@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.293

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.293 (2026-08-13)
+
+### Features
+
+* **aws:** narrow the token to the role a caller chose to act as ([194332f](https://github.com/ReventlessDev/reventless-core/commit/194332fa0af8e13417f72d57904e2ed469747dde))
+
+
 # 3.0.0-alpha.292 (2026-08-13)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.292",
+  "version": "3.0.0-alpha.293",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,17 +12,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.73",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.231",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.95",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {

package/src/Platform.res

@@ -245,11 +245,12 @@ module MakeWithConfig = (
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
-    types: Array.concat(
-      ReventlessCore.Platform_AdminApi.uploadTypes,
-      ReventlessCore.Platform_AdminApi.geocodeTypes,
+    types: ReventlessCore.Platform_AdminApi.uploadTypes
+    ->Array.concat(ReventlessCore.Platform_AdminApi.geocodeTypes)
+    ->Array.concat(ReventlessCore.Platform_AdminApi.activeRoleTypes),
+    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields->Array.concat(
+      ReventlessCore.Platform_AdminApi.activeRoleMutationFields,
     ),
-    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields,
     queries: Array.concat(
       ["  Platform_ping: String"],
       ReventlessCore.Platform_AdminApi.geocodeQueryFields,
@@ -2106,6 +2107,31 @@ module MakeWithConfig = (
       | _ => ()
       }
 
+      // Where a caller records the role they want to act as
+      // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
+      // a preference; the pre-token-generation trigger reads the row and re-checks
+      // it against real membership before narrowing anything, so this door grants
+      // nobody anything on its own.
+      //
+      // The table and the trigger were provisioned with the pool — they have to
+      // be, since the pool is declared carrying the trigger's ARN. Only the write
+      // door waits for the API.
+      //
+      // Split-API only, like the upload and geocode resolvers above:
+      // `Platform_SetActiveRole` lives on the domain base document, which a
+      // unified-mode deployment's single API does not carry. The table and
+      // trigger are provisioned either way — see `Platform_Stack` for why that
+      // is not gated on this flag.
+      if Config.splitApi {
+        Auth_ActiveRoleStore.makeWriteDoor(
+          ~api=domainApi,
+          ~table=cognitoPool.activeRoleTable,
+          ~cognitoUserPoolId=cognitoPool.poolId->Pulumi.Output.asInput,
+          ~cognitoUserPoolArn=cognitoPool.poolArn->Pulumi.Output.asInput,
+          ~opts={},
+        )
+      }
+
       // The place index itself, exported so the unattended slice path can reach the
       // capability: a slice's Lambda signs an SDK call directly and needs the index
       // name, not an endpoint (no proxy hop, no dependence on a public URL). The

package/src/Platform.res.mjs

@@ -60,6 +60,7 @@ import * as StateTopic_AppSync$ReventlessAws from "./adapter/StateTopic/StateTop
 import * as AppSync_SdlDecorate$ReventlessAws from "./components/Api/AppSync_SdlDecorate.res.mjs";
 import * as UiFragmentRegistry$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateChangeSlice/UiFragmentRegistry.res.mjs";
 import * as Util_ResourceNaming$ReventlessAws from "./util/Util_ResourceNaming.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as ClonerRunner_Fargate$ReventlessAws from "./plugin/cloner/ClonerRunner_Fargate.res.mjs";
 import * as QueryEngine_DynamoDb$ReventlessAws from "./adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginRuntime_Builder.res.mjs";
@@ -192,8 +193,8 @@ function MakeWithConfig(Config) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -1130,6 +1131,9 @@ function MakeWithConfig(Config) {
       if (index !== undefined && Config.splitApi) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
+      if (Config.splitApi) {
+        Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
+      }
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
@@ -1491,8 +1495,8 @@ function Make($star) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -2406,6 +2410,7 @@ function Make($star) {
       if (index !== undefined) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
+      Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);

package/src/Platform_Stack.res

@@ -6,6 +6,12 @@ type cognitoUserPool = {
   clientId: Pulumi.Output.t<string>,
   poolArn: Pulumi.Output.t<string>,
   managed: bool,
+  /** Rows holding the role each caller chose to act as, read by the pool's
+    pre-token-generation trigger. Carried on the resolved pool because the table
+    has to be provisioned *before* the pool (the trigger reads it, and the pool
+    is declared with the trigger's ARN), while the mutation that writes it is
+    provisioned after the API — see [Auth_ActiveRoleStore.res]. */
+  activeRoleTable: Auth_ActiveRoleStore.storeTable,
 }
 
 /**
@@ -32,6 +38,11 @@ type cognitoUserPool = {
  * `cognitoUserPoolArn`, `cognitoRegion`, and `cognitoUserPoolManaged` as
  * stack outputs so downstream stacks (and Stage D AppSync wiring) can read
  * them via `StackReference`.
+ *
+ * Also provisions the role-state table and the pre-token-generation trigger that
+ * narrows `cognito:groups` to a caller's chosen role. They belong here rather
+ * than beside the mutation that writes the table because the pool must be
+ * declared carrying the trigger's ARN — see the ordering note below.
  */
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
@@ -40,6 +51,33 @@ let _resolveUncached = (): cognitoUserPool => {
   | None => cfg->Pulumi.Config.get("cognitoUserPoolId")
   }
 
+  // Provisioned ahead of the pool in both pool modes: the pre-token-generation
+  // trigger reads these rows, and in auto mode the pool is declared carrying the
+  // trigger's ARN — so table → trigger → pool is a forced order, not a choice.
+  // See [docs/plans/active-role-narrows-the-token.md] §6.
+  //
+  // Unconditional, including for a unified-API platform that mounts no
+  // `Platform_SetActiveRole` and so can never write a row.
+  //
+  // This was briefly gated on whether a write door would exist, to save a
+  // DynamoDB read per sign-in in that mode. The gate was a parameter on this
+  // function — and because the result is process-cached, it made the feature's
+  // existence depend on *which caller resolved the pool first*. `Auth_Cognito.make`
+  // reaches this through an adapter record and gets there before the platform
+  // does, so the whole feature silently vanished from the deploy: no error, no
+  // resource, nothing to notice. A local `pulumi preview` was the only thing that
+  // caught it.
+  //
+  // Saving one GetItem in a legacy mode is not worth a switch whose failure mode
+  // is a feature that quietly is not there. If the cost ever matters, the fix is
+  // a design that does not hinge on call order — not this parameter again.
+  let activeRoleTable = Auth_ActiveRoleStore.makeTable(~opts={})
+  let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
+    ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
+    ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let result = switch existingPoolId {
   | Some(poolId) =>
     let tokenUnits: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
@@ -66,11 +104,25 @@ let _resolveUncached = (): cognitoUserPool => {
 
     let lookup = PulumiAws.Cognito.UserPool.getUserPoolOutput(~args={userPoolId: poolId})
 
+    // BYO: we hold no handle to set `lambdaConfig` on, and Cognito offers no
+    // separate attachment resource — so the trigger is attached by a declared
+    // resource that describes the pool, merges into what it finds, and sends the
+    // result back whole. Never a hand-run command: that would leave the
+    // deployment's behaviour depending on an act no source describes.
+    let _attachment = Auth_ActiveRolePoolAttachment.make(
+      ~props={
+        userPoolId: Pulumi.Input.make(poolId),
+        preTokenGenerationArn: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+      },
+      ~opts={},
+    )
+
     {
       poolId: Pulumi.Output.make(poolId),
       clientId: client.id,
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
+      activeRoleTable,
     }
 
   | None =>
@@ -83,6 +135,11 @@ let _resolveUncached = (): cognitoUserPool => {
       requireUppercase: Pulumi.Input.make(true),
       requireNumbers: Pulumi.Input.make(true),
     }
+    // Auto: the pool is ours, so the trigger is an ordinary declared property and
+    // no out-of-band `UpdateUserPool` is involved. Declaring it here rather than
+    // attaching it afterwards also keeps Pulumi's own state the authority — an
+    // attachment made behind the resource's back would read as drift on the next
+    // refresh and be reverted.
     let pool = PulumiAws.Cognito.UserPool.make(
       ~name="HostUiPool",
       ~args={
@@ -90,6 +147,9 @@ let _resolveUncached = (): cognitoUserPool => {
         usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
+        lambdaConfig: Pulumi.Input.make({
+          PulumiAws.Cognito.UserPool.preTokenGeneration: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+        }),
         tags: AWS.Tags.make(
           ~name="HostUiPool",
           ~kind=ReventlessCore.ComponentType.Platform,
@@ -126,9 +186,18 @@ let _resolveUncached = (): cognitoUserPool => {
       clientId: client.id,
       poolArn: pool.arn,
       managed: true,
+      activeRoleTable,
     }
   }
 
+  // After the branch, because the permission is scoped to the pool's ARN and the
+  // pool is what the branch produces.
+  Auth_ActiveRoleTrigger.grantInvoke(
+    ~trigger=activeRoleTrigger,
+    ~cognitoUserPoolArn=result.poolArn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let regionStr =
     Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
 
@@ -149,6 +218,15 @@ let _resolveUncached = (): cognitoUserPool => {
 // stack-export calls happen exactly once per Pulumi run.
 let _cached: ref<option<cognitoUserPool>> = ref(None)
 
+/**
+ 🚨 **Takes no arguments, and must not grow any.** Everything here is provisioned
+ on the *first* call and every later caller gets that same result — so a
+ parameter would not configure the pool, it would configure whichever caller
+ happened to arrive first. `Auth_Cognito.make` reaches this through an adapter
+ record and gets here before the platform's own call does, which is not obvious
+ from any call site. Anything that needs to vary belongs in [_resolveUncached],
+ read from config or environment where every caller sees the same answer.
+ */
 let resolveCognitoUserPool = (): cognitoUserPool =>
   switch _cached.contents {
   | Some(p) => p

package/src/Platform_Stack.res.mjs

@@ -6,11 +6,16 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
+import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let v = Util_LocalConfig$ReventlessAws.get("cognitoUserPoolId");
   let existingPoolId = v !== undefined ? v : cfg.get("cognitoUserPoolId");
+  let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.makeTable(undefined, {});
+  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
     let tokenUnits_accessToken = "minutes";
@@ -37,11 +42,16 @@ function _resolveUncached() {
     let lookup = Aws.cognito.getUserPoolOutput({
       userPoolId: existingPoolId
     });
+    Auth_ActiveRolePoolAttachment$ReventlessAws.make(undefined, {
+      userPoolId: existingPoolId,
+      preTokenGenerationArn: activeRoleTrigger.functionArn
+    }, {});
     result = {
       poolId: Pulumi.output(existingPoolId),
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
-      managed: false
+      managed: false,
+      activeRoleTable: activeRoleTable
     };
   } else {
     let adminConfig = {
@@ -58,6 +68,9 @@ function _resolveUncached() {
       requireUppercase: pwdPolicy_requireUppercase
     };
     let pool = new (Aws.cognito.UserPool)("HostUiPool", {
+      lambdaConfig: {
+        preTokenGeneration: activeRoleTrigger.functionArn
+      },
       adminCreateUserConfig: adminConfig,
       usernameAttributes: ["email"],
       passwordPolicy: pwdPolicy,
@@ -89,9 +102,11 @@ function _resolveUncached() {
       poolId: pool.id,
       clientId: client$1.id,
       poolArn: pool.arn,
-      managed: true
+      managed: true,
+      activeRoleTable: activeRoleTable
     };
   }
+  Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -0,0 +1,309 @@
+/** Attaches the pre-token-generation trigger to a Cognito user pool the stack
+    does **not** own — the BYO case of `Platform_Stack.resolveCognitoUserPool`,
+    where `platform:cognitoUserPoolId` names an existing pool that is looked up
+    for its ARN and nothing more.
+
+    BYO cannot be the unsupported mode. It is the mode a customer with an
+    existing identity estate is in, and requiring the framework to own their user
+    pool before an operator can act as a role is a far larger ask than the
+    feature is worth. In **auto** mode the pool is ours and
+    `lambdaConfig.preTokenGeneration` is an ordinary property on a resource we
+    already declare — this resource is not used there.
+
+    The trigger is a property of the pool and Cognito offers no separate
+    attachment resource, so something has to call `UpdateUserPool` against a pool
+    no stack owns. That belongs in a declared resource executed at deploy time,
+    never a hand-run command against a live pool, which would leave the
+    deployment's behaviour depending on an act no source describes.
+
+    🚨 **`UpdateUserPool` resets by omission.** The API requires "a value for all
+    parameters that you don't want set to a default value". An attach that sends
+    only `LambdaConfig` silently returns every other setting on that pool to its
+    default — on a pool the framework did not create and whose configuration it
+    never described. So every call here describes first and sends the pool's own
+    configuration back whole, with one field changed. See [mergedUpdateInput].
+
+    Mirrors the dynImport + hand-rolled shape of
+    [AppSync_SourceApiAssociation_Retrying.res]: Pulumi serialises a dynamic
+    provider's whole captured closure into stack state, so the SDK is imported
+    lazily and nothing here captures a Pulumi Output. */
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// ── The merge ────────────────────────────────────────────────────────────────
+
+/** Keys `DescribeUserPool` returns that `UpdateUserPool` does not accept.
+
+    A **denylist**, deliberately, and the choice matters. An allowlist that
+    missed a field would omit it from the update and silently reset it — exactly
+    the failure this whole resource exists to prevent, and one that succeeds
+    quietly. A denylist that misses a read-only field instead makes AWS reject
+    the call, which is loud, immediate, and fixable. When the two error shapes
+    are "a customer's pool quietly loses a setting" and "the deploy fails with a
+    parameter error", the second is the one to design for.
+
+    `Name` is absent from this list because it is not dropped but *renamed* —
+    `DescribeUserPool` returns `Name`, `UpdateUserPool` takes `PoolName`. */
+let readOnlyKeys = [
+  "Id",
+  "Name",
+  "Arn",
+  "Status",
+  "CreationDate",
+  "LastModifiedDate",
+  "SchemaAttributes",
+  "AliasAttributes",
+  "UsernameAttributes",
+  "UsernameConfiguration",
+  "EstimatedNumberOfUsers",
+  "Domain",
+  "CustomDomain",
+  "SmsConfigurationFailure",
+  "EmailConfigurationFailure",
+]
+
+/** The pool's own configuration, sent back whole with `PreTokenGeneration` set
+    (or, when `preTokenGenerationArn` is `None`, removed).
+
+    Pure and total so the property that matters — a pool carrying non-default
+    settings still carries them afterwards — is checkable without a pool. */
+let mergedUpdateInput = (
+  ~described: dict<JSON.t>,
+  ~userPoolId: string,
+  ~preTokenGenerationArn: option<string>,
+): dict<JSON.t> => {
+  let out = Dict.make()
+  described->Dict.forEachWithKey((value, key) =>
+    if !(readOnlyKeys->Array.includes(key)) {
+      out->Dict.set(key, value)
+    }
+  )
+  described->Dict.get("Name")->Option.forEach(name => out->Dict.set("PoolName", name))
+  out->Dict.set("UserPoolId", JSON.Encode.string(userPoolId))
+
+  // The pool's other triggers are carried through untouched. Replacing the whole
+  // `LambdaConfig` with a single-key object would silently detach every trigger
+  // the customer already had — the reset-by-omission hazard one level down.
+  let lambdaConfig =
+    described
+    ->Dict.get("LambdaConfig")
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.mapOr(Dict.make(), existing => Dict.fromArray(existing->Dict.toArray))
+  switch preTokenGenerationArn {
+  | Some(arn) => lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
+  | None => lambdaConfig->Dict.delete("PreTokenGeneration")
+  }
+  out->Dict.set("LambdaConfig", lambdaConfig->JSON.Encode.object)
+  out
+}
+
+/** The trigger currently attached to a described pool, if any. */
+let attachedTrigger = (~described: dict<JSON.t>): option<string> =>
+  described
+  ->Dict.get("LambdaConfig")
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
+  ->Option.flatMap(JSON.Decode.string)
+
+// ── AWS SDK bindings (lazily imported — see AppSync_SourceApiAssociation_Retrying) ──
+
+type cognitoClient
+
+type describeInput = {@as("UserPoolId") userPoolId: string}
+type describeResult = {@as("UserPool") userPool?: JSON.t}
+
+type describeCmd
+type updateCmd
+
+type sdkModule = {
+  @as("CognitoIdentityProviderClient") clientCtor: unit => cognitoClient,
+  @as("DescribeUserPoolCommand") describeCtor: describeInput => describeCmd,
+  @as("UpdateUserPoolCommand") updateCtor: dict<JSON.t> => updateCmd,
+}
+
+// Calls a constructor with `new` — the SDK exports plain classes.
+//
+// `%raw` here rather than a companion `.mjs` bound through `@module`, matching
+// [AppSync_SourceApiAssociation_Retrying.res]: Pulumi serialises this provider's
+// whole closure into stack state, and a helper reached through a module import
+// is a dependency that serialisation cannot carry. Inline source can be.
+let newOf1: ('ctor, 'arg) => 'r = %raw(`(C, x) => new C(x)`)
+let newOf0: 'ctor => 'r = %raw(`(C) => new C()`)
+
+@send external sendDescribe: (cognitoClient, describeCmd) => promise<describeResult> = "send"
+@send external sendUpdate: (cognitoClient, updateCmd) => promise<unit> = "send"
+
+// Emitted as a literal `import("...")` so the Pulumi serialiser does not
+// statically capture the module in the provider closure.
+@val external dynImport: string => promise<sdkModule> = "import"
+
+let _sdk: ref<option<sdkModule>> = ref(None)
+let _client: ref<option<cognitoClient>> = ref(None)
+
+let getSdk = async (): sdkModule =>
+  switch _sdk.contents {
+  | Some(m) => m
+  | None =>
+    let m = await dynImport("@aws-sdk/client-cognito-identity-provider")
+    _sdk.contents = Some(m)
+    m
+  }
+
+let getClient = async (): cognitoClient =>
+  switch _client.contents {
+  | Some(c) => c
+  | None =>
+    let sdk = await getSdk()
+    let c = newOf0(sdk.clientCtor)
+    _client.contents = Some(c)
+    c
+  }
+
+@get @return(nullable) external exnName: JsExn.t => option<string> = "name"
+
+let isPoolGoneError = (jsErr: JsExn.t): bool =>
+  switch (jsErr->exnName, JsExn.message(jsErr)) {
+  | (Some("ResourceNotFoundException"), _) => true
+  | (_, Some(msg)) => msg->String.includes("ResourceNotFoundException")
+  | _ => false
+  }
+
+// ── Describe → merge → update ────────────────────────────────────────────────
+
+let describePool = async (~userPoolId: string): option<dict<JSON.t>> => {
+  let sdk = await getSdk()
+  let client = await getClient()
+  let result = await client->sendDescribe(newOf1(sdk.describeCtor, {userPoolId: userPoolId}))
+  result.userPool->Option.flatMap(JSON.Decode.object)
+}
+
+/** Set (or clear) the pool's pre-token-generation trigger, preserving every
+    other setting the pool carries. */
+let applyTrigger = async (~userPoolId: string, ~preTokenGenerationArn: option<string>): unit => {
+  let sdk = await getSdk()
+  let client = await getClient()
+  switch await describePool(~userPoolId) {
+  | None =>
+    // Describe succeeded but returned no pool body. Sending an update built from
+    // nothing is precisely the reset this resource exists to avoid.
+    JsError.throwWithMessage(
+      `DescribeUserPool returned no pool for "${userPoolId}"; refusing to send an UpdateUserPool that would reset it`,
+    )
+  | Some(described) =>
+    let input = mergedUpdateInput(~described, ~userPoolId, ~preTokenGenerationArn)
+    await client->sendUpdate(newOf1(sdk.updateCtor, input))
+  }
+}
+
+// ── Dynamic provider ─────────────────────────────────────────────────────────
+
+type providerInputs = {
+  userPoolId: string,
+  preTokenGenerationArn: string,
+}
+
+type createOuts = {
+  userPoolId: string,
+  preTokenGenerationArn: string,
+}
+
+type createResult = {id: string, outs: createOuts}
+type updateResult = {outs: createOuts}
+type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace: bool}
+type readResult = {id?: string, props?: createOuts}
+
+let create = async (inputs: providerInputs): createResult => {
+  await applyTrigger(
+    ~userPoolId=inputs.userPoolId,
+    ~preTokenGenerationArn=Some(inputs.preTokenGenerationArn),
+  )
+  {
+    id: inputs.userPoolId,
+    outs: {userPoolId: inputs.userPoolId, preTokenGenerationArn: inputs.preTokenGenerationArn},
+  }
+}
+
+let update = async (_id: string, _olds: createOuts, news: providerInputs): updateResult => {
+  await applyTrigger(
+    ~userPoolId=news.userPoolId,
+    ~preTokenGenerationArn=Some(news.preTokenGenerationArn),
+  )
+  {outs: {userPoolId: news.userPoolId, preTokenGenerationArn: news.preTokenGenerationArn}}
+}
+
+/** Detaching on destroy is not optional. The Lambda is torn down with the rest
+    of the stack; a pool left pointing at a deleted function fails **every**
+    sign-in, and it is a pool the framework does not own — so nothing else in
+    this deployment would ever put it right. A pool that has already gone is
+    nothing to detach from. */
+let delete_ = async (_id: string, props: createOuts): unit =>
+  try {
+    await applyTrigger(~userPoolId=props.userPoolId, ~preTokenGenerationArn=None)
+  } catch {
+  | exn if exn->JsExn.fromException->Option.mapOr(false, isPoolGoneError) =>
+    log.info(
+      ~comp="Auth_ActiveRolePoolAttachment",
+      `user pool ${props.userPoolId} is gone; nothing to detach`,
+    )
+  }
+
+/** A different pool is a different attachment: the old pool must be detached
+    before the new one is attached, so this replaces rather than updates in
+    place. Changing only the function ARN is an ordinary update. */
+let diff_ = (_id: string, olds: createOuts, news: providerInputs): diffResult => {
+  let poolChanged = olds.userPoolId != news.userPoolId
+  {
+    changes: poolChanged || olds.preTokenGenerationArn != news.preTokenGenerationArn,
+    replaces: poolChanged ? ["userPoolId"] : [],
+    deleteBeforeReplace: true,
+  }
+}
+
+/** Live state for `pulumi refresh`: report what the pool actually carries, so a
+    trigger detached out of band shows as drift and the next `up` re-attaches
+    it. A missing pool drops the resource from state. */
+let read_ = async (id: string, props: createOuts): readResult =>
+  try {
+    switch await describePool(~userPoolId=props.userPoolId) {
+    | None => ({}: readResult)
+    | Some(described) => {
+        id,
+        props: {
+          userPoolId: props.userPoolId,
+          preTokenGenerationArn: attachedTrigger(~described)->Option.getOr(""),
+        },
+      }
+    }
+  } catch {
+  | exn if exn->JsExn.fromException->Option.mapOr(false, isPoolGoneError) => ({}: readResult)
+  }
+
+// Provider as a plain JS object (no Pulumi Output captures — all state flows
+// through inputs / olds / news).
+let provider = {
+  "create": create,
+  "update": update,
+  "delete": delete_,
+  "diff": diff_,
+  "read": read_,
+}
+
+// ── Pulumi dynamic resource binding ──────────────────────────────────────────
+
+type t = {id: Pulumi.Output.t<string>}
+
+type constructorProps = {
+  userPoolId: Pulumi.Input.t<string>,
+  preTokenGenerationArn: Pulumi.Input.t<string>,
+}
+
+// Explicit /index.js path because @pulumi/pulumi/dynamic is a directory import
+// not resolvable in ESM mode.
+@module("@pulumi/pulumi/dynamic/index.js") @new
+external _newResource: ('provider, string, 'props, Pulumi.CustomResourceOptions.t) => t = "Resource"
+
+let make = (
+  ~name: string="ActiveRolePoolAttachment",
+  ~props: constructorProps,
+  ~opts: Pulumi.CustomResourceOptions.t,
+): t => _newResource(provider, name, props, opts)