@reventlessdev/reventless-core 3.0.0-alpha.216 → 3.0.0-alpha.217

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.217 (2026-08-08)
+
+### Bug Fixes
+
+* **core:** attribute resources built after a builder's construct returns ([67d6d9c](https://github.com/ReventlessDev/reventless-core/commit/67d6d9c0ff3ff1d38cd9e8ad43a4b86121abf827))
+### Features
+
+* **core:** let an extension switch query interception on, and provision it ([4523b10](https://github.com/ReventlessDev/reventless-core/commit/4523b10597f1a028eedccc42391b250b25a6ddd3))
+
+
 # 3.0.0-alpha.216 (2026-08-08)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.216",
+  "version": "3.0.0-alpha.217",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,17 +28,17 @@
   "dependencies": {
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.2",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.2",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.2",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.128",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.102"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.102",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/ResourceAttribution.res

@@ -112,10 +112,28 @@ large, purely mechanical churn — so the plugin builder publishes them here for
 the duration of its construct, exactly as it already does for
 `Logger.currentPluginName`.
 
-Safe because deploy-time resource construction is synchronous (the framework
-forbids creating resources inside `Pulumi.Output.apply`), so everything built
-between `enter` and `restore` genuinely belongs to that plugin. Outside any
-plugin construct both are `None` — which is the correct answer for
+The `enter`/`restore` bracket covers what runs **synchronously** inside the
+builder's construct, and everything built there genuinely belongs to that plugin.
+
+It does not cover all of construct. Builders defer part of their work until every
+handler has registered, and they defer it by waiting on outputs — so that work
+runs from a `Pulumi.Output.apply` callback, after construct has returned and
+`restore` has already emptied the context. A resource created there would be
+attributed to nobody, and `None` is a *meaningful* value here: it means
+platform-scope substrate. So the miss does not read as a gap, it reads as a
+positive answer, and a consumer cannot tell the two apart.
+
+Deferred work therefore carries its own attribution. Capture the context while it
+is still published and reinstate it around the callback: `deferred` for a
+callback registered during construct and invoked later, and
+`ResourceAttribution_Deploytime.applyAttributed` / `flatMapAttributed` for a
+builder's own apply. Both restore afterwards, so several plugins' deferred work
+can run from one apply without leaking into each other.
+
+Everything Pulumi-shaped lives in that separate module, so this one stays
+importable from code that ends up in a Lambda bundle.
+
+Outside any plugin construct both are `None` — the correct answer for
 platform-scope substrate.
 */
 type context = {platform: option<string>, plugin: option<string>}
@@ -131,3 +149,41 @@ let enter = (~platform: string, ~plugin: string) => {
 
 /** Restore the context captured by `enter`. */
 let restore = (previous: context) => current := previous
+
+/** Re-enter a whole captured context — including an empty one, which `enter`
+    cannot express since it takes two required strings. Returns the previous
+    context, exactly as `enter` does. */
+let enterCaptured = (captured: context) => {
+  let previous = current.contents
+  current := captured
+  previous
+}
+
+/** Run `fn` under `captured`, then put the previous context back — including
+    when `fn` throws, so a failing deferred callback cannot strand the context
+    and mis-attribute everything built after it. */
+let within = (captured: context, fn: unit => 'a): 'a => {
+  let previous = enterCaptured(captured)
+  try {
+    let result = fn()
+    restore(previous)
+    result
+  } catch {
+  | e =>
+    restore(previous)
+    throw(e)
+  }
+}
+
+/** Capture the context now and wrap a callback so it runs under that context
+    whenever it is finally called. For work registered during construct but
+    executed later from an apply — a builder's deferred `finish`, whose whole
+    purpose is to run after every handler has registered.
+
+    Wrap at **registration**, not at the call site: the registries these
+    callbacks land in are module-level and shared by every plugin, so by the time
+    they run there is no single context that would be right for all of them. */
+let deferred = (fn: unit => 'a): (unit => 'a) => {
+  let captured = current.contents
+  () => within(captured, fn)
+}

package/src/ResourceAttribution.res.mjs

@@ -86,11 +86,37 @@ function restore(previous) {
   current.contents = previous;
 }
 
+function enterCaptured(captured) {
+  let previous = current.contents;
+  current.contents = captured;
+  return previous;
+}
+
+function within(captured, fn) {
+  let previous = enterCaptured(captured);
+  try {
+    let result = fn();
+    current.contents = previous;
+    return result;
+  } catch (e) {
+    current.contents = previous;
+    throw e;
+  }
+}
+
+function deferred(fn) {
+  let captured = current.contents;
+  return () => within(captured, fn);
+}
+
 export {
   Scope,
   Role,
   current,
   enter,
   restore,
+  enterCaptured,
+  within,
+  deferred,
 }
 /* No side effect */

package/src/adapter/QueryInterception/QueryInterception.res

@@ -0,0 +1,74 @@
+/**
+Deploy-time switch: an extension asks for query interception, and the framework
+provisions whatever that costs.
+
+`QueryDb_Callback.registerQueryInterceptor` is a runtime hook, and `RuntimeExtension`
+made it reachable inside a deployed runtime. On a DynamoDB-backed read model there
+was still nothing to reach: a top-level Query resolver talks to DynamoDB directly,
+so no code of ours runs on a read at all. Something has to put a runtime in front
+of the read, and that is a provisioning decision the extension cannot make for
+itself — an AppSync Lambda data source needs the api handle and a service role,
+both of which exist only inside the plugin build.
+
+So the split follows `Monitoring` and `EventLogProvisioning`: **the extension
+decides, the framework provisions.** An extension says only *that* interception
+should happen; it names no data source, no api and no role, and writes nothing
+provider-shaped. The framework already ships the handler
+(`QueryInterceptor_Lambda` on AWS), so there is nothing left for a caller to
+supply.
+
+**Off by default, and silent when off.** No registration means no interceptor
+runtime, no data source, unit resolvers exactly as before, and a byte-identical
+code archive — the same guarantee the cold-start seam makes.
+
+**It composes with `RuntimeExtension` without either knowing about the other.**
+The interceptor runtime is built through the standard runtime builder, so
+`Util_Bundle` bundles every registered extension's package into its archive and
+`makeFromCodeAsset` writes `RUNTIME_EXTENSIONS`. An extension that registers its
+interceptor in `onColdStart` is therefore carried into the interceptor runtime
+with no second registration.
+
+## What it costs, which is why it is opt-in
+
+Interception puts a Lambda invocation in front of **every read** on a
+DynamoDB-backed read model. Reads outrun writes by orders of magnitude, so this
+is the most expensive thing the framework can be asked to switch on. Two
+properties bound it:
+
+- **It is a property of the read-model backend, not of the cloud.** A
+  Postgres-backed read model already routes through a resolver Lambda, which
+  consults the same hook, so interception there costs nothing extra. Only the
+  DynamoDB direct-resolver path pays.
+- **It is the only place a read can be refused.** Anything cheaper — a log
+  subscription, a stream-fed counter — observes a read after the fact but cannot
+  deny it. Where the requirement is enforcement rather than observation, this
+  cost is the requirement's price rather than overhead.
+
+Granularity is per-deployment, deliberately: an operator asking "what does
+interception cost me" wants one answer, not one per component. Narrowing later is
+additive (a predicate on the registration); widening a per-component switch is
+not.
+
+See `docs/plans/done/query-interception-provisioning.md`.
+*/
+
+let enabled = ref(false)
+
+/**
+Switch query interception on for this deployment. Must run before the
+platform/plugin build in the deploy program (plain statement order — the switch is
+read lazily at each provisioning site), exactly like `Monitoring.use`.
+
+Registering the runtime interceptor itself stays separate and is the extension's
+job, through `QueryDb_Callback.registerQueryInterceptor` — typically from a
+`RuntimeExtension` cold-start hook. This call only provisions the path that lets
+that hook be consulted on a read.
+*/
+let use = () => enabled := true
+
+/** Whether interception was asked for. Consulted by the provisioning sites. */
+let isEnabled = () => enabled.contents
+
+/** Tests only — the switch is process-global, so a test that flips it must put it
+    back. */
+let reset = () => enabled := false

package/src/adapter/QueryInterception/QueryInterception.res.mjs

@@ -0,0 +1,26 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let enabled = {
+  contents: false
+};
+
+function use() {
+  enabled.contents = true;
+}
+
+function isEnabled() {
+  return enabled.contents;
+}
+
+function reset() {
+  enabled.contents = false;
+}
+
+export {
+  enabled,
+  use,
+  isEnabled,
+  reset,
+}
+/* No side effect */

package/src/adapter/ResourceAttribution_Deploytime.res

@@ -0,0 +1,43 @@
+/***
+Carrying `ResourceAttribution` across a `Pulumi.Output` boundary.
+
+Separate from `ResourceAttribution` itself on purpose: that module is read by
+code that ends up in a Lambda bundle, and importing the deploy-time engine there
+is a cold-start failure. Everything Pulumi-shaped lives here, where only
+deploy-time builders reach it — the same reason `AdapterDeploytime` sits apart
+from `Adapter`.
+
+Both helpers wrap `apply` / `flatMap` rather than the callback alone. Wrapping
+the callback would read more neatly, but it severs the type flow from the Output
+to the callback's parameters, and inference then fails on records the Output was
+the only thing constraining.
+*/
+
+/** `Pulumi.Output.apply` for a callback that CREATES RESOURCES.
+
+    An apply callback runs after the enclosing builder's construct has returned,
+    so the ambient attribution context — published for the duration of that
+    construct and unpublished at the end of it — is already empty by then, and
+    anything the callback provisions is attributed to nobody. That is not a gap
+    but a wrong answer: an empty plugin means platform-scope substrate.
+
+    This captures the context where the apply is *registered*, which is
+    synchronous inside construct, and reinstates it around the callback. Reach
+    for it wherever an apply body reaches a resource; plain `Pulumi.Output.apply`
+    stays right for a callback that only shapes data. */
+let applyAttributed = (output, callback) => {
+  let captured = ResourceAttribution.current.contents
+  output->Pulumi.Output.apply(resolved =>
+    captured->ResourceAttribution.within(() => callback(resolved))
+  )
+}
+
+/** `Pulumi.Output.flatMap` counterpart, for the same reason — a builder that
+    resolves one resource's outputs in order to build the next one defers just as
+    far. */
+let flatMapAttributed = (output, callback) => {
+  let captured = ResourceAttribution.current.contents
+  output->Pulumi.Output.flatMap(resolved =>
+    captured->ResourceAttribution.within(() => callback(resolved))
+  )
+}

package/src/adapter/ResourceAttribution_Deploytime.res.mjs

@@ -0,0 +1,20 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "../ResourceAttribution.res.mjs";
+
+function applyAttributed(output, callback) {
+  let captured = ResourceAttribution$ReventlessCore.current.contents;
+  return output.apply(resolved => ResourceAttribution$ReventlessCore.within(captured, () => callback(resolved)));
+}
+
+function flatMapAttributed(output, callback) {
+  let captured = ResourceAttribution$ReventlessCore.current.contents;
+  return Output$Pulumi.flatMap(output, resolved => ResourceAttribution$ReventlessCore.within(captured, () => callback(resolved)));
+}
+
+export {
+  applyAttributed,
+  flatMapAttributed,
+}
+/* Output-Pulumi Not a pure module */

package/src/components/Builder_Helpers.res

@@ -42,7 +42,13 @@ let createAggregatesWithoutEventMappers = (
     let publishJsons =
       SpecificAggregate.operations(aggregate)->Pulumi.Output.apply(({publishJsons}) => publishJsons)
     publishToAggregates->Dict.set(SpecificAggregate.Spec.name, publishJsons)
-    aggregateFinishFns->Dict.set(SpecificAggregate.Spec.name, SpecificAggregate.finish)
+    // `finish` runs from an apply in `finishAggregates`, long after this
+    // construct returns — wrap it now, while the plugin is still the ambient
+    // one, so whatever it provisions is attributed to that plugin.
+    aggregateFinishFns->Dict.set(
+      SpecificAggregate.Spec.name,
+      ResourceAttribution.deferred(SpecificAggregate.finish),
+    )
     aggOutputs
   })
   ->Array.map(aggregate => {(aggregate.name, aggregate)})
@@ -106,7 +112,10 @@ let taskSideEffectFinishFns: array<unit => unit> = []
 
 let registerTaskSideEffectHandler = (~gate, ~finish) => {
   let _ = taskSideEffectGates->Array.push(gate)
-  let _ = taskSideEffectFinishFns->Array.push(finish)
+  // These arrays are module-level and shared by every plugin, so the context has
+  // to travel with each entry: by the time `finishTasks` runs them there is no
+  // one plugin that would be right for all of them.
+  let _ = taskSideEffectFinishFns->Array.push(ResourceAttribution.deferred(finish))
 }
 
 // Provision side-effect handler runtimes once every task's handler is ready. Same
@@ -179,7 +188,16 @@ let createReadModels = (
       rmOperations->Pulumi.Output.apply(({enqueueEvent}) => enqueueEvent),
     )
 
-    (SpecificReadModel.Spec.name, {outputs: rmOutputs, operations: rmOperations, finish: SpecificReadModel.finish})
+    // Deferred to `finishReadModels`, which runs it from an apply — wrap it here
+    // so the read model's runtime is attributed to the plugin building it.
+    (
+      SpecificReadModel.Spec.name,
+      {
+        outputs: rmOutputs,
+        operations: rmOperations,
+        finish: ResourceAttribution.deferred(SpecificReadModel.finish),
+      },
+    )
   })
   readModels->finishReadModels
   readModels->extractReadModelsOutputs

package/src/components/Builder_Helpers.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as QueryDb$ReventlessCore from "./QueryDb/QueryDb.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "../ResourceAttribution.res.mjs";
 
 let addEventMapperFns = {};
 
@@ -22,7 +23,7 @@ function createAggregatesWithoutEventMappers(aggregates, api, componentRuntime,
     aggregateResources[SpecificAggregate.Spec.name] = resources;
     let publishJsons = SpecificAggregate.operations(aggregate).apply(param => param.publishJsons);
     publishToAggregates[SpecificAggregate.Spec.name] = publishJsons;
-    aggregateFinishFns[SpecificAggregate.Spec.name] = SpecificAggregate.finish;
+    aggregateFinishFns[SpecificAggregate.Spec.name] = ResourceAttribution$ReventlessCore.deferred(SpecificAggregate.finish);
     return aggOutputs;
   }).map(aggregate => [
     aggregate.name,
@@ -54,7 +55,7 @@ let taskSideEffectFinishFns = [];
 
 function registerTaskSideEffectHandler(gate, finish) {
   taskSideEffectGates.push(gate);
-  taskSideEffectFinishFns.push(finish);
+  taskSideEffectFinishFns.push(ResourceAttribution$ReventlessCore.deferred(finish));
 }
 
 function finishTasks() {
@@ -102,7 +103,7 @@ function createReadModels(readModels, api, apiRole, componentRuntime, allEventTo
       {
         outputs: rmOutputs,
         operations: rmOperations,
-        finish: SpecificReadModel.finish
+        finish: ResourceAttribution$ReventlessCore.deferred(SpecificReadModel.finish)
       }
     ];
   });

package/src/components/ExtensionPoint/ExtensionPoint_Builder.res

@@ -63,7 +63,10 @@ module Make = (
 
     let (commandTopic, eventTopic, outgoingJsonEventsHandler) =
       commandTopicResources
-      ->Pulumi.Output.flatMap(commandTopicResources => {
+      // The extension point's runtime and its event topic are both built in
+      // here, once the command topic's resources resolve — i.e. after the
+      // plugin's construct has returned. Reinstate its attribution.
+      ->ResourceAttribution_Deploytime.flatMapAttributed(commandTopicResources => {
         module ExtensionPointCallback = ExtensionPoint_Callback.Make(
           {
             let publishToAggregates = publishToAggregates

package/src/components/ExtensionPoint/ExtensionPoint_Builder.res.mjs

@@ -15,6 +15,7 @@ import * as EventTopic_Builder$ReventlessCore from "../EventTopic/EventTopic_Bui
 import * as CommandTopic_Builder$ReventlessCore from "../CommandTopic/CommandTopic_Builder.res.mjs";
 import * as ExtensionPoint_Callback$ReventlessCore from "./ExtensionPoint_Callback.res.mjs";
 import * as ExtensionPoint_Operations$ReventlessCore from "./ExtensionPoint_Operations.res.mjs";
+import * as ResourceAttribution_Deploytime$ReventlessCore from "../../adapter/ResourceAttribution_Deploytime.res.mjs";
 
 function Make(Spec) {
   return Mappings => (RuntimeEnvironment => (CommandTopicChannel => (EventTopicAdapter => (ExtensionPointRuntimeBuilder => (Defaults => {
@@ -42,7 +43,7 @@ function Make(Spec) {
       }, opts);
       let aggregateNames = Stdlib_Array.filterMap(Mappings.mappings, Mapping => Stdlib_Option.map(Mapping.mapOutgoingEvent, param => Mapping.delegateName));
       let commandTopicResources = Adapter$ReventlessCore.resourcesToResolvedOutput(commandTopic.channel.resources);
-      let match = Output$Pulumi.unzip3(Output$Pulumi.flatMap(commandTopicResources, commandTopicResources => {
+      let match = Output$Pulumi.unzip3(ResourceAttribution_Deploytime$ReventlessCore.flatMapAttributed(commandTopicResources, commandTopicResources => {
         let ExtensionPointCallback = ExtensionPoint_Callback$ReventlessCore.Make({
           publishToAggregates: publishToAggregates,
           commandTopicResources: commandTopicResources,

package/src/plugin/component/Plugin_Builder.res

@@ -648,7 +648,11 @@ module Make = (
         queryEngine,
       )
       ->Pulumi.Output.all6
-      ->Pulumi.Output.apply(((
+      // `applyAttributed`, not `apply`: this callback provisions real resources —
+      // extension points, tasks, the heartbeat, resolvers — and it runs after
+      // this construct has returned, when the ambient attribution context is
+      // already empty. It reinstates the plugin's context for the duration.
+      ->ResourceAttribution_Deploytime.applyAttributed(((
         (interstackAdminExtensionPoints, localAdminResolvedEP, _),
         aggregateResources,
         publishToAggregates,

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -36,6 +36,7 @@ import * as ResourceAttribution$ReventlessCore from "../../ResourceAttribution.r
 import * as Plugin_EventQuerySchema$ReventlessCore from "./Plugin_EventQuerySchema.res.mjs";
 import * as PluginExtensionPointSpec$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/PluginExtensionPointSpec.res.mjs";
 import * as Plugin_SubscriptionSchema$ReventlessCore from "./Plugin_SubscriptionSchema.res.mjs";
+import * as ResourceAttribution_Deploytime$ReventlessCore from "../../adapter/ResourceAttribution_Deploytime.res.mjs";
 
 function Make(Spec) {
   return ApiSpec => (FragmentProvider => (RuntimeEnvironment => (EventCollectorChannel => (QueryEngineAdapter => (PluginExtensionPointRemoteChannel => (HeartbeatRunner => (PluginRuntimeBuilder => (DcbEventLogStorage => (DcbEventTopicPublisher => (DcbCommandTopicChannel => (DcbCommandTopicChannelAsync => {
@@ -428,7 +429,7 @@ function Make(Spec) {
         let schemaPushed = pushSchema !== undefined ? pushSchema(extra$1, version, apiSchemaFragment) : Pulumi.output();
         let apiSchemaFragmentPayload = Plugin_Helpers$ReventlessCore.offloadPayload(apiSchemaFragment, Plugin$Reventless.apiSchemaFragmentSchema, "pluginApiFragments");
         let structurePayload = Stdlib_Option.map(pluginStructure, s => Plugin_Helpers$ReventlessCore.offloadPayload(s, Plugin$Reventless.pluginStructureSchema, "pluginStructures"));
-        let builderOutputs = Pulumi.all([
+        let builderOutputs = ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(Pulumi.all([
           Pulumi.all([
             interstackAdminExtensionPoints,
             localAdminResolvedEP,
@@ -439,7 +440,7 @@ function Make(Spec) {
           Pulumi.all(Plugin_Helpers$ReventlessCore.publishToReadModels),
           scheduler,
           queryEngine
-        ]).apply(param => {
+        ]), param => {
           let queryEngine = param[5];
           let scheduler = param[4];
           let publishToReadModels = param[3];

package/src/plugin/component/Plugin_Helpers.res

@@ -383,7 +383,10 @@ let createConnectPluginExtension = (
   ~opts,
 ) =>
   pluginDefinition
-  ->Pulumi.Output.apply(pluginDefinition => {
+  // Provisions the plugin's connect-extension and its event-collector runtime,
+  // so it needs the plugin's attribution reinstated — the apply runs after
+  // construct has emptied it.
+  ->ResourceAttribution_Deploytime.applyAttributed(pluginDefinition => {
     module ConnectPluginExtension = PluginConnectExtension_Builder.Make({
       let pluginDefinition = pluginDefinition
       let uiFragments = uiFragments
@@ -548,7 +551,9 @@ module MakeEventCollectorHelper = (
       resources,
     )
     ->Pulumi.Output.all5
-    ->Pulumi.Output.apply(((
+    // Builds the plugin's own event-collector runtime, so it needs the plugin's
+    // attribution reinstated — this callback runs after construct emptied it.
+    ->ResourceAttribution_Deploytime.applyAttributed(((
       pluginDefinition,
       connectExtData,
       extensionsHandlers,

package/src/plugin/component/Plugin_Helpers.res.mjs

@@ -58,6 +58,7 @@ import * as OutboundTranslationSlice$ReventlessInterop from "@reventlessdev/reve
 import * as PluginExtensionPoint_Plugin$ReventlessCore from "../connect/PluginExtensionPoint_Plugin.res.mjs";
 import * as PluginConnectExtension_Builder$ReventlessCore from "../connect/PluginConnectExtension_Builder.res.mjs";
 import * as PluginConnectExtension_Mapping$ReventlessCore from "../connect/PluginConnectExtension_Mapping.res.mjs";
+import * as ResourceAttribution_Deploytime$ReventlessCore from "../../adapter/ResourceAttribution_Deploytime.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -224,7 +225,7 @@ function extractExtensionDefinitions(extensionsOutputs) {
 }
 
 function createConnectPluginExtension(pluginDefinition, uiFragments, publishToPluginExtensionPoint, publishToAggregates, readModelNamesForSourceName, publishToReadModels, queryEngine, opts) {
-  return Output$Pulumi.unzip(pluginDefinition.apply(pluginDefinition => {
+  return Output$Pulumi.unzip(ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(pluginDefinition, pluginDefinition => {
     let ConnectPluginExtension = PluginConnectExtension_Builder$ReventlessCore.Make({
       pluginDefinition: pluginDefinition,
       uiFragments: uiFragments
@@ -292,13 +293,13 @@ function MakeEventCollectorHelper(RuntimeEnvironment) {
           param[0],
           param[1]
         ]) : Pulumi.output(undefined);
-      return Pulumi.all([
+      return ResourceAttribution_Deploytime$ReventlessCore.applyAttributed(Pulumi.all([
         pluginDefinition,
         connectExtData,
         Pulumi.all(extensionsHandlers),
         Pulumi.all(extensionPointsHandlers),
         resources
-      ]).apply(param => {
+      ]), param => {
         let extensionsHandlers = param[2];
         let connectExtData = param[1];
         let pluginDefinition = param[0];

package/tests/ResourceAttributionTest.res

@@ -68,3 +68,118 @@ describe("ResourceAttribution — ambient plugin context", () => {
     expect(Attribution.current.contents.plugin)->toEqual(None)
   })
 })
+
+// The bracket only covers what runs synchronously inside a builder's construct.
+// Builders defer part of their work into a `Pulumi.Output.apply`, which runs
+// after `restore` has emptied the context — so a resource created there is
+// attributed to nobody. These pin the mechanism that carries the context across
+// that gap. Each empties the context first, which is exactly the state a
+// deferred callback finds itself in.
+
+describe("ResourceAttribution — carrying the context into deferred work", () => {
+  testSync("a deferred callback runs under the context it was wrapped in", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let observed = ref(None)
+    let finish = Attribution.deferred(() => observed := Attribution.current.contents.plugin)
+    Attribution.restore(previous)
+
+    // Construct has returned; nothing is attributed. This is when the apply fires.
+    expect(Attribution.current.contents.plugin)->toEqual(None)
+    finish()
+    expect(observed.contents)->toEqual(Some("Catalog"))
+  })
+
+  testSync("it puts the context back, so the next callback is not attributed to it", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let finish = Attribution.deferred(() => ())
+    Attribution.restore(previous)
+
+    finish()
+    expect(Attribution.current.contents.plugin)->toEqual(None)
+  })
+
+  // The registries these callbacks land in are module-level and shared, so one
+  // apply runs several plugins' finish functions back to back. Attributing them
+  // all to whichever ran first is the failure this guards.
+  testSync("two plugins deferred from one apply are each attributed to themselves", () => {
+    let outer = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let catalogSaw = ref(None)
+    let catalogFinish = Attribution.deferred(() =>
+      catalogSaw := Attribution.current.contents.plugin
+    )
+    Attribution.restore(outer)
+
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Ordering")
+    let orderingSaw = ref(None)
+    let orderingFinish = Attribution.deferred(() =>
+      orderingSaw := Attribution.current.contents.plugin
+    )
+    Attribution.restore(previous)
+
+    catalogFinish()
+    orderingFinish()
+    expect((catalogSaw.contents, orderingSaw.contents))->toEqual((
+      Some("Catalog"),
+      Some("Ordering"),
+    ))
+  })
+
+  testSync("a throwing callback still puts the context back", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let finish: unit => unit = Attribution.deferred(() =>
+      JsError.throwWithMessage("finish blew up")
+    )
+    Attribution.restore(previous)
+
+    let threw = try {
+      finish()
+      false
+    } catch {
+    | _ => true
+    }
+    expect(threw)->toBe(true)
+    expect(Attribution.current.contents.plugin)->toEqual(None)
+  })
+
+  testSync("within re-enters a captured context for a callback that takes arguments", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let captured = Attribution.current.contents
+    Attribution.restore(previous)
+
+    let observed = captured->Attribution.within(() => Attribution.current.contents.plugin)
+    expect(observed)->toEqual(Some("Catalog"))
+    expect(Attribution.current.contents.plugin)->toEqual(None)
+  })
+
+  testSync("enterCaptured can express the empty context, which enter cannot", () => {
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    let restoredToEmpty = Attribution.enterCaptured({platform: None, plugin: None})
+    expect(Attribution.current.contents.plugin)->toEqual(None)
+    expect(restoredToEmpty.plugin)->toEqual(Some("Catalog"))
+    Attribution.restore(previous)
+  })
+})
+
+// The combinator being right is not the same as it being wired in. This one
+// exercises the production choke point: a task side-effect handler registered
+// during construct, then run the way `finishTasks` runs it — from an apply,
+// with nothing attributed.
+describe("Builder_Helpers.registerTaskSideEffectHandler — attribution survives the deferral", () => {
+  testSync("the registered finish sees the plugin that registered it", () => {
+    let before = Builder_Helpers.taskSideEffectFinishFns->Array.length
+    let observed = ref(None)
+
+    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+    Builder_Helpers.registerTaskSideEffectHandler(
+      ~gate=Pulumi.Output.make(),
+      ~finish=() => observed := Attribution.current.contents.plugin,
+    )
+    Attribution.restore(previous)
+
+    switch Builder_Helpers.taskSideEffectFinishFns->Array.get(before) {
+    | Some(finish) => finish()
+    | None => JsError.throwWithMessage("handler was not registered")
+    }
+    expect(observed.contents)->toEqual(Some("Catalog"))
+  })
+})

package/tests/ResourceAttributionTest.res.mjs

@@ -1,6 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as ComponentType$ReventlessCore from "../src/ComponentType.res.mjs";
+import * as Builder_Helpers$ReventlessCore from "../src/components/Builder_Helpers.res.mjs";
 import * as ResourceAttribution$ReventlessCore from "../src/ResourceAttribution.res.mjs";
 
 globalThis.describe("ResourceAttribution.Scope — wire spellings", () => {
@@ -67,6 +70,109 @@ globalThis.describe("ResourceAttribution — ambient plugin context", () => {
   });
 });
 
+globalThis.describe("ResourceAttribution — carrying the context into deferred work", () => {
+  globalThis.test("a deferred callback runs under the context it was wrapped in", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let observed = {
+      contents: undefined
+    };
+    let finish = ResourceAttribution$ReventlessCore.deferred(() => {
+      observed.contents = ResourceAttribution$ReventlessCore.current.contents.plugin;
+    });
+    ResourceAttribution$ReventlessCore.restore(previous);
+    globalThis.expect(ResourceAttribution$ReventlessCore.current.contents.plugin).toEqual(undefined);
+    finish();
+    globalThis.expect(observed.contents).toEqual("Catalog");
+  });
+  globalThis.test("it puts the context back, so the next callback is not attributed to it", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let finish = ResourceAttribution$ReventlessCore.deferred(() => {});
+    ResourceAttribution$ReventlessCore.restore(previous);
+    finish();
+    globalThis.expect(ResourceAttribution$ReventlessCore.current.contents.plugin).toEqual(undefined);
+  });
+  globalThis.test("two plugins deferred from one apply are each attributed to themselves", () => {
+    let outer = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let catalogSaw = {
+      contents: undefined
+    };
+    let catalogFinish = ResourceAttribution$ReventlessCore.deferred(() => {
+      catalogSaw.contents = ResourceAttribution$ReventlessCore.current.contents.plugin;
+    });
+    ResourceAttribution$ReventlessCore.restore(outer);
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Ordering");
+    let orderingSaw = {
+      contents: undefined
+    };
+    let orderingFinish = ResourceAttribution$ReventlessCore.deferred(() => {
+      orderingSaw.contents = ResourceAttribution$ReventlessCore.current.contents.plugin;
+    });
+    ResourceAttribution$ReventlessCore.restore(previous);
+    catalogFinish();
+    orderingFinish();
+    globalThis.expect([
+      catalogSaw.contents,
+      orderingSaw.contents
+    ]).toEqual([
+      "Catalog",
+      "Ordering"
+    ]);
+  });
+  globalThis.test("a throwing callback still puts the context back", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let finish = ResourceAttribution$ReventlessCore.deferred(() => Stdlib_JsError.throwWithMessage("finish blew up"));
+    ResourceAttribution$ReventlessCore.restore(previous);
+    let threw;
+    try {
+      finish();
+      threw = false;
+    } catch (exn) {
+      threw = true;
+    }
+    globalThis.expect(threw).toBe(true);
+    globalThis.expect(ResourceAttribution$ReventlessCore.current.contents.plugin).toEqual(undefined);
+  });
+  globalThis.test("within re-enters a captured context for a callback that takes arguments", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let captured = ResourceAttribution$ReventlessCore.current.contents;
+    ResourceAttribution$ReventlessCore.restore(previous);
+    let observed = ResourceAttribution$ReventlessCore.within(captured, () => ResourceAttribution$ReventlessCore.current.contents.plugin);
+    globalThis.expect(observed).toEqual("Catalog");
+    globalThis.expect(ResourceAttribution$ReventlessCore.current.contents.plugin).toEqual(undefined);
+  });
+  globalThis.test("enterCaptured can express the empty context, which enter cannot", () => {
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    let restoredToEmpty = ResourceAttribution$ReventlessCore.enterCaptured({
+      platform: undefined,
+      plugin: undefined
+    });
+    globalThis.expect(ResourceAttribution$ReventlessCore.current.contents.plugin).toEqual(undefined);
+    globalThis.expect(restoredToEmpty.plugin).toEqual("Catalog");
+    ResourceAttribution$ReventlessCore.restore(previous);
+  });
+});
+
+globalThis.describe("Builder_Helpers.registerTaskSideEffectHandler — attribution survives the deferral", () => {
+  globalThis.test("the registered finish sees the plugin that registered it", () => {
+    let before = Builder_Helpers$ReventlessCore.taskSideEffectFinishFns.length;
+    let observed = {
+      contents: undefined
+    };
+    let previous = ResourceAttribution$ReventlessCore.enter("online-shop", "Catalog");
+    Builder_Helpers$ReventlessCore.registerTaskSideEffectHandler(Pulumi.output(), () => {
+      observed.contents = ResourceAttribution$ReventlessCore.current.contents.plugin;
+    });
+    ResourceAttribution$ReventlessCore.restore(previous);
+    let finish = Builder_Helpers$ReventlessCore.taskSideEffectFinishFns[before];
+    if (finish !== undefined) {
+      finish();
+    } else {
+      Stdlib_JsError.throwWithMessage("handler was not registered");
+    }
+    globalThis.expect(observed.contents).toEqual("Catalog");
+  });
+});
+
 let Attribution;
 
 export {

package/tests/adapter/QueryInterceptionTest.res

@@ -0,0 +1,55 @@
+open JestGlobals
+
+// The seam is a single process-global switch, so what is worth pinning is the
+// default (off) and the fact that switching it on does not also register a
+// runtime interceptor — the two are deliberately separate decisions, and
+// conflating them would provision an interceptor path for a hook nobody set.
+
+module Interception = QueryInterception
+
+describe("QueryInterception", () => {
+  testSync("off by default — no registration, nothing provisioned", () => {
+    Interception.reset()
+    expect(Interception.isEnabled())->toBe(false)
+  })
+
+  testSync("use switches it on for the deployment", () => {
+    Interception.reset()
+    Interception.use()
+    expect(Interception.isEnabled())->toBe(true)
+    Interception.reset()
+  })
+
+  testSync("use is idempotent — an extension may call it more than once", () => {
+    Interception.reset()
+    Interception.use()
+    Interception.use()
+    expect(Interception.isEnabled())->toBe(true)
+    Interception.reset()
+  })
+
+  testSync("reset puts it back, so one test cannot leak into the next", () => {
+    Interception.use()
+    Interception.reset()
+    expect(Interception.isEnabled())->toBe(false)
+  })
+
+  // Provisioning the path and registering the hook are separate on purpose: the
+  // framework provisions, the extension decides what runs. Asking for
+  // interception must not fabricate an interceptor.
+  testSync("switching provisioning on does not register a runtime interceptor", () => {
+    QueryDb_Callback.clearQueryInterceptor()
+    Interception.use()
+    expect(QueryDb_Callback.queryInterceptorHook.contents->Option.isNone)->toBe(true)
+    Interception.reset()
+  })
+
+  testSync("and registering a runtime interceptor does not switch provisioning on", () => {
+    Interception.reset()
+    QueryDb_Callback.registerQueryInterceptor((~identity as _, ~readModelName as _, ~args as _) =>
+      Promise.resolve(QueryDb_Callback.Allow)
+    )
+    expect(Interception.isEnabled())->toBe(false)
+    QueryDb_Callback.clearQueryInterceptor()
+  })
+})

package/tests/adapter/QueryInterceptionTest.res.mjs

@@ -0,0 +1,49 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as QueryDb_Callback$ReventlessCore from "../../src/components/QueryDb/QueryDb_Callback.res.mjs";
+import * as QueryInterception$ReventlessCore from "../../src/adapter/QueryInterception/QueryInterception.res.mjs";
+
+globalThis.describe("QueryInterception", () => {
+  globalThis.test("off by default — no registration, nothing provisioned", () => {
+    QueryInterception$ReventlessCore.reset();
+    globalThis.expect(QueryInterception$ReventlessCore.isEnabled()).toBe(false);
+  });
+  globalThis.test("use switches it on for the deployment", () => {
+    QueryInterception$ReventlessCore.reset();
+    QueryInterception$ReventlessCore.use();
+    globalThis.expect(QueryInterception$ReventlessCore.isEnabled()).toBe(true);
+    QueryInterception$ReventlessCore.reset();
+  });
+  globalThis.test("use is idempotent — an extension may call it more than once", () => {
+    QueryInterception$ReventlessCore.reset();
+    QueryInterception$ReventlessCore.use();
+    QueryInterception$ReventlessCore.use();
+    globalThis.expect(QueryInterception$ReventlessCore.isEnabled()).toBe(true);
+    QueryInterception$ReventlessCore.reset();
+  });
+  globalThis.test("reset puts it back, so one test cannot leak into the next", () => {
+    QueryInterception$ReventlessCore.use();
+    QueryInterception$ReventlessCore.reset();
+    globalThis.expect(QueryInterception$ReventlessCore.isEnabled()).toBe(false);
+  });
+  globalThis.test("switching provisioning on does not register a runtime interceptor", () => {
+    QueryDb_Callback$ReventlessCore.clearQueryInterceptor();
+    QueryInterception$ReventlessCore.use();
+    globalThis.expect(Stdlib_Option.isNone(QueryDb_Callback$ReventlessCore.queryInterceptorHook.contents)).toBe(true);
+    QueryInterception$ReventlessCore.reset();
+  });
+  globalThis.test("and registering a runtime interceptor does not switch provisioning on", () => {
+    QueryInterception$ReventlessCore.reset();
+    QueryDb_Callback$ReventlessCore.registerQueryInterceptor((param, param$1, param$2) => Promise.resolve("Allow"));
+    globalThis.expect(QueryInterception$ReventlessCore.isEnabled()).toBe(false);
+    QueryDb_Callback$ReventlessCore.clearQueryInterceptor();
+  });
+});
+
+let Interception;
+
+export {
+  Interception,
+}
+/*  Not a pure module */