@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res

@@ -0,0 +1,121 @@
+open Util_DynamoDb_Runtime
+open AwsSdk.DynamoDb.DocumentClient
+
+// `position` is a DynamoDB reserved keyword, so the ConditionExpression
+// references it via the `#p` placeholder declared in ExpressionAttributeNames.
+let positionAttrNames = [("#p", "position")]->Dict.fromArray
+
+let putItemConditional = (tableName, json) =>
+  {
+    PutCommand.tableName,
+    item: json,
+    conditionExpression: "attribute_not_exists(#p)",
+    expressionAttributeNames: positionAttrNames,
+  }
+  ->PutCommand.make
+  ->PutCommand.send
+
+let buildTransactItems = (tableName, jsons) =>
+  jsons->Array.map(json => {
+    TransactWriteCommand.put: {
+      TransactWriteCommand.item: json,
+      tableName,
+      conditionExpression: "attribute_not_exists(#p)",
+      expressionAttributeNames: positionAttrNames,
+    },
+  })
+
+let transactWriteConditional = (tableName, jsons) => {
+  let input: TransactWriteCommand.input = {
+    transactItems: buildTransactItems(tableName, jsons),
+  }
+  Effect.tryPromise(
+    ~catch=DynamoDb_Error.classify,
+    () => input->TransactWriteCommand.make->TransactWriteCommand.send,
+  )->Effect.map(_ => Ok())
+}
+
+let appendWithCondition = (tableName, jsons) => {
+  let count = jsons->Array.length
+  if count > 100 {
+    Effect.succeed(
+      Error(
+        `EventLog.append: max 100 events per command, got ${count->Int.toString}`,
+      ),
+    )
+  } else if count == 1 {
+    Effect.tryPromise(
+      ~catch=DynamoDb_Error.classify,
+      () => putItemConditional(tableName, jsons->Array.getUnsafe(0)),
+    )->Effect.map(_ => Ok())
+  } else {
+    transactWriteConditional(tableName, jsons)
+  }
+}
+
+let append = table =>
+  (_sequenceNr, _id, jsons) =>
+    appendWithCondition(table.name, jsons)
+    ->Effect.catchAll(err =>
+      switch err {
+      | DynamoDb_Error.StaleState(_) => Effect.succeed(Error("conflict"))
+      | _ =>
+        let msg = DynamoDb_Error.message(err)
+        Effect.succeed(Error(`DynamoDB conditional append failed: ${msg}`))
+      }
+    )
+    ->Effect.runPromise
+
+// True lazy pagination: each DynamoDB page is fetched on demand.
+// Per-page retry is handled inside queryStream.
+// Stream.take(n) short-circuits pagination once n events are consumed.
+let replayStream = table =>
+  id =>
+    queryStream({
+      tableName: table.name,
+      consistentRead: true,
+      keyConditionExpression: "id=:id",
+      expressionAttributeValues: [(":id", id->JSON.Encode.string)]->Dict.fromArray,
+    })
+    ->Stream.catchAll(err => {
+      let msg = DynamoDb_Error.message(err)
+      Stream.fromEffect(Effect.fail(msg))
+    })
+
+// Eager replay derived from replayStream — collects all events into an array.
+let replay = table =>
+  id =>
+    replayStream(table)(id)
+    ->Stream.runCollect
+    ->Effect.catchAll(msg => {
+      ReventlessCore.EffectLogger.logError(
+        ~comp=__MODULE__,
+        `Couldn't replay events for id ${id} after retries: ${msg}`,
+      )
+      ->Effect.flatMap(_ => Effect.fail(msg))
+    })
+    ->Effect.runPromise
+
+// Appends each stream item sequentially via conditional PutItem.
+// Node.js is single-threaded so a plain ref is safe for the seqNr counter.
+let appendStream = table =>
+  (startingSeqNr, _id, stream) => {
+    let seqNrRef = ref(startingSeqNr)
+    stream->Stream.runForEach(json =>
+      Effect.tryPromise(
+        ~catch=DynamoDb_Error.classify,
+        () => putItemConditional(table.name, json),
+      )
+      ->Effect.map(_ => {
+        seqNrRef := seqNrRef.contents + 1
+      })
+      ->Effect.catchAll(err =>
+        switch err {
+        | DynamoDb_Error.StaleState(_) => Effect.fail("conflict")
+        | _ =>
+          let msg = DynamoDb_Error.message(err)
+          Effect.fail(`DynamoDB appendStream error: ${msg}`)
+        }
+      )
+    )
+  }

package/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res.mjs

@@ -0,0 +1,137 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
+import * as Stream from "@reventlessdev/rescript-effect/src/Stream.res.mjs";
+import * as Effect$1 from "effect/Effect";
+import * as Stream$1 from "effect/Stream";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
+import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
+
+let positionAttrNames = Object.fromEntries([[
+    "#p",
+    "position"
+  ]]);
+
+function putItemConditional(tableName, json) {
+  return DynamoDb_DocumentClient$AwsSdk.PutCommand.send(new LibDynamodb.PutCommand({
+    Item: json,
+    TableName: tableName,
+    ConditionExpression: "attribute_not_exists(#p)",
+    ExpressionAttributeNames: positionAttrNames
+  }));
+}
+
+function buildTransactItems(tableName, jsons) {
+  return jsons.map(json => ({
+    Put: {
+      Item: json,
+      TableName: tableName,
+      ConditionExpression: "attribute_not_exists(#p)",
+      ExpressionAttributeNames: positionAttrNames
+    }
+  }));
+}
+
+function transactWriteConditional(tableName, jsons) {
+  let input_TransactItems = buildTransactItems(tableName, jsons);
+  let input = {
+    TransactItems: input_TransactItems
+  };
+  return Effect$1.map(Effect.tryPromise(DynamoDb_Error$ReventlessAws.classify, () => DynamoDb_DocumentClient$AwsSdk.TransactWriteCommand.send(new LibDynamodb.TransactWriteCommand(input))), param => ({
+    TAG: "Ok",
+    _0: undefined
+  }));
+}
+
+function appendWithCondition(tableName, jsons) {
+  let count = jsons.length;
+  if (count > 100) {
+    return Effect$1.succeed({
+      TAG: "Error",
+      _0: `EventLog.append: max 100 events per command, got ` + count.toString()
+    });
+  } else if (count === 1) {
+    return Effect$1.map(Effect.tryPromise(DynamoDb_Error$ReventlessAws.classify, () => putItemConditional(tableName, jsons[0])), param => ({
+      TAG: "Ok",
+      _0: undefined
+    }));
+  } else {
+    return transactWriteConditional(tableName, jsons);
+  }
+}
+
+function append(table) {
+  return (_sequenceNr, _id, jsons) => Effect$1.runPromise(Effect$1.catchAll(appendWithCondition(table.name, jsons), err => {
+    switch (err.TAG) {
+      case "StaleState" :
+        return Effect$1.succeed({
+          TAG: "Error",
+          _0: "conflict"
+        });
+      case "Transient" :
+      case "Permanent" :
+        break;
+    }
+    let msg = DynamoDb_Error$ReventlessAws.message(err);
+    return Effect$1.succeed({
+      TAG: "Error",
+      _0: `DynamoDB conditional append failed: ` + msg
+    });
+  }));
+}
+
+function replayStream(table) {
+  return id => Stream$1.catchAll(Util_DynamoDb_Runtime$ReventlessAws.queryStream({
+    TableName: table.name,
+    ConsistentRead: true,
+    ExpressionAttributeValues: Object.fromEntries([[
+        ":id",
+        id
+      ]]),
+    KeyConditionExpression: "id=:id"
+  }), err => {
+    let msg = DynamoDb_Error$ReventlessAws.message(err);
+    return Stream$1.fromEffect(Effect$1.fail(msg));
+  });
+}
+
+function replay(table) {
+  return id => Effect$1.runPromise(Effect$1.catchAll(Stream.runCollect(replayStream(table)(id)), msg => Effect$1.flatMap(EffectLogger$ReventlessCore.logError("EventLogStorage_DynamoDb_Runtime-ReventlessAws", undefined, `Couldn't replay events for id ` + id + ` after retries: ` + msg), () => Effect$1.fail(msg))));
+}
+
+function appendStream(table) {
+  return (startingSeqNr, _id, stream) => {
+    let seqNrRef = {
+      contents: startingSeqNr
+    };
+    return Stream$1.runForEach(stream, json => Effect$1.catchAll(Effect$1.map(Effect.tryPromise(DynamoDb_Error$ReventlessAws.classify, () => putItemConditional(table.name, json)), param => {
+      seqNrRef.contents = seqNrRef.contents + 1 | 0;
+    }), err => {
+      switch (err.TAG) {
+        case "StaleState" :
+          return Effect$1.fail("conflict");
+        case "Transient" :
+        case "Permanent" :
+          break;
+      }
+      let msg = DynamoDb_Error$ReventlessAws.message(err);
+      return Effect$1.fail(`DynamoDB appendStream error: ` + msg);
+    }));
+  };
+}
+
+export {
+  positionAttrNames,
+  putItemConditional,
+  buildTransactItems,
+  transactWriteConditional,
+  appendWithCondition,
+  append,
+  replayStream,
+  replay,
+  appendStream,
+}
+/* positionAttrNames Not a pure module */

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res

@@ -0,0 +1,265 @@
+// EventLogSubscription_AppSync.res
+// Source A: raw event stream subscriptions (SNS EventTopic → AppSync Events API).
+//
+// Creates deploy-time resources for one EventLog entry (aggregate or DCB):
+//   SNS EventTopic ──► SQS buffer ──► Lambda ──► AppSync Events channel
+//
+// Usage in the plugin builder (once per entry in eventLogEntries):
+//   EventLogSubscription_AppSync.make(
+//     ~name="CatalogPlugin",           // displayName from eventLogSchemaEntry
+//     ~topicName="CatalogPlugin",      // AppSync Events channel name (matches displayName)
+//     ~eventTopicOutputs,              // EventTopic.outputs (resources[0] is the SNS topic)
+//     ~api,
+//     ~opts,
+//   )
+
+open PulumiAws
+
+// ── Handler code ─────────────────────────────────────────────────────────────
+//
+// Receives SNS-via-SQS records (rawMessageDelivery=true → body IS the event JSON).
+// Publishes {position, eventType, payload, originatorSlice} to AppSync Events channel.
+// The "originatorSlice" tag is injected by StateChangeSlice_Callback.encodeEvent.
+
+let makeHandlerCode = (~topicName: string): string => {
+  // Mirrors StateTopic_AppSync.pathSegment: AppSync Events channel segments
+  // allow only [A-Za-z0-9-]. Today's event-log displayNames are bare
+  // PascalCase identifiers (Catalog, Ordering, Plugin) so the rule is a no-op
+  // in practice — kept in lock-step prophylactically so a future displayName
+  // carrying `@/./:` etc. doesn't hit the same silent-drop the Plugins admin
+  // RM did when StateTopic still only normalised underscores.
+  let channelName = topicName->String.replaceRegExp(%re("/[^A-Za-z0-9-]/g"), "-")
+  `
+import { createHmac, createHash } from "node:crypto";
+
+const CHANNEL = "/default/${channelName}";
+const APPSYNC_ENDPOINT = process.env.APPSYNC_ENDPOINT;
+const AWS_REGION = process.env.AWS_REGION ?? "eu-west-1";
+
+function sha256hex(data) {
+  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
+}
+function hmacBuf(key, data) {
+  return createHmac("sha256", key).update(data).digest();
+}
+
+async function signedHeaders(host, path, body) {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+  const sessionToken = process.env.AWS_SESSION_TOKEN;
+  const now = new Date();
+  const amzDate = now.toISOString().replace(/[:\\-]|\\..../g, "").slice(0, 15) + "Z";
+  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
+  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
+  const canonH = Object.entries(headers).sort(([a],[b]) => a.localeCompare(b)).map(([k,v]) => \`\${k}:\${v}\\n\`).join("");
+  const signH = Object.keys(headers).sort().join(";");
+  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\\n");
+  const scope = \`\${dateStamp}/\${AWS_REGION}/appsync/aws4_request\`;
+  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\\n");
+  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
+  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, AWS_REGION), "appsync"), "aws4_request");
+  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
+  return { ...headers, Authorization: \`AWS4-HMAC-SHA256 Credential=\${accessKeyId}/\${scope}, SignedHeaders=\${signH}, Signature=\${sig}\` };
+}
+
+export async function handler(event) {
+  const url = new URL(APPSYNC_ENDPOINT);
+  for (const record of event.Records) {
+    let body;
+    try {
+      body = JSON.parse(record.body);
+    } catch (e) {
+      console.error("EventLogSubscription: failed to parse record body", record.body, e);
+      continue;
+    }
+    const originatorSlice = body.tags?.find(t => t.key === "originatorSlice")?.value;
+    const payload = { position: body.position, eventType: body.eventType, payload: body.data, originatorSlice: originatorSlice ?? null };
+    const reqBody = JSON.stringify({ id: record.messageId, channel: CHANNEL, events: [JSON.stringify(payload)] });
+    const auth = await signedHeaders(url.hostname, "/event", reqBody);
+    const res = await fetch(APPSYNC_ENDPOINT + "/event", {
+      method: "POST",
+      headers: { accept: "application/json, text/javascript", "content-encoding": "amz-1.0", "content-type": "application/json; charset=UTF-8", ...auth },
+      body: reqBody,
+    });
+    if (!res.ok) {
+      const txt = await res.text();
+      console.error("EventLogSubscription publish failed:", res.status, txt);
+    }
+  }
+}
+`
+}
+
+// ── Deploy-time resource builder ──────────────────────────────────────────────
+
+let make = (
+  ~name: string,
+  ~topicName: string,
+  ~eventTopicOutputs: ReventlessInfra.EventTopic.outputs,
+  ~eventsApi: AppSync_EventsApi.t,
+  ~opts: Pulumi.CustomResourceOptions.t,
+) => {
+  // SQS buffer queue with redrive to shared dead-letter queue
+  let queue = SQS.Queue.make(
+    ~name=name ++ "EventLogSubQueue",
+    ~args={
+      SQS.Queue.visibilityTimeoutSeconds: 60->Pulumi.Input.make,
+      redrivePolicy: Util_DeadLetterQueue.queue.arn
+      ->Pulumi.Output.apply(dlqArn =>
+        SQS.Queue.RedrivePolicy.make(~deadLetterTargetArn=dlqArn, ~maxReceiveCount=5)
+      )
+      ->Pulumi.Output.asInput,
+      sqsManagedSseEnabled: false->Pulumi.Input.make,
+    },
+    ~opts,
+  )
+
+  // SQS queue policy — allow SNS to send messages
+  let snsResource = eventTopicOutputs.resources->Array.getUnsafe(0)
+  let _ =
+    (queue.arn, queue.id, snsResource.urn)
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((queueArn, queueId, snsUrn)) => {
+      open PolicyDocument
+      let _queuePolicy = SQS.QueuePolicy.make(
+        ~name=name ++ "EventLogSubQueuePolicy",
+        ~args={
+          queueUrl: queueId->Pulumi.Input.make,
+          policy: PolicyDocument.make(
+            ~id=name ++ "EventLogSubQueuePolicy",
+            ~statements=[
+              {
+                sid: "AllowSNSSend",
+                principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
+                effect: Allow,
+                actions: Actions(["sqs:SendMessage"]),
+                resources: Resource(queueArn),
+                conditions: {
+                  arnEquals: [
+                    ("aws:SourceArn", ConditionValues([snsUrn])),
+                  ]->Dict.fromArray,
+                },
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+        },
+        ~opts=Some(opts),
+      )
+    })
+
+  // SNS → SQS subscription (raw delivery so body IS the event JSON)
+  let _subscription = Util_SQS.subscribeToSnsTopic(
+    ~queue,
+    ~targetName=name ++ "EventLogSub",
+    ~sourceName=name,
+    ~topic=snsResource,
+    ~opts,
+  )
+
+  // IAM role for the Lambda
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "EventLogSubRole",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  // IAM policy: SQS receive + AppSync Events publish
+  let _ =
+    (
+      queue.arn,
+      eventsApi.api.apiArn,
+    )
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, apiArn)) => {
+      open PolicyDocument
+      let _rolePolicy = IAM.RolePolicy.make(
+        ~name=name ++ "EventLogSubPolicy",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "EventLogSubPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Action("logs:*"),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowReceiveSQS",
+                effect: Allow,
+                actions: Actions([
+                  "sqs:ReceiveMessage",
+                  "sqs:DeleteMessage",
+                  "sqs:GetQueueAttributes",
+                ]),
+                resources: Resource(queueArn),
+              },
+              {
+                sid: "AllowPublishAppSyncEvents",
+                effect: Allow,
+                actions: Action("appsync:EventPublish"),
+                resources: Resource(apiArn ++ "/*"),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  // Lambda function — processes SQS records (SNS events) → AppSync Events channel
+  let handlerCode = makeHandlerCode(~topicName)
+  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  archiveContents->Dict.set(
+    "index.mjs",
+    Pulumi.Asset.stringAsset(handlerCode)->Pulumi.Archive.assetToAssetOrArchive,
+  )
+  let code = Pulumi.Archive.assetArchive(archiveContents)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCode)
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let appsyncEndpoint = AppSync_EventsApi.httpEndpoint(eventsApi)
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "EventLogSubscriber",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 128->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(~name=name ++ "EventLogSub", ReventlessCore.EventTopic.componentType),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("APPSYNC_ENDPOINT", appsyncEndpoint->Pulumi.Output.asInput),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+    },
+    ~opts,
+  )
+
+  // EventSourceMapping: SQS → Lambda
+  let lambdaOutput = lambda->Pulumi.Output.make
+  let _esm = Util_EventSourceMapping.subscribeSqs(
+    ~lambda=lambdaOutput,
+    ~name=name ++ "EventLogSubEventSourceMapping",
+    ~queue,
+    ~opts,
+  )
+}