@reventlessdev/reventless-aws 3.0.0-alpha.305 → 3.0.0-alpha.306

package/src/adapter/Runtime/EventCollectorEntryPoint.mjs

@@ -3,7 +3,7 @@
 // driven entirely by HANDLER_CONFIG.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of EP/extension/spec
 // modules named in HANDLER_CONFIG and the functor applications consuming those
 // runtime-loaded modules. Everything else (config parse/validation, the Plugin-RM

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the Plugin EventCollector Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // EventCollectorEntryPoint.mjs owns ONLY the untyped seams — the dynamic
 // `import()` of EP/extension/spec modules named in HANDLER_CONFIG and the
 // functor applications consuming those runtime-loaded modules

package/src/adapter/Runtime/EventMapperEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires EventMapper_Callback.MakeCounterHandler + MakeEventCollectorHandler.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the
 // target-spec/mappings modules named in HANDLER_CONFIG, the shape fix-ups on
 // those runtime-loaded modules (patchSpecId / patchMappingsSourceIds), and the

package/src/adapter/Runtime/EventMapperEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the EventMapper Lambda entry point (Micro mode).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // EventMapperEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of the target-spec/mappings modules named in HANDLER_CONFIG, the
 // `patchSpecId` / mapping-Source-Id fix-ups, and the

package/src/adapter/Runtime/ExtensionPointEntryPoint.mjs

@@ -4,7 +4,7 @@
 // routes SQS events through handleQueueEvent.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the
 // spec/mappings modules named in HANDLER_CONFIG, the `patchSpecId` fix-up, and
 // the two functor applications consuming them. The callback config,

package/src/adapter/Runtime/ExtensionPointEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core for the (per-extension-point) ExtensionPoint Lambda
 // entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // ExtensionPointEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of the spec/mappings modules named in HANDLER_CONFIG, the
 // `patchSpecId` fix-up, and the ExtensionPoint_Callback.Make /

package/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs

@@ -9,7 +9,7 @@
 // PgQueryResolver_Lambda.dispatch routes.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the spec
 // packages named in QUERY_RESOLVER_CONFIG, the `patchSpecId` fix-up, and the
 // reads of the runtime-loaded modules' exports. QUERY_RESOLVER_CONFIG parsing,

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core for the shared PgQueryResolver Lambda entry point
 // (B3.2b).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // PgQueryResolverEntryPoint.mjs keeps only the untyped seam — the dynamic
 // `import()` of each spec package named in QUERY_RESOLVER_CONFIG, the
 // `patchSpecId` fix-up, and the reads of the runtime-loaded module's exports

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -95,7 +95,7 @@ module Mappings = {
   // Parity with the former shell: only the Plugin lifecycle mapping. The
   // in-process wiring (PluginExtensionPoint_Builder) additionally registers
   // PluginExtensionPoint_UiFragment.Mapping — divergence tracked in
-  // docs/plans/entry-point-rescript-conversion.md.
+  // docs/plans/done/entry-point-rescript-conversion.md.
   let mappings: array<module(Mapping)> = [module(PluginMappingInstance.Mapping)]
 }
 

package/src/adapter/Runtime/ProjectionEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed QueryDb-assembly core shared by the two projection Lambda entry points
 // (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // both shells build the QueryDb operation set (DynamoDB or Postgres, live-update
 // wrapped) for each projection from spec-module reads; that machinery lives
 // here, fully type-checked. The routed dispatch boundary they share (with the

package/src/adapter/Runtime/QueryDbEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core shared by the QueryDb-backed entry-point shells
 // (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 // The DynamoDB QueryDb operations were built in each shell with seven positional
 // `load(table)` / `save(table)` / … calls into the compiled runtime, assembled
 // into an object the shell then passes to the ReadModel/StateViewSlice callback

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires ReadModel_Callback.Make, builds handler map keyed by source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of spec/mappings
 // modules named in HANDLER_CONFIG, the shape fix-ups on those runtime-loaded
 // modules (patchSpecId / fixMappingsModule), and the ReadModel_Callback.Make

package/src/adapter/Runtime/ReadModelEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the ReadModel Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // ReadModelEntryPoint.mjs keeps only the untyped seams — the dynamic `import()`
 // of spec/mappings modules named in HANDLER_CONFIG, the `patchSpecId` /
 // `fixMappingsModule` shape fix-ups on those runtime-loaded modules, and the

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -354,7 +354,7 @@ let makeFromCodeAsset: (
 
   // Announce the provisioned execution unit to the Monitoring registry. No-op
   // unless a deploy program registered a backend via Monitoring.use — see
-  // docs/plans/monitoring-hook-seam.md.
+  // docs/plans/done/monitoring-hook-seam.md.
   ReventlessCore.Monitoring.notify(~kind=unitKind, ~name, ~component=lambdaResource)
 
   {

package/src/adapter/Runtime/SideEffectEntryPoint.mjs

@@ -3,7 +3,7 @@
 // wires SideEffectHandler_Callback.Make, builds handler map keyed by source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the side-effect
 // modules named in HANDLER_CONFIG and the SideEffectHandler_Callback.Make
 // functor application consuming them. HANDLER_CONFIG parsing and handler

package/src/adapter/Runtime/SideEffectEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the SideEffectHandler Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // SideEffectEntryPoint.mjs keeps only the untyped seam — the dynamic `import()`
 // of the side-effect modules named in HANDLER_CONFIG and the
 // SideEffectHandler_Callback.Make functor application consuming them.

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -4,7 +4,7 @@
 // source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // inherently-untyped seam — the dynamic `import()` of spec/projection modules
 // named in HANDLER_CONFIG and the reads of their exports. Everything else
 // (HANDLER_CONFIG parsing incl. the compact-v2 expansion, the QueryDb operation

package/src/adapter/Runtime/StateViewSliceEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the StateViewSlice Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // StateViewSliceEntryPoint.mjs keeps only the inherently-untyped seam — the
 // dynamic `import()` of spec/projection modules named in HANDLER_CONFIG and the
 // reads of their exports. HANDLER_CONFIG parsing (including the compact-v2

package/src/adapter/Runtime/StreamRoutedEntryPoint_Ops.res

@@ -2,7 +2,7 @@
 // points (ReadModelEntryPoint.mjs, StateViewSliceEntryPoint.mjs,
 // AutomationSliceEntryPoint.mjs).
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // all three shells route DynamoDB-stream / SQS-feed records to per-source-URN
 // handler lists with per-handler log attribution — machinery the `.mjs` files
 // previously duplicated verbatim. It lives here so every co-hosted component

package/src/adapter/Runtime/TaskBucketEntryPoint.mjs

@@ -4,7 +4,7 @@
 // Events schedules).
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // inherently-untyped seam — the dynamic `import()` of the callback module named
 // in HANDLER_CONFIG and the read of its `callback` export. Everything else
 // (HANDLER_CONFIG parsing, S3-event handling via TaskBucket_S3_Runtime, the

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the TaskBucket Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // TaskBucketEntryPoint.mjs keeps only the inherently-untyped seam — the
 // dynamic `import()` of the task callback module named in HANDLER_CONFIG and
 // the read of its `callback` export. HANDLER_CONFIG parsing, the S3-event →

package/src/util/Util_Bundle.res

@@ -122,7 +122,7 @@ let hashString = (str: string): string =>
 // (set on the Lambda env by RuntimeEnvironment_Lambda.makeFromCodeAsset). Shipped
 // at the root of every code archive; NODE_OPTIONS=--import points Node at
 // register-hook.mjs. Validated on a Node 22.17.1 rig; see
-// docs/plans/deployed-lambda-esm-self-containment.md.
+// docs/plans/done/deployed-lambda-esm-self-containment.md.
 let registerHookFileName = "register-hook.mjs"
 let layerResolverFileName = "layer-resolver.mjs"
 

package/src/util/Util_DynamoDbStream_Runtime.res

@@ -5,7 +5,7 @@ type result =
   | Invalid
 
 // Returns None for rows that aren't events — e.g. DCB FENCE rows and aggregate
-// snapshot rows (position = "SNAPSHOT"; docs/plans/aggregate-snapshotting.md),
+// snapshot rows (position = "SNAPSHOT"; docs/plans/done/aggregate-snapshotting.md),
 // neither of which has an `event` column. The caller filters these out via
 // `Invalid` rather than synthesising a bogus event that sury would later reject.
 let buildJsonEvent' = dict => {

package/tests/AWS_TagsTest.res

@@ -3,7 +3,7 @@ open JestGlobals
 // Guards the resource-attribution tag schema. A downstream inventory answers
 // "which model component owns this resource, in what role, at what scope" purely
 // from these keys, so the key set and its namespacing are load-bearing.
-// See docs/plans/resource-attribution-tag-schema.md.
+// See docs/plans/done/resource-attribution-tag-schema.md.
 
 module Attribution = ReventlessCore.ResourceAttribution
 
@@ -95,7 +95,7 @@ describe("AWS_Tags — owner overrides the piece adapter's own kind", () => {
   // The piece adapters pass their OWN ComponentType as ~kind, which names the
   // piece and so collapses onto ~role. A QueryDb is instantiated by six different
   // component kinds, so without the owner a reader cannot tell a ReadModel's
-  // table from a StateViewSlice's. See docs/plans/resource-attribution-owner-kind.md.
+  // table from a StateViewSlice's. See docs/plans/done/resource-attribution-owner-kind.md.
   let queryDbTagsFor = (~owner=?) =>
     AWS_Tags.make(
       ~name="ProductsQueryDb",

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -76,6 +76,11 @@ let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
 let lambdaConfigOf = input =>
   input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
 
+/** The `PreTokenGenerationConfig` an attach is expected to write: our ARN, at the
+    only version the trigger handler implements. */
+let v1Config = arn =>
+  Dict.fromArray([("LambdaArn", str(arn)), ("LambdaVersion", str("V1_0"))])->JSON.Encode.object
+
 describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(~preTokenGenerationArn=Some(triggerArn))
 
@@ -192,8 +197,105 @@ describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothin
       ~preTokenGenerationArn=Some(triggerArn),
     )
     expect(lambdaConfigOf(input))->toEqual(
-      Some(Dict.fromArray([("PreTokenGeneration", str(triggerArn))])),
+      Some(
+        Dict.fromArray([
+          ("PreTokenGeneration", str(triggerArn)),
+          ("PreTokenGenerationConfig", v1Config(triggerArn)),
+        ]),
+      ),
+    )
+  })
+})
+
+// 🚨 The pool shape that took the deploy down. Cognito carries this one trigger
+// in two fields, and `UpdateUserPool` rejects the call when both are present
+// naming different functions. Nothing in this suite carried a
+// `PreTokenGenerationConfig` before, which is exactly why it shipped.
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
+
+  let describedWithConfig = (~version) =>
+    Dict.fromArray([
+      ("Name", str("CustomerPool")),
+      (
+        "LambdaConfig",
+        Dict.fromArray([
+          ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+          ("PreTokenGeneration", str(theirArn)),
+          (
+            "PreTokenGenerationConfig",
+            Dict.fromArray([
+              ("LambdaArn", str(theirArn)),
+              ("LambdaVersion", str(version)),
+            ])->JSON.Encode.object,
+          ),
+        ])->JSON.Encode.object,
+      ),
+    ])
+
+  let attachOnto = (~version) =>
+    Attachment.mergedUpdateInput(
+      ~described=describedWithConfig(~version),
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
+    )
+
+  // The property AWS enforces, asserted directly rather than through its error
+  // text: the two fields must name the same function.
+  testSync("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto(~version="V1_0"))
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaArn")),
+    ))->toEqual((Some(str(triggerArn)), Some(str(triggerArn))))
+  })
+
+  // A pool left on V2_0 does not fail — the handler answers in V1_0 shape and
+  // Cognito ignores it, so tokens mint un-narrowed and nothing reports it.
+  testSync("a pool that arrived on V2_0 is pinned back to the version we implement", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V2_0"))
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaVersion")),
+    )->toEqual(Some(str("V1_0")))
+  )
+
+  testSync("the customer's other triggers still survive", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V1_0"))->Option.flatMap(c => c->Dict.get("PreSignUp")),
+    )->toEqual(Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")))
+  )
+
+  testSync("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(
+      Attachment.mergedUpdateInput(
+        ~described=describedWithConfig(~version="V1_0"),
+        ~userPoolId="eu-west-1_abc123",
+        ~preTokenGenerationArn=None,
+      ),
+    )
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig")),
+    ))->toEqual((None, None))
+  })
+
+  // The fixpoint property, and the one that would have caught this: AWS
+  // materialises whichever field the merge did not write, so the merge has to
+  // accept its own output unchanged or a later deploy fails with nothing altered
+  // but the service normalising its own record.
+  testSync("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto(~version="V1_0")
+    let twice = Attachment.mergedUpdateInput(
+      ~described=once,
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
     )
+    expect(lambdaConfigOf(twice))->toEqual(lambdaConfigOf(once))
   })
 })
 
@@ -208,6 +310,43 @@ describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
       None,
     )
   )
+
+  testSync("reads the V2 field on a pool that only carries that one", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([("PreTokenGenerationConfig", v1Config(triggerArn))])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(Some(triggerArn))
+  )
+
+  // Our own ARN, at a version the handler does not speak. Reporting it as
+  // attached would leave a pool minting un-narrowed tokens looking correct
+  // forever; reporting none makes it drift the next `up` repairs.
+  testSync("reports none for our trigger held at a version we do not implement", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([
+              (
+                "PreTokenGenerationConfig",
+                Dict.fromArray([
+                  ("LambdaArn", str(triggerArn)),
+                  ("LambdaVersion", str("V2_0")),
+                ])->JSON.Encode.object,
+              ),
+            ])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(None)
+  )
 })
 
 // The pre-attach check. Its whole job is to keep a trigger that cannot run off a

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -119,6 +119,19 @@ function lambdaConfigOf(input) {
   return Stdlib_Option.flatMap(input["LambdaConfig"], Stdlib_JSON.Decode.object);
 }
 
+function v1Config(arn) {
+  return Object.fromEntries([
+    [
+      "LambdaArn",
+      arn
+    ],
+    [
+      "LambdaVersion",
+      "V1_0"
+    ]
+  ]);
+}
+
 globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(triggerArn);
   globalThis.test("MFA stays on rather than defaulting off", () => {
@@ -200,10 +213,84 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool
         "Name",
         "Bare"
       ]]), "eu-west-1_bare", triggerArn);
-    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([[
+    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([
+      [
         "PreTokenGeneration",
         triggerArn
-      ]]));
+      ],
+      [
+        "PreTokenGenerationConfig",
+        v1Config(triggerArn)
+      ]
+    ]));
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken";
+  let describedWithConfig = version => Object.fromEntries([
+    [
+      "Name",
+      "CustomerPool"
+    ],
+    [
+      "LambdaConfig",
+      Object.fromEntries([
+        [
+          "PreSignUp",
+          "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp"
+        ],
+        [
+          "PreTokenGeneration",
+          theirArn
+        ],
+        [
+          "PreTokenGenerationConfig",
+          Object.fromEntries([
+            [
+              "LambdaArn",
+              theirArn
+            ],
+            [
+              "LambdaVersion",
+              version
+            ]
+          ])
+        ]
+      ])
+    ]
+  ]);
+  let attachOnto = version => Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig(version), "eu-west-1_abc123", triggerArn);
+  globalThis.test("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto("V1_0"));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaArn"])
+    ]).toEqual([
+      triggerArn,
+      triggerArn
+    ]);
+  });
+  globalThis.test("a pool that arrived on V2_0 is pinned back to the version we implement", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V2_0")), c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaVersion"])).toEqual("V1_0");
+  });
+  globalThis.test("the customer's other triggers still survive", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V1_0")), c => c["PreSignUp"])).toEqual("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp");
+  });
+  globalThis.test("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig("V1_0"), "eu-west-1_abc123", undefined));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"])
+    ]).toEqual([
+      undefined,
+      undefined
+    ]);
+  });
+  globalThis.test("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto("V1_0");
+    let twice = Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(once, "eu-west-1_abc123", triggerArn);
+    globalThis.expect(lambdaConfigOf(twice)).toEqual(lambdaConfigOf(once));
   });
 });
 
@@ -217,6 +304,33 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
         "Bare"
       ]]))).toEqual(undefined);
   });
+  globalThis.test("reads the V2 field on a pool that only carries that one", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            v1Config(triggerArn)
+          ]])
+      ]]))).toEqual(triggerArn);
+  });
+  globalThis.test("reports none for our trigger held at a version we do not implement", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            Object.fromEntries([
+              [
+                "LambdaArn",
+                triggerArn
+              ],
+              [
+                "LambdaVersion",
+                "V2_0"
+              ]
+            ])
+          ]])
+      ]]))).toEqual(undefined);
+  });
 });
 
 globalThis.describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
@@ -259,5 +373,6 @@ export {
   merged,
   triggerArn,
   lambdaConfigOf,
+  v1Config,
 }
 /*  Not a pure module */

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -440,7 +440,7 @@ describe("Runtime.buildConditionalTransactItems — composite partition fences o
   // pluginName}. The read is one exact `tag_composite` match, so the fence must be
   // a SINGLE composite-key fence — not one per member. Per-member fencing made the
   // low-cardinality prefix (`environment`, `platformName`) hot under a deploy
-  // fan-out. Plan: docs/plans/Backlog/dcb-hot-tag-fence-contention.md.
+  // fan-out. Plan: docs/plans/done/dcb-hot-tag-fence-contention.md.
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,
     data: JSON.Object(Dict.make()),
@@ -563,7 +563,7 @@ describe("Runtime.toItem — an empty tag value skips its GSI attribute", () =>
   // `tag_<key>` is a GSI hash key, and DynamoDB rejects an empty string for a key
   // attribute — writing one fails the whole append. An empty value is legitimate
   // (an absent composite-partition member), so the attribute is skipped and that
-  // index goes sparse. See docs/plans/dcb-empty-tag-values-break-append.md.
+  // index goes sparse. See docs/plans/done/dcb-empty-tag-values-break-append.md.
   let tagOf = (key, value): Reventless.DcbTag.tag => {key, value}
   let tags = [tagOf("environment", "prod"), tagOf("componentName", "")]
   let storedEvent: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {

package/tests/EventLogStorage_DynamoDb_RuntimeTest.res

@@ -57,7 +57,7 @@ describe("Runtime.buildTransactItems", () => {
   })
 })
 
-// ─── Aggregate snapshots (docs/plans/aggregate-snapshotting.md) ───
+// ─── Aggregate snapshots (docs/plans/done/aggregate-snapshotting.md) ───
 
 describe("Runtime.replayQueryInput", () => {
   testSync("default bounds cover exactly the zero-padded event range", () => {

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,6 +1,6 @@
 open JestGlobals
 
-// Regression guard for docs/plans/platform-plugins-admin-connection-null-rows.md:
+// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
 // the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
 // (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
 // The auto-generated Connection Scan must exclude them, or `name: String!` resolves
@@ -39,7 +39,7 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/aws-scan-connection-cursor-roundtrip.md. The Scan
+// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
 // resolver's cursor must round-trip DynamoDB's own continuation token, not a
 // synthetic index — every list past page 1 was unreachable before this.
 describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {

package/tests/Util_BundleEsmLoaderTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // load-bearing contract: every code archive that ships the loader files MUST set
 // NODE_OPTIONS=--import pointing at the shipped register-hook.mjs, and the two
 // files must keep cross-referencing each other by the exact filenames used here.
-// See docs/plans/deployed-lambda-esm-self-containment.md.
+// See docs/plans/done/deployed-lambda-esm-self-containment.md.
 
 describe("Util_Bundle ESM loader — env-var contract", () => {
   testSync("NODE_OPTIONS --imports the shipped register-hook file by name", () => {

package/tests/Util_BundleRuntimeExtensionTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // packages its runtime import graph reaches (`companionModuleUrls`), the
 // bundler carries them into the archive, and the archive build fails loudly on
 // any statically imported package that would not resolve at cold start. See
-// docs/plans/runtime-extension-companion-packages.md.
+// docs/plans/done/runtime-extension-companion-packages.md.
 
 // realpath because macOS hands out /var/... symlinks for tmpdir while the
 // package-root walk reports paths as given.

package/tests/integration/AggregateEntryPoint_IntegrationTest.res

@@ -11,7 +11,7 @@
 // CommandAccepted -> Lambda:Unhandled.
 //
 // This is also the harness that unblocks moving the Aggregate functor wiring
-// behind a typed core (docs/plans/minimize-lambda-entrypoint-mjs-shell.md,
+// behind a typed core (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md,
 // Tier 2.5): with it green, that refactor is verifiable end-to-end rather than
 // only at compile time. Boots via the same Docker-gated
 // `pnpm run test:integration` suite as the storage-runtime tests.