@reventlessdev/reventless-aws 3.0.0-alpha.300 → 3.0.0-alpha.302

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.302 (2026-08-15)
+
+### Bug Fixes
+
+* **aws:** let a stream resource answer for its own stream ([4617773](https://github.com/ReventlessDev/reventless-core/commit/461777349f10ebc83085d59907bac5b5537429ed))
+### Features
+
+* **aws:** serve one baked manifest per journey ([16d6307](https://github.com/ReventlessDev/reventless-core/commit/16d63071f059cf1fc7025f9be9206dda51f71053))
+
+
+# 3.0.0-alpha.301 (2026-08-15)
+
+### Bug Fixes
+
+* **aws:** ask Cognito about a caller by the name it knows them by ([265f436](https://github.com/ReventlessDev/reventless-core/commit/265f4361f9695a12d1dcc055b256ec72174d428e))
+### Features
+
+* **core:** curate the pages a shell builds across a plugin's views ([589835a](https://github.com/ReventlessDev/reventless-core/commit/589835a1ad428c5e2dea8bf6e4c64e49d2f67e0d))
+
+
 # 3.0.0-alpha.300 (2026-08-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.300",
+  "version": "3.0.0-alpha.302",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -14,16 +14,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.76",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.141",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.142",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.236",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.98",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.234",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.100",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.114"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -2221,9 +2221,14 @@ module MakeWithConfig = (
       // target without reading either out of the deploy program.
       switch (componentDefinitions, cfg.bakedManifest) {
       | (Some(fn), Some(bake)) =>
-        let manifestKey = bake.key->Option.getOr(
-          ReventlessCore.Platform_BakedManifest.defaultKey,
-        )
+        // Every file the declaration produces: the default journey's, which is
+        // what the shell's `manifestUrl` points at, and one per declared journey.
+        // Resolved through the same function the bake and `config.json` use, so
+        // a grant cannot be scoped to a key nothing writes.
+        let manifestKeys =
+          ReventlessCore.Platform_BakedManifest.files(~config=bake)->Array.map(((key, _)) => key)
+        let manifestKey =
+          manifestKeys->Array.get(0)->Option.getOr(ReventlessCore.Platform_BakedManifest.defaultKey)
         let _ =
           (fn.roleId, bucketName)
           ->Pulumi.Output.all2
@@ -2239,7 +2244,16 @@ module MakeWithConfig = (
                       sid: "AllowWriteBakedManifest",
                       effect: Allow,
                       actions: Actions(["s3:PutObject"]),
-                      resources: Resource(`arn:aws:s3:::${bucket}/${manifestKey}`),
+                      // A single key stays a bare `Resource` string: the two
+                      // forms mean the same thing to IAM, and a deployment that
+                      // declares no journey should not see its policy rewritten
+                      // for a field it does not use.
+                      resources: switch manifestKeys->Array.map(key =>
+                        `arn:aws:s3:::${bucket}/${key}`
+                      ) {
+                      | [only] => Resource(only)
+                      | arns => Resources(arns)
+                      },
                     },
                   ],
                 )

package/src/Platform.res.mjs

@@ -1210,17 +1210,27 @@ function MakeWithConfig(Config) {
       }
       let match$5 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+        let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
           bucketName
         ]).apply(param => {
+          let bucket = param[1];
+          let arns = manifestKeys.map(key => `arn:aws:s3:::` + bucket + `/` + key);
+          let tmp;
+          if (arns.length !== 1) {
+            tmp = arns;
+          } else {
+            let only = arns[0];
+            tmp = only;
+          }
           new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
             policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
                 Sid: "AllowWriteBakedManifest",
                 Effect: "Allow",
                 Action: ["s3:PutObject"],
-                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+                Resource: tmp
               }])),
             role: param[0]
           });
@@ -2490,17 +2500,27 @@ function Make($star) {
       }
       let match$5 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKey = Stdlib_Option.getOr(match$5.key, Platform_BakedManifest$ReventlessCore.defaultKey);
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+        let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
           bucketName
         ]).apply(param => {
+          let bucket = param[1];
+          let arns = manifestKeys.map(key => `arn:aws:s3:::` + bucket + `/` + key);
+          let tmp;
+          if (arns.length !== 1) {
+            tmp = arns;
+          } else {
+            let only = arns[0];
+            tmp = only;
+          }
           new (Aws.iam.RolePolicy)("PlatformUIDefinitionsBake", {
             policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "PlatformUIDefinitionsBakePolicy", [{
                 Sid: "AllowWriteBakedManifest",
                 Effect: "Allow",
                 Action: ["s3:PutObject"],
-                Resource: `arn:aws:s3:::` + param[1] + `/` + manifestKey
+                Resource: tmp
               }])),
             role: param[0]
           });

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -141,10 +141,8 @@ let make = (
   // as a record so the deploy input and the runtime input are the same shape —
   // `views`/`commands` absent means "every public component", which a record
   // with explicit nulls would not say.
-  let bakeSelectionsJson = switch bakedManifest {
-  | None => ""
-  | Some(bake) =>
-    bake.components
+  let encodeSelections = (components: array<ReventlessCore.Platform_BakedManifest.selection>) =>
+    components
     ->Array.map(sel => {
       let entry = Dict.fromArray([("plugin", JSON.Encode.string(sel.plugin))])
       let strings = (key, value) =>
@@ -153,9 +151,43 @@ let make = (
         )
       strings("views", sel.views)
       strings("commands", sel.commands)
+      strings("derived", sel.derived)
       entry->JSON.Encode.object
     })
     ->JSON.Encode.array
+
+  let bakeSelectionsJson = switch bakedManifest {
+  | None => ""
+  | Some(bake) =>
+    bake.components
+    ->Array.map(ReventlessCore.Platform_BakedManifest.toSelection)
+    ->encodeSelections
+    ->JSON.stringify
+  }
+
+  // The journeys, in a variable of their own rather than folded into the one
+  // above: a deployment that declares none then puts the same string in the same
+  // place it always did, and its function is not replaced for a field it does
+  // not use.
+  //
+  // Each carries the key the DECLARATION resolves to, taken from the function
+  // that also decides the IAM grant and the URL `config.json` publishes. A key
+  // the handler derived for itself would be a fourth derivation of one name, and
+  // the way it fails is a file written where nothing fetches it.
+  let bakeJourneysJson = switch bakedManifest->Option.mapOr([], config =>
+    ReventlessCore.Platform_BakedManifest.journeyFiles(~config)
+  ) {
+  | [] => ""
+  | journeys =>
+    journeys
+    ->Array.map(j =>
+      Dict.fromArray([
+        ("group", JSON.Encode.string(j.group)),
+        ("key", JSON.Encode.string(j.key)),
+        ("components", j.selections->encodeSelections),
+      ])->JSON.Encode.object
+    )
+    ->JSON.Encode.array
     ->JSON.stringify
   }
 
@@ -225,6 +257,10 @@ let make = (
             // An include-list is names only, so it stays far from the 4096-byte
             // total the admin entry already pushed out of this dict.
             ("BAKE_SELECTIONS", bakeSelectionsJson->Pulumi.Input.make),
+            // One curated surface per audience beside the default one. Empty for
+            // a deployment that declares none, which is every deployment that
+            // predates journeys.
+            ("BAKE_JOURNEYS", bakeJourneysJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -13,6 +13,7 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as Platform_ComponentDefinitionsApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_ComponentDefinitionsApi.res.mjs";
 
@@ -77,19 +78,36 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
       role: lambdaRole.id
     }, opts$1);
   });
-  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(bakedManifest.components.map(sel => {
-      let entry = Object.fromEntries([[
-          "plugin",
-          sel.plugin
-        ]]);
-      let strings = (key, value) => Stdlib_Option.forEach(value, names => {
-        entry[key] = names.map(prim => prim);
-      });
-      strings("views", sel.views);
-      strings("commands", sel.commands);
-      return entry;
-    })) : "";
-  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, Platform_Admin_Structure$ReventlessCore.structure));
+  let encodeSelections = components => components.map(sel => {
+    let entry = Object.fromEntries([[
+        "plugin",
+        sel.plugin
+      ]]);
+    let strings = (key, value) => Stdlib_Option.forEach(value, names => {
+      entry[key] = names.map(prim => prim);
+    });
+    strings("views", sel.views);
+    strings("commands", sel.commands);
+    strings("derived", sel.derived);
+    return entry;
+  });
+  let bakeSelectionsJson = bakedManifest !== undefined ? JSON.stringify(encodeSelections(bakedManifest.components.map(Platform_BakedManifest$ReventlessCore.toSelection))) : "";
+  let journeys = Stdlib_Option.mapOr(bakedManifest, [], Platform_BakedManifest$ReventlessCore.journeyFiles);
+  let bakeJourneysJson = journeys.length !== 0 ? JSON.stringify(journeys.map(j => Object.fromEntries([
+      [
+        "group",
+        j.group
+      ],
+      [
+        "key",
+        j.key
+      ],
+      [
+        "components",
+        encodeSelections(j.selections)
+      ]
+    ]))) : "";
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
@@ -127,6 +145,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
           "BAKE_SELECTIONS",
           bakeSelectionsJson
         ],
+        [
+          "BAKE_JOURNEYS",
+          bakeJourneysJson
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -288,6 +288,18 @@ let structureOf = (item: dict<JSON.t>, ~name as _: string): option<(
   | _ => None
   }
 
+// One curated surface per audience, beside the default one. Only what the write
+// needs travels: the file's key, resolved by the deploy so that the grant, the
+// URL in `config.json` and the object written here are one string, and the
+// include-list that decides its contents. The group the journey serves is
+// carried too, purely so the invocation's report names the audience a file was
+// written for.
+type journey = {
+  group: string,
+  key: string,
+  selections: array<ReventlessCore.Platform_BakedManifest.selection>,
+}
+
 let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest.selection> => {
   let strings = (o, key) =>
     o
@@ -304,10 +316,14 @@ let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest
       ReventlessCore.Platform_BakedManifest.plugin,
       views: strings(o, "views"),
       commands: strings(o, "commands"),
+      derived: strings(o, "derived"),
     })
   )
 }
 
+let decodeSelections = (json: JSON.t): array<ReventlessCore.Platform_BakedManifest.selection> =>
+  json->JSON.Decode.array->Option.getOr([])->Array.filterMap(bakeSelection)
+
 // The declaration travels as an env var because it is deploy input — stated once
 // in the platform program, beside the bucket it is written to. The target travels
 // in the invocation payload instead: the bucket only exists inside the host-UI
@@ -318,14 +334,44 @@ let bakeSelections = (): array<ReventlessCore.Platform_BakedManifest.selection>
   switch NodeProcess.env->Dict.get("BAKE_SELECTIONS") {
   | None | Some("") => []
   | Some(raw) =>
-    switch raw->JSON.parseOrThrow->JSON.Decode.array {
-    | Some(entries) => entries->Array.filterMap(bakeSelection)
-    | None => []
+    switch raw->JSON.parseOrThrow {
+    | json => json->decodeSelections
     | exception _ =>
       JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array")
     }
   }
 
+let bakeJourney = (json: JSON.t): option<journey> =>
+  json
+  ->JSON.Decode.object
+  ->Option.flatMap(o =>
+    switch (
+      o->Dict.get("group")->Option.flatMap(JSON.Decode.string),
+      o->Dict.get("key")->Option.flatMap(JSON.Decode.string),
+    ) {
+    | (Some(group), Some(key)) =>
+      Some({
+        group,
+        key,
+        selections: o->Dict.get("components")->Option.mapOr([], decodeSelections),
+      })
+    | _ => None
+    }
+  )
+
+// Absent for every deployment that declares one audience, which is what the
+// declaration meant before journeys existed and what it still means.
+let bakeJourneys = (): array<journey> =>
+  switch NodeProcess.env->Dict.get("BAKE_JOURNEYS") {
+  | None | Some("") => []
+  | Some(raw) =>
+    switch raw->JSON.parseOrThrow->JSON.Decode.array {
+    | Some(entries) => entries->Array.filterMap(bakeJourney)
+    | None => []
+    | exception _ => JsError.throwWithMessage("baked manifest: BAKE_JOURNEYS is not a JSON array")
+    }
+  }
+
 type bakeTarget = {bucket: string, key: string}
 
 let bakeTargetOf = (event: JSON.t): option<bakeTarget> =>
@@ -416,27 +462,49 @@ let runBake = async (
       "so there is nothing to write and a shell pointed at the file would find none.",
     )
   }
-  switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
-  | Error(e) =>
-    JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
-  | Ok(manifest) =>
-    let body = JSON.stringify(manifest, ~space=2)
-    let _ = await AwsSdk.S3.PutObjectCommand.make({
-      bucket: target.bucket,
-      key: target.key,
-      body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
-      contentType: "application/json",
-    })->AwsSdk.S3.PutObjectCommand.send
-    [
-      Dict.fromArray([
+  // The default journey first and always — the caller supplies its key, because
+  // the caller is what knows where the shell it configured fetches from — then
+  // one file per declared journey, under the key the deploy resolved.
+  let files = Array.concat(
+    [(None, target.key, selections)],
+    bakeJourneys()->Array.map(j => (Some(j.group), j.key, j.selections)),
+  )
+
+  // Every file is curated before any is written, for the reason the in-memory
+  // platform curates before it writes: a declaration naming a component that
+  // does not exist fails the bake, and failing it halfway would leave the bucket
+  // serving one audience's file beside a stale copy of another's.
+  let curated = files->Array.map(((group, key, selections)) => (
+    group,
+    key,
+    selections,
+    switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
+    | Error(e) => JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
+    | Ok(manifest) => JSON.stringify(manifest, ~space=2)
+    },
+  ))
+
+  await Promise.all(
+    curated->Array.map(async ((group, key, selections, body)) => {
+      let _ = await AwsSdk.S3.PutObjectCommand.make({
+        bucket: target.bucket,
+        key,
+        body: AwsSdk.S3.PutObjectCommand.bodyFromString(body),
+        contentType: "application/json",
+      })->AwsSdk.S3.PutObjectCommand.send
+      let report = Dict.fromArray([
         ("baked", JSON.Encode.bool(true)),
         ("bucket", JSON.Encode.string(target.bucket)),
-        ("key", JSON.Encode.string(target.key)),
+        ("key", JSON.Encode.string(key)),
         ("plugins", JSON.Encode.int(selections->Array.length)),
         ("bytes", JSON.Encode.int(body->String.length)),
-      ])->JSON.Encode.object,
-    ]
-  }
+      ])
+      // Only a journey's entry carries the audience it was written for, so the
+      // default one reports exactly what it reported before journeys existed.
+      group->Option.forEach(g => report->Dict.set("group", JSON.Encode.string(g)))
+      report->JSON.Encode.object
+    }),
+  )
 }
 
 let handler = async (event: JSON.t): array<JSON.t> => {

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -263,10 +263,15 @@ function bakeSelection(json) {
   return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => Stdlib_Option.map(Stdlib_Option.flatMap(o["plugin"], Stdlib_JSON.Decode.string), plugin => ({
     plugin: plugin,
     views: strings(o, "views"),
-    commands: strings(o, "commands")
+    commands: strings(o, "commands"),
+    derived: strings(o, "derived")
   })));
 }
 
+function decodeSelections(json) {
+  return Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(json), []), bakeSelection);
+}
+
 function bakeSelections() {
   let raw = process.env["BAKE_SELECTIONS"];
   if (raw === undefined) {
@@ -275,14 +280,45 @@ function bakeSelections() {
   if (raw === "") {
     return [];
   }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (exn) {
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+  }
+  return decodeSelections(json);
+}
+
+function bakeJourney(json) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => {
+    let match = Stdlib_Option.flatMap(o["group"], Stdlib_JSON.Decode.string);
+    let match$1 = Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string);
+    if (match !== undefined && match$1 !== undefined) {
+      return {
+        group: match,
+        key: match$1,
+        selections: Stdlib_Option.mapOr(o["components"], [], decodeSelections)
+      };
+    }
+  });
+}
+
+function bakeJourneys() {
+  let raw = process.env["BAKE_JOURNEYS"];
+  if (raw === undefined) {
+    return [];
+  }
+  if (raw === "") {
+    return [];
+  }
   let entries;
   try {
     entries = Stdlib_JSON.Decode.array(JSON.parse(raw));
   } catch (exn) {
-    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is not a JSON array");
+    return Stdlib_JsError.throwWithMessage("baked manifest: BAKE_JOURNEYS is not a JSON array");
   }
   if (entries !== undefined) {
-    return Stdlib_Array.filterMap(entries, bakeSelection);
+    return Stdlib_Array.filterMap(entries, bakeJourney);
   } else {
     return [];
   }
@@ -335,18 +371,37 @@ async function runBake(target, structures) {
   if (selections.length === 0) {
     Stdlib_JsError.throwWithMessage("baked manifest: BAKE_SELECTIONS is empty — this platform declares no bake, so there is nothing to write and a shell pointed at the file would find none.");
   }
-  let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
-  if (e.TAG !== "Ok") {
-    return Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
-  }
-  let body = JSON.stringify(e._0, undefined, 2);
-  await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
-    Bucket: target.bucket,
-    Key: target.key,
-    Body: body,
-    ContentType: "application/json"
-  }));
-  return [Object.fromEntries([
+  let files = [[
+      undefined,
+      target.key,
+      selections
+    ]].concat(bakeJourneys().map(j => [
+    j.group,
+    j.key,
+    j.selections
+  ]));
+  let curated = files.map(param => {
+    let selections = param[2];
+    let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
+    let tmp;
+    tmp = e.TAG === "Ok" ? JSON.stringify(e._0, undefined, 2) : Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
+    return [
+      param[0],
+      param[1],
+      selections,
+      tmp
+    ];
+  });
+  return await Promise.all(curated.map(async param => {
+    let body = param[3];
+    let key = param[1];
+    await S3$AwsSdk.PutObjectCommand.send(new ClientS3.PutObjectCommand({
+      Bucket: target.bucket,
+      Key: key,
+      Body: body,
+      ContentType: "application/json"
+    }));
+    let report = Object.fromEntries([
       [
         "baked",
         true
@@ -357,17 +412,22 @@ async function runBake(target, structures) {
       ],
       [
         "key",
-        target.key
+        key
       ],
       [
         "plugins",
-        selections.length
+        param[2].length
       ],
       [
         "bytes",
         body.length
       ]
-    ])];
+    ]);
+    Stdlib_Option.forEach(param[0], g => {
+      report["group"] = g;
+    });
+    return report;
+  }));
 }
 
 async function handler(event) {
@@ -432,7 +492,10 @@ export {
   isComplete,
   structureOf,
   bakeSelection,
+  decodeSelections,
   bakeSelections,
+  bakeJourney,
+  bakeJourneys,
   bakeTargetOf,
   bakeExpectations,
   structureRefKey,

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -40,6 +40,15 @@ type storeTable = {
 // JS resolver code (APPSYNC_JS runtime): forward the caller's arguments and the
 // authorizer-verified identity. `sub` is what keys the row, and it comes from
 // here — the mutation has no `sub` argument for a client to supply.
+//
+// `username` travels with it because the two answer different questions. The row
+// is keyed on `sub`, which is stable across a rename and is what the pre-token
+// trigger looks the row up by; but Cognito's admin API addresses a user by
+// *username*, and a pool with neither `UsernameAttributes` nor `AliasAttributes`
+// does not accept a `sub` there — it answers `UserNotFoundException`, which is
+// how the membership read used to fail for every caller on such a pool. Both
+// fields come from the authorizer, so forwarding the second grants nothing the
+// first did not.
 let invokeCode: Pulumi.Input.t<string> = `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   const id = ctx.identity;
@@ -47,7 +56,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub } : null
+      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
     }
   };
 }

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -22,7 +22,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub } : null
+      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
     }
   };
 }