@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -0,0 +1,238 @@
+// AWS resolver for the `Platform_ComponentDefinitions` admin GraphQL query.
+//
+// Backed by a Lambda DataSource that scans the Plugin read model and emits
+// one entry per Connected plugin whose persisted state carries a `structure`
+// field. The persisted structure is sury-encoded with the exact same shape
+// the in-memory adapter's `Platform_ComponentDefinitionsApi.encodePluginStructureEntry`
+// produces (literal-string `commandLevel`, `null`-encoded options), so the
+// handler simply wraps each persisted structure with `pluginId` — no decoding
+// or re-encoding needed.
+
+open PulumiAws
+
+// `adminEntryJson` is the JSON-stringified entry for the built-in Platform_Admin
+// plugin (Plugin aggregate with Activate/Deactivate, Plugin read model).
+// The admin never `Connect`s to itself, so its structure never
+// enters the Plugin read model — we inject it at deploy time so the host shell
+// renders Auto UI for it alongside user plugins.
+let makeHandlerCode = (~tableName as _: string, ~adminEntryJson: string): string =>
+  `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.PLUGIN_RM_TABLE;
+const ADMIN_ENTRY = ${adminEntryJson};
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
+    return [ADMIN_ENTRY];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      FilterExpression: "contains(#status, :connected)",
+      ExpressionAttributeNames: { "#status": "status" },
+      ExpressionAttributeValues: { ":connected": "Connected" },
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Platform invariant: one version per plugin at a time, so the UI sees just
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The Connected
+  // filter above does not enforce single-version: during a rolling deploy or a
+  // missed retire, several versions of the same plugin sit in Connected at once
+  // and each would otherwise emit a full duplicate set of AutoUI menu entries.
+  // Collapse to the highest version per plugin name (mirrors
+  // ReventlessCore.Plugin.compareVersions).
+  const cmpVer = (a, b) => {
+    const pa = String(a).replace(/[-+]/g, ".").split(".");
+    const pb = String(b).replace(/[-+]/g, ".").split(".");
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+      const sa = pa[i] ?? "", sb = pb[i] ?? "";
+      const na = Number(sa), nb = Number(sb);
+      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
+      else if (sa !== sb) return sa > sb ? 1 : -1;
+    }
+    return 0;
+  };
+  const latestByName = new Map();
+  for (const item of items) {
+    if (!item || !item.structure) continue;
+    const name = String(item.name).split("@")[0];
+    const version = String(item.name).split("@")[1] ?? "";
+    const prev = latestByName.get(name);
+    if (!prev || cmpVer(version, prev.version) > 0) {
+      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+    }
+  }
+  const userEntries = [...latestByName.values()].map(v => v.entry);
+  return [ADMIN_ENTRY, ...userEntries];
+}
+`
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+let make = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~pluginReadModelTableName: Pulumi.Output.t<string>,
+  ~opts: Pulumi.ComponentResource.options,
+) => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let name = "PlatformUIDefinitions"
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "Lambda",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    pluginReadModelTableName->Pulumi.Output.apply(tableName => {
+      open PolicyDocument
+      let _rolePolicy = IAM.RolePolicy.make(
+        ~name=name ++ "LambdaPolicy",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "LambdaPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Action("logs:*"),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowScanPluginRm",
+                effect: Allow,
+                actions: Actions(["dynamodb:Scan"]),
+                resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let adminEntryJson =
+    ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
+      ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
+      ReventlessCore.Platform_Admin_Structure.structure,
+    )->JSON.stringify
+
+  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  let handlerCodeStub = makeHandlerCode(~tableName="", ~adminEntryJson)
+  archiveContents->Dict.set(
+    "index.mjs",
+    Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
+  )
+  let code = Pulumi.Archive.assetArchive(archiveContents)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub)
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "Lambda",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 512->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(~name=name ++ "Lambda", ReventlessCore.ReadModel.componentType),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+    },
+    ~opts,
+  )
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      open PolicyDocument
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  let _resolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Resolver",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Query"->Pulumi.Input.make,
+    ~field="Platform_ComponentDefinitions"->Pulumi.Input.make,
+    ~code=resolverCode,
+    ~opts,
+  )
+}

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -0,0 +1,179 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
+import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
+import * as Platform_ComponentDefinitionsApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_ComponentDefinitionsApi.res.mjs";
+
+function makeHandlerCode(param, adminEntryJson) {
+  return `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.PLUGIN_RM_TABLE;
+const ADMIN_ENTRY = ` + adminEntryJson + `;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
+    return [ADMIN_ENTRY];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      FilterExpression: "contains(#status, :connected)",
+      ExpressionAttributeNames: { "#status": "status" },
+      ExpressionAttributeValues: { ":connected": "Connected" },
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Platform invariant: one version per plugin at a time, so the UI sees just
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The Connected
+  // filter above does not enforce single-version: during a rolling deploy or a
+  // missed retire, several versions of the same plugin sit in Connected at once
+  // and each would otherwise emit a full duplicate set of AutoUI menu entries.
+  // Collapse to the highest version per plugin name (mirrors
+  // ReventlessCore.Plugin.compareVersions).
+  const cmpVer = (a, b) => {
+    const pa = String(a).replace(/[-+]/g, ".").split(".");
+    const pb = String(b).replace(/[-+]/g, ".").split(".");
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+      const sa = pa[i] ?? "", sb = pb[i] ?? "";
+      const na = Number(sa), nb = Number(sb);
+      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
+      else if (sa !== sb) return sa > sb ? 1 : -1;
+    }
+    return 0;
+  };
+  const latestByName = new Map();
+  for (const item of items) {
+    if (!item || !item.structure) continue;
+    const name = String(item.name).split("@")[0];
+    const version = String(item.name).split("@")[1] ?? "";
+    const prev = latestByName.get(name);
+    if (!prev || cmpVer(version, prev.version) > 0) {
+      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+    }
+  }
+  const userEntries = [...latestByName.values()].map(v => v.entry);
+  return [ADMIN_ENTRY, ...userEntries];
+}
+`;
+}
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function make(api, pluginReadModelTableName, opts) {
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PlatformUIDefinitions";
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), opts$1);
+  pluginReadModelTableName.apply(tableName => {
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: "logs:*",
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowScanPluginRm",
+          Effect: "Allow",
+          Action: ["dynamodb:Scan"],
+          Resource: "arn:aws:dynamodb:*:*:table/" + tableName
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, Platform_Admin_Structure$ReventlessCore.structure));
+  let archiveContents = {};
+  let handlerCodeStub = makeHandlerCode("", adminEntryJson);
+  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCodeStub);
+  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: code,
+    role: lambdaRole.arn,
+    memorySize: 512,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", ReadModel$ReventlessCore.componentType),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "PLUGIN_RM_TABLE",
+          pluginReadModelTableName
+        ]
+      ])
+    },
+    sourceCodeHash: sourceCodeHash
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Resolver", api, dataSource.name, "Query", "Platform_ComponentDefinitions", resolverCode, opts$1);
+}
+
+export {
+  makeHandlerCode,
+  resolverCode,
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -0,0 +1,229 @@
+// AWS resolver for the `Platform_UIFragments` admin GraphQL query.
+//
+// Backed by a Lambda DataSource that scans the UIFragmentRegistry read model
+// (one item per plugin whose pluginDefinition carries a uiFragments manifest).
+// The persisted state is sury-encoded with the same shape the in-memory adapter's
+// `Platform_UIFragmentsApi.encodeUIFragmentEntry` produces (null-encoded options,
+// nested panel/page objects), so the handler simply returns the rows as-is.
+
+open PulumiAws
+
+let makeHandlerCode = (~tableName as _: string): string =>
+  `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.UI_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_UIFragments: UI_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Platform invariant: one version per plugin at a time, so the UI sees just
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
+  // accumulates one row per deployed plugin version and carries no lifecycle
+  // status of its own, so without deduping a redeployed federation plugin would
+  // surface duplicate fragments. Collapse to the highest version per plugin name
+  // (mirrors ReventlessCore.Plugin.compareVersions).
+  const cmpVer = (a, b) => {
+    const pa = String(a).replace(/[-+]/g, ".").split(".");
+    const pb = String(b).replace(/[-+]/g, ".").split(".");
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+      const sa = pa[i] ?? "", sb = pb[i] ?? "";
+      const na = Number(sa), nb = Number(sb);
+      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
+      else if (sa !== sb) return sa > sb ? 1 : -1;
+    }
+    return 0;
+  };
+  const latestByName = new Map();
+  for (const item of items) {
+    if (!item || !item.pluginId || !item.remoteEntryUrl) continue;
+    const name = String(item.pluginId).split("@")[0];
+    const version = String(item.pluginId).split("@")[1] ?? "";
+    const prev = latestByName.get(name);
+    if (!prev || cmpVer(version, prev.version) > 0) {
+      latestByName.set(name, {
+        version,
+        entry: {
+          pluginId: name,
+          remoteEntryUrl: item.remoteEntryUrl,
+          panels: item.panels || [],
+          pages: item.pages || [],
+          registeredAt: item.registeredAt || "",
+          updatedAt: item.updatedAt || "",
+        },
+      });
+    }
+  }
+  return [...latestByName.values()].map(v => v.entry);
+}
+`
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+let make = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~uiFragmentRegistryTableName: Pulumi.Output.t<string>,
+  ~opts: Pulumi.ComponentResource.options,
+) => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let name = "PlatformUIFragments"
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "Lambda",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    uiFragmentRegistryTableName->Pulumi.Output.apply(tableName => {
+      open PolicyDocument
+      let _rolePolicy = IAM.RolePolicy.make(
+        ~name=name ++ "LambdaPolicy",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "LambdaPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Action("logs:*"),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowScanUIFragmentRegistryRm",
+                effect: Allow,
+                actions: Actions(["dynamodb:Scan"]),
+                resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  let handlerCodeStub = makeHandlerCode(~tableName="")
+  archiveContents->Dict.set(
+    "index.mjs",
+    Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
+  )
+  let code = Pulumi.Archive.assetArchive(archiveContents)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub)
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "Lambda",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 512->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(~name=name ++ "Lambda", ReventlessCore.ReadModel.componentType),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("UI_FRAGMENT_RM_TABLE", uiFragmentRegistryTableName->Pulumi.Output.asInput),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+    },
+    ~opts,
+  )
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      open PolicyDocument
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  let _resolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Resolver",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Query"->Pulumi.Input.make,
+    ~field="Platform_UIFragments"->Pulumi.Input.make,
+    ~code=resolverCode,
+    ~opts,
+  )
+}