@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.174

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.174 (2026-07-05)
+
+### Features
+
+* @[@reventless](https://github.com/reventless).systemCallable slice opt-in for deploy-time system callers ([c5ed537](https://github.com/ReventlessDev/reventless-core/commit/c5ed537309f8e4b7d4a4d4af1ed1ec83d060aea3))
+* **reventless-aws:** deploy-time Postgres selection for DCB EventLog (B2.3c) ([c9ac79e](https://github.com/ReventlessDev/reventless-core/commit/c9ac79e890e183874e81ee562ed0938d1efb02df))
+* **reventless-aws:** Postgres change-feed relay auto-wiring (B2.3d) ([62b430f](https://github.com/ReventlessDev/reventless-core/commit/62b430f1e6d8ec1f172de0cca324f7f26aaf5fcb))
+
+
+# 3.0.0-alpha.173 (2026-07-05)
+
+### Features
+
+* **reventless-aws:** aggregate EventLog Postgres runtime + entry-point branch ([fd81ece](https://github.com/ReventlessDev/reventless-core/commit/fd81ece65c2bf6aebf227d74ec2d0f002833d351))
+* **reventless-aws:** DCB EventLog Postgres runtime + entry-point branch (B2.1) ([a6b4f8d](https://github.com/ReventlessDev/reventless-core/commit/a6b4f8d34509ff7213273a1f71f31705b625ff40)), closes [#4](https://github.com/ReventlessDev/reventless-core/issues/4)
+* **reventless-aws:** opt-in [@aws](https://github.com/aws)_iam dual-auth for deploy-time AppSync callers ([94037f1](https://github.com/ReventlessDev/reventless-core/commit/94037f17ae48a33415b02e8e7b178906be8b59a4))
+* **reventless-aws:** Postgres change-feed relay deploy builder + Lambda VPC (B2.3a/b, C1) ([64d67f3](https://github.com/ReventlessDev/reventless-core/commit/64d67f3ecd2c42d59ba814d6d821683ae8c81612))
+* **reventless-aws:** Postgres change-feed relay runtime (B2.2) ([9ccb601](https://github.com/ReventlessDev/reventless-core/commit/9ccb60192457e9da21869e0d1c98fe8dbfb42178))
+
+
 # 3.0.0-alpha.172 (2026-07-05)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.172",
+  "version": "3.0.0-alpha.174",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,14 +11,14 @@
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.24",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.13",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.139",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.85",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.1",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.87",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.141",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.23",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.64"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.3",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.65"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -61,6 +61,11 @@ module MakeWithConfig = (
     let splitApi: bool
     let cloner: bool
     let commandHandlerConfig: ReventlessCore.Runtime.commandHandlerConfigs
+    /** B2.3c platform toggle. When `Some`, every DCB EventLog is Postgres-backed
+        (no DynamoDB table/stream; a scheduled `PgChangeFeedRelay` drives propagation),
+        while aggregate EventLogs stay on DynamoDB. Provisioned by the app via
+        `PgConnection.make`. `None` = all-DynamoDB (unchanged). */
+    let pgConnection: option<PgConnection.t>
   },
 ): (
   ReventlessInfra.Platform.T with type api = Types.AppSync.api and type role = Types.AppSync.role
@@ -76,6 +81,17 @@ module MakeWithConfig = (
   Config.commandHandlerConfig.stateChanges->Option.forEach(({?sync, ?async}) =>
     PluginRuntime_Builder.setStateChangesConfig(~sync?, ~async?, ())
   )
+  // B2.3c: when a PgConnection is supplied, route ALL DCB EventLogs to Postgres
+  // (aggregate EventLogs stay on DynamoDB until the classic feed lands — B2.5) and
+  // record the selection for the change-feed relay wiring in makePlatform below.
+  // Set BEFORE the Admin/plugin functors run so DcbEventLogStorage.Selectable sees it.
+  Config.pgConnection->Option.forEach((pg: PgConnection.t) =>
+    DcbBackend.set({
+      connectionConfig: pg.connectionConfig,
+      securityGroupId: pg.securityGroupId,
+      subnetIds: pg.subnetIds,
+    })
+  )
   type api = Types.AppSync.api
   type role = Types.AppSync.role
   type apiTarget = Domain | Platform
@@ -999,12 +1015,16 @@ module MakeWithConfig = (
       })
     },
     // DCB EventLog created hook — extracts DynamoDB table name for DCB CommandTopic Lambda handler.
-    onDcbEventLogCreated: dcbEventLogUnknown => {
-      let dcbEventLog = dcbEventLogUnknown->asDcbEventLogComponent
-      let outputs = dcbEventLog->ReventlessCore.Component.outputs
-      let tableResource = outputs.resources->Array.getUnsafe(0)
-      PluginRuntime_Builder.registerDcbTableName(tableResource.name)
-    },
+    // Postgres-backed DCB logs (B2.3c) create no table, so there is no resource to read:
+    // the DCB command Lambda derives its `dcb_event.log_name` from the plugin name and
+    // reads the PG connection from DcbBackend, so no table-name registration is needed.
+    onDcbEventLogCreated: dcbEventLogUnknown =>
+      if !DcbBackend.isPostgres() {
+        let dcbEventLog = dcbEventLogUnknown->asDcbEventLogComponent
+        let outputs = dcbEventLog->ReventlessCore.Component.outputs
+        let tableResource = outputs.resources->Array.getUnsafe(0)
+        PluginRuntime_Builder.registerDcbTableName(tableResource.name)
+      },
     // DCB CommandTopic created hook — extracts SQS queue URL for slice builders.
     onDcbCommandTopicCreated: dcbCommandTopicUnknown => {
       let commandTopic = dcbCommandTopicUnknown->asDcbCommandTopicComponent
@@ -1124,7 +1144,7 @@ module MakeWithConfig = (
     QueryEngine.DynamoDb,
     ClonerRunner.Fargate,
     PluginRuntime_Builder.Make(EventCollectorChannel),
-    DcbEventLogStorage.DynamoDb,
+    DcbEventLogStorage.Selectable,
     EventTopicPublisher.DynamoDbStream,
     CommandTopicChannel.SQS_Sync,
     CommandTopicChannel.SQS_Async,
@@ -1210,6 +1230,47 @@ module MakeWithConfig = (
   type mcpSupported = | @as(true) McpSupported | @as(false) McpNotSupported
   let mcpSupported = McpNotSupported
 
+  // B2.3d: provision the Postgres change-feed relay when the DCB backend is Postgres.
+  // Called after plugins are built (makePlatform monolithic, or deployPlugin per
+  // stack). Each Postgres DCB log registered {logName, partitionTag} during its
+  // plugin build (DcbEventLogStorage_Postgres.make), and its plugin's EventCollector
+  // queue was attached in forPluginEventCollector — so the registry is complete here.
+  // One shared relay Lambda drains all logs from their per-log dcb_subscription
+  // checkpoints and feeds each plugin's collector queue.
+  let provisionPgChangeFeedRelay = () =>
+    switch DcbBackend.get() {
+    | Some({connectionConfig, securityGroupId, subnetIds}) =>
+      let relayLogs =
+        DcbBackend.getRelayLogs()->Array.filterMap(entry =>
+          switch (entry.collectorQueueUrl, entry.collectorQueueArn) {
+          | (Some(targetQueueUrl), Some(targetQueueArn)) =>
+            Some({
+              PgChangeFeedRelay_Builder.connectionConfig,
+              logName: entry.logName,
+              subscriber: "aws-eventcollector-relay",
+              partitionTag: entry.partitionTag,
+              targetQueueUrl,
+              targetQueueArn,
+            })
+          | _ =>
+            log.warn(
+              ~comp="Platform",
+              `PgChangeFeedRelay: DCB log ${entry.logName} has no EventCollector queue — skipping (its events will not propagate)`,
+            )
+            None
+          }
+        )
+      if relayLogs->Array.length > 0 {
+        let _ = PgChangeFeedRelay_Builder.make(
+          ~name="PgChangeFeedRelay",
+          ~logs=relayLogs,
+          ~securityGroupId,
+          ~subnetIds,
+        )
+      }
+    | None => ()
+    }
+
   // In split mode, create a dedicated core AppSync API and push the core schema.
   // In unified mode, makePlatform is a no-op (schema stitching handled by events).
   let makePlatform = (~version, ~plugins: array<module(PluginMaker)>) => {
@@ -1321,6 +1382,10 @@ module MakeWithConfig = (
     | None => ()
     }
 
+    // B2.3d: provision the Postgres change-feed relay (monolithic mode — all plugins
+    // built above, so the DcbBackend relay registry is complete).
+    provisionPgChangeFeedRelay()
+
     // Admin schema push is fired by preAdminResolversSchemaHook from inside
     // Admin.construct (with createResolvers gated on it). Only exports below.
     if Config.splitApi {
@@ -1881,6 +1946,10 @@ module MakeWithConfig = (
     let pluginOutputs = pluginComponent->ReventlessCore.Component.outputs
     ReventlessCore.Plugin_Helpers.exportPluginOutputs(pluginOutputs)
 
+    // B2.3d: provision the Postgres change-feed relay (plugin-stack mode — this
+    // plugin's Postgres DCB log(s) + collector queue were registered during P.make()).
+    provisionPgChangeFeedRelay()
+
     // Zero-downtime handover (Part 3.1): fire ONE synthetic heartbeat for the
     // just-deployed plugin so its new version runs the connect handshake within
     // seconds instead of waiting for the CloudWatch heartbeat rule's first
@@ -1936,5 +2005,6 @@ module Make = (): (
     let splitApi = true
     let cloner = false
     let commandHandlerConfig: ReventlessCore.Runtime.commandHandlerConfigs = {}
+    let pgConnection = None
   })
 }

package/src/Platform.res.mjs

@@ -22,6 +22,7 @@ import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/adm
 import * as Scheduler$ReventlessAws from "./components/Scheduler.res.mjs";
 import * as Aggregate$ReventlessCore from "@reventlessdev/reventless-core/src/components/Aggregate/Aggregate.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "./adapter/DcbEventLog/DcbBackend.res.mjs";
 import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Api_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Builder.res.mjs";
@@ -42,6 +43,7 @@ import * as AppSync_EventsApi$ReventlessAws from "./adapter/Api/AppSync_EventsAp
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 import * as NoEventMappings$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/NoEventMappings.res.mjs";
 import * as Util_HostUiDomain$ReventlessAws from "./util/Util_HostUiDomain.res.mjs";
+import * as DcbEventLogStorage$ReventlessAws from "./adapter/DcbEventLog/DcbEventLogStorage.res.mjs";
 import * as ExtensionMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionMapping.res.mjs";
 import * as PluginsProjection$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginsProjection.res.mjs";
 import * as StateTopic_AppSync$ReventlessAws from "./adapter/StateTopic/StateTopic_AppSync.res.mjs";
@@ -60,9 +62,9 @@ import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
 import * as StateChangeSlice_Builder$ReventlessAws from "./components/StateChangeSlice_Builder.res.mjs";
 import * as EventCollectorChannel_SQS$ReventlessAws from "./adapter/EventCollector/EventCollectorChannel_SQS.res.mjs";
+import * as PgChangeFeedRelay_Builder$ReventlessAws from "./adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
 import * as PluginExtensionPointSpec$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/PluginExtensionPointSpec.res.mjs";
-import * as DcbEventLogStorage_DynamoDb$ReventlessAws from "./adapter/DcbEventLog/DcbEventLogStorage_DynamoDb.res.mjs";
 import * as Platform_UIFragments_Lambda$ReventlessAws from "./adapter/Api/Platform_UIFragments_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "./adapter/CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
 import * as EventLogSubscription_AppSync$ReventlessAws from "./adapter/EventLogSubscription/EventLogSubscription_AppSync.res.mjs";
@@ -118,6 +120,11 @@ function MakeWithConfig(Config) {
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
   });
   Stdlib_Option.forEach(Config.commandHandlerConfig.stateChanges, param => PluginRuntime_Builder$ReventlessAws.setStateChangesConfig(param.sync, param.async, undefined));
+  Stdlib_Option.forEach(Config.pgConnection, pg => DcbBackend$ReventlessAws.set({
+    connectionConfig: pg.connectionConfig,
+    securityGroupId: pg.securityGroupId,
+    subnetIds: pg.subnetIds
+  }));
   let currentDeployTarget = {
     contents: "Domain"
   };
@@ -598,7 +605,7 @@ function MakeWithConfig(Config) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -653,7 +660,7 @@ function MakeWithConfig(Config) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
@@ -674,6 +681,9 @@ function MakeWithConfig(Config) {
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
   let hooks_onDcbEventLogCreated = dcbEventLogUnknown => {
+    if (DcbBackend$ReventlessAws.isPostgres()) {
+      return;
+    }
     let outputs = Component$ReventlessCore.outputs(dcbEventLogUnknown);
     let tableResource = outputs.resources[0];
     PluginRuntime_Builder$ReventlessAws.registerDcbTableName(tableResource.name);
@@ -742,7 +752,7 @@ function MakeWithConfig(Config) {
   })(ClonerRunner_Fargate$ReventlessAws)(PluginRuntime_Builder$ReventlessAws.Make({
     make: EventCollectorChannel_SQS$ReventlessAws.make,
     connect: EventCollectorChannel_SQS$ReventlessAws.connect
-  }))(DcbEventLogStorage_DynamoDb$ReventlessAws)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
+  }))(DcbEventLogStorage$ReventlessAws.Selectable)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
     make: CommandTopicChannel_SQS_Sync$ReventlessAws.make
   })({
     make: CommandTopicChannel_SQS_Async$ReventlessAws.make
@@ -805,6 +815,32 @@ function MakeWithConfig(Config) {
     hooks_schedulerRoleUrn.contents = outputs.resource.urn;
     return Component$ReventlessCore.operations(component);
   };
+  let provisionPgChangeFeedRelay = () => {
+    let match = DcbBackend$ReventlessAws.get();
+    if (match === undefined) {
+      return;
+    }
+    let connectionConfig = match.connectionConfig;
+    let relayLogs = Stdlib_Array.filterMap(DcbBackend$ReventlessAws.getRelayLogs(), entry => {
+      let match = entry.collectorQueueUrl;
+      let match$1 = entry.collectorQueueArn;
+      if (match !== undefined && match$1 !== undefined) {
+        return {
+          connectionConfig: connectionConfig,
+          logName: entry.logName,
+          subscriber: "aws-eventcollector-relay",
+          partitionTag: entry.partitionTag,
+          targetQueueUrl: match,
+          targetQueueArn: match$1
+        };
+      }
+      log.warn("Platform", undefined, `PgChangeFeedRelay: DCB log ` + entry.logName + ` has no EventCollector queue — skipping (its events will not propagate)`);
+    });
+    if (relayLogs.length !== 0) {
+      PgChangeFeedRelay_Builder$ReventlessAws.make("PgChangeFeedRelay", relayLogs, match.securityGroupId, match.subnetIds, undefined, undefined);
+      return;
+    }
+  };
   let makePlatform = (version, plugins) => {
     log.info("Platform", undefined, `v` + version);
     let scheduler = makeScheduler();
@@ -856,6 +892,7 @@ function MakeWithConfig(Config) {
     if (pluginComponent !== undefined) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
+    provisionPgChangeFeedRelay();
     if (Config.splitApi) {
       Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
       Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
@@ -920,7 +957,7 @@ function MakeWithConfig(Config) {
           return;
         }
       });
-      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin");
+      let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
       let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, fragments);
       return await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(AppSync_Adapter$ReventlessAws.getClient(), {
         apiId: apiId,
@@ -1129,6 +1166,7 @@ function MakeWithConfig(Config) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    provisionPgChangeFeedRelay();
     let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
     let match = IndexJs.isDryRun();
     let match$1 = hbConfig.epQueueUrl;
@@ -1207,6 +1245,11 @@ function Make($star) {
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
   });
   Stdlib_Option.forEach(commandHandlerConfig.stateChanges, param => PluginRuntime_Builder$ReventlessAws.setStateChangesConfig(param.sync, param.async, undefined));
+  Stdlib_Option.forEach(undefined, pg => DcbBackend$ReventlessAws.set({
+    connectionConfig: pg.connectionConfig,
+    securityGroupId: pg.securityGroupId,
+    subnetIds: pg.subnetIds
+  }));
   let currentDeployTarget = {
     contents: "Domain"
   };
@@ -1686,7 +1729,7 @@ function Make($star) {
       return Output$Pulumi.flatMap(targetApi, api => Output$Pulumi.flatMap(api.id, apiId => {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
-          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+          baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
           let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
@@ -1741,7 +1784,7 @@ function Make($star) {
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin");
+    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
@@ -1762,6 +1805,9 @@ function Make($star) {
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
   let hooks_onDcbEventLogCreated = dcbEventLogUnknown => {
+    if (DcbBackend$ReventlessAws.isPostgres()) {
+      return;
+    }
     let outputs = Component$ReventlessCore.outputs(dcbEventLogUnknown);
     let tableResource = outputs.resources[0];
     PluginRuntime_Builder$ReventlessAws.registerDcbTableName(tableResource.name);
@@ -1830,7 +1876,7 @@ function Make($star) {
   })(ClonerRunner_Fargate$ReventlessAws)(PluginRuntime_Builder$ReventlessAws.Make({
     make: EventCollectorChannel_SQS$ReventlessAws.make,
     connect: EventCollectorChannel_SQS$ReventlessAws.connect
-  }))(DcbEventLogStorage_DynamoDb$ReventlessAws)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
+  }))(DcbEventLogStorage$ReventlessAws.Selectable)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
     make: CommandTopicChannel_SQS_Sync$ReventlessAws.make
   })({
     make: CommandTopicChannel_SQS_Async$ReventlessAws.make
@@ -1893,6 +1939,32 @@ function Make($star) {
     hooks_schedulerRoleUrn.contents = outputs.resource.urn;
     return Component$ReventlessCore.operations(component);
   };
+  let provisionPgChangeFeedRelay = () => {
+    let match = DcbBackend$ReventlessAws.get();
+    if (match === undefined) {
+      return;
+    }
+    let connectionConfig = match.connectionConfig;
+    let relayLogs = Stdlib_Array.filterMap(DcbBackend$ReventlessAws.getRelayLogs(), entry => {
+      let match = entry.collectorQueueUrl;
+      let match$1 = entry.collectorQueueArn;
+      if (match !== undefined && match$1 !== undefined) {
+        return {
+          connectionConfig: connectionConfig,
+          logName: entry.logName,
+          subscriber: "aws-eventcollector-relay",
+          partitionTag: entry.partitionTag,
+          targetQueueUrl: match,
+          targetQueueArn: match$1
+        };
+      }
+      log.warn("Platform", undefined, `PgChangeFeedRelay: DCB log ` + entry.logName + ` has no EventCollector queue — skipping (its events will not propagate)`);
+    });
+    if (relayLogs.length !== 0) {
+      PgChangeFeedRelay_Builder$ReventlessAws.make("PgChangeFeedRelay", relayLogs, match.securityGroupId, match.subnetIds, undefined, undefined);
+      return;
+    }
+  };
   let makePlatform = (version, plugins) => {
     log.info("Platform", undefined, `v` + version);
     let scheduler = makeScheduler();
@@ -1939,6 +2011,7 @@ function Make($star) {
     if (pluginComponent !== undefined) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
+    provisionPgChangeFeedRelay();
     Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
     Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
     Pulumi$Pulumi.$$export("platformApiRoleArn", Output$Pulumi.flatMap(platformApiRole, role => role.arn));
@@ -2194,6 +2267,7 @@ function Make($star) {
     Pulumi$Pulumi.$$export("_interopMeta", Plugin_Helpers$ReventlessCore.getInteropMeta());
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
+    provisionPgChangeFeedRelay();
     let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
     let match = IndexJs.isDryRun();
     let match$1 = hbConfig.epQueueUrl;

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -52,7 +52,7 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
   let componentOpts = {
     parent: componentOpts_parent
   };
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, componentOpts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
   let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
   subscribe(referencesName, referencesStream);

package/src/adapter/DcbEventLog/DcbBackend.res

@@ -0,0 +1,78 @@
+// AWS-side selection for the DCB EventLog storage backend (B2.3c platform toggle).
+//
+// When `Platform.MakeWithConfig` is given a `~pgConnection`, it records the resolved
+// selection here BEFORE any admin/plugin `construct` runs. Read by:
+//   - `DcbEventLogStorage.Selectable` — route DCB storage to Postgres (no DynamoDB
+//     table/stream) and bind the Postgres operation set;
+//   - the DCB-command runtime env builder — inject `PG_CONNECTION` so the B2.1
+//     `DcbCommandTopicEntryPoint.mjs` Postgres branch activates;
+//   - `Platform.makePlatform` — provision the `PgChangeFeedRelay` and feed the plugin
+//     EventCollector SQS queue.
+//
+// All DCB logs in the platform share one selection (the confirmed B2.3c toggle);
+// aggregate EventLogs are unaffected — they stay on DynamoDB until the classic
+// `event_log` change feed lands (B2.5). See docs/plans/aws-postgres-change-feed-bridge.md.
+
+type selection = {
+  connectionConfig: Pulumi.Output.t<PgConnection.connectionConfig>,
+  /** DB-access security group every DCB/relay Lambda attaches (PgConnection.securityGroupId). */
+  securityGroupId: Pulumi.Output.t<string>,
+  /** Private subnets for the in-VPC DCB/relay Lambdas (PgConnection.subnetIds). */
+  subnetIds: array<Pulumi.Input.t<string>>,
+}
+
+let selectionRef: ref<option<selection>> = ref(None)
+
+/** Record the DCB Postgres selection. Called once by the platform before construct. */
+let set = (sel: selection) => selectionRef := Some(sel)
+
+/** The active DCB Postgres selection, if the platform was given a `PgConnection`. */
+let get = (): option<selection> => selectionRef.contents
+
+/** Whether DCB storage is Postgres-backed on this platform. */
+let isPostgres = (): bool => selectionRef.contents->Option.isSome
+
+// ---------------------------------------------------------------------------
+// Relay-log registry (B2.3d)
+//
+// One entry per Postgres-backed DCB log, assembled across the plugin build in two
+// steps so `makePlatform` can provision the change-feed relay from complete inputs:
+//   1. `DcbEventLogStorage_Postgres.make` registers `{logName, partitionTag}` when
+//      the DCB storage is created (both are known there, AWS-side).
+//   2. `PluginRuntime_Builder.forPluginEventCollector` attaches that plugin's
+//      EventCollector SQS queue, keyed by the canonical `logName`
+//      (`<plugin>DcbEventLog`), when the collector Lambda is built.
+// Both run during the plugin's own `P.make()`, so every registered log ends the
+// build with its collector queue attached. `makePlatform` then reads this and calls
+// `PgChangeFeedRelay_Builder.make` once (shared relay, per-log checkpoints).
+// ---------------------------------------------------------------------------
+type relayLogEntry = {
+  logName: string,
+  partitionTag: Reventless.DcbTag.derivedPartitionTag,
+  mutable collectorQueueUrl: option<Pulumi.Output.t<string>>,
+  mutable collectorQueueArn: option<Pulumi.Output.t<string>>,
+}
+
+let relayLogs: array<relayLogEntry> = []
+
+/** Step 1: record a Postgres DCB log and its partition tag (from the storage maker). */
+let registerRelayLog = (~logName: string, ~partitionTag: Reventless.DcbTag.derivedPartitionTag) =>
+  relayLogs
+  ->Array.push({logName, partitionTag, collectorQueueUrl: None, collectorQueueArn: None})
+  ->ignore
+
+/** Step 2: attach a plugin's EventCollector SQS queue to its DCB log's relay entry. */
+let attachCollectorQueue = (
+  ~logName: string,
+  ~url: Pulumi.Output.t<string>,
+  ~arn: Pulumi.Output.t<string>,
+) =>
+  relayLogs
+  ->Array.find(e => e.logName == logName)
+  ->Option.forEach(e => {
+    e.collectorQueueUrl = Some(url)
+    e.collectorQueueArn = Some(arn)
+  })
+
+/** All registered relay logs (read by `makePlatform` to provision the relay). */
+let getRelayLogs = (): array<relayLogEntry> => relayLogs

package/src/adapter/DcbEventLog/DcbBackend.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+
+let selectionRef = {
+  contents: undefined
+};
+
+function set(sel) {
+  selectionRef.contents = sel;
+}
+
+function get() {
+  return selectionRef.contents;
+}
+
+function isPostgres() {
+  return Stdlib_Option.isSome(selectionRef.contents);
+}
+
+let relayLogs = [];
+
+function registerRelayLog(logName, partitionTag) {
+  relayLogs.push({
+    logName: logName,
+    partitionTag: partitionTag,
+    collectorQueueUrl: undefined,
+    collectorQueueArn: undefined
+  });
+}
+
+function attachCollectorQueue(logName, url, arn) {
+  Stdlib_Option.forEach(relayLogs.find(e => e.logName === logName), e => {
+    e.collectorQueueUrl = url;
+    e.collectorQueueArn = arn;
+  });
+}
+
+function getRelayLogs() {
+  return relayLogs;
+}
+
+export {
+  selectionRef,
+  set,
+  get,
+  isPostgres,
+  relayLogs,
+  registerRelayLog,
+  attachCollectorQueue,
+  getRelayLogs,
+}
+/* No side effect */

package/src/adapter/DcbEventLog/DcbEventLogStorage.res

@@ -1 +1,21 @@
 module DynamoDb = DcbEventLogStorage_DynamoDb
+module Postgres = DcbEventLogStorage_Postgres
+
+// Build-time DCB storage selector (B2.3c). Reads `DcbBackend` — set by the platform
+// when a `PgConnection` is supplied — and dispatches to Postgres (no table/stream) or
+// DynamoDB. Passed to the Plugin / Admin functors in place of `.DynamoDb` so every DCB
+// log follows the platform toggle, while aggregate EventLogs stay on DynamoDB.
+module Selectable = {
+  let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
+    ~name,
+    ~indexes,
+    ~partitionTag,
+    ~crossPartitionTagKeys=[],
+    ~opts,
+  ) =>
+    if DcbBackend.isPostgres() {
+      Postgres.make(~name, ~indexes, ~partitionTag, ~crossPartitionTagKeys, ~opts)
+    } else {
+      DynamoDb.make(~name, ~indexes, ~partitionTag, ~crossPartitionTagKeys, ~opts)
+    }
+}

package/src/adapter/DcbEventLog/DcbEventLogStorage.res.mjs

@@ -1,9 +1,29 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as DcbBackend$ReventlessAws from "./DcbBackend.res.mjs";
+import * as DcbEventLogStorage_DynamoDb$ReventlessAws from "./DcbEventLogStorage_DynamoDb.res.mjs";
+import * as DcbEventLogStorage_Postgres$ReventlessAws from "./DcbEventLogStorage_Postgres.res.mjs";
+
+function make(name, indexes, partitionTag, crossPartitionTagKeysOpt, opts) {
+  let crossPartitionTagKeys = crossPartitionTagKeysOpt !== undefined ? crossPartitionTagKeysOpt : [];
+  if (DcbBackend$ReventlessAws.isPostgres()) {
+    return DcbEventLogStorage_Postgres$ReventlessAws.make(name, indexes, partitionTag, crossPartitionTagKeys, opts);
+  } else {
+    return DcbEventLogStorage_DynamoDb$ReventlessAws.make(name, indexes, partitionTag, crossPartitionTagKeys, opts);
+  }
+}
+
+let Selectable = {
+  make: make
+};
 
 let DynamoDb;
 
+let Postgres;
+
 export {
   DynamoDb,
+  Postgres,
+  Selectable,
 }
-/* No side effect */
+/* DcbEventLogStorage_DynamoDb-ReventlessAws Not a pure module */