing anything, so this door grants
+      // nobody anything on its own.
+      //
+      // The table and the trigger were provisioned with the pool — they have to
+      // be, since the pool is declared carrying the trigger's ARN. Only the write
+      // door waits for the API.
+      //
+      // Split-API only, like the upload and geocode resolvers above:
+      // `Platform_SetActiveRole` lives on the domain base document, which a
+      // unified-mode deployment's single API does not carry. The table and
+      // trigger are provisioned either way — see `Platform_Stack` for why that
+      // is not gated on this flag.
+      if Config.splitApi {
+        Auth_ActiveRoleStore.makeWriteDoor(
+          ~api=domainApi,
+          ~table=cognitoPool.activeRoleTable,
+          ~cognitoUserPoolId=cognitoPool.poolId->Pulumi.Output.asInput,
+          ~cognitoUserPoolArn=cognitoPool.poolArn->Pulumi.Output.asInput,
+          ~opts={},
+        )
+      }
+
       // The place index itself, exported so the unattended slice path can reach the
       // capability: a slice's Lambda signs an SDK call directly and needs the index
       // name, not an endpoint (no proxy hop, no dependence on a public URL). The
@@ -2296,11 +2322,34 @@ module MakeWithConfig = (
       ->Pulumi.Output.apply(o => o->Option.getOr("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY"))
     | None => Pulumi.Output.make("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")
     }
+    // The key this deploy wrote for the plugin's structure, exported below. The
+    // Plugin read model is what the manifest bake reads and it is updated
+    // asynchronously, so the bake needs to know which structure "current" means;
+    // an equality check against the key the stack just wrote says that without
+    // timestamps, and passes immediately for a plugin whose structure did not
+    // change.
+    let structureOffloadKey = ref(None)
+
     ReventlessCore.Plugin_Helpers.registerOffload((~store, ~bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes)
       let key = "sha256/" ++ hash
+      if store == "pluginStructures" {
+        structureOffloadKey := Some(key)
+      }
       // Content-addressed: the name and key are the hash, so re-deploying an
       // unchanged field writes the same object (idempotent, deduplicating).
+      //
+      // `retainOnDelete`: the only readers of these objects are the persisted
+      // refs on the Plugin read model, and that row is updated asynchronously —
+      // the deploy publishes a re-detect, the Plugin aggregate handles it, the
+      // projection lands, minutes later. A changed field means a new hash, so
+      // without this Pulumi DELETES the previous object as part of the same
+      // update, and every reference still on the read model dangles until
+      // registration catches up. S3 answers a GET for a deleted key with
+      // AccessDenied (it masks the 404 unless the caller may ListBucket), so the
+      // window shows up as an authorization failure in the manifest bake and in
+      // the AutoUI definitions query. Content-addressed objects are immutable
+      // and cost kilobytes; keeping them closes the window outright.
       let _ = PulumiAws.S3.BucketObject.make(
         ~name="offload-" ++ hash,
         ~args={
@@ -2309,6 +2358,7 @@ module MakeWithConfig = (
           content: Pulumi.Input.make(bytes),
           contentType: Pulumi.Input.make("application/json"),
         },
+        ~opts={retainOnDelete: true},
       )
       {Reventless.Offload.store, key, hash, bytes: bytes->String.length}
     })
@@ -2361,6 +2411,23 @@ module MakeWithConfig = (
     let pluginOutputs = pluginComponent->ReventlessCore.Component.outputs
     ReventlessCore.Plugin_Helpers.exportPluginOutputs(pluginOutputs)
 
+    // What the manifest bake compares the read model against. Keyed by the bare
+    // plugin name because that is how the Plugin read model keys its rows — the
+    // stack's own id carries the version, which the bake has no opinion about.
+    switch structureOffloadKey.contents {
+    | Some(key) =>
+      Pulumi.Pulumi.export(
+        "pluginStructureRef",
+        pluginOutputs.id->Pulumi.Output.apply(id =>
+          Dict.fromArray([
+            ("plugin", JSON.Encode.string(ReventlessCore.Plugin.name(id))),
+            ("key", JSON.Encode.string(key)),
+          ])->JSON.Encode.object
+        ),
+      )
+    | None => ()
+    }
+
     // ── Merged-API association (merged-api plan, Phase 4) ───────────────────
     // Associate this plugin's source API with the platform's merged API —
     // this replaces the SigV4 RegisterApiFragment handshake + reactive push +
@@ -2539,7 +2606,20 @@ module MakeWithConfig = (
     // synchronously always saw the initial empty config, so the publish was skipped
     // on every deploy. `pluginOutputs.heartbeat` derives from that same callback's
     // output, so applying to it is the earliest point the config is populated.
-    let _ = pluginOutputs.heartbeat->Pulumi.Output.apply(_ => {
+    //
+    // The EventCollector Lambda is the other half of the gate because it is what
+    // ANSWERS the handshake: the re-detect only asks the platform to re-run it,
+    // and the definition that comes back is the one compiled into that Lambda
+    // (PluginConnectExtension_Mapping's UnknownPluginDetected branch). Published
+    // before it carries the new code, the plugin answers with the PREVIOUS
+    // deploy's definition, `Connect` sees a definition it already holds and emits
+    // nothing, and the row keeps the old structure — silently, and with no second
+    // re-detect coming to correct it. Waiting on the heartbeat alone gated on a
+    // Lambda that has no part in the answer.
+    let redetectReady =
+      (pluginOutputs.heartbeat, PluginRuntime_Builder.eventCollectorReadyRef.contents)
+      ->Pulumi.Output.all2
+    let _ = redetectReady->Pulumi.Output.apply(_ => {
       let hbConfig = PluginRuntime_Builder.heartbeatConfigRef.contents
       switch (Pulumi.Pulumi.isDryRun(), hbConfig.epQueueUrl) {
       | (true, _) => () // `pulumi preview` — no deploy-time side effects

package/src/Platform.res.mjs

@@ -16,6 +16,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
@@ -59,6 +60,7 @@ import * as StateTopic_AppSync$ReventlessAws from "./adapter/StateTopic/StateTop
 import * as AppSync_SdlDecorate$ReventlessAws from "./components/Api/AppSync_SdlDecorate.res.mjs";
 import * as UiFragmentRegistry$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateChangeSlice/UiFragmentRegistry.res.mjs";
 import * as Util_ResourceNaming$ReventlessAws from "./util/Util_ResourceNaming.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as ClonerRunner_Fargate$ReventlessAws from "./plugin/cloner/ClonerRunner_Fargate.res.mjs";
 import * as QueryEngine_DynamoDb$ReventlessAws from "./adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginRuntime_Builder.res.mjs";
@@ -191,8 +193,8 @@ function MakeWithConfig(Config) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -1129,6 +1131,9 @@ function MakeWithConfig(Config) {
       if (index !== undefined && Config.splitApi) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
+      if (Config.splitApi) {
+        Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
+      }
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
@@ -1248,14 +1253,22 @@ function MakeWithConfig(Config) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -1273,6 +1286,19 @@ function MakeWithConfig(Config) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -1335,7 +1361,11 @@ function MakeWithConfig(Config) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;
@@ -1465,8 +1495,8 @@ function Make($star) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -2380,6 +2410,7 @@ function Make($star) {
       if (index !== undefined) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
+      Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
@@ -2499,14 +2530,22 @@ function Make($star) {
     hooksApiRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApi);
     hooksApiRoleRef.contents = Platform_Casts$ReventlessAws.wrapHookedValue(targetApiRole);
     let offloadBucketName = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("offloadBucket").apply(o => Stdlib_Option.getOr(o, "OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY")) : Pulumi.output("OFFLOAD_BUCKET_PENDING_PLATFORM_DEPLOY");
+    let structureOffloadKey = {
+      contents: undefined
+    };
     Plugin_Helpers$ReventlessCore.registerOffload((store, bytes) => {
       let hash = NodeCrypto.sha256Hex(bytes);
       let key = "sha256/" + hash;
+      if (store === "pluginStructures") {
+        structureOffloadKey.contents = key;
+      }
       new (Aws.s3.BucketObject)("offload-" + hash, {
         bucket: offloadBucketName,
         key: key,
         content: bytes,
         contentType: "application/json"
+      }, {
+        retainOnDelete: true
       });
       return {
         store: store,
@@ -2524,6 +2563,19 @@ function Make($star) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    let key = structureOffloadKey.contents;
+    if (key !== undefined) {
+      Pulumi$Pulumi.$$export("pluginStructureRef", pluginOutputs.id.apply(id => Object.fromEntries([
+        [
+          "plugin",
+          Plugin$ReventlessCore.name(id)
+        ],
+        [
+          "key",
+          key
+        ]
+      ])));
+    }
     if (platformStackRef !== undefined) {
       let stackRef = Primitive_option.valFromOption(platformStackRef);
       let defaultOutput = stackRef.getOutput("default");
@@ -2586,7 +2638,11 @@ function Make($star) {
     if (sel !== undefined) {
       PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
     }
-    pluginOutputs.heartbeat.apply(param => {
+    let redetectReady = Pulumi.all([
+      pluginOutputs.heartbeat,
+      PluginRuntime_Builder$ReventlessAws.eventCollectorReadyRef.contents
+    ]);
+    redetectReady.apply(param => {
       let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
       let match = IndexJs.isDryRun();
       let match$1 = hbConfig.epQueueUrl;

package/src/Platform_Stack.res

@@ -6,6 +6,12 @@ type cognitoUserPool = {
   clientId: Pulumi.Output.t<string>,
   poolArn: Pulumi.Output.t<string>,
   managed: bool,
+  /** Rows holding the role each caller chose to act as, read by the pool's
+    pre-token-generation trigger. Carried on the resolved pool because the table
+    has to be provisioned *before* the pool (the trigger reads it, and the pool
+    is declared with the trigger's ARN), while the mutation that writes it is
+    provisioned after the API — see [Auth_ActiveRoleStore.res]. */
+  activeRoleTable: Auth_ActiveRoleStore.storeTable,
 }
 
 /**
@@ -32,6 +38,11 @@ type cognitoUserPool = {
  * `cognitoUserPoolArn`, `cognitoRegion`, and `cognitoUserPoolManaged` as
  * stack outputs so downstream stacks (and Stage D AppSync wiring) can read
  * them via `StackReference`.
+ *
+ * Also provisions the role-state table and the pre-token-generation trigger that
+ * narrows `cognito:groups` to a caller's chosen role. They belong here rather
+ * than beside the mutation that writes the table because the pool must be
+ * declared carrying the trigger's ARN — see the ordering note below.
  */
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
@@ -40,6 +51,33 @@ let _resolveUncached = (): cognitoUserPool => {
   | None => cfg->Pulumi.Config.get("cognitoUserPoolId")
   }
 
+  // Provisioned ahead of the pool in both pool modes: the pre-token-generation
+  // trigger reads these rows, and in auto mode the pool is declared carrying the
+  // trigger's ARN — so table → trigger → pool is a forced order, not a choice.
+  // See [docs/plans/active-role-narrows-the-token.md] §6.
+  //
+  // Unconditional, including for a unified-API platform that mounts no
+  // `Platform_SetActiveRole` and so can never write a row.
+  //
+  // This was briefly gated on whether a write door would exist, to save a
+  // DynamoDB read per sign-in in that mode. The gate was a parameter on this
+  // function — and because the result is process-cached, it made the feature's
+  // existence depend on *which caller resolved the pool first*. `Auth_Cognito.make`
+  // reaches this through an adapter record and gets there before the platform
+  // does, so the whole feature silently vanished from the deploy: no error, no
+  // resource, nothing to notice. A local `pulumi preview` was the only thing that
+  // caught it.
+  //
+  // Saving one GetItem in a legacy mode is not worth a switch whose failure mode
+  // is a feature that quietly is not there. If the cost ever matters, the fix is
+  // a design that does not hinge on call order — not this parameter again.
+  let activeRoleTable = Auth_ActiveRoleStore.makeTable(~opts={})
+  let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
+    ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
+    ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let result = switch existingPoolId {
   | Some(poolId) =>
     let tokenUnits: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
@@ -66,11 +104,25 @@ let _resolveUncached = (): cognitoUserPool => {
 
     let lookup = PulumiAws.Cognito.UserPool.getUserPoolOutput(~args={userPoolId: poolId})
 
+    // BYO: we hold no handle to set `lambdaConfig` on, and Cognito offers no
+    // separate attachment resource — so the trigger is attached by a declared
+    // resource that describes the pool, merges into what it finds, and sends the
+    // result back whole. Never a hand-run command: that would leave the
+    // deployment's behaviour depending on an act no source describes.
+    let _attachment = Auth_ActiveRolePoolAttachment.make(
+      ~props={
+        userPoolId: Pulumi.Input.make(poolId),
+        preTokenGenerationArn: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+      },
+      ~opts={},
+    )
+
     {
       poolId: Pulumi.Output.make(poolId),
       clientId: client.id,
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
+      activeRoleTable,
     }
 
   | None =>
@@ -83,6 +135,11 @@ let _resolveUncached = (): cognitoUserPool => {
       requireUppercase: Pulumi.Input.make(true),
       requireNumbers: Pulumi.Input.make(true),
     }
+    // Auto: the pool is ours, so the trigger is an ordinary declared property and
+    // no out-of-band `UpdateUserPool` is involved. Declaring it here rather than
+    // attaching it afterwards also keeps Pulumi's own state the authority — an
+    // attachment made behind the resource's back would read as drift on the next
+    // refresh and be reverted.
     let pool = PulumiAws.Cognito.UserPool.make(
       ~name="HostUiPool",
       ~args={
@@ -90,6 +147,9 @@ let _resolveUncached = (): cognitoUserPool => {
         usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
+        lambdaConfig: Pulumi.Input.make({
+          PulumiAws.Cognito.UserPool.preTokenGeneration: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+        }),
         tags: AWS.Tags.make(
           ~name="HostUiPool",
           ~kind=ReventlessCore.ComponentType.Platform,
@@ -126,9 +186,18 @@ let _resolveUncached = (): cognitoUserPool => {
       clientId: client.id,
       poolArn: pool.arn,
       managed: true,
+      activeRoleTable,
     }
   }
 
+  // After the branch, because the permission is scoped to the pool's ARN and the
+  // pool is what the branch produces.
+  Auth_ActiveRoleTrigger.grantInvoke(
+    ~trigger=activeRoleTrigger,
+    ~cognitoUserPoolArn=result.poolArn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let regionStr =
     Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
 
@@ -149,6 +218,15 @@ let _resolveUncached = (): cognitoUserPool => {
 // stack-export calls happen exactly once per Pulumi run.
 let _cached: ref<option<cognitoUserPool>> = ref(None)
 
+/**
+ 🚨 **Takes no arguments, and must not grow any.** Everything here is provisioned
+ on the *first* call and every later caller gets that same result — so a
+ parameter would not configure the pool, it would configure whichever caller
+ happened to arrive first. `Auth_Cognito.make` reaches this through an adapter
+ record and gets here before the platform's own call does, which is not obvious
+ from any call site. Anything that needs to vary belongs in [_resolveUncached],
+ read from config or environment where every caller sees the same answer.
+ */
 let resolveCognitoUserPool = (): cognitoUserPool =>
   switch _cached.contents {
   | Some(p) => p

package/src/Platform_Stack.res.mjs

@@ -6,11 +6,16 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
+import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let v = Util_LocalConfig$ReventlessAws.get("cognitoUserPoolId");
   let existingPoolId = v !== undefined ? v : cfg.get("cognitoUserPoolId");
+  let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.makeTable(undefined, {});
+  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
     let tokenUnits_accessToken = "minutes";
@@ -37,11 +42,16 @@ function _resolveUncached() {
     let lookup = Aws.cognito.getUserPoolOutput({
       userPoolId: existingPoolId
     });
+    Auth_ActiveRolePoolAttachment$ReventlessAws.make(undefined, {
+      userPoolId: existingPoolId,
+      preTokenGenerationArn: activeRoleTrigger.functionArn
+    }, {});
     result = {
       poolId: Pulumi.output(existingPoolId),
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
-      managed: false
+      managed: false,
+      activeRoleTable: activeRoleTable
     };
   } else {
     let adminConfig = {
@@ -58,6 +68,9 @@ function _resolveUncached() {
       requireUppercase: pwdPolicy_requireUppercase
     };
     let pool = new (Aws.cognito.UserPool)("HostUiPool", {
+      lambdaConfig: {
+        preTokenGeneration: activeRoleTrigger.functionArn
+      },
       adminCreateUserConfig: adminConfig,
       usernameAttributes: ["email"],
       passwordPolicy: pwdPolicy,
@@ -89,9 +102,11 @@ function _resolveUncached() {
       poolId: pool.id,
       clientId: client$1.id,
       poolArn: pool.arn,
-      managed: true
+      managed: true,
+      activeRoleTable: activeRoleTable
     };
   }
+  Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -117,6 +117,16 @@ let make = (
                 actions: Actions(["s3:GetObject"]),
                 resources: Resource("arn:aws:s3:::" ++ offloadBucket ++ "/*"),
               },
+              // Read-only on the bucket itself, purely so a key that is not there
+              // says so: S3 answers GET for a missing key with AccessDenied unless
+              // the caller may list the bucket, which reports a ref the handler
+              // cannot resolve as an IAM problem it does not have.
+              {
+                sid: "AllowOffloadList",
+                effect: Allow,
+                actions: Actions(["s3:ListBucket"]),
+                resources: Resource("arn:aws:s3:::" ++ offloadBucket),
+              },
             ],
           )
           ->PolicyDocument.toJsonString

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -46,6 +46,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
     pluginReadModelTableName,
     offloadBucketName
   ]).apply(param => {
+    let offloadBucket = param[1];
     new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
         {
@@ -64,7 +65,13 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
           Sid: "AllowOffloadGet",
           Effect: "Allow",
           Action: ["s3:GetObject"],
-          Resource: "arn:aws:s3:::" + param[1] + "/*"
+          Resource: "arn:aws:s3:::" + offloadBucket + "/*"
+        },
+        {
+          Sid: "AllowOffloadList",
+          Effect: "Allow",
+          Action: ["s3:ListBucket"],
+          Resource: "arn:aws:s3:::" + offloadBucket
         }
       ])),
       role: lambdaRole.id