@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -0,0 +1,246 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../../adapter/AWS.res.mjs";
+import * as Cloner$ReventlessCore from "@reventlessdev/reventless-core/src/components/Cloner.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
+import * as Util_Vpc$ReventlessAws from "../../util/Util_Vpc.res.mjs";
+import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as GetSecretVersion$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/SecretsManager/GetSecretVersion.res.mjs";
+import * as Util_AppSync$ReventlessAws from "../../util/Util_AppSync.res.mjs";
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../../adapter/Api/AppSync_Resolver_Retrying.res.mjs";
+
+function make(name, api, fullQualifiedStackName, reventlessCiSecretUrn, secretUrns, opts) {
+  let cluster = new (Aws.ecs.Cluster)(name, undefined, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+  let taskExecutionRole = new (Aws.iam.Role)(name + "TaskExecution", {
+    assumeRolePolicy: IAM$PulumiAws.Policy.assumeRolePolicy(name, "ecs-tasks.amazonaws.com"),
+    inlinePolicies: [IAM$PulumiAws.InlinePolicy.makeForActions("clonerTask", [
+        "logs:PutLogEvents",
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream"
+      ])]
+  });
+  let secretsManagerPolicyDocument = PolicyDocument$PulumiAws.make(undefined, name + "SecretsManagerPolicy", [{
+      Sid: "AllowManageSecrets",
+      Effect: "Allow",
+      Action: [
+        "secretsmanager:GetRandomPassword",
+        "secretsmanager:GetResourcePolicy",
+        "secretsmanager:GetSecretValue",
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:ListSecretVersionIds"
+      ]
+    }]);
+  let secretsManagerAccessPolicy = new (Aws.iam.Policy)("secretsManagerAccess", {
+    policy: PolicyDocument$PulumiAws.toJsonString(secretsManagerPolicyDocument)
+  });
+  let taskRunnerPolicyDocument = PolicyDocument$PulumiAws.make(undefined, name + "TaskRunnerPolicy", [{
+      Sid: "AllowRunTask",
+      Effect: "Allow",
+      Action: [
+        "ecs:RunTask",
+        "iam:PassRole"
+      ]
+    }]);
+  let taskRunnerPolicy = new (Aws.iam.Policy)("taskRunner", {
+    policy: PolicyDocument$PulumiAws.toJsonString(taskRunnerPolicyDocument)
+  });
+  new (Aws.iam.RolePolicyAttachment)("ClonerTaskExecutionSecretsManagerAccess", {
+    policyArn: secretsManagerAccessPolicy.arn,
+    role: taskExecutionRole.id
+  }, opts);
+  let entryPointCode = `import { ECSClient, RunTaskCommand } from "@aws-sdk/client-ecs";
+const client = new ECSClient();
+export const handler = async (event) => {
+  const environment = Object.fromEntries([
+    ["REVENTLESS_CORE_STACK", process.env.STACK_ORG + "/" + process.env.STACK_PROJECT + "/" + process.env.STACK_STACK],
+    ["RESTORE_DATE_TIME", event.restoreDateTime],
+  ]);
+  console.log("clone: requested by user " + event.meta.user + " from ip " + event.meta.ip);
+  await client.send(new RunTaskCommand({
+    taskDefinition: process.env.TASK_DEFINITION_ARN,
+    cluster: process.env.CLUSTER_ARN,
+    launchType: "FARGATE",
+    networkConfiguration: { awsvpcConfiguration: { subnets: JSON.parse(process.env.SUBNETS) } },
+    overrides: {
+      containerOverrides: [{
+        name: "reventless-ci",
+        command: ["reventless-ci", "clone-environment"],
+        environment: environment,
+      }],
+    },
+  }));
+};`;
+  let clonerArchiveContents = {};
+  clonerArchiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(entryPointCode);
+  let code = new (Pulumi.asset.AssetArchive)(clonerArchiveContents);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(entryPointCode);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let vpcStackName = Stdlib_Option.getOrThrow(new Pulumi.Config("vpc").get("stack"), undefined);
+  let vpcConfig = Util_Vpc$ReventlessAws.getVpcConfig(vpcStackName, "vpc");
+  let secrets = Pulumi.all(secretUrns.map(urn => GetSecretVersion$PulumiAws.getSecretNames(urn).apply(names => names.map(name => ({
+    name: name,
+    valueFrom: urn + `:` + name + `::`
+  }))))).apply(s => s.flat());
+  let resources = Pulumi.all([
+    secretsManagerAccessPolicy.arn,
+    taskRunnerPolicy.arn,
+    vpcConfig,
+    secrets
+  ]).apply(param => {
+    let containerDefinitions = [{
+        name: "reventless-ci",
+        cpu: 1024,
+        image: new Pulumi.Config("ci").require("image"),
+        logConfiguration: {
+          logDriver: "awslogs",
+          options: {
+            "awslogs-create-group": true,
+            "awslogs-group": "/aws/ecs/reventless-cloner",
+            "awslogs-region": new Pulumi.Config("aws").require("region"),
+            "awslogs-stream-prefix": "reventless-cloner"
+          }
+        },
+        memory: 4096,
+        repositoryCredentials: {
+          credentialsParameter: reventlessCiSecretUrn
+        },
+        secrets: param[3],
+        ulimits: [{
+            name: "nofile",
+            hardLimit: 1048576,
+            softLimit: 1048576
+          }]
+      }];
+    let taskDefinition = new (Aws.ecs.TaskDefinition)(name, {
+      family: name,
+      containerDefinitions: Stdlib_Option.getOrThrow(JSON.stringify(containerDefinitions), undefined),
+      cpu: "1024",
+      memory: "4096",
+      networkMode: "awsvpc",
+      requiresCompatibilities: ["FARGATE"],
+      executionRoleArn: taskExecutionRole.arn
+    }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+    let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts);
+    let lambda = new (Aws.lambda.Function)(name, {
+      handler: "index.handler",
+      runtime: "nodejs22.x",
+      code: code,
+      role: lambdaRole.arn,
+      memorySize: 1024,
+      timeout: 180,
+      layers: layers,
+      tags: AWS_Tags$ReventlessAws.make(name, Cloner$ReventlessCore.componentType),
+      environment: {
+        variables: Object.fromEntries([
+          [
+            "TASK_DEFINITION_ARN",
+            taskDefinition.arn
+          ],
+          [
+            "CLUSTER_ARN",
+            cluster.arn
+          ],
+          [
+            "STACK_ORG",
+            fullQualifiedStackName.organization
+          ],
+          [
+            "STACK_PROJECT",
+            fullQualifiedStackName.project
+          ],
+          [
+            "STACK_STACK",
+            fullQualifiedStackName.stack
+          ],
+          [
+            "SUBNETS",
+            Stdlib_Option.getOr(JSON.stringify(param[2].subnetIds), "[]")
+          ],
+          [
+            "Environment",
+            Pulumi.getStack()
+          ]
+        ])
+      },
+      sourceCodeHash: sourceCodeHash
+    }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+    lambda.arn.apply(arn => {
+      let appsyncInvokeLambdaPolicyDocument = PolicyDocument$PulumiAws.make(undefined, name + "AppSyncInvokePolicy", [{
+          Sid: "AllowAppSyncInvoke",
+          Principal: {
+            Service: AWS$ReventlessAws.AppSync.principal
+          },
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: arn
+        }]);
+      let lambdaPolicyDocument = PolicyDocument$PulumiAws.mergePolicyDocuments(name + "LambdaPolicy", [
+        Lambda$PulumiAws.defaultLoggingPolicyDocument,
+        appsyncInvokeLambdaPolicyDocument,
+        secretsManagerPolicyDocument,
+        taskRunnerPolicyDocument
+      ]);
+      return lambdaRole.id.apply(lambdaRoleId => {
+        new (Aws.iam.RolePolicy)(name + "LambdaRolePolicy", {
+          policy: lambdaPolicyDocument.apply(lambdaPolicyDocument => lambdaPolicyDocument),
+          role: lambdaRoleId
+        });
+      });
+    });
+    let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DS", Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts);
+    new (Aws.iam.RolePolicy)(name + "DS", {
+      policy: lambda.arn.apply(lambdaArn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [{
+          Sid: "AllowInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: lambdaArn
+        }]))),
+      role: dataSourceRole.id
+    }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+    let dataSource = new (Aws.appsync.DataSource)(name, {
+      type: "AWS_LAMBDA",
+      apiId: Output$Pulumi.flatMap(api, api => api.id),
+      lambdaConfig: {
+        functionArn: lambda.arn
+      },
+      serviceRoleArn: dataSourceRole.arn
+    }, opts);
+    let field = AdminApi$ReventlessCore.cloneMutationEntry.fieldNames[0];
+    let resolver = AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(field, api, dataSource.name, "Mutation", field, `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return {
+    operation: 'Invoke',
+    payload: {
+      restoreDateTime: ctx.args.restoreDateTime,
+      meta: {
+        ip: ctx.identity.sourceIp,
+        user: ctx.identity.username
+      }
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`, opts);
+    return [Util_AppSync$ReventlessAws.toResourceNative(resolver)];
+  });
+  return {
+    resources: resources
+  };
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/plugin/cloner/ClonerRunner_Fargate_Runtime.res

@@ -0,0 +1,42 @@
+open ReventlessCore.Cloner
+
+let log = ReventlessCore.Logger.fromEnv()
+
+let clone = async (~taskDefinition, ~cluster, ~fullQualifiedStackName, ~subnets, payload, _) => {
+  let {organization, project, stack} = fullQualifiedStackName
+
+  let environment = {
+    [
+      ("REVENTLESS_CORE_STACK", `${organization}/${project}/${stack}`),
+      ("RESTORE_DATE_TIME", payload["restoreDateTime"]),
+    ]->Dict.fromArray
+  }
+
+  log.info(
+    ~comp="ClonerRunner",
+    "clone: requested by user " ++
+    payload["meta"]["user"] ++
+    " from ip " ++
+    payload["meta"]["ip"],
+  )
+
+  let _ = await {
+    taskDefinition: taskDefinition->Pulumi.Output.get,
+    cluster: cluster->Pulumi.Output.get,
+    networkConfiguration: {
+      awsvpcConfiguration: {subnets},
+    },
+    launchType: #FARGATE,
+    overrides: {
+      containerOverrides: [
+        {
+          name: "reventless-ci",
+          environment,
+          command: ["reventless-ci", "clone-environment"],
+        },
+      ],
+    },
+  }
+  ->AwsSdk.ECS.RunTaskCommand.make
+  ->AwsSdk.ECS.RunTaskCommand.send
+}

package/src/plugin/cloner/ClonerRunner_Fargate_Runtime.res.mjs

@@ -0,0 +1,45 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as ECS$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/ECS.res.mjs";
+import * as ClientEcs from "@aws-sdk/client-ecs";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+async function clone(taskDefinition, cluster, fullQualifiedStackName, subnets, payload, param) {
+  let environment = Object.fromEntries([
+    [
+      "REVENTLESS_CORE_STACK",
+      fullQualifiedStackName.organization + `/` + fullQualifiedStackName.project + `/` + fullQualifiedStackName.stack
+    ],
+    [
+      "RESTORE_DATE_TIME",
+      payload.restoreDateTime
+    ]
+  ]);
+  log.info("ClonerRunner", undefined, "clone: requested by user " + payload.meta.user + " from ip " + payload.meta.ip);
+  await ECS$AwsSdk.RunTaskCommand.send(new ClientEcs.RunTaskCommand({
+    taskDefinition: taskDefinition.get(),
+    launchType: "FARGATE",
+    cluster: cluster.get(),
+    networkConfiguration: {
+      awsvpcConfiguration: subnets
+    },
+    overrides: {
+      containerOverrides: [{
+          name: "reventless-ci",
+          command: [
+            "reventless-ci",
+            "clone-environment"
+          ],
+          environment: environment
+        }]
+    }
+  }));
+}
+
+export {
+  log,
+  clone,
+}
+/* log Not a pure module */

package/src/plugin/heartbeat/HeartbeatRunner.res

@@ -0,0 +1 @@
+module CloudwatchEvents = HeartbeatRunner_CloudWatchEvents

package/src/plugin/heartbeat/HeartbeatRunner.res.mjs

@@ -0,0 +1,9 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let CloudwatchEvents;
+
+export {
+  CloudwatchEvents,
+}
+/* No side effect */

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res

@@ -0,0 +1,96 @@
+type runtimeParts = Util.Lambda.runtimeParts
+
+let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
+  ~name,
+  ~remoteChannel,
+  ~timeout,
+  ~runtime,
+  ~opts,
+) => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let cloudwatchEventRule = {
+    open PulumiAws.Cloudwatch
+    EventRule.make(
+      ~name=Pulumi.Pulumi.getStackName() ++ ("-" ++ name),
+      ~args={
+        description: "Send a heartbeat to the Core Plugin ExtensionPoint"->Pulumi.Input.make,
+        scheduleExpression: EventRule.ScheduleExpression.every(timeout->Minutes),
+      },
+      ~opts,
+    )
+  }
+
+  let lambda = runtime.parts.lambda
+  let lambdaRole = runtime.parts.lambdaRole
+  let coreSqsQueue = remoteChannel.resources->Util_SQS.findResolvedResource
+
+  let _attachPoliciesAndSetEventTarget =
+    (
+      lambda->Pulumi.Output.flatMap(lambda => lambda.arn),
+      lambda->Pulumi.Output.flatMap(lambda => lambda.name),
+      lambdaRole.id,
+    )
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName, heartbeatRoleId)) => {
+      open PulumiAws.PolicyDocument
+
+      let _addHeartbeatLambdaPermission = PulumiAws.Lambda.Permission.make(
+        ~name,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: lambdaName->Pulumi.Input.make,
+          principal: AWS.CloudwatchEventRule.principal,
+        },
+        ~opts,
+      )
+
+      let heartbeatLambdaSendMessagePolicyDocument = {
+        PulumiAws.PolicyDocument.make(
+          ~statements=[
+            {
+              sid: "AllowLambdaToSendSQS",
+              effect: Allow,
+              actions: Action("sqs:SendMessage"),
+              resources: Resource(coreSqsQueue.urn),
+            },
+          ],
+        )
+      }
+
+      let _attachHeartbeatLambdaPolicy = PulumiAws.IAM.RolePolicy.make(
+        ~name=name ++ "RolePolicy",
+        ~args={
+          policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
+            name ++ "Policy",
+            [
+              PulumiAws.Lambda.defaultLoggingPolicyDocument,
+              heartbeatLambdaSendMessagePolicyDocument,
+            ],
+          )->Pulumi.Output.asInput,
+          role: heartbeatRoleId->Pulumi.Input.make,
+        },
+      )
+
+      let _cloudwatchEventTarget = {
+        open PulumiAws.Cloudwatch
+        EventTarget.make(
+          ~name,
+          ~args={
+            rule: EventTarget.Rule.ofEventRule(cloudwatchEventRule),
+            arn: lambdaArn->Pulumi.Input.make,
+          },
+          ~opts,
+        )
+      }
+    })
+
+  {
+    resources: [
+      lambda
+      ->Pulumi.Output.apply(lambda => lambda->Util_Lambda.toResource)
+      ->ReventlessCore.Adapter.outputToResource,
+      cloudwatchEventRule->Util_Cloudwatch.EventRule.toResource,
+    ],
+  }
+}

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res.mjs

@@ -0,0 +1,69 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../../adapter/AWS.res.mjs";
+import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_Cloudwatch$ReventlessAws from "../../util/Util_Cloudwatch.res.mjs";
+import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
+import * as Cloudwatch_EventTarget$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventTarget.res.mjs";
+
+function make(name, remoteChannel, timeout, runtime, opts) {
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let cloudwatchEventRule = new (Aws.cloudwatch.EventRule)(Pulumi.getStack() + ("-" + name), {
+    description: "Send a heartbeat to the Core Plugin ExtensionPoint",
+    scheduleExpression: Primitive_option.some(Cloudwatch_EventRule$PulumiAws.ScheduleExpression.every({
+      TAG: "Minutes",
+      _0: timeout
+    }))
+  }, opts$1);
+  let lambda = runtime.parts.lambda;
+  let lambdaRole = runtime.parts.lambdaRole;
+  let coreSqsQueue = Util_SQS$ReventlessAws.findResolvedResource(remoteChannel.resources);
+  Pulumi.all([
+    Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
+    Output$Pulumi.flatMap(lambda, lambda => lambda.name),
+    lambdaRole.id
+  ]).apply(param => {
+    new (Aws.lambda.Permission)(name, {
+      action: "lambda:InvokeFunction",
+      function: param[1],
+      principal: AWS$ReventlessAws.CloudwatchEventRule.principal
+    }, opts$1);
+    let heartbeatLambdaSendMessagePolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
+        Sid: "AllowLambdaToSendSQS",
+        Effect: "Allow",
+        Action: "sqs:SendMessage",
+        Resource: coreSqsQueue.urn
+      }]);
+    new (Aws.iam.RolePolicy)(name + "RolePolicy", {
+      policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "Policy", [
+        Lambda$PulumiAws.defaultLoggingPolicyDocument,
+        heartbeatLambdaSendMessagePolicyDocument
+      ]),
+      role: param[2]
+    });
+    new (Aws.cloudwatch.EventTarget)(name, {
+      rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(cloudwatchEventRule),
+      arn: param[0]
+    }, opts$1);
+  });
+  return {
+    resources: [
+      Adapter$ReventlessCore.outputToResource(lambda.apply(lambda => Util_Lambda$ReventlessAws.toResource(undefined, lambda))),
+      Util_Cloudwatch$ReventlessAws.EventRule.toResource(cloudwatchEventRule)
+    ]
+  };
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res

@@ -0,0 +1,115 @@
+module CommandTopicChannel = CommandTopicChannel.SQS_Sync
+module RuntimeEnvironment = RuntimeEnvironment.Lambda
+
+type context = PulumiAws.Lambda.context
+type runtimeParts = Util.Lambda.runtimeParts
+
+// Admin-specific data that the Plugin extension point Lambda needs but that
+// the generic ExtensionPointRuntime_Builder.T params don't carry. Wired in
+// from `Platform.res` after `Admin.construct()` exposes the read model and
+// scheduler resources; consumed lazily at deploy-resolve time when
+// `forCommandTopic` runs inside its `Pulumi.Output.apply`.
+type adminExtras = {
+  pluginReadModelTableName: option<Pulumi.Output.t<string>>,
+  schedulerRoleArn: option<Pulumi.Output.t<string>>,
+}
+
+let adminExtras: ref<adminExtras> = ref({
+  pluginReadModelTableName: None,
+  schedulerRoleArn: None,
+})
+
+let registerPluginExtensionPoint = (~pluginReadModelTableName=?, ~schedulerRoleArn=?, ()) =>
+  adminExtras := {pluginReadModelTableName, schedulerRoleArn}
+
+let forCommandTopic = (
+  ~handler as _,
+  ~connect,
+  ~memorySize=1024,
+  ~timeout=30,
+  ~specModulePath as _,
+  ~mappingsModulePath as _,
+  ~publishToAggregatesQueueUrls,
+  commandTopic,
+) => {
+  let commandTopicResource = commandTopic->ReventlessCore.Component.toPulumiResource
+  let extras = adminExtras.contents
+
+  let channel = commandTopic->ReventlessCore.CommandTopic_Adapter.channel
+  let channelParts: Util.SQS.channelParts = Obj.magic(channel.parts)
+  let queue = channelParts.queue
+
+  // The EP command-handler Lambda inherits the bare EP CommandTopic resource
+  // name (`<EP>ExtPoint`) and appends the unified `CmdHandler` kind so it is
+  // greppable alongside the aggregate/DCB command handlers (analysis §8.2).
+  // Mirrors ExtensionPointRuntime_Builder_PerExtensionPoint.
+  let name = commandTopicResource.name->Option.getOr("UnnamedExtPoint") ++ "CmdHandler"
+  let opts = {Pulumi.ComponentResource.parent: commandTopicResource}
+
+  let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
+
+  let outputOrPlaceholder = opt =>
+    switch opt {
+    | Some(v) => v->Pulumi.Output.asInput
+    | None => "NOT_AVAILABLE"->Pulumi.Output.make->Pulumi.Output.asInput
+    }
+
+  // Build publishToAggregates env var mapping
+  let publishToAggregatesEnvVars: dict<string> = Dict.make()
+  publishToAggregatesQueueUrls->Dict.forEachWithKey((queueUrlOutput, aggName) => {
+    let envVar = `PTA_${aggName}_QUEUE_URL`
+    envVars->Dict.set(envVar, queueUrlOutput->Pulumi.Output.asInput)
+    publishToAggregatesEnvVars->Dict.set(aggName, envVar)
+  })
+
+  let publishToAggregatesJson =
+    publishToAggregatesEnvVars
+    ->Dict.toArray
+    ->Array.map(((aggName, envVar)) =>
+      `${aggName->JSON.stringifyAny->Option.getOr(`""`)}: ${envVar->JSON.stringifyAny->Option.getOr(`""`)}`
+    )
+    ->Array.join(",")
+
+  // Build HANDLER_CONFIG JSON
+  let queueName =
+    queue.id->Pulumi.Output.apply(id =>
+      id->String.split("/")->Array.at(-1)->Option.getOr(id)
+    )
+
+  let handlerConfigJson =
+    Pulumi.Output.all([
+      queue.id,
+      extras.pluginReadModelTableName->outputOrPlaceholder->Obj.magic,
+      extras.schedulerRoleArn->outputOrPlaceholder->Obj.magic,
+      queue.arn,
+      queueName,
+    ])
+    ->Pulumi.Output.apply(values => {
+      let queueUrl = values->Array.getUnsafe(0)
+      let rmTable = values->Array.getUnsafe(1)
+      let schedRoleArn = values->Array.getUnsafe(2)
+      let schedQueueArn = values->Array.getUnsafe(3)
+      let schedQueueName = values->Array.getUnsafe(4)
+      `{"queueUrl":"${queueUrl}","pluginReadModelTableName":"${rmTable}","schedulerRoleArn":"${schedRoleArn}","schedulerQueueArn":"${schedQueueArn}","schedulerQueueName":"${schedQueueName}","publishToAggregates":{${publishToAggregatesJson}}}`
+    })
+  envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
+
+  // No user packages — all framework imports are in the Layer
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~memorySize,
+    ~timeout,
+    ~opts,
+  )
+  connect(~runtime)
+}
+
+let finish = () => ()