@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.173

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.173 (2026-07-05)
+
+### Features
+
+* **reventless-aws:** aggregate EventLog Postgres runtime + entry-point branch ([fd81ece](https://github.com/ReventlessDev/reventless-core/commit/fd81ece65c2bf6aebf227d74ec2d0f002833d351))
+* **reventless-aws:** DCB EventLog Postgres runtime + entry-point branch (B2.1) ([a6b4f8d](https://github.com/ReventlessDev/reventless-core/commit/a6b4f8d34509ff7213273a1f71f31705b625ff40)), closes [#4](https://github.com/ReventlessDev/reventless-core/issues/4)
+* **reventless-aws:** opt-in [@aws](https://github.com/aws)_iam dual-auth for deploy-time AppSync callers ([94037f1](https://github.com/ReventlessDev/reventless-core/commit/94037f17ae48a33415b02e8e7b178906be8b59a4))
+* **reventless-aws:** Postgres change-feed relay deploy builder + Lambda VPC (B2.3a/b, C1) ([64d67f3](https://github.com/ReventlessDev/reventless-core/commit/64d67f3ecd2c42d59ba814d6d821683ae8c81612))
+* **reventless-aws:** Postgres change-feed relay runtime (B2.2) ([9ccb601](https://github.com/ReventlessDev/reventless-core/commit/9ccb60192457e9da21869e0d1c98fe8dbfb42178))
+
+
 # 3.0.0-alpha.172 (2026-07-05)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.172",
+  "version": "3.0.0-alpha.173",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,15 +9,15 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.5",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.13",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.139",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.85",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.1",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.86",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.23",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.2",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.64"
   },
   "devDependencies": {

package/src/Platform.res.mjs

@@ -598,7 +598,7 @@ function MakeWithConfig(Config) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -653,7 +653,7 @@ function MakeWithConfig(Config) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
@@ -920,7 +920,7 @@ function MakeWithConfig(Config) {
           return;
         }
       });
-      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
       let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, fragments);
       return await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(AppSync_Adapter$ReventlessAws.getClient(), {
         apiId: apiId,
@@ -1686,7 +1686,7 @@ function Make($star) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -1741,7 +1741,7 @@ function Make($star) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -52,7 +52,7 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
   let componentOpts = {
     parent: componentOpts_parent
   };
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, componentOpts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
   let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
   subscribe(referencesName, referencesStream);

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,26 @@
+// AWS-side runtime DcbEventLog operations for the Postgres backend. The DCB
+// analogue of EventLogStorage_Postgres_Runtime: turn a resolved connection config
+// into the DCB operation set (`read`/`append`/`readStream`), bound to the
+// container-lifetime pool from PgRuntime. Consumed by DcbCommandTopicEntryPoint.mjs
+// (Postgres branch, selected when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// The pg maker ignores `~indexes` / `~partitionTag` / `~crossPartitionTagKeys`
+// (Postgres evaluates the real `DcbTag.query` atomically — no GSI routing), so
+// they are passed empty here. `logName` is the `dcb_event.log_name` discriminator.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
+): ReventlessCore.DcbEventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.DcbEventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~indexes=[],
+    ~partitionTag=(),
+    ~opts=(),
+    ~lockStrategy,
+  )
+  ops
+}

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName, lockStrategyOpt) {
+  let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return DcbEventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, [], undefined, undefined, undefined, lockStrategy, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,23 @@
+// AWS-side runtime EventLog operations for the Postgres backend. Mirrors the
+// role of EventLogStorage_DynamoDb_Runtime: turn a resolved connection config
+// into the classic EventLog operation set, bound to the container-lifetime pool
+// from PgRuntime. Consumed by AggregateEntryPoint.mjs (Postgres branch, selected
+// when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// Unlike DynamoDB (table-per-aggregate), all aggregates share the single
+// Postgres `event_log` table, discriminated by `log_name`. `logName` is that
+// per-aggregate discriminator — the same stable identifier the builder would
+// otherwise use as the DynamoDB table name.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+): ReventlessCore.EventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~opts=(),
+  )
+  ops
+}

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,14 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, undefined, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res

@@ -0,0 +1,181 @@
+// Deploy-time builder for the Postgres change-feed relay (B2.3b).
+//
+// Provisions a scheduled, in-VPC Lambda that drains each Postgres DCB log via
+// PgChangeFeed and relays events to the plugin EventCollector SQS queue — which
+// fans out to read-model projections, aggregate command topics, and the
+// cross-plugin SNS EventTopic. The platform (D1, B2.3c) calls this with the set of
+// Postgres-backed DCB logs and points the EventCollector's event source at the
+// relay-fed queue.
+//
+// NOTE: EventBridge rate rules have a 1-minute floor, so v1 poll latency is
+// >= 1 minute. Sub-minute latency needs a self-invoking loop / EventBridge
+// Scheduler (follow-up) or the Fargate-LISTEN upgrade.
+
+// One Postgres-backed DCB log to relay.
+type relayLog = {
+  connectionConfig: Pulumi.Output.t<PgConnection.connectionConfig>,
+  /** dcb_event.log_name — also the DCB `event_log` discriminator. */
+  logName: string,
+  /** dcb_subscription checkpoint key for this relay. */
+  subscriber: string,
+  /** Plugin EventCollector SQS queue this log's events are relayed to. */
+  targetQueueUrl: Pulumi.Output.t<string>,
+  targetQueueArn: Pulumi.Output.t<string>,
+}
+
+// ~securityGroupId: DB-access SG the relay Lambda attaches (PgConnection.securityGroupId).
+// ~subnetIds: private subnets for the relay Lambda (PgConnection.subnetIds).
+let make = (
+  ~name: string,
+  ~logs: array<relayLog>,
+  ~securityGroupId: Pulumi.Output.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~intervalMinutes: int=1,
+  ~opts=?,
+): array<ReventlessInfra.Adapter.resource> => {
+  open PulumiAws
+  let customOpts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  // HANDLER_CONFIG.logs[], serialized from the deploy-time-resolved Outputs.
+  let logJsonOutputs = logs->Array.map(l =>
+    (l.connectionConfig, l.targetQueueUrl)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((cc, queueUrl)) => {
+      let pgConnectionJson =
+        [
+          ("host", cc.host->JSON.Encode.string),
+          ("port", cc.port->Int.toFloat->JSON.Encode.float),
+          ("database", cc.database->JSON.Encode.string),
+          ("username", cc.username->JSON.Encode.string),
+          ("secretArn", cc.secretArn->JSON.Encode.string),
+        ]
+        ->Dict.fromArray
+        ->JSON.Encode.object
+      [
+        ("pgConnection", pgConnectionJson),
+        ("logName", l.logName->JSON.Encode.string),
+        ("subscriber", l.subscriber->JSON.Encode.string),
+        ("targetQueueUrl", queueUrl->JSON.Encode.string),
+      ]
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    })
+  )
+  let handlerConfigOutput =
+    Pulumi.Output.all(logJsonOutputs)->Pulumi.Output.apply(items =>
+      `{"logs":[${items->Array.join(",")}]}`
+    )
+
+  let envVars = Dict.fromArray([("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)])
+
+  let vpcConfig =
+    securityGroupId
+    ->Pulumi.Output.apply(sgId =>
+      (
+        {
+          Lambda.Function.subnetIds: subnetIds->Pulumi.Input.make,
+          securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+        }: Lambda.Function.vpcConfig
+      )
+    )
+    ->Pulumi.Output.asInput
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~vpcConfig,
+    ~opts?,
+  )
+
+  // IAM: GetSecretValue on each log's DB secret + SendMessage on each target queue.
+  let secretArns =
+    logs->Array.map(l => l.connectionConfig->Pulumi.Output.apply(cc => cc.secretArn))
+  let queueArns = logs->Array.map(l => l.targetQueueArn)
+  let _iam =
+    (Pulumi.Output.all(secretArns), Pulumi.Output.all(queueArns), runtime.parts.lambdaRole.id)
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((secretArns, queueArns, roleId)) => {
+      open PulumiAws.PolicyDocument
+      let _ = PulumiAws.IAM.RolePolicy.make(
+        ~name=`${name}RelayAccess`,
+        ~args={
+          policy: PulumiAws.PolicyDocument.make(
+            ~id=`${name}RelayAccessPolicy`,
+            ~statements=[
+              {
+                sid: "AllowGetSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resources(secretArns),
+              },
+              {
+                sid: "AllowSendSqs",
+                effect: Allow,
+                actions: Action("sqs:SendMessage"),
+                resources: Resources(queueArns),
+              },
+            ],
+          )
+          ->PulumiAws.PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: roleId->Pulumi.Input.make,
+        },
+      )
+    })
+
+  // Scheduled poll: EventRule (rate) → Permission → EventTarget.
+  let rule = {
+    open PulumiAws.Cloudwatch
+    EventRule.make(
+      ~name=`${Pulumi.Pulumi.getStackName()}-${name}`,
+      ~args={
+        description: "Poll Postgres DCB change feed and relay to EventCollector"->Pulumi.Input.make,
+        scheduleExpression: EventRule.ScheduleExpression.every(Minutes(intervalMinutes)),
+      },
+      ~opts=?customOpts,
+    )
+  }
+
+  let lambda = runtime.parts.lambda
+  let _wire =
+    (lambda->Pulumi.Output.flatMap(l => l.arn), lambda->Pulumi.Output.flatMap(l => l.name))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
+      let _permission = PulumiAws.Lambda.Permission.make(
+        ~name=`${name}SchedulePermission`,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: lambdaName->Pulumi.Input.make,
+          principal: AWS.CloudwatchEventRule.principal,
+        },
+        ~opts=?customOpts,
+      )
+      let _target = {
+        open PulumiAws.Cloudwatch
+        EventTarget.make(
+          ~name,
+          ~args={
+            rule: EventTarget.Rule.ofEventRule(rule),
+            arn: lambdaArn->Pulumi.Input.make,
+          },
+          ~opts=?customOpts,
+        )
+      }
+    })
+
+  [
+    lambda
+    ->Pulumi.Output.apply(l => l->Util_Lambda.toResource)
+    ->ReventlessCore.Adapter.outputToResource,
+    rule->Util_Cloudwatch.EventRule.toResource,
+  ]
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs

@@ -0,0 +1,135 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_Cloudwatch$ReventlessAws from "../../util/Util_Cloudwatch.res.mjs";
+import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
+import * as Cloudwatch_EventTarget$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventTarget.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts) {
+  let intervalMinutes = intervalMinutesOpt !== undefined ? intervalMinutesOpt : 1;
+  let customOpts = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs", {}, undefined);
+  let logJsonOutputs = logs.map(l => Pulumi.all([
+    l.connectionConfig,
+    l.targetQueueUrl
+  ]).apply(param => {
+    let cc = param[0];
+    let pgConnectionJson = Object.fromEntries([
+      [
+        "host",
+        cc.host
+      ],
+      [
+        "port",
+        cc.port
+      ],
+      [
+        "database",
+        cc.database
+      ],
+      [
+        "username",
+        cc.username
+      ],
+      [
+        "secretArn",
+        cc.secretArn
+      ]
+    ]);
+    return JSON.stringify(Object.fromEntries([
+      [
+        "pgConnection",
+        pgConnectionJson
+      ],
+      [
+        "logName",
+        l.logName
+      ],
+      [
+        "subscriber",
+        l.subscriber
+      ],
+      [
+        "targetQueueUrl",
+        param[1]
+      ]
+    ]));
+  }));
+  let handlerConfigOutput = Pulumi.all(logJsonOutputs).apply(items => `{"logs":[` + items.join(",") + `]}`);
+  let envVars = Object.fromEntries([[
+      "HANDLER_CONFIG",
+      handlerConfigOutput
+    ]]);
+  let vpcConfig = securityGroupId.apply(sgId => ({
+    subnetIds: subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, undefined, undefined, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  let secretArns = logs.map(l => l.connectionConfig.apply(cc => cc.secretArn));
+  let queueArns = logs.map(l => l.targetQueueArn);
+  Pulumi.all([
+    Pulumi.all(secretArns),
+    Pulumi.all(queueArns),
+    runtime.parts.lambdaRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + `RelayAccess`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `RelayAccessPolicy`, [
+        {
+          Sid: "AllowGetSecret",
+          Effect: "Allow",
+          Action: "secretsmanager:GetSecretValue",
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowSendSqs",
+          Effect: "Allow",
+          Action: "sqs:SendMessage",
+          Resource: param[1]
+        }
+      ])),
+      role: param[2]
+    });
+  });
+  let rule = new (Aws.cloudwatch.EventRule)(Pulumi.getStack() + `-` + name, {
+    description: "Poll Postgres DCB change feed and relay to EventCollector",
+    scheduleExpression: Primitive_option.some(Cloudwatch_EventRule$PulumiAws.ScheduleExpression.every({
+      TAG: "Minutes",
+      _0: intervalMinutes
+    }))
+  }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  let lambda = runtime.parts.lambda;
+  Pulumi.all([
+    Output$Pulumi.flatMap(lambda, l => l.arn),
+    Output$Pulumi.flatMap(lambda, l => l.name)
+  ]).apply(param => {
+    new (Aws.lambda.Permission)(name + `SchedulePermission`, {
+      action: "lambda:InvokeFunction",
+      function: param[1],
+      principal: AWS$ReventlessAws.CloudwatchEventRule.principal
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+    new (Aws.cloudwatch.EventTarget)(name, {
+      rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(rule),
+      arn: param[0]
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  });
+  return [
+    Adapter$ReventlessCore.outputToResource(lambda.apply(l => Util_Lambda$ReventlessAws.toResource(undefined, l))),
+    Util_Cloudwatch$ReventlessAws.EventRule.toResource(rule)
+  ];
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -0,0 +1,64 @@
+// Postgres change-feed relay runtime (B2.2).
+//
+// Drains a Postgres DCB log via `PgChangeFeed` and pushes each event — transformed
+// into the `{id, meta, event}` shape the plugin EventCollector SQS handler
+// consumes — onto that queue. The plugin EventCollector (`AdminEventCollectorEntryPoint`)
+// then drives the full fan-out: read-model projections, aggregate command topics,
+// and the cross-plugin SNS EventTopic. See
+// docs/plans/aws-postgres-change-feed-bridge.md.
+//
+// The transform reuses the canonical DynamoDB shape producers
+// (`derivePartitionKey` + `buildJsonEvent'`) so the emitted body is byte-identical
+// to the DynamoDB-stream path — the SQS handler cannot tell the difference.
+
+/**
+ * Transform one feed event into the EventCollector JSON body. Rebuilds the same
+ * unmarshalled-item dict the DCB DynamoDB-stream decoder would see (id from the
+ * partition tag, position, event type, data, decomposed meta) and runs it through
+ * `buildJsonEvent'` — the exact decoder the SQS handler expects. Returns `None`
+ * for a malformed event (mirrors `buildJsonEvent'`).
+ */
+let toEventCollectorJson = (
+  event: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent,
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+): option<JSON.t> => {
+  let item = Dict.make()
+  item->Dict.set(
+    "id",
+    DcbEventLogStorage_DynamoDb_Runtime.derivePartitionKey(~partitionTag?, event.tags)
+    ->JSON.Encode.string,
+  )
+  item->Dict.set("position", event.position->JSON.Encode.string)
+  item->Dict.set("event", event.eventType->JSON.Encode.string)
+  item->Dict.set("data", event.data)
+  ReventlessCore.Message.decomposeMeta(event.meta)->Array.forEach(((key, value)) =>
+    item->Dict.set(key, value)
+  )
+  Util_DynamoDbStream_Runtime.buildJsonEvent'(item)
+}
+
+/**
+ * Drain a Postgres DCB log from its checkpoint and relay its events to the
+ * EventCollector via the injected `sendBatch`. `sendBatch` is injected (rather than
+ * hardcoding SQS) so the drain/transform is unit-testable; the relay entry point
+ * wires it to the actual `SendMessage`. Returns the number of events processed.
+ *
+ * At-least-once by construction: `PgChangeFeed.drain` replays the last page on a
+ * crash before checkpoint, and EventCollector projections are idempotent
+ * (event-sourced), so re-delivery is safe.
+ */
+let relay = async (
+  ~config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~subscriber: string,
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+  ~sendBatch: array<JSON.t> => promise<unit>,
+): int => {
+  let pool = PgRuntime.poolFor(config)
+  await ReventlessPostgres.PgChangeFeed.drain(pool, ~logName, ~subscriber, ~handle=async events => {
+    let jsons = events->Array.filterMap(event => toEventCollectorJson(event, ~partitionTag?))
+    if jsons->Array.length > 0 {
+      await sendBatch(jsons)
+    }
+  })
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs

@@ -0,0 +1,36 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as PgRuntime$ReventlessAws from "./PgRuntime.res.mjs";
+import * as PgChangeFeed$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgChangeFeed.res.mjs";
+import * as Util_DynamoDbStream_Runtime$ReventlessAws from "../../util/Util_DynamoDbStream_Runtime.res.mjs";
+import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
+
+function toEventCollectorJson(event, partitionTag) {
+  let item = {};
+  item["id"] = DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, event.tags);
+  item["position"] = event.position;
+  item["event"] = event.eventType;
+  item["data"] = event.data;
+  Message$ReventlessCore.decomposeMeta(event.meta).forEach(param => {
+    item[param[0]] = param[1];
+  });
+  return Util_DynamoDbStream_Runtime$ReventlessAws.buildJsonEvent$p(item);
+}
+
+async function relay(config, logName, subscriber, partitionTag, sendBatch) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return await PgChangeFeed$ReventlessPostgres.drain(pool, logName, subscriber, undefined, async events => {
+    let jsons = Stdlib_Array.filterMap(events, event => toEventCollectorJson(event, partitionTag));
+    if (jsons.length !== 0) {
+      return await sendBatch(jsons);
+    }
+  });
+}
+
+export {
+  toEventCollectorJson,
+  relay,
+}
+/* Message-ReventlessCore Not a pure module */

package/src/adapter/Runtime/AggregateEntryPoint.mjs

@@ -12,6 +12,7 @@ import { Make as commandTopicCallbackMake } from "@reventlessdev/reventless-core
 import { makeGenerateCommand } from "@reventlessdev/reventless-core/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
 import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
 import { append, replay, replayStream, appendStream } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgEventLogOpsFor } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs";
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import { DynamoDBClient, ScanCommand } from "@aws-sdk/client-dynamodb";
 import { unmarshall } from "@aws-sdk/util-dynamodb";
@@ -118,15 +119,32 @@ async function checkPluginStatus(event) {
 // Route 2 (SQS event source): the in-process command handler (used both as the
 // inline dispatch target and as the SQS message handler) plus the resolved
 // queue ref for the fire-and-forget async path.
-function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl) {
+// `pgConnection`, when present, is the resolved PgConnection.connectionConfig
+// ({host,port,database,username,secretArn}) serialized into HANDLER_CONFIG by the
+// runtime builder for a Postgres-backed aggregate. Its presence selects the
+// Postgres EventLog runtime; absence keeps the DynamoDB path byte-identical.
+// `eventLogTableName` doubles as the Postgres `event_log.log_name` discriminator
+// (all aggregates share one Postgres table, unlike DynamoDB's table-per-aggregate).
+function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl, pgConnection) {
   const patchedSpec = patchSpecId(specModule);
-  const resolvedTable = { name: eventLogTableName };
-  const rawStorageOps = {
-    append: append(resolvedTable),
-    replay: replay(resolvedTable),
-    replayStream: replayStream(resolvedTable),
-    appendStream: appendStream(resolvedTable),
-  };
+  let rawStorageOps;
+  if (pgConnection) {
+    const pgOps = pgEventLogOpsFor(pgConnection, eventLogTableName);
+    rawStorageOps = {
+      append: pgOps.append,
+      replay: pgOps.replay,
+      replayStream: pgOps.replayStream,
+      appendStream: pgOps.appendStream,
+    };
+  } else {
+    const resolvedTable = { name: eventLogTableName };
+    rawStorageOps = {
+      append: append(resolvedTable),
+      replay: replay(resolvedTable),
+      replayStream: replayStream(resolvedTable),
+      appendStream: appendStream(resolvedTable),
+    };
+  }
   const eventLogOps = eventLogOperationsMake(patchedSpec)({
     Spec: patchedSpec,
     EventTopic: { Spec: patchedSpec },
@@ -246,7 +264,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const behaviorModule = await dynamicImport(h.behaviorModule);
-    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl);
+    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl, h.pgConnection);
     cmdTopicHandlers[h.queueArn] = parts.sqsHandler;
     cmdGenHandlers[specModule.name] = buildCommandGeneratorHandler(parts, DISPATCH_MODE);
   }));