@reventlessdev/reventless-aws 3.0.0-alpha.342 → 3.0.0-alpha.344

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.344 (2026-09-09)
+
+### Bug Fixes
+
+* **aws:** the archive asks what the layer holds, not what resolves ([fca352f](https://github.com/ReventlessDev/reventless-core/commit/fca352f7a19f0518a84944d4efd23eb98285f6bf))
+
+
+# 3.0.0-alpha.343 (2026-09-08)
+
+### Bug Fixes
+
+* **aws:** the collector gate waits on the one property an update changes ([2c48193](https://github.com/ReventlessDev/reventless-core/commit/2c481934d58c64b8e637d0df1b051b03cf59a35c))
+
+
 # 3.0.0-alpha.342 (2026-09-08)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.342",
+  "version": "3.0.0-alpha.344",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -15,18 +15,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.16",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.11",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.16",
     "@reventlessdev/rescript-node": "2.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/reventless-core": "3.0.0-alpha.260",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.124",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.161",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.133",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.161"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -677,13 +677,12 @@ module Make = (
       ~opts,
     )
 
-    // Through an output property, not the resource. `apply` receives the Function
-    // record as soon as the outer Output carries it — at construction, fields
-    // still unresolved — so discarding it reported ready mid-update, and the
-    // re-detect reached a Lambda still serving the previous bundle. `flatMap`
-    // returns the Output itself, which Pulumi awaits.
-    eventCollectorReadyRef :=
-      runtime.parts.lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())
+    // Not the resource, and not one of its identifiers: both are known before the
+    // update lands, so either opens the gate while the collector is still serving
+    // the previous bundle — and the re-detect that follows is answered with the
+    // previous definition. `updateLanded` depends on the one property that cannot
+    // be known early.
+    eventCollectorReadyRef := runtime.parts.lambda->Util_Lambda.updateLanded
 
     // Admin-only cross-plugin SNS subscription permissions. The admin EC
     // Lambda's manageSubscriptions hook (Phase 3 Step 1) creates SNS

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
-import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
@@ -15,6 +14,7 @@ import * as Heartbeat$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
 import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
 import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../../adapter/EventLog/EventLogBackend.res.mjs";
@@ -414,7 +414,7 @@ function Make(EventCollectorChannel) {
         eventTopics: eventTopics,
         resources: resources
       }], runtime, opts);
-    eventCollectorReadyRef.contents = Output$Pulumi.flatMap(runtime.parts.lambda, fn => fn.arn).apply(param => {});
+    eventCollectorReadyRef.contents = Util_Lambda$ReventlessAws.updateLanded(runtime.parts.lambda);
     let isAdminEventCollector = Stdlib_Option.isNone(Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name]);
     if (isAdminEventCollector) {
       new (Aws.iam.RolePolicy)(name + `-snsManageSubs`, {

package/src/util/Util_Bundle.res

@@ -349,32 +349,35 @@ let isRuntimeProvided = (specifier: string, ~pkgName: string): bool =>
     }
   )
 
-// Memo for isFrameworkPackage — one require.resolve per package name per deploy.
-let frameworkPackageCache: dict<bool> = Dict.make()
-
-/**
- * Whether the framework's own module resolution reaches this package: the
- * deploy-time stand-in for "the Lambda layer already carries it", since the
- * layer is built from reventless-aws's dependency closure.
- *
- * Deliberately framework-rooted only — no Pulumi-project fallback. The question
- * here is the opposite of `resolvePackageRoot`'s: a package the *project*
- * resolves but the framework does not is precisely a user package, which is
- * what the closure walk below must treat as a starting point rather than as
- * something the runtime provides.
- */
-let isFrameworkPackage = (pkgName: string): bool =>
-  switch frameworkPackageCache->Dict.get(pkgName) {
-  | Some(known) => known
-  | None =>
-    let known = try {
-      let _ = localRequire->NodeModule.requireResolve(pkgName ++ "/package.json")
-      true
-    } catch {
-    | _ => false
+/** The framework's own package root: this module ships inside reventless-aws, so
+    the nearest package.json walking up from it is reventless-aws's own. */
+let frameworkPackageRoot: string = {
+  let filePath = newURL(%raw("import.meta.url"))->pathname
+  let dirRef = ref(NodePath.dirname(filePath))
+  let foundRef: ref<option<string>> = ref(None)
+  while dirRef.contents != "/" && foundRef.contents->Option.isNone {
+    if NodeFs.existsSync(NodePath.join([dirRef.contents, "package.json"])) {
+      foundRef := Some(dirRef.contents)
+    } else {
+      dirRef := NodePath.dirname(dirRef.contents)
     }
-    frameworkPackageCache->Dict.set(pkgName, known)
-    known
+  }
+  foundRef.contents->Option.getOr(NodePath.dirname(filePath))
+}
+
+/** The `dependencies` a package declares — the edges the layer's own npm install
+    follows. devDependencies are deliberately not read: the layer is a production
+    install, so a dev-only package is not in it. */
+let declaredDependencies = (packageRoot: string): array<string> =>
+  try {
+    NodeFs.readFileSync(NodePath.join([packageRoot, "package.json"]))
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+    ->Option.flatMap(o => o->Dict.get("dependencies"))
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.mapOr([], Dict.keysToArray)
+  } catch {
+  | _ => []
   }
 
 // The distinct bare packages a package's own bundled files import, memoised per
@@ -427,6 +430,76 @@ let resolvePackageRootFrom = (~fromRoot: string, pkgName: string): option<string
   | _ => None
   }
 
+/** Packages the layer carries that reventless-aws does not declare, mirroring
+    `includeModules` in the layer builder's config. `@rescript/runtime` is the
+    case that matters: it is a transitive of `rescript`, which the layer excludes
+    as a build tool, so the production closure misses it while the layer holds
+    it. Without this the walk would add 19 MB to every archive.
+
+    The layer's `excludeModules` are deliberately NOT mirrored. Those are
+    deploy-time-only packages (the @pulumi bindings, esbuild, the SSH stack); the
+    walk is import-driven, so a package no runtime file imports never comes up. */
+let layerIncludedModules = Set.fromArray(["@rescript/runtime"])
+
+// Memo for the framework's dependency closure — one walk per deploy.
+let frameworkClosureCache: ref<option<dict<bool>>> = ref(None)
+
+/**
+ * The packages the Lambda layer carries: reventless-aws and its transitive
+ * `dependencies`, which is exactly what the layer builder npm-installs.
+ *
+ * Membership rather than resolvability, and the distinction is the whole point.
+ * Resolvability asked whether `require.resolve` reaches a package from this
+ * module — but Node resolution walks *up*, so in a consumer repo with a hoisted
+ * `node_modules` every package at the workspace root answers yes, including the
+ * plugin packages and their traits. That made this predicate true for packages
+ * the layer has never held: they were dropped from the archive as
+ * layer-provided, and the plugin package itself was filtered out of the closure
+ * walk's starting points, so its imports were never walked at all. The failure
+ * lands at the first command as `Cannot find package`, on a green deploy.
+ *
+ * Declared edges are followed from the declaring package's own directory, so a
+ * pnpm layout resolves the same way the runtime would. A dependency that is
+ * declared but not installed still counts as the layer's: the archive is not the
+ * place to compensate for an incomplete install.
+ */
+let frameworkPackages = (): dict<bool> =>
+  switch frameworkClosureCache.contents {
+  | Some(closure) => closure
+  | None =>
+    let closure = Dict.make()
+    let pending = [frameworkPackageRoot]
+    let next = ref(0)
+    while next.contents < pending->Array.length {
+      let root = pending->Array.getUnsafe(next.contents)
+      next := next.contents + 1
+      declaredDependencies(root)->Array.forEach(dep =>
+        if !(closure->Dict.has(dep)) {
+          closure->Dict.set(dep, true)
+          switch resolvePackageRootFrom(~fromRoot=root, dep) {
+          | Some(depRoot) => pending->Array.push(depRoot)
+          | None => ()
+          }
+        }
+      )
+    }
+    frameworkClosureCache := Some(closure)
+    closure
+  }
+
+/**
+ * Whether the deployed runtime already carries this package, so the archive
+ * need not: reventless-aws itself, or anything in its dependency closure.
+ *
+ * A package the *project* resolves but this does not is precisely a user
+ * package, which the closure walk below must treat as a starting point rather
+ * than as something the runtime provides.
+ */
+let isFrameworkPackage = (pkgName: string): bool =>
+  pkgName == "@reventlessdev/reventless-aws" ||
+  layerIncludedModules->Set.has(pkgName) ||
+  frameworkPackages()->Dict.has(pkgName)
+
 /**
  * Carry every package a bundled *user* package imports into the archive, and
  * every package those import in turn.

package/src/util/Util_Bundle.res.mjs

@@ -232,22 +232,28 @@ function isRuntimeProvided(specifier, pkgName) {
   }
 }
 
-let frameworkPackageCache = {};
+let filePath = new URL(import.meta.url).pathname;
 
-function isFrameworkPackage(pkgName) {
-  let known = frameworkPackageCache[pkgName];
-  if (known !== undefined) {
-    return known;
+let dirRef = Nodepath.dirname(filePath);
+
+let foundRef;
+
+while (dirRef !== "/" && Stdlib_Option.isNone(foundRef)) {
+  if (Nodefs.existsSync(Nodepath.join(dirRef, "package.json"))) {
+    foundRef = dirRef;
+  } else {
+    dirRef = Nodepath.dirname(dirRef);
   }
-  let known$1;
+};
+
+let frameworkPackageRoot = Stdlib_Option.getOr(foundRef, Nodepath.dirname(filePath));
+
+function declaredDependencies(packageRoot) {
   try {
-    localRequire.resolve(pkgName + "/package.json");
-    known$1 = true;
+    return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(JSON.parse(Nodefs.readFileSync(Nodepath.join(packageRoot, "package.json"), "utf8"))), o => o["dependencies"]), Stdlib_JSON.Decode.object), [], prim => Object.keys(prim));
   } catch (exn) {
-    known$1 = false;
+    return [];
   }
-  frameworkPackageCache[pkgName] = known$1;
-  return known$1;
 }
 
 let importedPackagesCache = {};
@@ -289,6 +295,47 @@ function resolvePackageRootFrom(fromRoot, pkgName) {
   }
 }
 
+let layerIncludedModules = new Set(["@rescript/runtime"]);
+
+let frameworkClosureCache = {
+  contents: undefined
+};
+
+function frameworkPackages() {
+  let closure = frameworkClosureCache.contents;
+  if (closure !== undefined) {
+    return closure;
+  }
+  let closure$1 = {};
+  let pending = [frameworkPackageRoot];
+  let next = 0;
+  while (next < pending.length) {
+    let root = pending[next];
+    next = next + 1 | 0;
+    declaredDependencies(root).forEach(dep => {
+      if (dep in closure$1) {
+        return;
+      }
+      closure$1[dep] = true;
+      let depRoot = resolvePackageRootFrom(root, dep);
+      if (depRoot !== undefined) {
+        pending.push(depRoot);
+        return;
+      }
+    });
+  };
+  frameworkClosureCache.contents = closure$1;
+  return closure$1;
+}
+
+function isFrameworkPackage(pkgName) {
+  if (pkgName === "@reventlessdev/reventless-aws" || layerIncludedModules.has(pkgName)) {
+    return true;
+  } else {
+    return pkgName in frameworkPackages();
+  }
+}
+
 function addImportedPackageClosure(packageDirs) {
   let pending = Object.entries(packageDirs).filter(param => !isFrameworkPackage(param[0]));
   let next = 0;
@@ -410,11 +457,15 @@ export {
   isBareSpecifier,
   nodeBuiltins,
   isRuntimeProvided,
-  frameworkPackageCache,
-  isFrameworkPackage,
+  frameworkPackageRoot,
+  declaredDependencies,
   importedPackagesCache,
   importedPackages,
   resolvePackageRootFrom,
+  layerIncludedModules,
+  frameworkClosureCache,
+  frameworkPackages,
+  isFrameworkPackage,
   addImportedPackageClosure,
   assertRuntimeExtensionImportsResolvable,
   buildCodeArchive,

package/src/util/Util_Lambda.res

@@ -26,8 +26,21 @@ let fromOutput = (output: Pulumi.Output.t<PulumiAws.Lambda.Function.t>) => {
   id: output->Pulumi.Output.flatMap(({id}) => id),
   name: output->Pulumi.Output.flatMap(({name}) => name),
   invokeArn: output->Pulumi.Output.flatMap(({invokeArn}) => invokeArn),
+  lastModified: output->Pulumi.Output.flatMap(({lastModified}) => lastModified),
 }
 
+/** Resolves once the function's update has actually landed — the barrier a
+    deploy-time handshake needs before it may publish to that function.
+
+    It must depend on `lastModified`. The identifiers (`arn`, `id`, `name`,
+    `invokeArn`) are equal before and after a code update, so the engine resolves
+    them from existing state and a gate built on one of them opens while the
+    update is still in flight — measurably, about a second before it even starts.
+    `sourceCodeHash` is no better: it is also an input, so it can be known in
+    advance for the same reason. */
+let updateLanded = (lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>): Pulumi.Output.t<unit> =>
+  lambda->Pulumi.Output.flatMap(({lastModified}) => lastModified)->Pulumi.Output.apply(_ => ())
+
 let functionToResource = (~tags=?, {id, name, arn}: PulumiAws.Lambda.Function.t): ReventlessInfra.Adapter.resource =>
   ReventlessInfra.Adapter.make(
     ~name,

package/src/util/Util_Lambda.res.mjs

@@ -26,10 +26,15 @@ function fromOutput(output) {
     arn: Output$Pulumi.flatMap(output, param => param.arn),
     id: Output$Pulumi.flatMap(output, param => param.id),
     name: Output$Pulumi.flatMap(output, param => param.name),
-    invokeArn: Output$Pulumi.flatMap(output, param => param.invokeArn)
+    invokeArn: Output$Pulumi.flatMap(output, param => param.invokeArn),
+    lastModified: Output$Pulumi.flatMap(output, param => param.lastModified)
   };
 }
 
+function updateLanded(lambda) {
+  return Output$Pulumi.flatMap(lambda, param => param.lastModified).apply(param => {});
+}
+
 function functionToResource(tags, param) {
   let name = param.name;
   return Adapter$ReventlessInfra.make(name, param.id, param.arn, name.apply(param => AWS$ReventlessAws.Lambda.service), undefined, undefined, undefined, Pulumi.output("aws:lambda:Function"), undefined, tags);
@@ -40,6 +45,7 @@ export {
   toResource,
   fromResource,
   fromOutput,
+  updateLanded,
   functionToResource,
 }
 /* @pulumi/aws Not a pure module */

package/tests/EventCollectorConnectLambdaPreviewTest.res

@@ -110,6 +110,7 @@ let lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t> = Pulumi.Output.make({
   id: "AllStateViewSlices"->Pulumi.Output.make,
   name: "AllStateViewSlices"->Pulumi.Output.make,
   invokeArn: "arn:aws:apigateway:invoke"->Pulumi.Output.make,
+  lastModified: "2026-01-01T00:00:00.000+0000"->Pulumi.Output.make,
 })
 
 // ── Tests ────────────────────────────────────────────────────────────────────

package/tests/EventCollectorConnectLambdaPreviewTest.res.mjs

@@ -66,7 +66,8 @@ let lambda = Pulumi.output({
   arn: Pulumi.output("arn:aws:lambda:eu-west-1:123456789012:function:AllStateViewSlices"),
   id: Pulumi.output("AllStateViewSlices"),
   name: Pulumi.output("AllStateViewSlices"),
-  invokeArn: Pulumi.output("arn:aws:apigateway:invoke")
+  invokeArn: Pulumi.output("arn:aws:apigateway:invoke"),
+  lastModified: Pulumi.output("2026-01-01T00:00:00.000+0000")
 });
 
 globalThis.describe("EventCollectorChannel_Helpers.connectLambda under an unknown view table", () => {

package/tests/EventCollectorReadyGateTest.res

@@ -1,26 +1,26 @@
 open JestGlobals
 
-// Guards what `eventCollectorReadyRef` waits for.
+// Guards what `Util_Lambda.updateLanded` waits for — the barrier the deploy
+// publishes its synthetic re-detect behind.
 //
-// The deploy publishes a synthetic re-detect once the EventCollector Lambda is
-// ready, because that Lambda is what ANSWERS the handshake: reached while it is
-// still serving the previous bundle, it replies with the previous definition,
-// Connect sees a definition it already holds and emits nothing, and the
-// registration keeps the old structure — with no second re-detect coming.
+// That collector Lambda is what ANSWERS the handshake: reached while it is still
+// serving the previous bundle, it replies with the previous definition, Connect
+// sees a definition it already holds and emits nothing, and the registration
+// keeps the old structure — with no second re-detect coming.
 //
-// The gate used to be `lambda->Output.apply(_ => ())`. `apply` receives the
-// Function record as soon as the OUTER Output carries it, which is at
-// construction, with every field inside still an unresolved Output — so the gate
-// settled while the update was in flight and the whole barrier was inert. No
-// deploy-shaped test catches it: the answer is only stale when a deploy changes a
-// structure, and the race is won more often than it is lost.
+// The first attempt at this gate depended on `arn`, and failed in production
+// exactly as it had before: the re-detect went out ~1.2s BEFORE the Lambda update
+// even started. A Lambda's identifiers are equal on both sides of a code update,
+// so the engine resolves them from existing state without waiting for it. The
+// mechanism (`flatMap` awaiting the Output it returns) was never in doubt — the
+// property was.
 //
-// So this asserts the barrier directly — the gate must not settle until the
-// resource's own outputs do.
+// So these pin the property, not the mechanism. The middle test is the one that
+// fails for an identifier-based gate.
 
 // The engine's Output constructor, so a field can be left genuinely pending
-// rather than faked. A resolved promise would settle on the next tick either
-// way, which is the difference under test.
+// rather than faked. A resolved promise settles on the next tick either way,
+// which is the difference under test.
 @module("@pulumi/pulumi") @new
 external makeOutput: (
   Set.t<unit>,
@@ -34,7 +34,13 @@ let pending = (value: 'a): (Pulumi.Output.t<'a>, unit => unit) => {
   let settle = ref(() => ())
   let p = Promise.make((resolve, _) => settle := () => resolve(value))
   (
-    makeOutput(Set.make(), p, Promise.resolve(true), Promise.resolve(false), Promise.resolve(Set.make())),
+    makeOutput(
+      Set.make(),
+      p,
+      Promise.resolve(true),
+      Promise.resolve(false),
+      Promise.resolve(Set.make()),
+    ),
     settle.contents,
   )
 }
@@ -43,14 +49,17 @@ let ticks = async () => await Promise.make((resolve, _) => {
   let _ = setTimeout(() => resolve(), 50)
 })
 
-// A Lambda mid-update: the resource record exists, its outputs do not yet.
+/** A collector mid-update, the way the engine presents one: the identifiers are
+    already known — they do not change across a code update — and only
+    `lastModified` is still pending. `complete` is AWS answering. */
 let deploying = (): (Pulumi.Output.t<PulumiAws.Lambda.Function.t>, unit => unit) => {
-  let (arn, complete) = pending("arn:aws:lambda:eu-west-1:123456789012:function:CatalogPluginEventColl")
+  let (lastModified, complete) = pending("2026-09-08T12:13:41.891+0000")
   let fn: PulumiAws.Lambda.Function.t = {
-    arn,
-    id: "CatalogPluginEventColl"->Pulumi.Output.make,
-    name: "CatalogPluginEventColl"->Pulumi.Output.make,
+    arn: "arn:aws:lambda:eu-west-1:123456789012:function:OrderingPluginEventColl"->Pulumi.Output.make,
+    id: "OrderingPluginEventColl"->Pulumi.Output.make,
+    name: "OrderingPluginEventColl"->Pulumi.Output.make,
     invokeArn: "arn:aws:apigateway:invoke"->Pulumi.Output.make,
+    lastModified,
   }
   // `apply` preserves the nested Outputs, which is how the real resource arrives.
   (()->Pulumi.Output.make->Pulumi.Output.apply(_ => fn), complete)
@@ -62,28 +71,33 @@ let observe = (gate: Pulumi.Output.t<unit>): ref<bool> => {
   settled
 }
 
-describe("the EventCollector readiness gate", () => {
-  testAsync("does not settle while the function's outputs are still pending", async () => {
+describe("Util_Lambda.updateLanded", () => {
+  // The regression. Every identifier on the record is already resolved here, so a
+  // gate reading any of them opens immediately — which is the production failure,
+  // reproduced.
+  testAsync("does not open while only the identifiers are known", async () => {
     let (lambda, _complete) = deploying()
-    let settled = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
+    let settled = lambda->Util_Lambda.updateLanded->observe
     await ticks()
     expect(settled.contents)->toBe(false)
   })
 
-  testAsync("settles once they resolve", async () => {
+  testAsync("opens once AWS reports the update", async () => {
     let (lambda, complete) = deploying()
-    let settled = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
+    let settled = lambda->Util_Lambda.updateLanded->observe
     complete()
     await ticks()
     expect(settled.contents)->toBe(true)
   })
 
-  // The shape that shipped, kept as the reason the one above is written the way it
-  // is: applying to the resource settles against a Lambda still being updated.
-  testAsync("settles immediately when taken off the resource instead", async () => {
+  // Kept as the reason the gate is written the way it is: both shapes that were
+  // tried before open against a collector still serving the previous bundle.
+  testAsync("the shapes that shipped before open too early", async () => {
     let (lambda, _complete) = deploying()
-    let settled = lambda->Pulumi.Output.apply(_ => ())->observe
+    let onResource = lambda->Pulumi.Output.apply(_ => ())->observe
+    let onArn = lambda->Pulumi.Output.flatMap(fn => fn.arn)->Pulumi.Output.apply(_ => ())->observe
     await ticks()
-    expect(settled.contents)->toBe(true)
+    expect(onResource.contents)->toBe(true)
+    expect(onArn.contents)->toBe(true)
   })
 })

package/tests/EventCollectorReadyGateTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Util_Lambda$ReventlessAws from "../src/util/Util_Lambda.res.mjs";
 
 function pending(value) {
   let settle = {
@@ -23,16 +24,18 @@ async function ticks() {
 }
 
 function deploying() {
-  let match = pending("arn:aws:lambda:eu-west-1:123456789012:function:CatalogPluginEventColl");
-  let fn_arn = match[0];
-  let fn_id = Pulumi.output("CatalogPluginEventColl");
-  let fn_name = Pulumi.output("CatalogPluginEventColl");
+  let match = pending("2026-09-08T12:13:41.891+0000");
+  let fn_arn = Pulumi.output("arn:aws:lambda:eu-west-1:123456789012:function:OrderingPluginEventColl");
+  let fn_id = Pulumi.output("OrderingPluginEventColl");
+  let fn_name = Pulumi.output("OrderingPluginEventColl");
   let fn_invokeArn = Pulumi.output("arn:aws:apigateway:invoke");
+  let fn_lastModified = match[0];
   let fn = {
     arn: fn_arn,
     id: fn_id,
     name: fn_name,
-    invokeArn: fn_invokeArn
+    invokeArn: fn_invokeArn,
+    lastModified: fn_lastModified
   };
   return [
     Pulumi.output().apply(() => fn),
@@ -50,25 +53,28 @@ function observe(gate) {
   return settled;
 }
 
-globalThis.describe("the EventCollector readiness gate", () => {
-  globalThis.test("does not settle while the function's outputs are still pending", async () => {
+globalThis.describe("Util_Lambda.updateLanded", () => {
+  globalThis.test("does not open while only the identifiers are known", async () => {
     let match = deploying();
-    let settled = observe(Output$Pulumi.flatMap(match[0], fn => fn.arn).apply(param => {}));
+    let settled = observe(Util_Lambda$ReventlessAws.updateLanded(match[0]));
     await ticks();
     globalThis.expect(settled.contents).toBe(false);
   });
-  globalThis.test("settles once they resolve", async () => {
+  globalThis.test("opens once AWS reports the update", async () => {
     let match = deploying();
-    let settled = observe(Output$Pulumi.flatMap(match[0], fn => fn.arn).apply(param => {}));
+    let settled = observe(Util_Lambda$ReventlessAws.updateLanded(match[0]));
     match[1]();
     await ticks();
     globalThis.expect(settled.contents).toBe(true);
   });
-  globalThis.test("settles immediately when taken off the resource instead", async () => {
+  globalThis.test("the shapes that shipped before open too early", async () => {
     let match = deploying();
-    let settled = observe(match[0].apply(param => {}));
+    let lambda = match[0];
+    let onResource = observe(lambda.apply(param => {}));
+    let onArn = observe(Output$Pulumi.flatMap(lambda, fn => fn.arn).apply(param => {}));
     await ticks();
-    globalThis.expect(settled.contents).toBe(true);
+    globalThis.expect(onResource.contents).toBe(true);
+    globalThis.expect(onArn.contents).toBe(true);
   });
 });
 

package/tests/Util_BundleDependencyClosureTest.res

@@ -100,6 +100,32 @@ describe("Util_Bundle — bundled user packages carry their imports", () => {
     expect(bundled->Array.includes("@fixture/never-installed"))->toBe(false)
   })
 
+  testSync("a package the framework merely resolves is still bundled", () => {
+    // The layer carries reventless-aws's dependency closure and nothing else.
+    // A consumer with a hoisted node_modules puts every package at the root,
+    // where the framework's own resolution reaches it by walking up — so
+    // resolvability said "the layer has it" about packages the layer has never
+    // held, and they were dropped from the archive. `sury` above is genuinely a
+    // framework dependency; these are not, and must ride along.
+    expect(Util_Bundle.isFrameworkPackage("@fixture/closure-trait"))->toBe(false)
+    // A real, published, @reventlessdev-scoped package that is not a dependency
+    // of reventless-aws: scope is not what decides this.
+    expect(Util_Bundle.isFrameworkPackage("@reventlessdev/reventless-local"))->toBe(false)
+  })
+
+  testSync("the framework's own closure is recognised", () => {
+    expect(Util_Bundle.isFrameworkPackage("@reventlessdev/reventless-aws"))->toBe(true)
+    expect(Util_Bundle.isFrameworkPackage("sury"))->toBe(true)
+  })
+
+  testSync("a package the layer adds outside that closure counts as the layer's", () => {
+    // @rescript/runtime is a transitive of `rescript`, which the layer excludes
+    // as a build tool, so it is absent from the production closure while the
+    // layer carries it explicitly. Every compiled ReScript file imports it, and
+    // it is 19 MB — treating it as a user package puts that in every archive.
+    expect(Util_Bundle.isFrameworkPackage("@rescript/runtime"))->toBe(true)
+  })
+
   testSync("framework packages are starting points, not walked", () => {
     // Walking reventless-aws would reach its deploy-time-only imports (the
     // @pulumi bindings) and add tens of megabytes to every archive.

package/tests/Util_BundleDependencyClosureTest.res.mjs

@@ -106,6 +106,17 @@ globalThis.describe("Util_Bundle — bundled user packages carry their imports",
     let bundled = Object.keys((Util_Bundle$ReventlessAws.addImportedPackageClosure(packageDirs), packageDirs));
     globalThis.expect(bundled.includes("@fixture/never-installed")).toBe(false);
   });
+  globalThis.test("a package the framework merely resolves is still bundled", () => {
+    globalThis.expect(Util_Bundle$ReventlessAws.isFrameworkPackage("@fixture/closure-trait")).toBe(false);
+    globalThis.expect(Util_Bundle$ReventlessAws.isFrameworkPackage("@reventlessdev/reventless-local")).toBe(false);
+  });
+  globalThis.test("the framework's own closure is recognised", () => {
+    globalThis.expect(Util_Bundle$ReventlessAws.isFrameworkPackage("@reventlessdev/reventless-aws")).toBe(true);
+    globalThis.expect(Util_Bundle$ReventlessAws.isFrameworkPackage("sury")).toBe(true);
+  });
+  globalThis.test("a package the layer adds outside that closure counts as the layer's", () => {
+    globalThis.expect(Util_Bundle$ReventlessAws.isFrameworkPackage("@rescript/runtime")).toBe(true);
+  });
   globalThis.test("framework packages are starting points, not walked", () => {
     let packageDirs = Object.fromEntries([[
         "@reventlessdev/reventless-aws",