@reventlessdev/reventless-aws 3.0.0-alpha.171 → 3.0.0-alpha.173

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -0,0 +1,64 @@
+// Postgres change-feed relay runtime (B2.2).
+//
+// Drains a Postgres DCB log via `PgChangeFeed` and pushes each event — transformed
+// into the `{id, meta, event}` shape the plugin EventCollector SQS handler
+// consumes — onto that queue. The plugin EventCollector (`AdminEventCollectorEntryPoint`)
+// then drives the full fan-out: read-model projections, aggregate command topics,
+// and the cross-plugin SNS EventTopic. See
+// docs/plans/aws-postgres-change-feed-bridge.md.
+//
+// The transform reuses the canonical DynamoDB shape producers
+// (`derivePartitionKey` + `buildJsonEvent'`) so the emitted body is byte-identical
+// to the DynamoDB-stream path — the SQS handler cannot tell the difference.
+
+/**
+ * Transform one feed event into the EventCollector JSON body. Rebuilds the same
+ * unmarshalled-item dict the DCB DynamoDB-stream decoder would see (id from the
+ * partition tag, position, event type, data, decomposed meta) and runs it through
+ * `buildJsonEvent'` — the exact decoder the SQS handler expects. Returns `None`
+ * for a malformed event (mirrors `buildJsonEvent'`).
+ */
+let toEventCollectorJson = (
+  event: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent,
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+): option<JSON.t> => {
+  let item = Dict.make()
+  item->Dict.set(
+    "id",
+    DcbEventLogStorage_DynamoDb_Runtime.derivePartitionKey(~partitionTag?, event.tags)
+    ->JSON.Encode.string,
+  )
+  item->Dict.set("position", event.position->JSON.Encode.string)
+  item->Dict.set("event", event.eventType->JSON.Encode.string)
+  item->Dict.set("data", event.data)
+  ReventlessCore.Message.decomposeMeta(event.meta)->Array.forEach(((key, value)) =>
+    item->Dict.set(key, value)
+  )
+  Util_DynamoDbStream_Runtime.buildJsonEvent'(item)
+}
+
+/**
+ * Drain a Postgres DCB log from its checkpoint and relay its events to the
+ * EventCollector via the injected `sendBatch`. `sendBatch` is injected (rather than
+ * hardcoding SQS) so the drain/transform is unit-testable; the relay entry point
+ * wires it to the actual `SendMessage`. Returns the number of events processed.
+ *
+ * At-least-once by construction: `PgChangeFeed.drain` replays the last page on a
+ * crash before checkpoint, and EventCollector projections are idempotent
+ * (event-sourced), so re-delivery is safe.
+ */
+let relay = async (
+  ~config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~subscriber: string,
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+  ~sendBatch: array<JSON.t> => promise<unit>,
+): int => {
+  let pool = PgRuntime.poolFor(config)
+  await ReventlessPostgres.PgChangeFeed.drain(pool, ~logName, ~subscriber, ~handle=async events => {
+    let jsons = events->Array.filterMap(event => toEventCollectorJson(event, ~partitionTag?))
+    if jsons->Array.length > 0 {
+      await sendBatch(jsons)
+    }
+  })
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs

@@ -0,0 +1,36 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as PgRuntime$ReventlessAws from "./PgRuntime.res.mjs";
+import * as PgChangeFeed$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgChangeFeed.res.mjs";
+import * as Util_DynamoDbStream_Runtime$ReventlessAws from "../../util/Util_DynamoDbStream_Runtime.res.mjs";
+import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
+
+function toEventCollectorJson(event, partitionTag) {
+  let item = {};
+  item["id"] = DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, event.tags);
+  item["position"] = event.position;
+  item["event"] = event.eventType;
+  item["data"] = event.data;
+  Message$ReventlessCore.decomposeMeta(event.meta).forEach(param => {
+    item[param[0]] = param[1];
+  });
+  return Util_DynamoDbStream_Runtime$ReventlessAws.buildJsonEvent$p(item);
+}
+
+async function relay(config, logName, subscriber, partitionTag, sendBatch) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return await PgChangeFeed$ReventlessPostgres.drain(pool, logName, subscriber, undefined, async events => {
+    let jsons = Stdlib_Array.filterMap(events, event => toEventCollectorJson(event, partitionTag));
+    if (jsons.length !== 0) {
+      return await sendBatch(jsons);
+    }
+  });
+}
+
+export {
+  toEventCollectorJson,
+  relay,
+}
+/* Message-ReventlessCore Not a pure module */

package/src/adapter/Postgres/PgConnection.res

@@ -0,0 +1,169 @@
+/** Deploy-time component that provisions a managed Postgres instance (RDS) and
+  resolves the connection details the `reventless-postgres` runtime needs inside
+  a Lambda.
+
+  One `PgConnection` hosts **all three** storage surfaces (classic `event_log`,
+  DCB `dcb_event`, and the QueryDb `qdb_*` tables) in a single database — the
+  per-surface adapters take a reference to it, they do not each provision a DB.
+
+  Networking is supplied by the platform (an existing VPC + private subnets); a
+  `PgConnection` does not provision a VPC. It creates:
+  - a **shared security group** with a self-referencing `5432` ingress rule, so
+    every Lambda that attaches this same SG (see C1 / `securityGroupId`) can
+    reach the DB without a separate client SG;
+  - a **DB subnet group** over the given private subnets;
+  - the **RDS instance** with `manageMasterUserPassword` — RDS mints and rotates
+    the master credentials in Secrets Manager, so no plaintext password ever
+    lands in Pulumi state. The resulting secret ARN surfaces on
+    `connectionConfig.secretArn`; the runtime resolves it at cold start.
+
+  Aurora / Aurora Serverless v2 is a planned second engine behind the same
+  `connectionConfig` output shape (tracked in the AWS-Postgres plan). */
+
+/** Resolved at deploy time, serialized into the handler Lambda env, and consumed
+  at cold start to build a `PgDriver` pool. `secretArn` points at the
+  RDS-managed `{username, password}` secret; `host`/`port`/`database` come from
+  the instance itself. */
+@schema
+type connectionConfig = {
+  host: string,
+  port: int,
+  database: string,
+  /** RDS master username — set at deploy time, not secret. The pool's `user`;
+    the Secrets Manager secret supplies only the matching password. */
+  username: string,
+  secretArn: string,
+}
+
+type t = {
+  /** Deploy-time resources (currently the RDS instance) for dependency wiring —
+    e.g. the A3 migration Lambda and the B-phase adapters order after these. */
+  resources: array<ReventlessInfra.Adapter.resource>,
+  connectionConfig: Pulumi.Output.t<connectionConfig>,
+  /** Attach to every Lambda that talks to Postgres: the SG's self-referencing
+    rule is what lets those Lambdas reach the DB on 5432. */
+  securityGroupId: Pulumi.Output.t<string>,
+  /** The DB's private subnets, echoed back for the Lambda `vpcConfig` so
+    handlers land in the same subnets as the database. */
+  subnetIds: array<Pulumi.Input.t<string>>,
+}
+
+/** Postgres wire port. */
+let port = 5432
+
+let make = (
+  ~name,
+  ~vpcId: Pulumi.Input.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~databaseName="reventless",
+  ~username="reventless_admin",
+  ~engineVersion="16",
+  ~instanceClass="db.t3.micro",
+  ~allocatedStorage=20,
+  ~multiAz=false,
+  ~storageEncrypted=true,
+  ~backupRetentionPeriod=7,
+  ~deletionProtection=true,
+  ~skipFinalSnapshot=false,
+  ~opts: option<Pulumi.ComponentResource.options>=?,
+): t => {
+  let opts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let tags =
+    [
+      ("Name", name),
+      ("Environment", Pulumi.Pulumi.getStackName()),
+      ("reventless:role", "postgres-connection"),
+    ]->Dict.fromArray
+
+  // Shared DB-access security group. Self-referencing 5432 ingress lets member
+  // Lambdas reach the DB; open egress so both the DB and those Lambdas can make
+  // outbound calls (e.g. Secrets Manager, other AWS APIs).
+  let sg = PulumiAws.EC2.SecurityGroup.make(
+    ~name=`${name}-pg-sg`,
+    ~args={
+      name: `${name}-pg-sg`,
+      vpcId,
+      ingress: [
+        {
+          fromPort: port,
+          protocol: "tcp",
+          toPort: port,
+          cidrBlocks: [],
+          self: true,
+        },
+      ],
+      egress: [PulumiAws.EC2.SecurityGroup.Egress.allowAll],
+      tags,
+    },
+    ~opts?,
+  )
+
+  let subnetGroup = PulumiAws.Rds.SubnetGroup.make(
+    ~name=`${name}-pg-subnets`,
+    ~args={
+      name: `${name}-pg-subnets`->Pulumi.Input.make,
+      subnetIds: subnetIds->Pulumi.Input.make,
+      tags: tags->Pulumi.Input.make,
+    },
+    ~opts?,
+  )
+
+  let instance = PulumiAws.Rds.Instance.make(
+    ~name=`${name}-pg`,
+    ~args={
+      engine: "postgres"->Pulumi.Input.make,
+      engineVersion: engineVersion->Pulumi.Input.make,
+      instanceClass: instanceClass->Pulumi.Input.make,
+      allocatedStorage: allocatedStorage->Pulumi.Input.make,
+      dbName: databaseName->Pulumi.Input.make,
+      username: username->Pulumi.Input.make,
+      manageMasterUserPassword: true->Pulumi.Input.make,
+      dbSubnetGroupName: subnetGroup.name->Pulumi.Output.asInput,
+      vpcSecurityGroupIds: [sg.id->Pulumi.Output.asInput]->Pulumi.Input.make,
+      port: port->Pulumi.Input.make,
+      multiAz: multiAz->Pulumi.Input.make,
+      publiclyAccessible: false->Pulumi.Input.make,
+      storageEncrypted: storageEncrypted->Pulumi.Input.make,
+      backupRetentionPeriod: backupRetentionPeriod->Pulumi.Input.make,
+      deletionProtection: deletionProtection->Pulumi.Input.make,
+      skipFinalSnapshot: skipFinalSnapshot->Pulumi.Input.make,
+      tags: tags->Pulumi.Input.make,
+    },
+    ~opts?,
+  )
+
+  let connectionConfig =
+    (instance.address, instance.masterUserSecrets)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((host, secrets)) => {
+      host,
+      port,
+      database: databaseName,
+      username,
+      secretArn: switch secrets->Array.get(0) {
+      | Some(secret) => secret.secretArn
+      | None =>
+        JsError.throwWithMessage(
+          "RDS instance exposes no master user secret — manageMasterUserPassword must be enabled",
+        )
+      },
+    })
+
+  {
+    resources: [
+      ReventlessInfra.Adapter.make(
+        ~name=name->Pulumi.Output.make,
+        ~id=instance.id,
+        ~urn=instance.arn,
+        ~service="aws:rds"->Pulumi.Output.make,
+        ~role="postgres"->Pulumi.Output.make,
+        ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
+      ),
+    ],
+    connectionConfig,
+    securityGroupId: sg.id,
+    subnetIds,
+  }
+}

package/src/adapter/Postgres/PgConnection.res.mjs

@@ -0,0 +1,112 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as EC2_SecurityGroup$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/EC2/EC2_SecurityGroup.res.mjs";
+
+let connectionConfigSchema = S.schema(s => ({
+  host: s.m(S.string),
+  port: s.m(S.int),
+  database: s.m(S.string),
+  username: s.m(S.string),
+  secretArn: s.m(S.string)
+}));
+
+function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, opts) {
+  let databaseName = databaseNameOpt !== undefined ? databaseNameOpt : "reventless";
+  let username = usernameOpt !== undefined ? usernameOpt : "reventless_admin";
+  let engineVersion = engineVersionOpt !== undefined ? engineVersionOpt : "16";
+  let instanceClass = instanceClassOpt !== undefined ? instanceClassOpt : "db.t3.micro";
+  let allocatedStorage = allocatedStorageOpt !== undefined ? allocatedStorageOpt : 20;
+  let multiAz = multiAzOpt !== undefined ? multiAzOpt : false;
+  let storageEncrypted = storageEncryptedOpt !== undefined ? storageEncryptedOpt : true;
+  let backupRetentionPeriod = backupRetentionPeriodOpt !== undefined ? backupRetentionPeriodOpt : 7;
+  let deletionProtection = deletionProtectionOpt !== undefined ? deletionProtectionOpt : true;
+  let skipFinalSnapshot = skipFinalSnapshotOpt !== undefined ? skipFinalSnapshotOpt : false;
+  let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let tags = Object.fromEntries([
+    [
+      "Name",
+      name
+    ],
+    [
+      "Environment",
+      Pulumi.getStack()
+    ],
+    [
+      "reventless:role",
+      "postgres-connection"
+    ]
+  ]);
+  let sg = EC2_SecurityGroup$PulumiAws.make(name + `-pg-sg`, {
+    name: name + `-pg-sg`,
+    vpcId: vpcId,
+    ingress: [{
+        fromPort: 5432,
+        protocol: "tcp",
+        toPort: 5432,
+        cidrBlocks: [],
+        self: true
+      }],
+    egress: [EC2_SecurityGroup$PulumiAws.Egress.allowAll],
+    tags: tags
+  }, opts$1);
+  let subnetGroup = new (Aws.rds.SubnetGroup)(name + `-pg-subnets`, {
+    name: name + `-pg-subnets`,
+    subnetIds: subnetIds,
+    tags: tags
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let instance = new (Aws.rds.Instance)(name + `-pg`, {
+    allocatedStorage: allocatedStorage,
+    engine: "postgres",
+    engineVersion: engineVersion,
+    instanceClass: instanceClass,
+    dbName: databaseName,
+    username: username,
+    manageMasterUserPassword: true,
+    dbSubnetGroupName: subnetGroup.name,
+    vpcSecurityGroupIds: [sg.id],
+    port: 5432,
+    multiAz: multiAz,
+    publiclyAccessible: false,
+    storageEncrypted: storageEncrypted,
+    backupRetentionPeriod: backupRetentionPeriod,
+    deletionProtection: deletionProtection,
+    skipFinalSnapshot: skipFinalSnapshot,
+    tags: tags
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let connectionConfig = Pulumi.all([
+    instance.address,
+    instance.masterUserSecrets
+  ]).apply(param => {
+    let secret = param[1][0];
+    return {
+      host: param[0],
+      port: 5432,
+      database: databaseName,
+      username: username,
+      secretArn: secret !== undefined ? secret.secretArn : Stdlib_JsError.throwWithMessage("RDS instance exposes no master user secret — manageMasterUserPassword must be enabled")
+    };
+  });
+  return {
+    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)],
+    connectionConfig: connectionConfig,
+    securityGroupId: sg.id,
+    subnetIds: subnetIds
+  };
+}
+
+let port = 5432;
+
+export {
+  connectionConfigSchema,
+  port,
+  make,
+}
+/* connectionConfigSchema Not a pure module */

package/src/adapter/Postgres/PgRuntime.res

@@ -0,0 +1,71 @@
+/** Cold-start Postgres connectivity for deployed Lambdas.
+
+  Given a resolved `PgConnection.connectionConfig` (injected into the handler env
+  at deploy time), this resolves the RDS-managed master password from Secrets
+  Manager and builds **one pg pool per container**, memoized by secret ARN.
+
+  Rotation-safe by construction: the pool is created with a *password provider*,
+  which pg invokes each time it opens a physical connection — so a rotated secret
+  is picked up on the next new connection. The fetched secret is cached per ARN
+  (as a promise) to avoid a Secrets Manager round trip on every connection; a
+  password rotation surfaces as auth failures that recycle the container, after
+  which the next cold start re-fetches. */
+
+/** RDS-managed master secret payload (`{username, password}` JSON). We only need
+  the password here — the username is carried on `connectionConfig` (deploy-time
+  known) so the pool can be constructed without first awaiting the secret. */
+let passwordFromSecret = async (secretArn: string): string => {
+  let out =
+    await {AwsSdk.SecretsManager.GetSecretValueCommand.secretId: secretArn}
+    ->AwsSdk.SecretsManager.GetSecretValueCommand.make
+    ->AwsSdk.SecretsManager.GetSecretValueCommand.send
+  switch out.secretString {
+  | Some(str) =>
+    switch str->JSON.parseOrThrow->JSON.Decode.object {
+    | Some(obj) =>
+      switch obj->Dict.get("password")->Option.flatMap(JSON.Decode.string) {
+      | Some(password) => password
+      | None => JsError.throwWithMessage("Secrets Manager secret has no `password` field")
+      }
+    | None => JsError.throwWithMessage("Secrets Manager secret is not a JSON object")
+    }
+  | None =>
+    JsError.throwWithMessage(`Secrets Manager secret ${secretArn} has no SecretString`)
+  }
+}
+
+// Cache the in-flight/settled password fetch per ARN so pg's per-connection
+// provider doesn't hit Secrets Manager on every physical connection.
+let passwordCache: dict<promise<string>> = Dict.make()
+
+let cachedPassword = (secretArn: string): promise<string> =>
+  switch passwordCache->Dict.get(secretArn) {
+  | Some(p) => p
+  | None =>
+    let p = passwordFromSecret(secretArn)
+    passwordCache->Dict.set(secretArn, p)
+    p
+  }
+
+// One pool per secret ARN for the life of the container.
+let poolCache: dict<ReventlessPostgres.PgDriver.pool> = Dict.make()
+
+/** The container-lifetime pool for the given connection config, built on first
+  use. pg pools connect lazily, so this is cheap until the first query. */
+let poolFor = (config: PgConnection.connectionConfig): ReventlessPostgres.PgDriver.pool =>
+  switch poolCache->Dict.get(config.secretArn) {
+  | Some(pool) => pool
+  | None =>
+    let pool = ReventlessPostgres.PgDriver.makePool({
+      host: config.host,
+      port: config.port,
+      database: config.database,
+      user: config.username,
+      password: () => cachedPassword(config.secretArn),
+      // RDS PG15+ defaults to rds.force_ssl=1. Encrypt without CA verification
+      // for v1; pin the RDS CA bundle as a hardening follow-up.
+      ssl: {rejectUnauthorized: false},
+    })
+    poolCache->Dict.set(config.secretArn, pool)
+    pool
+  }

package/src/adapter/Postgres/PgRuntime.res.mjs

@@ -0,0 +1,71 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as SecretsManager$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/SecretsManager.res.mjs";
+import * as PgDriver$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgDriver.res.mjs";
+import * as ClientSecretsManager from "@aws-sdk/client-secrets-manager";
+
+async function passwordFromSecret(secretArn) {
+  let out = await SecretsManager$AwsSdk.GetSecretValueCommand.send(new ClientSecretsManager.GetSecretValueCommand({
+    SecretId: secretArn
+  }));
+  let str = out.SecretString;
+  if (str === undefined) {
+    return Stdlib_JsError.throwWithMessage(`Secrets Manager secret ` + secretArn + ` has no SecretString`);
+  }
+  let obj = Stdlib_JSON.Decode.object(JSON.parse(str));
+  if (obj === undefined) {
+    return Stdlib_JsError.throwWithMessage("Secrets Manager secret is not a JSON object");
+  }
+  let password = Stdlib_Option.flatMap(obj["password"], Stdlib_JSON.Decode.string);
+  if (password !== undefined) {
+    return password;
+  } else {
+    return Stdlib_JsError.throwWithMessage("Secrets Manager secret has no `password` field");
+  }
+}
+
+let passwordCache = {};
+
+function cachedPassword(secretArn) {
+  let p = passwordCache[secretArn];
+  if (p !== undefined) {
+    return p;
+  }
+  let p$1 = passwordFromSecret(secretArn);
+  passwordCache[secretArn] = p$1;
+  return p$1;
+}
+
+let poolCache = {};
+
+function poolFor(config) {
+  let pool = poolCache[config.secretArn];
+  if (pool !== undefined) {
+    return Primitive_option.valFromOption(pool);
+  }
+  let pool$1 = PgDriver$ReventlessPostgres.makePool({
+    host: config.host,
+    port: config.port,
+    database: config.database,
+    user: config.username,
+    password: () => cachedPassword(config.secretArn),
+    ssl: {
+      rejectUnauthorized: false
+    }
+  });
+  poolCache[config.secretArn] = pool$1;
+  return pool$1;
+}
+
+export {
+  passwordFromSecret,
+  passwordCache,
+  cachedPassword,
+  poolCache,
+  poolFor,
+}
+/* SecretsManager-AwsSdk Not a pure module */

package/src/adapter/Runtime/AggregateEntryPoint.mjs

@@ -12,6 +12,7 @@ import { Make as commandTopicCallbackMake } from "@reventlessdev/reventless-core
 import { makeGenerateCommand } from "@reventlessdev/reventless-core/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
 import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
 import { append, replay, replayStream, appendStream } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgEventLogOpsFor } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs";
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import { DynamoDBClient, ScanCommand } from "@aws-sdk/client-dynamodb";
 import { unmarshall } from "@aws-sdk/util-dynamodb";
@@ -118,15 +119,32 @@ async function checkPluginStatus(event) {
 // Route 2 (SQS event source): the in-process command handler (used both as the
 // inline dispatch target and as the SQS message handler) plus the resolved
 // queue ref for the fire-and-forget async path.
-function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl) {
+// `pgConnection`, when present, is the resolved PgConnection.connectionConfig
+// ({host,port,database,username,secretArn}) serialized into HANDLER_CONFIG by the
+// runtime builder for a Postgres-backed aggregate. Its presence selects the
+// Postgres EventLog runtime; absence keeps the DynamoDB path byte-identical.
+// `eventLogTableName` doubles as the Postgres `event_log.log_name` discriminator
+// (all aggregates share one Postgres table, unlike DynamoDB's table-per-aggregate).
+function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl, pgConnection) {
   const patchedSpec = patchSpecId(specModule);
-  const resolvedTable = { name: eventLogTableName };
-  const rawStorageOps = {
-    append: append(resolvedTable),
-    replay: replay(resolvedTable),
-    replayStream: replayStream(resolvedTable),
-    appendStream: appendStream(resolvedTable),
-  };
+  let rawStorageOps;
+  if (pgConnection) {
+    const pgOps = pgEventLogOpsFor(pgConnection, eventLogTableName);
+    rawStorageOps = {
+      append: pgOps.append,
+      replay: pgOps.replay,
+      replayStream: pgOps.replayStream,
+      appendStream: pgOps.appendStream,
+    };
+  } else {
+    const resolvedTable = { name: eventLogTableName };
+    rawStorageOps = {
+      append: append(resolvedTable),
+      replay: replay(resolvedTable),
+      replayStream: replayStream(resolvedTable),
+      appendStream: appendStream(resolvedTable),
+    };
+  }
   const eventLogOps = eventLogOperationsMake(patchedSpec)({
     Spec: patchedSpec,
     EventTopic: { Spec: patchedSpec },
@@ -246,7 +264,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const behaviorModule = await dynamicImport(h.behaviorModule);
-    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl);
+    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl, h.pgConnection);
     cmdTopicHandlers[h.queueArn] = parts.sqsHandler;
     cmdGenHandlers[specModule.name] = buildCommandGeneratorHandler(parts, DISPATCH_MODE);
   }));

package/src/adapter/Runtime/AggregateRuntime_Builder_Micro.res.mjs

@@ -173,7 +173,7 @@ function finish() {
       cmdTopicEnvVars["HANDLER_CONFIG"] = cmdTopicHandlerConfigOutput;
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       let cmdTopicName = baseName + "CmdHandler";
-      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.commandTopicConnects.forEach(connect => connect(cmdTopicRuntime));
       if (spec.commandGeneratorConnects.length !== 0) {
         let cmdGenHandlerConfigOutput = Pulumi.all([
@@ -185,7 +185,7 @@ function finish() {
         cmdGenEnvVars["HANDLER_CONFIG"] = cmdGenHandlerConfigOutput;
         let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
         let cmdGenName = baseName + "CmdGen";
-        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
         spec.commandGeneratorConnects.forEach(connect => connect(cmdGenRuntime));
       }
       let match$2 = spec.eventCollectorChannelSpec;
@@ -208,7 +208,7 @@ function finish() {
       evtMapperPackageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
       let match$4 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventMapperEntryPoint.mjs", evtMapperPackageDirs, undefined);
       let evtMapperName = baseName + "EventMapper";
-      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, aggregateOpts);
+      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(evtMapperName, [match$2], evtMapperRuntime, aggregateOpts);
     });
   }

package/src/adapter/Runtime/AggregateRuntime_Builder_Micro_Async.res.mjs

@@ -173,7 +173,7 @@ function finish() {
       cmdTopicEnvVars["HANDLER_CONFIG"] = cmdTopicHandlerConfigOutput;
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       let cmdTopicName = baseName + "CmdHandler";
-      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.commandTopicConnects.forEach(connect => connect(cmdTopicRuntime));
       if (spec.commandGeneratorConnects.length !== 0) {
         let cmdGenHandlerConfigOutput = Pulumi.all([
@@ -186,7 +186,7 @@ function finish() {
         cmdGenEnvVars["DISPATCH_MODE"] = "async";
         let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
         let cmdGenName = baseName + "CmdGen";
-        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
         spec.commandGeneratorConnects.forEach(connect => connect(cmdGenRuntime));
       }
       let match$2 = spec.eventCollectorChannelSpec;
@@ -209,7 +209,7 @@ function finish() {
       evtMapperPackageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
       let match$4 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventMapperEntryPoint.mjs", evtMapperPackageDirs, undefined);
       let evtMapperName = baseName + "EventMapper";
-      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, aggregateOpts);
+      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(evtMapperName, [match$2], evtMapperRuntime, aggregateOpts);
     });
   }

package/src/adapter/Runtime/AggregateRuntime_Builder_PerAggregate.res.mjs

@@ -152,7 +152,7 @@ function finish() {
       packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
       packageDirs[behaviorPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(behaviorPkg);
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(lambdaName, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, aggregateOpts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(lambdaName, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.connects.forEach(connect => connect(runtime));
       let channelSpecs = Stdlib_Option.mapOr(spec.eventCollectorChannelSpec, [], cs => [cs]);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(name, channelSpecs, runtime, aggregateOpts);

package/src/adapter/Runtime/AggregateRuntime_Builder_PerAggregate_Async.res.mjs

@@ -152,7 +152,7 @@ function finish() {
       packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
       packageDirs[behaviorPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(behaviorPkg);
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, aggregateOpts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.connects.forEach(connect => connect(runtime));
       let channelSpecs = Stdlib_Option.mapOr(spec.eventCollectorChannelSpec, [], cs => [cs]);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(name, channelSpecs, runtime, aggregateOpts);