@reventlessdev/reventless-core 3.0.0-alpha.212 → 3.0.0-alpha.214

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.214 (2026-08-07)
+
+### Features
+
+* **core,aws:** add the EventLogProvisioning seam for out-of-tree consumers ([82477b3](https://github.com/ReventlessDev/reventless-core/commit/82477b38c1ef90fbe3a6f4a114a9798770329470))
+
+
+# 3.0.0-alpha.213 (2026-08-05)
+
+### Bug Fixes
+
+* **core:** describe slice TODO items by their own schema in the API ([d863056](https://github.com/ReventlessDev/reventless-core/commit/d863056ba734ba3dc76721c32bfb766d777ceb9a))
+### Features
+
+* **core:** cap rendered values in command, event and action logs ([8e07752](https://github.com/ReventlessDev/reventless-core/commit/8e077527ad3c8258582951544ee53d2722876191))
+* **local:** offload large pluginDefinition fields to the object store ([84c5fab](https://github.com/ReventlessDev/reventless-core/commit/84c5fab339856b5d64f0c05110b1fa7f38646f5e))
+* **local:** scoped seed:reset for the local platform ([a4dd003](https://github.com/ReventlessDev/reventless-core/commit/a4dd0033b7d01be23be91bac3f01d38ebeab7d45))
+
+
 # 3.0.0-alpha.212 (2026-08-04)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.212",
+  "version": "3.0.0-alpha.214",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,17 +28,17 @@
   "dependencies": {
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.1",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.2",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.2",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.126",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.2",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.127",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.100"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.101"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Projection.res

@@ -126,9 +126,12 @@ let applyChanges = async (
 }
 
 // Best-effort: a state that can't be JSON-serialized (e.g. carries a function)
-// must not crash the projection just to produce a debug line.
+// must not crash the projection just to produce a debug line. Capped at the
+// shared log budget — an action line names which row changed, and a read model
+// holding a large field (a plugin structure, an inline offload payload) would
+// otherwise print the whole row twice, once per side of the `=>`.
 let stateToString: 'a => string = state =>
-  state->JSON.stringifyAny->Option.getOr("<unserializable>")
+  state->JSON.stringifyAny->Option.getOr("<unserializable>")->LogFormat.truncate
 let statesToString: array<'a> => string = states =>
   states->Array.map(stateToString)->Array.joinUnsafe(", ")
 

package/src/Projection.res.mjs

@@ -16,6 +16,7 @@ import * as DisplayName$Reventless from "@reventlessdev/reventless-spec/src/comp
 import * as Message$ReventlessCore from "./Message.res.mjs";
 import * as QueryDb$ReventlessCore from "./components/QueryDb/QueryDb.res.mjs";
 import * as QueryDb$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/QueryDb.res.mjs";
+import * as LogFormat$ReventlessCore from "./util/LogFormat.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -195,7 +196,7 @@ async function applyChanges(action, id, beforeStates, afterStates, param, param$
 }
 
 function stateToString(state) {
-  return Stdlib_Option.getOr(JSON.stringify(state), "<unserializable>");
+  return LogFormat$ReventlessCore.truncate(Stdlib_Option.getOr(JSON.stringify(state), "<unserializable>"));
 }
 
 function statesToString(states) {

package/src/adapter/EventLogProvisioning/EventLogProvisioning.res

@@ -0,0 +1,165 @@
+/**
+Deploy-time hook: every event log announces itself as it is provisioned, so an
+extension can attach behaviour to it inside the program that owns it.
+
+No-op by default. Zero behavioral change unless an extension registers a backend
+via `use` before the platform/plugin build. The seam fires once per log at
+provisioning time (inside the deploy program) — never at invocation, and it runs
+no code in production.
+
+What a backend does with a log is deliberately NOT a framework concern.
+Aggregation, CDC export, external indexing, replication and archival all want to
+react to an event log's changes; none of them belong in core, and each one added
+to core is maintenance its users pay for whether or not they use it. This only
+exposes the choke point through which the framework says "I just provisioned an
+event log, here is everything I know about it" and leaves the reaction to the
+listener.
+
+The alternative — discovering a log's resources from outside the owning program —
+is impractical on AWS: a DynamoDB stream ARN ends in a creation-time stream
+label, so it cannot be synthesised, and exporting it per plugin pushes framework
+internals into every deployment's stack outputs.
+
+See `docs/plans/done/event-log-provisioned-seam.md`.
+*/
+
+/**
+Which event-log family provisioned the log. The two differ in what a reader finds
+on the wire — a classic log is per-aggregate and its rows carry an aggregate id;
+a DCB log is per-plugin and its rows carry tags — so a backend that decodes
+records needs to know which it is looking at before it looks.
+*/
+type logStyle =
+  | /** per-aggregate log behind `EventLog_Builder` */ Classic
+  | /** per-plugin tagged log behind `DcbEventLog_Builder` */ Dcb
+
+/**
+An event-log backend, registered by an extension (a deploy program) before the
+platform builds. `onProvisioned` is called once per event log.
+
+`~name` is the log's STATIC logical name — the suffixed component name the
+builder passed to its storage maker (`ProductEventLog`, `CatalogDcbEventLog`). A
+Pulumi-based backend derives logical resource names from it, which must be stable
+and known at graph-construction time.
+
+`~owner` is the model element the log belongs to: `{kind: Aggregate, name:
+"Product"}` for a classic log, `{kind: Plugin, name: "Catalog"}` for a DCB log
+(the plugin owns it, not any one slice). `~plugin` / `~platform` come from the
+ambient `ResourceAttribution` context the plugin builder publishes during
+construction — the same source `AWS_Tags` and `Monitoring.notify` use. Both are
+`None` for a log provisioned outside any plugin construct.
+
+`~resources` is the adapter's deploy-time resources, not a stream: a stream is a
+DynamoDB-shaped idea and SQL-backed adapters have none. A backend derives
+whatever its store supports and does nothing for the rest — a Postgres log
+arrives with `resources: []`, and an in-memory one with nothing attachable. The
+contract is uniform on purpose; filtering belongs in the backend.
+
+`~opts` carries the log component's parent options. A backend that provisions
+anything needs them, or its resources land outside the component tree.
+
+Because `onProvisioned` fires during resource creation inside the deploy program,
+a Pulumi-based backend can create its resources in the same stack, parented
+naturally.
+
+**The reader budget.** A DynamoDB table has exactly one stream, and DynamoDB
+Streams throttles beyond two processes reading the same shard. Core already
+spends one slot: `EventCollectorChannel_Helpers` maps every event-log stream onto
+the plugin's event-collector Lambda. A backend that subscribes through this seam
+is therefore reader #2 — the ceiling. A second stream consumer would throttle the
+first, which is why registration is single-slot and loud (see `use`). If several
+consumers are ever needed the answer is a fan-out — routing through the existing
+collector, or a stream type that supports more readers — not more subscriptions.
+
+**Snapshots share the log's table.** Classic aggregate snapshots are written to
+the event-log table under `position = "SNAPSHOT"`, so a stream consumer sees them
+alongside events. The seam does not filter; a backend that only wants events must
+skip those rows itself.
+
+**No ordering guarantee against other seams.** This and `Monitoring.notify` both
+fire during provisioning, from different builders, in whatever order the graph is
+constructed. A backend must not depend on having seen one before the other.
+*/
+module type Backend = {
+  let onProvisioned: (
+    ~logStyle: logStyle,
+    ~name: string,
+    ~owner: option<ResourceAttribution.owner>,
+    ~plugin: option<string>,
+    ~platform: option<string>,
+    ~resources: array<ReventlessInfra.Adapter.resource>,
+    ~opts: Pulumi.CustomResourceOptions.t,
+  ) => unit
+}
+
+/** Default backend: does nothing. Active unless an extension calls `use`. */
+module Noop: Backend = {
+  let onProvisioned = (
+    ~logStyle as _,
+    ~name as _,
+    ~owner as _,
+    ~plugin as _,
+    ~platform as _,
+    ~resources as _,
+    ~opts as _,
+  ) => ()
+}
+
+let backend: ref<module(Backend)> = ref(module(Noop: Backend))
+let registered = ref(false)
+
+/**
+Register the event-log backend. Must run before the platform/plugin build in the
+deploy program (plain statement order — the registry is consulted lazily at each
+provisioning site). Called once, by the extension, first.
+
+Single-slot and loud: a second `use` raises rather than silently winning, because
+the reader budget documented on `Backend` means two registered backends is not a
+last-writer-wins configuration question but two consumers competing for one
+stream slot — a defect that otherwise surfaces in production as iterator-age
+alarms on whichever one lost. `reset` clears the slot for tests.
+*/
+let use = (b: module(Backend)) => {
+  if registered.contents {
+    JsError.throwWithMessage(
+      "EventLogProvisioning.use called twice: only one event-log backend can be registered. " ++
+      "A DynamoDB stream supports two readers per shard and core's event collector already holds one, " ++
+      "so a second backend would throttle the first. Compose the two backends into one, or fan out " ++
+      "behind a single registration.",
+    )
+  }
+  registered := true
+  backend := b
+}
+
+/**
+Restore the default `Noop` backend and clear the registration slot. Test-support
+only — deploy programs never call this.
+*/
+let reset = () => {
+  backend := module(Noop: Backend)
+  registered := false
+}
+
+/**
+Announce a provisioned event log to the registered backend. Called by the
+`EventLog` and `DcbEventLog` builders at their storage-provisioning sites (once
+per log). Firing from the builders rather than from each storage adapter is what
+makes the contract uniform: every adapter — DynamoDB, Postgres, SQLite,
+in-memory, and any future one — is covered by construction, with nothing to
+remember when a new one is written. No-op until an extension registers a backend.
+*/
+let notify = (
+  ~logStyle: logStyle,
+  ~name: string,
+  ~owner: option<ResourceAttribution.owner>,
+  ~resources: array<ReventlessInfra.Adapter.resource>,
+  ~opts: Pulumi.CustomResourceOptions.t,
+) => {
+  module B = unpack(backend.contents)
+  // The owning plugin/platform come from the ambient context the plugin builder publishes
+  // (ResourceAttribution.enter) — populated exactly when this fires, so the call sites need not
+  // thread the names. `None` outside a plugin construct.
+  let {ResourceAttribution.plugin: plugin, platform} = ResourceAttribution.current.contents
+  B.onProvisioned(~logStyle, ~name, ~owner, ~plugin, ~platform, ~resources, ~opts)
+}

package/src/adapter/EventLogProvisioning/EventLogProvisioning.res.mjs

@@ -0,0 +1,49 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as ResourceAttribution$ReventlessCore from "../../ResourceAttribution.res.mjs";
+
+function onProvisioned(param, param$1, param$2, param$3, param$4, param$5, param$6) {
+  
+}
+
+let Noop = {
+  onProvisioned: onProvisioned
+};
+
+let backend = {
+  contents: Noop
+};
+
+let registered = {
+  contents: false
+};
+
+function use(b) {
+  if (registered.contents) {
+    Stdlib_JsError.throwWithMessage("EventLogProvisioning.use called twice: only one event-log backend can be registered. A DynamoDB stream supports two readers per shard and core's event collector already holds one, so a second backend would throttle the first. Compose the two backends into one, or fan out behind a single registration.");
+  }
+  registered.contents = true;
+  backend.contents = b;
+}
+
+function reset() {
+  backend.contents = Noop;
+  registered.contents = false;
+}
+
+function notify(logStyle, name, owner, resources, opts) {
+  let B = backend.contents;
+  let match = ResourceAttribution$ReventlessCore.current.contents;
+  B.onProvisioned(logStyle, name, owner, match.plugin, match.platform, resources, opts);
+}
+
+export {
+  Noop,
+  backend,
+  registered,
+  use,
+  reset,
+  notify,
+}
+/* No side effect */

package/src/components/AutomationSlice/AutomationSlice_Callback.res

@@ -31,6 +31,36 @@ type todoRow = {
   retryCount: int,
 }
 
+/** The item schema seen through the `JSON.t` the row actually stores.
+
+    `item` holds `Spec.todoItemSchema`-encoded JSON, so the item schema already
+    describes the stored value exactly — only the ReScript types disagree. */
+external itemAsJson: S.t<'item> => S.t<JSON.t> = "%identity"
+
+/**
+The row schema as the API describes it: `item` carried by the slice's own item
+schema instead of as opaque JSON.
+
+`todoRowSchema` types `item` as `JSON.t`, which the schema→GraphQL IR can only
+classify as `Unknown` — and `Unknown` renders as `String!`. The field then
+serves a stored object through a String, which fails at execution ("String
+cannot represent value: { … }") the moment a client selects it. Describing the
+item shape gives the field a real object type instead.
+
+Shape only: never encode or parse a row with this. The runtime field is `JSON.t`
+and the identity cast above would have `S.parseOrThrow` hand back an item where
+the row's own code expects JSON.
+*/
+let todoRowSchemaFor = (itemSchema: S.t<'item>): S.t<todoRow> =>
+  S.schema(s => {
+    item: s.matches(itemSchema->itemAsJson),
+    status: s.matches(todoStatusSchema),
+    createdAt: s.matches(S.string),
+    processedAt: ?s.matches(S.option(S.string)),
+    completedAt: ?s.matches(S.option(S.string)),
+    retryCount: s.matches(S.int),
+  })
+
 /**
 The runtime protocol between a built callback and whoever drives it — the same
 arrangement as `OutboundTranslationSlice_Callback`, and for the same reason. The

package/src/components/AutomationSlice/AutomationSlice_Callback.res.mjs

@@ -30,6 +30,17 @@ let todoRowSchema = S.schema(s => ({
   retryCount: s.m(S.int)
 }));
 
+function todoRowSchemaFor(itemSchema) {
+  return S.schema(s => ({
+    item: s.m(itemSchema),
+    status: s.m(todoStatusSchema),
+    createdAt: s.m(S.string),
+    processedAt: s.m(S.option(S.string)),
+    completedAt: s.m(S.option(S.string)),
+    retryCount: s.m(S.int)
+  }));
+}
+
 function Make(Spec) {
   return Automation => {
     let todoItems = {};
@@ -184,6 +195,7 @@ function Make(Spec) {
 export {
   todoStatusSchema,
   todoRowSchema,
+  todoRowSchemaFor,
   Make,
 }
 /*  Not a pure module */

package/src/components/Dcb/Dcb_Builder.res

@@ -1009,7 +1009,9 @@ module Make = (
             ReventlessInfra.Api.singleFieldName: qn.singleFieldName,
             listFieldName: qn.listFieldName,
             returnTypeName: qn.returnTypeName,
-            stateSchema: AutomationSlice_Callback.todoRowSchema->S.castToUnknown,
+            stateSchema: AutomationSlice_Callback.todoRowSchemaFor(
+              A.Spec.todoItemSchema,
+            )->S.castToUnknown,
             authorization: None,
             connectionSpec: true,
           }
@@ -1023,7 +1025,9 @@ module Make = (
             ReventlessInfra.Api.singleFieldName: qn.singleFieldName,
             listFieldName: qn.listFieldName,
             returnTypeName: qn.returnTypeName,
-            stateSchema: OutboundTranslationSlice_Callback.todoRowSchema->S.castToUnknown,
+            stateSchema: OutboundTranslationSlice_Callback.todoRowSchemaFor(
+              O.Spec.outboundItemSchema,
+            )->S.castToUnknown,
             authorization: None,
             connectionSpec: true,
           }

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -531,7 +531,7 @@ function Make(DcbEventLogStorage) {
           singleFieldName: qn.singleFieldName,
           listFieldName: qn.listFieldName,
           returnTypeName: qn.returnTypeName,
-          stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchema,
+          stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchemaFor(A.Spec.todoItemSchema),
           authorization: undefined,
           connectionSpec: true
         };
@@ -542,7 +542,7 @@ function Make(DcbEventLogStorage) {
           singleFieldName: qn.singleFieldName,
           listFieldName: qn.listFieldName,
           returnTypeName: qn.returnTypeName,
-          stateSchema: OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema,
+          stateSchema: OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchemaFor(O.Spec.outboundItemSchema),
           authorization: undefined,
           connectionSpec: true
         };

package/src/components/DcbEventLog/DcbEventLog_Builder.res

@@ -16,21 +16,34 @@ module Make = (
   let construct = (indexes, partitionTag, crossPartitionTagKeys, self, name) => {
     let opts = {Pulumi.CustomResourceOptions.parent: self->Component.toPulumiResource}
 
+    let logName = name->ComponentType.name(DcbEventLog.componentType)
+    // The DCB event log is shared across the plugin's slices, so the plugin owns
+    // it — not any one component.
+    let owner: ResourceAttribution.owner = {kind: ComponentType.Plugin, name}
     let storage = Storage.make(
-      ~name=name->ComponentType.name(DcbEventLog.componentType),
+      ~name=logName,
       ~indexes,
       ~partitionTag,
       ~crossPartitionTagKeys,
       ~opts,
     )
 
+    // Announce the log to any registered extension. No-op unless a deploy program
+    // registered a backend via EventLogProvisioning.use — see
+    // src/adapter/EventLogProvisioning/EventLogProvisioning.res.
+    EventLogProvisioning.notify(
+      ~logStyle=Dcb,
+      ~name=logName,
+      ~owner=Some(owner),
+      ~resources=storage.resources,
+      ~opts,
+    )
+
     module SpecificEventTopic = EventTopic_Builder.Make(EventTopicSpec, EventTopicPublisher)
     let eventTopic = SpecificEventTopic.make(
       ~name,
       ~storageResources=storage.resources,
-      // The DCB event log is shared across the plugin's slices, so the plugin
-      // owns it — not any one component.
-      ~owner={kind: ComponentType.Plugin, name},
+      ~owner,
       ~opts=opts->Util.Pulumi.ComponentResourceOptions.ofCustomResourceOptions,
     )
 

package/src/components/DcbEventLog/DcbEventLog_Builder.res.mjs

@@ -8,6 +8,7 @@ import * as DcbEventLog$ReventlessCore from "./DcbEventLog.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "../../util/Util_Pulumi.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as EventTopic_Builder$ReventlessCore from "../EventTopic/EventTopic_Builder.res.mjs";
+import * as EventLogProvisioning$ReventlessCore from "../../adapter/EventLogProvisioning/EventLogProvisioning.res.mjs";
 import * as DcbEventLog_Operations$ReventlessCore from "./DcbEventLog_Operations.res.mjs";
 
 function Make(Storage) {
@@ -20,16 +21,19 @@ function Make(Storage) {
         let opts = {
           parent: opts_parent
         };
-        let storage = Storage.make(ComponentType$ReventlessCore.name(extra$1, DcbEventLog$ReventlessCore.componentType), indexes, partitionTag, crossPartitionTagKeys, opts);
+        let logName = ComponentType$ReventlessCore.name(extra$1, DcbEventLog$ReventlessCore.componentType);
+        let owner = {
+          kind: "Plugin",
+          name: extra$1
+        };
+        let storage = Storage.make(logName, indexes, partitionTag, crossPartitionTagKeys, opts);
+        EventLogProvisioning$ReventlessCore.notify("Dcb", logName, owner, storage.resources, opts);
         let SpecificEventTopic = EventTopic_Builder$ReventlessCore.Make({
           Id: Id$Reventless.$$String,
           name: "DcbEventLog",
           eventSchema: S.json
         })(EventTopicPublisher);
-        let eventTopic = SpecificEventTopic.make(extra$1, storage.resources, {
-          kind: "Plugin",
-          name: extra$1
-        }, Util_Pulumi$ReventlessCore.ComponentResourceOptions.ofCustomResourceOptions(opts));
+        let eventTopic = SpecificEventTopic.make(extra$1, storage.resources, owner, Util_Pulumi$ReventlessCore.ComponentResourceOptions.ofCustomResourceOptions(opts));
         Component$ReventlessCore.setOperations(extra, Pulumi.all([
           storage.operations,
           Component$ReventlessCore.operations(eventTopic)

package/src/components/EventLog/EventLog_Builder.res

@@ -18,9 +18,17 @@ module Make = (
   let construct = (~owner=?, self, name) => {
     let opts = {Pulumi.CustomResourceOptions.parent: self->Component.toPulumiResource}
 
-    let storage = Storage.make(
-      ~name=name->ComponentType.name(EventLog.componentType),
+    let logName = name->ComponentType.name(EventLog.componentType)
+    let storage = Storage.make(~name=logName, ~owner, ~opts)
+
+    // Announce the log to any registered extension. No-op unless a deploy program
+    // registered a backend via EventLogProvisioning.use — see
+    // src/adapter/EventLogProvisioning/EventLogProvisioning.res.
+    EventLogProvisioning.notify(
+      ~logStyle=Classic,
+      ~name=logName,
       ~owner,
+      ~resources=storage.resources,
       ~opts,
     )
 

package/src/components/EventLog/EventLog_Builder.res.mjs

@@ -7,6 +7,7 @@ import * as Util_Pulumi$ReventlessCore from "../../util/Util_Pulumi.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as EventTopic_Builder$ReventlessCore from "../EventTopic/EventTopic_Builder.res.mjs";
 import * as EventLog_Operations$ReventlessCore from "./EventLog_Operations.res.mjs";
+import * as EventLogProvisioning$ReventlessCore from "../../adapter/EventLogProvisioning/EventLogProvisioning.res.mjs";
 
 function Make(Spec) {
   return Storage => (EventTopicPublisher => {
@@ -15,7 +16,9 @@ function Make(Spec) {
       let opts = {
         parent: opts_parent
       };
-      let storage = Storage.make(ComponentType$ReventlessCore.name(extra$1, EventLog$ReventlessCore.componentType), owner, opts);
+      let logName = ComponentType$ReventlessCore.name(extra$1, EventLog$ReventlessCore.componentType);
+      let storage = Storage.make(logName, owner, opts);
+      EventLogProvisioning$ReventlessCore.notify("Classic", logName, owner, storage.resources, opts);
       let SpecificEventTopic = EventTopic_Builder$ReventlessCore.Make(Spec)(EventTopicPublisher);
       let eventTopic = SpecificEventTopic.make(extra$1, storage.resources, owner, Util_Pulumi$ReventlessCore.ComponentResourceOptions.ofCustomResourceOptions(opts));
       Component$ReventlessCore.setOperations(extra, Pulumi.all([

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Callback.res

@@ -22,6 +22,38 @@ type todoRow = {
   lastError?: string,
 }
 
+/** The item schema seen through the `JSON.t` the row actually stores.
+
+    `item` holds `Spec.outboundItemSchema`-encoded JSON, so the item schema
+    already describes the stored value exactly — only the ReScript types
+    disagree. */
+external itemAsJson: S.t<'item> => S.t<JSON.t> = "%identity"
+
+/**
+The row schema as the API describes it: `item` carried by the slice's own item
+schema instead of as opaque JSON.
+
+`todoRowSchema` types `item` as `JSON.t`, which the schema→GraphQL IR can only
+classify as `Unknown` — and `Unknown` renders as `String!`. The field then
+serves a stored object through a String, which fails at execution ("String
+cannot represent value: { … }") the moment a client selects it. Describing the
+item shape gives the field a real object type instead.
+
+Shape only: never encode or parse a row with this. The runtime field is `JSON.t`
+and the identity cast above would have `S.parseOrThrow` hand back an item where
+the row's own code expects JSON.
+*/
+let todoRowSchemaFor = (itemSchema: S.t<'item>): S.t<todoRow> =>
+  S.schema(s => {
+    item: s.matches(itemSchema->itemAsJson),
+    status: s.matches(todoStatusSchema),
+    createdAt: s.matches(S.string),
+    processedAt: ?s.matches(S.option(S.string)),
+    completedAt: ?s.matches(S.option(S.string)),
+    retryCount: s.matches(S.int),
+    lastError: ?s.matches(S.option(S.string)),
+  })
+
 /**
 The runtime protocol between a built callback and whoever drives it.
 

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Callback.res.mjs

@@ -29,6 +29,18 @@ let todoRowSchema = S.schema(s => ({
   lastError: s.m(S.option(S.string))
 }));
 
+function todoRowSchemaFor(itemSchema) {
+  return S.schema(s => ({
+    item: s.m(itemSchema),
+    status: s.m(todoStatusSchema),
+    createdAt: s.m(S.string),
+    processedAt: s.m(S.option(S.string)),
+    completedAt: s.m(S.option(S.string)),
+    retryCount: s.m(S.int),
+    lastError: s.m(S.option(S.string))
+  }));
+}
+
 function Make(Spec) {
   return Translation => {
     let todoItems = {};
@@ -168,6 +180,7 @@ function Make(Spec) {
 export {
   todoStatusSchema,
   todoRowSchema,
+  todoRowSchemaFor,
   Make,
 }
 /*  Not a pure module */

package/src/plugin/component/Plugin_Builder.res

@@ -621,20 +621,13 @@ module Make = (
 
       // Offload the two large pluginDefinition fields at deploy time when a
       // provider offers an object store (AWS writes a content-addressed object
-      // and returns a reference); unset locally, so they stay Inline. Computed
-      // HERE, at graph-construction time — both values are concrete and the hook
-      // (which creates the object resource) MUST run outside the Pulumi.Output.apply
-      // below: a resource cannot be created inside .apply, and an apply callback is
-      // skipped entirely on `pulumi preview` when its inputs are still unknown.
+      // and returns a reference). Computed HERE, at graph-construction time —
+      // both values are concrete and the hook (which creates the object resource)
+      // MUST run outside the Pulumi.Output.apply below: a resource cannot be
+      // created inside .apply, and an apply callback is skipped entirely on
+      // `pulumi preview` when its inputs are still unknown.
       // Unconditional: these fields are always large enough to be worth offloading.
-      let toPayload = (value, ~schema, ~store) =>
-        switch Plugin_Helpers.offloadHook.contents {
-        | Some(hook) =>
-          Reventless.Offload.Offloaded(
-            hook(~store, ~bytes=value->S.reverseConvertToJsonStringOrThrow(schema)),
-          )
-        | None => Reventless.Offload.Inline(value)
-        }
+      let toPayload = Plugin_Helpers.offloadPayload
       let apiSchemaFragmentPayload = toPayload(
         apiSchemaFragment,
         ~schema=Reventless.Plugin.apiSchemaFragmentSchema,

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -425,22 +425,8 @@ function Make(Spec) {
         });
         let pushSchema = Spec.hooks.preResolversSchemaHook;
         let schemaPushed = pushSchema !== undefined ? pushSchema(extra$1, version, apiSchemaFragment) : Pulumi.output();
-        let toPayload = (value, schema, store) => {
-          let hook = Plugin_Helpers$ReventlessCore.offloadHook.contents;
-          if (hook !== undefined) {
-            return {
-              TAG: "Offloaded",
-              _0: hook(store, S.reverseConvertToJsonStringOrThrow(value, schema, undefined))
-            };
-          } else {
-            return {
-              TAG: "Inline",
-              _0: value
-            };
-          }
-        };
-        let apiSchemaFragmentPayload = toPayload(apiSchemaFragment, Plugin$Reventless.apiSchemaFragmentSchema, "pluginApiFragments");
-        let structurePayload = Stdlib_Option.map(pluginStructure, s => toPayload(s, Plugin$Reventless.pluginStructureSchema, "pluginStructures"));
+        let apiSchemaFragmentPayload = Plugin_Helpers$ReventlessCore.offloadPayload(apiSchemaFragment, Plugin$Reventless.apiSchemaFragmentSchema, "pluginApiFragments");
+        let structurePayload = Stdlib_Option.map(pluginStructure, s => Plugin_Helpers$ReventlessCore.offloadPayload(s, Plugin$Reventless.pluginStructureSchema, "pluginStructures"));
         let builderOutputs = Pulumi.all([
           Pulumi.all([
             interstackAdminExtensionPoints,