@reventlessdev/reventless-aws 3.0.0-alpha.171 → 3.0.0-alpha.173

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.173 (2026-07-05)
+
+### Features
+
+* **reventless-aws:** aggregate EventLog Postgres runtime + entry-point branch ([fd81ece](https://github.com/ReventlessDev/reventless-core/commit/fd81ece65c2bf6aebf227d74ec2d0f002833d351))
+* **reventless-aws:** DCB EventLog Postgres runtime + entry-point branch (B2.1) ([a6b4f8d](https://github.com/ReventlessDev/reventless-core/commit/a6b4f8d34509ff7213273a1f71f31705b625ff40)), closes [#4](https://github.com/ReventlessDev/reventless-core/issues/4)
+* **reventless-aws:** opt-in [@aws](https://github.com/aws)_iam dual-auth for deploy-time AppSync callers ([94037f1](https://github.com/ReventlessDev/reventless-core/commit/94037f17ae48a33415b02e8e7b178906be8b59a4))
+* **reventless-aws:** Postgres change-feed relay deploy builder + Lambda VPC (B2.3a/b, C1) ([64d67f3](https://github.com/ReventlessDev/reventless-core/commit/64d67f3ecd2c42d59ba814d6d821683ae8c81612))
+* **reventless-aws:** Postgres change-feed relay runtime (B2.2) ([9ccb601](https://github.com/ReventlessDev/reventless-core/commit/9ccb60192457e9da21869e0d1c98fe8dbfb42178))
+
+
+# 3.0.0-alpha.172 (2026-07-05)
+
+### Bug Fixes
+
+* **reventless-aws:** sub-select CommandResult in AppSync mutation caller ([24cf37c](https://github.com/ReventlessDev/reventless-core/commit/24cf37cc537215b9523d1eac4a0f8ac6c610257d))
+### Features
+
+* **postgres:** add reventless-postgres backend + local-platform integration ([6913200](https://github.com/ReventlessDev/reventless-core/commit/69132001f9271e832a5af33416acd5b645feaf47))
+* **postgres:** cold-start pool foundation for AWS Postgres adapters ([b393449](https://github.com/ReventlessDev/reventless-core/commit/b393449769b6cd92abd03d2d5e7f564fe092938e))
+* **reventless-aws:** add PgConnection component + wire reventless-postgres dep ([a403a62](https://github.com/ReventlessDev/reventless-core/commit/a403a6292381513cfe679a2f7a967fda0ab00c0e))
+
+
 # 3.0.0-alpha.171 (2026-07-04)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.171",
+  "version": "3.0.0-alpha.173",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,13 +11,14 @@
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.5",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.44",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.13",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.138",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.86",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.23",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.64",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.84"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.2",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.64"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/rescript.json

@@ -32,7 +32,8 @@
     "@reventlessdev/reventless-infra",
     "@reventlessdev/reventless-interop",
     "@reventlessdev/reventless-spec",
-    "@reventlessdev/reventless-core"
+    "@reventlessdev/reventless-core",
+    "@reventlessdev/reventless-postgres"
   ],
   "compiler-flags": [],
   "suffix": ".res.mjs"

package/src/Platform.res.mjs

@@ -598,7 +598,7 @@ function MakeWithConfig(Config) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -653,7 +653,7 @@ function MakeWithConfig(Config) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
@@ -920,7 +920,7 @@ function MakeWithConfig(Config) {
           return;
         }
       });
-      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
       let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, fragments);
       return await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(AppSync_Adapter$ReventlessAws.getClient(), {
         apiId: apiId,
@@ -1686,7 +1686,7 @@ function Make($star) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -1741,7 +1741,7 @@ function Make($star) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -52,7 +52,7 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
   let componentOpts = {
     parent: componentOpts_parent
   };
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, componentOpts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
   let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
   subscribe(referencesName, referencesStream);

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -595,7 +595,7 @@ let read = (table: resolvedTable, ~crossPartitionTagKeys: array<string>=[]) =>
 //
 // All Puts and Updates ride a single `TransactWriteItems` call — atomic by
 // DynamoDB. Conflicts surface as `TransactionCanceledException` →
-// `DynamoDb_Error.StaleState` → `Error("Conflict: …")`.
+// `DynamoDb_Error.StaleState` → `Error(DcbEventLog.Conflict)`.
 
 let fenceSortKey = "FENCE"
 
@@ -861,9 +861,9 @@ let runTransactWrite = async (
   ->Effect.map(_ => Ok(basePosition))
   ->Effect.catchAll(err =>
     switch err {
-    | DynamoDb_Error.StaleState(msg) => Effect.succeed(Error(`Conflict: ${msg}`))
+    | DynamoDb_Error.StaleState(_msg) => Effect.succeed(Error(ReventlessInfra.DcbEventLog.Conflict))
     | Transient(msg) | Permanent(msg) =>
-      Effect.succeed(Error(`${errorPrefix}: ${msg}`))
+      Effect.succeed(Error(ReventlessInfra.DcbEventLog.StorageFailure(`${errorPrefix}: ${msg}`)))
     }
   )
   ->Effect.runPromise
@@ -886,7 +886,9 @@ let appendUnconditional = async (
     Ok(generatePosition())
   } else if totalItems > transactWriteItemsLimit {
     Error(
-      `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+      ReventlessInfra.DcbEventLog.StorageFailure(
+        `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+      ),
     )
   } else {
     let basePosition = generatePosition()
@@ -1211,7 +1213,9 @@ let appendConditional = async (
 
   if queryTags->Array.length == 0 {
     Error(
-      "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag",
+      ReventlessInfra.DcbEventLog.StorageFailure(
+        "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag",
+      ),
     )
   } else {
     let basePosition = generatePosition()
@@ -1219,7 +1223,9 @@ let appendConditional = async (
     let totalItems = transactItems->Array.length
     if totalItems > transactWriteItemsLimit {
       Error(
-        `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+        ReventlessInfra.DcbEventLog.StorageFailure(
+          `DCB append: TransactWriteItems limit exceeded (${totalItems->Int.toString} > ${transactWriteItemsLimit->Int.toString}); reduce events or distinct tag values per command`,
+        ),
       )
     } else {
       let input: TransactWriteCommand.input = {transactItems: transactItems}

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs

@@ -641,7 +641,7 @@ async function runTransactWrite(input, basePosition, errorPrefix) {
       case "StaleState" :
         return Effect$1.succeed({
           TAG: "Error",
-          _0: `Conflict: ` + err._0
+          _0: "Conflict"
         });
       case "Transient" :
       case "Permanent" :
@@ -649,7 +649,10 @@ async function runTransactWrite(input, basePosition, errorPrefix) {
     }
     return Effect$1.succeed({
       TAG: "Error",
-      _0: errorPrefix + `: ` + err._0
+      _0: {
+        TAG: "StorageFailure",
+        _0: errorPrefix + `: ` + err._0
+      }
     });
   }));
 }
@@ -666,7 +669,10 @@ async function appendUnconditional(table, events, partitionTag) {
   if (totalItems > 100) {
     return {
       TAG: "Error",
-      _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      _0: {
+        TAG: "StorageFailure",
+        _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      }
     };
   }
   let basePosition = generatePosition();
@@ -908,7 +914,10 @@ async function appendConditional(table, events, cond, partitionTag, crossPartiti
   if (queryTags.length === 0) {
     return {
       TAG: "Error",
-      _0: "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag"
+      _0: {
+        TAG: "StorageFailure",
+        _0: "DCB append: tagless conditions are not supported on DynamoDB — every queryItem must have at least one tag"
+      }
     };
   }
   let basePosition = generatePosition();
@@ -917,7 +926,10 @@ async function appendConditional(table, events, cond, partitionTag, crossPartiti
   if (totalItems > 100) {
     return {
       TAG: "Error",
-      _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      _0: {
+        TAG: "StorageFailure",
+        _0: `DCB append: TransactWriteItems limit exceeded (` + totalItems.toString() + ` > ` + (100).toString() + `); reduce events or distinct tag values per command`
+      }
     };
   }
   let input = {

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,26 @@
+// AWS-side runtime DcbEventLog operations for the Postgres backend. The DCB
+// analogue of EventLogStorage_Postgres_Runtime: turn a resolved connection config
+// into the DCB operation set (`read`/`append`/`readStream`), bound to the
+// container-lifetime pool from PgRuntime. Consumed by DcbCommandTopicEntryPoint.mjs
+// (Postgres branch, selected when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// The pg maker ignores `~indexes` / `~partitionTag` / `~crossPartitionTagKeys`
+// (Postgres evaluates the real `DcbTag.query` atomically — no GSI routing), so
+// they are passed empty here. `logName` is the `dcb_event.log_name` discriminator.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
+): ReventlessCore.DcbEventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.DcbEventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~indexes=[],
+    ~partitionTag=(),
+    ~opts=(),
+    ~lockStrategy,
+  )
+  ops
+}

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName, lockStrategyOpt) {
+  let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return DcbEventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, [], undefined, undefined, undefined, lockStrategy, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,23 @@
+// AWS-side runtime EventLog operations for the Postgres backend. Mirrors the
+// role of EventLogStorage_DynamoDb_Runtime: turn a resolved connection config
+// into the classic EventLog operation set, bound to the container-lifetime pool
+// from PgRuntime. Consumed by AggregateEntryPoint.mjs (Postgres branch, selected
+// when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// Unlike DynamoDB (table-per-aggregate), all aggregates share the single
+// Postgres `event_log` table, discriminated by `log_name`. `logName` is that
+// per-aggregate discriminator — the same stable identifier the builder would
+// otherwise use as the DynamoDB table name.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+): ReventlessCore.EventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~opts=(),
+  )
+  ops
+}

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,14 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, undefined, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res

@@ -0,0 +1,181 @@
+// Deploy-time builder for the Postgres change-feed relay (B2.3b).
+//
+// Provisions a scheduled, in-VPC Lambda that drains each Postgres DCB log via
+// PgChangeFeed and relays events to the plugin EventCollector SQS queue — which
+// fans out to read-model projections, aggregate command topics, and the
+// cross-plugin SNS EventTopic. The platform (D1, B2.3c) calls this with the set of
+// Postgres-backed DCB logs and points the EventCollector's event source at the
+// relay-fed queue.
+//
+// NOTE: EventBridge rate rules have a 1-minute floor, so v1 poll latency is
+// >= 1 minute. Sub-minute latency needs a self-invoking loop / EventBridge
+// Scheduler (follow-up) or the Fargate-LISTEN upgrade.
+
+// One Postgres-backed DCB log to relay.
+type relayLog = {
+  connectionConfig: Pulumi.Output.t<PgConnection.connectionConfig>,
+  /** dcb_event.log_name — also the DCB `event_log` discriminator. */
+  logName: string,
+  /** dcb_subscription checkpoint key for this relay. */
+  subscriber: string,
+  /** Plugin EventCollector SQS queue this log's events are relayed to. */
+  targetQueueUrl: Pulumi.Output.t<string>,
+  targetQueueArn: Pulumi.Output.t<string>,
+}
+
+// ~securityGroupId: DB-access SG the relay Lambda attaches (PgConnection.securityGroupId).
+// ~subnetIds: private subnets for the relay Lambda (PgConnection.subnetIds).
+let make = (
+  ~name: string,
+  ~logs: array<relayLog>,
+  ~securityGroupId: Pulumi.Output.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~intervalMinutes: int=1,
+  ~opts=?,
+): array<ReventlessInfra.Adapter.resource> => {
+  open PulumiAws
+  let customOpts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  // HANDLER_CONFIG.logs[], serialized from the deploy-time-resolved Outputs.
+  let logJsonOutputs = logs->Array.map(l =>
+    (l.connectionConfig, l.targetQueueUrl)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((cc, queueUrl)) => {
+      let pgConnectionJson =
+        [
+          ("host", cc.host->JSON.Encode.string),
+          ("port", cc.port->Int.toFloat->JSON.Encode.float),
+          ("database", cc.database->JSON.Encode.string),
+          ("username", cc.username->JSON.Encode.string),
+          ("secretArn", cc.secretArn->JSON.Encode.string),
+        ]
+        ->Dict.fromArray
+        ->JSON.Encode.object
+      [
+        ("pgConnection", pgConnectionJson),
+        ("logName", l.logName->JSON.Encode.string),
+        ("subscriber", l.subscriber->JSON.Encode.string),
+        ("targetQueueUrl", queueUrl->JSON.Encode.string),
+      ]
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    })
+  )
+  let handlerConfigOutput =
+    Pulumi.Output.all(logJsonOutputs)->Pulumi.Output.apply(items =>
+      `{"logs":[${items->Array.join(",")}]}`
+    )
+
+  let envVars = Dict.fromArray([("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)])
+
+  let vpcConfig =
+    securityGroupId
+    ->Pulumi.Output.apply(sgId =>
+      (
+        {
+          Lambda.Function.subnetIds: subnetIds->Pulumi.Input.make,
+          securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+        }: Lambda.Function.vpcConfig
+      )
+    )
+    ->Pulumi.Output.asInput
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~vpcConfig,
+    ~opts?,
+  )
+
+  // IAM: GetSecretValue on each log's DB secret + SendMessage on each target queue.
+  let secretArns =
+    logs->Array.map(l => l.connectionConfig->Pulumi.Output.apply(cc => cc.secretArn))
+  let queueArns = logs->Array.map(l => l.targetQueueArn)
+  let _iam =
+    (Pulumi.Output.all(secretArns), Pulumi.Output.all(queueArns), runtime.parts.lambdaRole.id)
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((secretArns, queueArns, roleId)) => {
+      open PulumiAws.PolicyDocument
+      let _ = PulumiAws.IAM.RolePolicy.make(
+        ~name=`${name}RelayAccess`,
+        ~args={
+          policy: PulumiAws.PolicyDocument.make(
+            ~id=`${name}RelayAccessPolicy`,
+            ~statements=[
+              {
+                sid: "AllowGetSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resources(secretArns),
+              },
+              {
+                sid: "AllowSendSqs",
+                effect: Allow,
+                actions: Action("sqs:SendMessage"),
+                resources: Resources(queueArns),
+              },
+            ],
+          )
+          ->PulumiAws.PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: roleId->Pulumi.Input.make,
+        },
+      )
+    })
+
+  // Scheduled poll: EventRule (rate) → Permission → EventTarget.
+  let rule = {
+    open PulumiAws.Cloudwatch
+    EventRule.make(
+      ~name=`${Pulumi.Pulumi.getStackName()}-${name}`,
+      ~args={
+        description: "Poll Postgres DCB change feed and relay to EventCollector"->Pulumi.Input.make,
+        scheduleExpression: EventRule.ScheduleExpression.every(Minutes(intervalMinutes)),
+      },
+      ~opts=?customOpts,
+    )
+  }
+
+  let lambda = runtime.parts.lambda
+  let _wire =
+    (lambda->Pulumi.Output.flatMap(l => l.arn), lambda->Pulumi.Output.flatMap(l => l.name))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
+      let _permission = PulumiAws.Lambda.Permission.make(
+        ~name=`${name}SchedulePermission`,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: lambdaName->Pulumi.Input.make,
+          principal: AWS.CloudwatchEventRule.principal,
+        },
+        ~opts=?customOpts,
+      )
+      let _target = {
+        open PulumiAws.Cloudwatch
+        EventTarget.make(
+          ~name,
+          ~args={
+            rule: EventTarget.Rule.ofEventRule(rule),
+            arn: lambdaArn->Pulumi.Input.make,
+          },
+          ~opts=?customOpts,
+        )
+      }
+    })
+
+  [
+    lambda
+    ->Pulumi.Output.apply(l => l->Util_Lambda.toResource)
+    ->ReventlessCore.Adapter.outputToResource,
+    rule->Util_Cloudwatch.EventRule.toResource,
+  ]
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs

@@ -0,0 +1,135 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_Cloudwatch$ReventlessAws from "../../util/Util_Cloudwatch.res.mjs";
+import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
+import * as Cloudwatch_EventTarget$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventTarget.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts) {
+  let intervalMinutes = intervalMinutesOpt !== undefined ? intervalMinutesOpt : 1;
+  let customOpts = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs", {}, undefined);
+  let logJsonOutputs = logs.map(l => Pulumi.all([
+    l.connectionConfig,
+    l.targetQueueUrl
+  ]).apply(param => {
+    let cc = param[0];
+    let pgConnectionJson = Object.fromEntries([
+      [
+        "host",
+        cc.host
+      ],
+      [
+        "port",
+        cc.port
+      ],
+      [
+        "database",
+        cc.database
+      ],
+      [
+        "username",
+        cc.username
+      ],
+      [
+        "secretArn",
+        cc.secretArn
+      ]
+    ]);
+    return JSON.stringify(Object.fromEntries([
+      [
+        "pgConnection",
+        pgConnectionJson
+      ],
+      [
+        "logName",
+        l.logName
+      ],
+      [
+        "subscriber",
+        l.subscriber
+      ],
+      [
+        "targetQueueUrl",
+        param[1]
+      ]
+    ]));
+  }));
+  let handlerConfigOutput = Pulumi.all(logJsonOutputs).apply(items => `{"logs":[` + items.join(",") + `]}`);
+  let envVars = Object.fromEntries([[
+      "HANDLER_CONFIG",
+      handlerConfigOutput
+    ]]);
+  let vpcConfig = securityGroupId.apply(sgId => ({
+    subnetIds: subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, undefined, undefined, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  let secretArns = logs.map(l => l.connectionConfig.apply(cc => cc.secretArn));
+  let queueArns = logs.map(l => l.targetQueueArn);
+  Pulumi.all([
+    Pulumi.all(secretArns),
+    Pulumi.all(queueArns),
+    runtime.parts.lambdaRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + `RelayAccess`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `RelayAccessPolicy`, [
+        {
+          Sid: "AllowGetSecret",
+          Effect: "Allow",
+          Action: "secretsmanager:GetSecretValue",
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowSendSqs",
+          Effect: "Allow",
+          Action: "sqs:SendMessage",
+          Resource: param[1]
+        }
+      ])),
+      role: param[2]
+    });
+  });
+  let rule = new (Aws.cloudwatch.EventRule)(Pulumi.getStack() + `-` + name, {
+    description: "Poll Postgres DCB change feed and relay to EventCollector",
+    scheduleExpression: Primitive_option.some(Cloudwatch_EventRule$PulumiAws.ScheduleExpression.every({
+      TAG: "Minutes",
+      _0: intervalMinutes
+    }))
+  }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  let lambda = runtime.parts.lambda;
+  Pulumi.all([
+    Output$Pulumi.flatMap(lambda, l => l.arn),
+    Output$Pulumi.flatMap(lambda, l => l.name)
+  ]).apply(param => {
+    new (Aws.lambda.Permission)(name + `SchedulePermission`, {
+      action: "lambda:InvokeFunction",
+      function: param[1],
+      principal: AWS$ReventlessAws.CloudwatchEventRule.principal
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+    new (Aws.cloudwatch.EventTarget)(name, {
+      rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(rule),
+      arn: param[0]
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  });
+  return [
+    Adapter$ReventlessCore.outputToResource(lambda.apply(l => Util_Lambda$ReventlessAws.toResource(undefined, l))),
+    Util_Cloudwatch$ReventlessAws.EventRule.toResource(rule)
+  ];
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */