@reventlessdev/reventless-aws 3.0.0-alpha.170 → 3.0.0-alpha.172

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.172 (2026-07-05)
+
+### Bug Fixes
+
+* **reventless-aws:** sub-select CommandResult in AppSync mutation caller ([24cf37c](https://github.com/ReventlessDev/reventless-core/commit/24cf37cc537215b9523d1eac4a0f8ac6c610257d))
+### Features
+
+* **postgres:** add reventless-postgres backend + local-platform integration ([6913200](https://github.com/ReventlessDev/reventless-core/commit/69132001f9271e832a5af33416acd5b645feaf47))
+* **postgres:** cold-start pool foundation for AWS Postgres adapters ([b393449](https://github.com/ReventlessDev/reventless-core/commit/b393449769b6cd92abd03d2d5e7f564fe092938e))
+* **reventless-aws:** add PgConnection component + wire reventless-postgres dep ([a403a62](https://github.com/ReventlessDev/reventless-core/commit/a403a6292381513cfe679a2f7a967fda0ab00c0e))
+
+
+# 3.0.0-alpha.171 (2026-07-04)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.170 (2026-07-03)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.170",
+  "version": "3.0.0-alpha.172",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,13 +9,14 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.44",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.5",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.13",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.137",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.84",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.139",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.85",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.1",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.23",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.64"
   },

package/rescript.json

@@ -32,7 +32,8 @@
     "@reventlessdev/reventless-infra",
     "@reventlessdev/reventless-interop",
     "@reventlessdev/reventless-spec",
-    "@reventlessdev/reventless-core"
+    "@reventlessdev/reventless-core",
+    "@reventlessdev/reventless-postgres"
   ],
   "compiler-flags": [],
   "suffix": ".res.mjs"

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -595,7 +595,7 @@ let read = (table: resolvedTable, ~crossPartitionTagKeys: array<string>=[]) =>
 //
 // All Puts and Updates ride a single `TransactWriteItems` call — atomic by
 // DynamoDB. Conflicts surface as `TransactionCanceledException` →
-// `DynamoDb_Error.StaleState` → `Error("Conflict: …")`.
+// `DynamoDb_Error.StaleState` → `Error(DcbEventLog.Conflict)`.
 
 let fenceSortKey = "FENCE"
 
@@ -861,9 +861,9 @@ let runTransactWrite = async (
   ->Effect.map(_ => Ok(basePosition))
   ->Effect.catchAll(err =>
     switch err {
-    | DynamoDb_Error.StaleState(msg) => Effect.succeed(Error(`Conflict: ${msg}`))
+    | DynamoDb_Error.StaleState(_msg) => Effect.succeed(Error(ReventlessInfra.DcbEventLog.Conflict))
     | Transient(msg) | Permanent(msg) =>
-      Effect.succeed(Error(`${errorPrefix}: ${msg}`))
+      Effect.succeed(Error(ReventlessInfra.DcbEventLog.StorageFailure(`${errorPrefix}: ${msg}`)))
     }
   )
   ->Effect.runPromise
@@ -886,7 +886,9 @@ let appendUnconditional = async (
     Ok(generatePosition())
   } else if totalItems > transactWriteItemsLimit {
     Error(
-      `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+      ReventlessInfra.DcbEventLog.StorageFailure(
+        `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+      ),
     )
   } else {
     let basePosition = generatePosition()
@@ -1211,7 +1213,9 @@ let appendConditional = async (
 
   if queryTags->Array.length == 0 {
     Error(
-      "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag",
+      ReventlessInfra.DcbEventLog.StorageFailure(
+        "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag",
+      ),
     )
   } else {
     let basePosition = generatePosition()
@@ -1219,7 +1223,9 @@ let appendConditional = async (
     let totalItems = transactItems->Array.length
     if totalItems > transactWriteItemsLimit {
       Error(
-        `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+        ReventlessInfra.DcbEventLog.StorageFailure(
+          `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+        ),
       )
     } else {
       let input: TransactWriteCommand.input = {transactItems: transactItems}

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs

@@ -641,7 +641,7 @@ async function runTransactWrite(input, basePosition, errorPrefix) {
       case "StaleState" :
         return Effect$1.succeed({
           TAG: "Error",
-          _0: `Conflict: ` + err._0
+          _0: "Conflict"
         });
       case "Transient" :
       case "Permanent" :
@@ -649,7 +649,10 @@ async function runTransactWrite(input, basePosition, errorPrefix) {
     }
     return Effect$1.succeed({
       TAG: "Error",
-      _0: errorPrefix + `: ` + err._0
+      _0: {
+        TAG: "StorageFailure",
+        _0: errorPrefix + `: ` + err._0
+      }
     });
   }));
 }
@@ -666,7 +669,10 @@ async function appendUnconditional(table, events, partitionTag) {
   if (totalItems > 100) {
     return {
       TAG: "Error",
-      _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      _0: {
+        TAG: "StorageFailure",
+        _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      }
     };
   }
   let basePosition = generatePosition();
@@ -908,7 +914,10 @@ async function appendConditional(table, events, cond, partitionTag, crossPartiti
   if (queryTags.length === 0) {
     return {
       TAG: "Error",
-      _0: "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag"
+      _0: {
+        TAG: "StorageFailure",
+        _0: "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag"
+      }
     };
   }
   let basePosition = generatePosition();
@@ -917,7 +926,10 @@ async function appendConditional(table, events, cond, partitionTag, crossPartiti
   if (totalItems > 100) {
     return {
       TAG: "Error",
-      _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      _0: {
+        TAG: "StorageFailure",
+        _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      }
     };
   }
   let input = {

package/src/adapter/Postgres/PgConnection.res

@@ -0,0 +1,169 @@
+/** Deploy-time component that provisions a managed Postgres instance (RDS) and
+  resolves the connection details the `reventless-postgres` runtime needs inside
+  a Lambda.
+
+  One `PgConnection` hosts **all three** storage surfaces (classic `event_log`,
+  DCB `dcb_event`, and the QueryDb `qdb_*` tables) in a single database — the
+  per-surface adapters take a reference to it, they do not each provision a DB.
+
+  Networking is supplied by the platform (an existing VPC + private subnets); a
+  `PgConnection` does not provision a VPC. It creates:
+  - a **shared security group** with a self-referencing `5432` ingress rule, so
+    every Lambda that attaches this same SG (see C1 / `securityGroupId`) can
+    reach the DB without a separate client SG;
+  - a **DB subnet group** over the given private subnets;
+  - the **RDS instance** with `manageMasterUserPassword` — RDS mints and rotates
+    the master credentials in Secrets Manager, so no plaintext password ever
+    lands in Pulumi state. The resulting secret ARN surfaces on
+    `connectionConfig.secretArn`; the runtime resolves it at cold start.
+
+  Aurora / Aurora Serverless v2 is a planned second engine behind the same
+  `connectionConfig` output shape (tracked in the AWS-Postgres plan). */
+
+/** Resolved at deploy time, serialized into the handler Lambda env, and consumed
+  at cold start to build a `PgDriver` pool. `secretArn` points at the
+  RDS-managed `{username, password}` secret; `host`/`port`/`database` come from
+  the instance itself. */
+@schema
+type connectionConfig = {
+  host: string,
+  port: int,
+  database: string,
+  /** RDS master username — set at deploy time, not secret. The pool's `user`;
+    the Secrets Manager secret supplies only the matching password. */
+  username: string,
+  secretArn: string,
+}
+
+type t = {
+  /** Deploy-time resources (currently the RDS instance) for dependency wiring —
+    e.g. the A3 migration Lambda and the B-phase adapters order after these. */
+  resources: array<ReventlessInfra.Adapter.resource>,
+  connectionConfig: Pulumi.Output.t<connectionConfig>,
+  /** Attach to every Lambda that talks to Postgres: the SG's self-referencing
+    rule is what lets those Lambdas reach the DB on 5432. */
+  securityGroupId: Pulumi.Output.t<string>,
+  /** The DB's private subnets, echoed back for the Lambda `vpcConfig` so
+    handlers land in the same subnets as the database. */
+  subnetIds: array<Pulumi.Input.t<string>>,
+}
+
+/** Postgres wire port. */
+let port = 5432
+
+let make = (
+  ~name,
+  ~vpcId: Pulumi.Input.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~databaseName="reventless",
+  ~username="reventless_admin",
+  ~engineVersion="16",
+  ~instanceClass="db.t3.micro",
+  ~allocatedStorage=20,
+  ~multiAz=false,
+  ~storageEncrypted=true,
+  ~backupRetentionPeriod=7,
+  ~deletionProtection=true,
+  ~skipFinalSnapshot=false,
+  ~opts: option<Pulumi.ComponentResource.options>=?,
+): t => {
+  let opts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let tags =
+    [
+      ("Name", name),
+      ("Environment", Pulumi.Pulumi.getStackName()),
+      ("reventless:role", "postgres-connection"),
+    ]->Dict.fromArray
+
+  // Shared DB-access security group. Self-referencing 5432 ingress lets member
+  // Lambdas reach the DB; open egress so both the DB and those Lambdas can make
+  // outbound calls (e.g. Secrets Manager, other AWS APIs).
+  let sg = PulumiAws.EC2.SecurityGroup.make(
+    ~name=`${name}-pg-sg`,
+    ~args={
+      name: `${name}-pg-sg`,
+      vpcId,
+      ingress: [
+        {
+          fromPort: port,
+          protocol: "tcp",
+          toPort: port,
+          cidrBlocks: [],
+          self: true,
+        },
+      ],
+      egress: [PulumiAws.EC2.SecurityGroup.Egress.allowAll],
+      tags,
+    },
+    ~opts?,
+  )
+
+  let subnetGroup = PulumiAws.Rds.SubnetGroup.make(
+    ~name=`${name}-pg-subnets`,
+    ~args={
+      name: `${name}-pg-subnets`->Pulumi.Input.make,
+      subnetIds: subnetIds->Pulumi.Input.make,
+      tags: tags->Pulumi.Input.make,
+    },
+    ~opts?,
+  )
+
+  let instance = PulumiAws.Rds.Instance.make(
+    ~name=`${name}-pg`,
+    ~args={
+      engine: "postgres"->Pulumi.Input.make,
+      engineVersion: engineVersion->Pulumi.Input.make,
+      instanceClass: instanceClass->Pulumi.Input.make,
+      allocatedStorage: allocatedStorage->Pulumi.Input.make,
+      dbName: databaseName->Pulumi.Input.make,
+      username: username->Pulumi.Input.make,
+      manageMasterUserPassword: true->Pulumi.Input.make,
+      dbSubnetGroupName: subnetGroup.name->Pulumi.Output.asInput,
+      vpcSecurityGroupIds: [sg.id->Pulumi.Output.asInput]->Pulumi.Input.make,
+      port: port->Pulumi.Input.make,
+      multiAz: multiAz->Pulumi.Input.make,
+      publiclyAccessible: false->Pulumi.Input.make,
+      storageEncrypted: storageEncrypted->Pulumi.Input.make,
+      backupRetentionPeriod: backupRetentionPeriod->Pulumi.Input.make,
+      deletionProtection: deletionProtection->Pulumi.Input.make,
+      skipFinalSnapshot: skipFinalSnapshot->Pulumi.Input.make,
+      tags: tags->Pulumi.Input.make,
+    },
+    ~opts?,
+  )
+
+  let connectionConfig =
+    (instance.address, instance.masterUserSecrets)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((host, secrets)) => {
+      host,
+      port,
+      database: databaseName,
+      username,
+      secretArn: switch secrets->Array.get(0) {
+      | Some(secret) => secret.secretArn
+      | None =>
+        JsError.throwWithMessage(
+          "RDS instance exposes no master user secret — manageMasterUserPassword must be enabled",
+        )
+      },
+    })
+
+  {
+    resources: [
+      ReventlessInfra.Adapter.make(
+        ~name=name->Pulumi.Output.make,
+        ~id=instance.id,
+        ~urn=instance.arn,
+        ~service="aws:rds"->Pulumi.Output.make,
+        ~role="postgres"->Pulumi.Output.make,
+        ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
+      ),
+    ],
+    connectionConfig,
+    securityGroupId: sg.id,
+    subnetIds,
+  }
+}

package/src/adapter/Postgres/PgConnection.res.mjs

@@ -0,0 +1,112 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as EC2_SecurityGroup$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/EC2/EC2_SecurityGroup.res.mjs";
+
+let connectionConfigSchema = S.schema(s => ({
+  host: s.m(S.string),
+  port: s.m(S.int),
+  database: s.m(S.string),
+  username: s.m(S.string),
+  secretArn: s.m(S.string)
+}));
+
+function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, opts) {
+  let databaseName = databaseNameOpt !== undefined ? databaseNameOpt : "reventless";
+  let username = usernameOpt !== undefined ? usernameOpt : "reventless_admin";
+  let engineVersion = engineVersionOpt !== undefined ? engineVersionOpt : "16";
+  let instanceClass = instanceClassOpt !== undefined ? instanceClassOpt : "db.t3.micro";
+  let allocatedStorage = allocatedStorageOpt !== undefined ? allocatedStorageOpt : 20;
+  let multiAz = multiAzOpt !== undefined ? multiAzOpt : false;
+  let storageEncrypted = storageEncryptedOpt !== undefined ? storageEncryptedOpt : true;
+  let backupRetentionPeriod = backupRetentionPeriodOpt !== undefined ? backupRetentionPeriodOpt : 7;
+  let deletionProtection = deletionProtectionOpt !== undefined ? deletionProtectionOpt : true;
+  let skipFinalSnapshot = skipFinalSnapshotOpt !== undefined ? skipFinalSnapshotOpt : false;
+  let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let tags = Object.fromEntries([
+    [
+      "Name",
+      name
+    ],
+    [
+      "Environment",
+      Pulumi.getStack()
+    ],
+    [
+      "reventless:role",
+      "postgres-connection"
+    ]
+  ]);
+  let sg = EC2_SecurityGroup$PulumiAws.make(name + `-pg-sg`, {
+    name: name + `-pg-sg`,
+    vpcId: vpcId,
+    ingress: [{
+        fromPort: 5432,
+        protocol: "tcp",
+        toPort: 5432,
+        cidrBlocks: [],
+        self: true
+      }],
+    egress: [EC2_SecurityGroup$PulumiAws.Egress.allowAll],
+    tags: tags
+  }, opts$1);
+  let subnetGroup = new (Aws.rds.SubnetGroup)(name + `-pg-subnets`, {
+    name: name + `-pg-subnets`,
+    subnetIds: subnetIds,
+    tags: tags
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let instance = new (Aws.rds.Instance)(name + `-pg`, {
+    allocatedStorage: allocatedStorage,
+    engine: "postgres",
+    engineVersion: engineVersion,
+    instanceClass: instanceClass,
+    dbName: databaseName,
+    username: username,
+    manageMasterUserPassword: true,
+    dbSubnetGroupName: subnetGroup.name,
+    vpcSecurityGroupIds: [sg.id],
+    port: 5432,
+    multiAz: multiAz,
+    publiclyAccessible: false,
+    storageEncrypted: storageEncrypted,
+    backupRetentionPeriod: backupRetentionPeriod,
+    deletionProtection: deletionProtection,
+    skipFinalSnapshot: skipFinalSnapshot,
+    tags: tags
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let connectionConfig = Pulumi.all([
+    instance.address,
+    instance.masterUserSecrets
+  ]).apply(param => {
+    let secret = param[1][0];
+    return {
+      host: param[0],
+      port: 5432,
+      database: databaseName,
+      username: username,
+      secretArn: secret !== undefined ? secret.secretArn : Stdlib_JsError.throwWithMessage("RDS instance exposes no master user secret — manageMasterUserPassword must be enabled")
+    };
+  });
+  return {
+    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)],
+    connectionConfig: connectionConfig,
+    securityGroupId: sg.id,
+    subnetIds: subnetIds
+  };
+}
+
+let port = 5432;
+
+export {
+  connectionConfigSchema,
+  port,
+  make,
+}
+/* connectionConfigSchema Not a pure module */

package/src/adapter/Postgres/PgRuntime.res

@@ -0,0 +1,71 @@
+/** Cold-start Postgres connectivity for deployed Lambdas.
+
+  Given a resolved `PgConnection.connectionConfig` (injected into the handler env
+  at deploy time), this resolves the RDS-managed master password from Secrets
+  Manager and builds **one pg pool per container**, memoized by secret ARN.
+
+  Rotation-safe by construction: the pool is created with a *password provider*,
+  which pg invokes each time it opens a physical connection — so a rotated secret
+  is picked up on the next new connection. The fetched secret is cached per ARN
+  (as a promise) to avoid a Secrets Manager round trip on every connection; a
+  password rotation surfaces as auth failures that recycle the container, after
+  which the next cold start re-fetches. */
+
+/** RDS-managed master secret payload (`{username, password}` JSON). We only need
+  the password here — the username is carried on `connectionConfig` (deploy-time
+  known) so the pool can be constructed without first awaiting the secret. */
+let passwordFromSecret = async (secretArn: string): string => {
+  let out =
+    await {AwsSdk.SecretsManager.GetSecretValueCommand.secretId: secretArn}
+    ->AwsSdk.SecretsManager.GetSecretValueCommand.make
+    ->AwsSdk.SecretsManager.GetSecretValueCommand.send
+  switch out.secretString {
+  | Some(str) =>
+    switch str->JSON.parseOrThrow->JSON.Decode.object {
+    | Some(obj) =>
+      switch obj->Dict.get("password")->Option.flatMap(JSON.Decode.string) {
+      | Some(password) => password
+      | None => JsError.throwWithMessage("Secrets Manager secret has no `password` field")
+      }
+    | None => JsError.throwWithMessage("Secrets Manager secret is not a JSON object")
+    }
+  | None =>
+    JsError.throwWithMessage(`Secrets Manager secret ${secretArn} has no SecretString`)
+  }
+}
+
+// Cache the in-flight/settled password fetch per ARN so pg's per-connection
+// provider doesn't hit Secrets Manager on every physical connection.
+let passwordCache: dict<promise<string>> = Dict.make()
+
+let cachedPassword = (secretArn: string): promise<string> =>
+  switch passwordCache->Dict.get(secretArn) {
+  | Some(p) => p
+  | None =>
+    let p = passwordFromSecret(secretArn)
+    passwordCache->Dict.set(secretArn, p)
+    p
+  }
+
+// One pool per secret ARN for the life of the container.
+let poolCache: dict<ReventlessPostgres.PgDriver.pool> = Dict.make()
+
+/** The container-lifetime pool for the given connection config, built on first
+  use. pg pools connect lazily, so this is cheap until the first query. */
+let poolFor = (config: PgConnection.connectionConfig): ReventlessPostgres.PgDriver.pool =>
+  switch poolCache->Dict.get(config.secretArn) {
+  | Some(pool) => pool
+  | None =>
+    let pool = ReventlessPostgres.PgDriver.makePool({
+      host: config.host,
+      port: config.port,
+      database: config.database,
+      user: config.username,
+      password: () => cachedPassword(config.secretArn),
+      // RDS PG15+ defaults to rds.force_ssl=1. Encrypt without CA verification
+      // for v1; pin the RDS CA bundle as a hardening follow-up.
+      ssl: {rejectUnauthorized: false},
+    })
+    poolCache->Dict.set(config.secretArn, pool)
+    pool
+  }

package/src/adapter/Postgres/PgRuntime.res.mjs

@@ -0,0 +1,71 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as SecretsManager$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/SecretsManager.res.mjs";
+import * as PgDriver$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgDriver.res.mjs";
+import * as ClientSecretsManager from "@aws-sdk/client-secrets-manager";
+
+async function passwordFromSecret(secretArn) {
+  let out = await SecretsManager$AwsSdk.GetSecretValueCommand.send(new ClientSecretsManager.GetSecretValueCommand({
+    SecretId: secretArn
+  }));
+  let str = out.SecretString;
+  if (str === undefined) {
+    return Stdlib_JsError.throwWithMessage(`Secrets Manager secret ` + secretArn + ` has no SecretString`);
+  }
+  let obj = Stdlib_JSON.Decode.object(JSON.parse(str));
+  if (obj === undefined) {
+    return Stdlib_JsError.throwWithMessage("Secrets Manager secret is not a JSON object");
+  }
+  let password = Stdlib_Option.flatMap(obj["password"], Stdlib_JSON.Decode.string);
+  if (password !== undefined) {
+    return password;
+  } else {
+    return Stdlib_JsError.throwWithMessage("Secrets Manager secret has no `password` field");
+  }
+}
+
+let passwordCache = {};
+
+function cachedPassword(secretArn) {
+  let p = passwordCache[secretArn];
+  if (p !== undefined) {
+    return p;
+  }
+  let p$1 = passwordFromSecret(secretArn);
+  passwordCache[secretArn] = p$1;
+  return p$1;
+}
+
+let poolCache = {};
+
+function poolFor(config) {
+  let pool = poolCache[config.secretArn];
+  if (pool !== undefined) {
+    return Primitive_option.valFromOption(pool);
+  }
+  let pool$1 = PgDriver$ReventlessPostgres.makePool({
+    host: config.host,
+    port: config.port,
+    database: config.database,
+    user: config.username,
+    password: () => cachedPassword(config.secretArn),
+    ssl: {
+      rejectUnauthorized: false
+    }
+  });
+  poolCache[config.secretArn] = pool$1;
+  return pool$1;
+}
+
+export {
+  passwordFromSecret,
+  passwordCache,
+  cachedPassword,
+  poolCache,
+  poolFor,
+}
+/* SecretsManager-AwsSdk Not a pure module */

package/src/util/Util_AppSync_Caller.res

@@ -107,13 +107,25 @@ let rec jsonToLiteral = (value: JSON.t): string =>
     }
   }
 
-let buildQuery = (~mutation: string, ~variablesDict: dict<JSON.t>): string => {
+// ~selection is the sub-selection appended after the field call. It defaults to
+// `{ __typename }` because every command mutation dispatched through this caller
+// returns the `CommandResult` union (CommandAccepted | CommandPending |
+// CommandRejected); GraphQL rejects a selectionless field on any object/union
+// type with `SubSelectionRequired`. Pass ~selection="" for a scalar-returning
+// mutation, or a richer set (e.g. "{ __typename ... on CommandRejected { reason } }")
+// to inspect the result.
+let buildQuery = (
+  ~mutation: string,
+  ~selection: string="{ __typename }",
+  ~variablesDict: dict<JSON.t>,
+): string => {
   let args =
     variablesDict
     ->Dict.toArray
     ->Array.map(((k, v)) => `${k}: ${jsonToLiteral(v)}`)
     ->Array.join(", ")
-  `mutation { ${mutation}(${args}) }`
+  let sel = selection == "" ? "" : ` ${selection}`
+  `mutation { ${mutation}(${args})${sel} }`
 }
 
 // ── sendMutation ────────────────────────────────────────────────────────────
@@ -121,6 +133,8 @@ let buildQuery = (~mutation: string, ~variablesDict: dict<JSON.t>): string => {
 // Signs and sends a single GraphQL mutation to an AppSync endpoint via IAM.
 // ~variables accepts any value; undefined/optional fields are omitted by
 // JSON.stringifyAny (mirrors how JSON.stringify drops undefined object keys).
+// ~selection defaults to `{ __typename }` so CommandResult-union mutations
+// validate (see buildQuery); pass ~selection="" for scalar-returning mutations.
 // Returns a promise — callers fire-and-forget with `let _ = sendMutation(...)`.
 
 // Signs and sends a GraphQL query; returns the `data` object or None on error.
@@ -164,7 +178,13 @@ let sendQuery = async (~endpoint: string, ~region: string, ~queryString: string)
   }
 }
 
-let sendMutation = async (~endpoint: string, ~region: string, ~mutation: string, ~variables: 'a) => {
+let sendMutation = async (
+  ~endpoint: string,
+  ~region: string,
+  ~mutation: string,
+  ~selection: string="{ __typename }",
+  ~variables: 'a,
+) => {
   let url = parseUrl(endpoint)
   let hostname: string = (url)["hostname"]
   let path: string = (url)["pathname"]
@@ -180,7 +200,7 @@ let sendMutation = async (~endpoint: string, ~region: string, ~mutation: string,
     | None => Dict.make()
     }
 
-  let query = buildQuery(~mutation, ~variablesDict)
+  let query = buildQuery(~mutation, ~selection, ~variablesDict)
   let body =
     Dict.fromArray([("query", query->JSON.Encode.string)])
     ->JSON.Encode.object

package/src/util/Util_AppSync_Caller.res.mjs

@@ -47,9 +47,11 @@ function jsonToLiteral(value) {
   }
 }
 
-function buildQuery(mutation, variablesDict) {
+function buildQuery(mutation, selectionOpt, variablesDict) {
+  let selection = selectionOpt !== undefined ? selectionOpt : "{ __typename }";
   let args = Object.entries(variablesDict).map(param => param[0] + `: ` + jsonToLiteral(param[1])).join(", ");
-  return `mutation { ` + mutation + `(` + args + `) }`;
+  let sel = selection === "" ? "" : ` ` + selection;
+  return `mutation { ` + mutation + `(` + args + `)` + sel + ` }`;
 }
 
 async function sendQuery(endpoint, region, queryString) {
@@ -104,7 +106,8 @@ async function sendQuery(endpoint, region, queryString) {
   }
 }
 
-async function sendMutation(endpoint, region, mutation, variables) {
+async function sendMutation(endpoint, region, mutation, selectionOpt, variables) {
+  let selection = selectionOpt !== undefined ? selectionOpt : "{ __typename }";
   let url = new URL(endpoint);
   let hostname = url.hostname;
   let path = url.pathname;
@@ -116,7 +119,7 @@ async function sendMutation(endpoint, region, mutation, variables) {
   } else {
     variablesDict = {};
   }
-  let query = buildQuery(mutation, variablesDict);
+  let query = buildQuery(mutation, selection, variablesDict);
   let body = JSON.stringify(Object.fromEntries([[
       "query",
       query

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -316,7 +316,9 @@ describe("Runtime.appendUnconditional", () => {
     let events = manyTags->Array.map(t => event("Foo", [t]))
     let result = await Runtime.appendUnconditional(table, events)
     switch result {
-    | Error(msg) => expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
+      expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })
@@ -555,8 +557,9 @@ describe("Runtime.appendConditional", () => {
     }
     let result = await Runtime.appendConditional(table, [], cond)
     switch result {
-    | Error(msg) =>
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
       expect(msg->String.includes("tagless"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })
@@ -579,8 +582,9 @@ describe("Runtime.appendConditional", () => {
     }
     let result = await Runtime.appendConditional(table, [event], cond)
     switch result {
-    | Error(msg) =>
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
       expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -363,7 +363,12 @@ globalThis.describe("Runtime.appendUnconditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("limit exceeded")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("limit exceeded")).toBe(true);
   });
 });
 
@@ -683,7 +688,12 @@ globalThis.describe("Runtime.appendConditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("tagless")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("tagless")).toBe(true);
   });
   globalThis.test("rejects appends exceeding 100 items with a clear error", async () => {
     let manyTags = Stdlib_Array.fromInitializer(100, i => ({
@@ -716,7 +726,12 @@ globalThis.describe("Runtime.appendConditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("limit exceeded")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("limit exceeded")).toBe(true);
   });
 });
 

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -44,7 +44,8 @@ let isOk = r =>
 
 let isConflict = r =>
   switch r {
-  | Error(msg) => msg->String.includes("Conflict")
+  | Error(ReventlessInfra.DcbEventLog.Conflict) => true
+  | Error(StorageFailure(_)) => false
   | Ok(_) => false
   }
 

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res.mjs

@@ -41,9 +41,9 @@ function isOk(r) {
 function isConflict(r) {
   if (r.TAG === "Ok") {
     return false;
-  } else {
-    return r._0.includes("Conflict");
   }
+  let tmp = r._0;
+  return typeof tmp !== "object";
 }
 
 async function readAfter(table, query) {