@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.174

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res

@@ -0,0 +1,43 @@
+// Deploy-time DCB EventLog storage for the Postgres backend (B2.3c).
+//
+// Creates NO DynamoDB table and NO stream: DCB events live in Postgres (`dcb_event`)
+// and the `PgChangeFeedRelay` drives propagation. Returns:
+//   - `resources: []` — so the EventCollector wires no DynamoDB-stream ESM for this
+//     log (the DCB EventTopic's `DynamoDbStream` publisher becomes a passive marker
+//     with nothing to subscribe to), and
+//   - `operations` — the runtime DCB op set bound to the shared `PgConnection` pool.
+//
+// Selected by `DcbEventLogStorage.Selectable` when `DcbBackend` holds a selection.
+// The pool is lazy (`PgRuntime.poolFor`), so binding ops inside the deploy-time
+// `Output.apply` opens no connection during `pulumi up` — a real query only runs
+// inside the DcbCommandTopic Lambda at runtime. See
+// docs/plans/aws-postgres-change-feed-bridge.md.
+
+let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
+  ~name,
+  ~indexes as _,
+  ~partitionTag,
+  ~crossPartitionTagKeys as _=[],
+  ~opts as _,
+) => {
+  // B2.3d: `name` is the canonical `dcb_event.log_name` (`<plugin>DcbEventLog`).
+  // Register it with its partition tag so `makePlatform` can wire the change-feed
+  // relay; the collector queue is attached later in forPluginEventCollector.
+  DcbBackend.registerRelayLog(~logName=name, ~partitionTag)
+
+  let operations = switch DcbBackend.get() {
+  | Some({connectionConfig}) =>
+    connectionConfig->Pulumi.Output.apply(config =>
+      DcbEventLogStorage_Postgres_Runtime.opsFor(config, ~logName=name)
+    )
+  | None =>
+    // Selectable only routes here when a selection is set; guard defensively.
+    JsError.throwWithMessage(
+      "DcbEventLogStorage_Postgres.make called without a DcbBackend selection",
+    )
+  }
+  {
+    ReventlessCore.DcbEventLog_Adapter.resources: [],
+    operations,
+  }
+}

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as DcbBackend$ReventlessAws from "./DcbBackend.res.mjs";
+import * as DcbEventLogStorage_Postgres_Runtime$ReventlessAws from "./DcbEventLogStorage_Postgres_Runtime.res.mjs";
+
+function make(name, param, partitionTag, $staropt$star, param$1) {
+  $staropt$star !== undefined;
+  DcbBackend$ReventlessAws.registerRelayLog(name, partitionTag);
+  let match = DcbBackend$ReventlessAws.get();
+  let operations = match !== undefined ? match.connectionConfig.apply(config => DcbEventLogStorage_Postgres_Runtime$ReventlessAws.opsFor(config, name, undefined)) : Stdlib_JsError.throwWithMessage("DcbEventLogStorage_Postgres.make called without a DcbBackend selection");
+  return {
+    resources: [],
+    operations: operations
+  };
+}
+
+export {
+  make,
+}
+/* DcbEventLogStorage_Postgres_Runtime-ReventlessAws Not a pure module */

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,26 @@
+// AWS-side runtime DcbEventLog operations for the Postgres backend. The DCB
+// analogue of EventLogStorage_Postgres_Runtime: turn a resolved connection config
+// into the DCB operation set (`read`/`append`/`readStream`), bound to the
+// container-lifetime pool from PgRuntime. Consumed by DcbCommandTopicEntryPoint.mjs
+// (Postgres branch, selected when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// The pg maker ignores `~indexes` / `~partitionTag` / `~crossPartitionTagKeys`
+// (Postgres evaluates the real `DcbTag.query` atomically — no GSI routing), so
+// they are passed empty here. `logName` is the `dcb_event.log_name` discriminator.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
+): ReventlessCore.DcbEventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.DcbEventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~indexes=[],
+    ~partitionTag=(),
+    ~opts=(),
+    ~lockStrategy,
+  )
+  ops
+}

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName, lockStrategyOpt) {
+  let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return DcbEventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, [], undefined, undefined, undefined, lockStrategy, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res

@@ -0,0 +1,23 @@
+// AWS-side runtime EventLog operations for the Postgres backend. Mirrors the
+// role of EventLogStorage_DynamoDb_Runtime: turn a resolved connection config
+// into the classic EventLog operation set, bound to the container-lifetime pool
+// from PgRuntime. Consumed by AggregateEntryPoint.mjs (Postgres branch, selected
+// when a PG_CONNECTION is present in HANDLER_CONFIG).
+//
+// Unlike DynamoDB (table-per-aggregate), all aggregates share the single
+// Postgres `event_log` table, discriminated by `log_name`. `logName` is that
+// per-aggregate discriminator — the same stable identifier the builder would
+// otherwise use as the DynamoDB table name.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~logName: string,
+): ReventlessCore.EventLog_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  let (_name, ops, _storage) = ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+    ~pool,
+    ~name=logName,
+    ~opts=(),
+  )
+  ops
+}

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,14 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+
+function opsFor(config, logName) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, undefined, undefined)[1];
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res

@@ -0,0 +1,188 @@
+// Deploy-time builder for the Postgres change-feed relay (B2.3b).
+//
+// Provisions a scheduled, in-VPC Lambda that drains each Postgres DCB log via
+// PgChangeFeed and relays events to the plugin EventCollector SQS queue — which
+// fans out to read-model projections, aggregate command topics, and the
+// cross-plugin SNS EventTopic. The platform (D1, B2.3c) calls this with the set of
+// Postgres-backed DCB logs and points the EventCollector's event source at the
+// relay-fed queue.
+//
+// NOTE: EventBridge rate rules have a 1-minute floor, so v1 poll latency is
+// >= 1 minute. Sub-minute latency needs a self-invoking loop / EventBridge
+// Scheduler (follow-up) or the Fargate-LISTEN upgrade.
+
+// One Postgres-backed DCB log to relay.
+type relayLog = {
+  connectionConfig: Pulumi.Output.t<PgConnection.connectionConfig>,
+  /** dcb_event.log_name — also the DCB `event_log` discriminator. */
+  logName: string,
+  /** dcb_subscription checkpoint key for this relay. */
+  subscriber: string,
+  /** The DCB log's partition tag — sury-encoded into HANDLER_CONFIG so the relay
+      computes the same `id` (partition key) the DynamoDB-stream path would. */
+  partitionTag: Reventless.DcbTag.derivedPartitionTag,
+  /** Plugin EventCollector SQS queue this log's events are relayed to. */
+  targetQueueUrl: Pulumi.Output.t<string>,
+  targetQueueArn: Pulumi.Output.t<string>,
+}
+
+// ~securityGroupId: DB-access SG the relay Lambda attaches (PgConnection.securityGroupId).
+// ~subnetIds: private subnets for the relay Lambda (PgConnection.subnetIds).
+let make = (
+  ~name: string,
+  ~logs: array<relayLog>,
+  ~securityGroupId: Pulumi.Output.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~intervalMinutes: int=1,
+  ~opts=?,
+): array<ReventlessInfra.Adapter.resource> => {
+  open PulumiAws
+  let customOpts =
+    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  // HANDLER_CONFIG.logs[], serialized from the deploy-time-resolved Outputs.
+  let logJsonOutputs = logs->Array.map(l =>
+    (l.connectionConfig, l.targetQueueUrl)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((cc, queueUrl)) => {
+      let pgConnectionJson =
+        [
+          ("host", cc.host->JSON.Encode.string),
+          ("port", cc.port->Int.toFloat->JSON.Encode.float),
+          ("database", cc.database->JSON.Encode.string),
+          ("username", cc.username->JSON.Encode.string),
+          ("secretArn", cc.secretArn->JSON.Encode.string),
+        ]
+        ->Dict.fromArray
+        ->JSON.Encode.object
+      [
+        ("pgConnection", pgConnectionJson),
+        ("logName", l.logName->JSON.Encode.string),
+        ("subscriber", l.subscriber->JSON.Encode.string),
+        (
+          "partitionTag",
+          l.partitionTag->S.reverseConvertToJsonOrThrow(Reventless.DcbTag.derivedPartitionTagSchema),
+        ),
+        ("targetQueueUrl", queueUrl->JSON.Encode.string),
+      ]
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    })
+  )
+  let handlerConfigOutput =
+    Pulumi.Output.all(logJsonOutputs)->Pulumi.Output.apply(items =>
+      `{"logs":[${items->Array.join(",")}]}`
+    )
+
+  let envVars = Dict.fromArray([("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)])
+
+  let vpcConfig =
+    securityGroupId
+    ->Pulumi.Output.apply(sgId =>
+      (
+        {
+          Lambda.Function.subnetIds: subnetIds->Pulumi.Input.make,
+          securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+        }: Lambda.Function.vpcConfig
+      )
+    )
+    ->Pulumi.Output.asInput
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~vpcConfig,
+    ~opts?,
+  )
+
+  // IAM: GetSecretValue on each log's DB secret + SendMessage on each target queue.
+  let secretArns =
+    logs->Array.map(l => l.connectionConfig->Pulumi.Output.apply(cc => cc.secretArn))
+  let queueArns = logs->Array.map(l => l.targetQueueArn)
+  let _iam =
+    (Pulumi.Output.all(secretArns), Pulumi.Output.all(queueArns), runtime.parts.lambdaRole.id)
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((secretArns, queueArns, roleId)) => {
+      open PulumiAws.PolicyDocument
+      let _ = PulumiAws.IAM.RolePolicy.make(
+        ~name=`${name}RelayAccess`,
+        ~args={
+          policy: PulumiAws.PolicyDocument.make(
+            ~id=`${name}RelayAccessPolicy`,
+            ~statements=[
+              {
+                sid: "AllowGetSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resources(secretArns),
+              },
+              {
+                sid: "AllowSendSqs",
+                effect: Allow,
+                actions: Action("sqs:SendMessage"),
+                resources: Resources(queueArns),
+              },
+            ],
+          )
+          ->PulumiAws.PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: roleId->Pulumi.Input.make,
+        },
+      )
+    })
+
+  // Scheduled poll: EventRule (rate) → Permission → EventTarget.
+  let rule = {
+    open PulumiAws.Cloudwatch
+    EventRule.make(
+      ~name=`${Pulumi.Pulumi.getStackName()}-${name}`,
+      ~args={
+        description: "Poll Postgres DCB change feed and relay to EventCollector"->Pulumi.Input.make,
+        scheduleExpression: EventRule.ScheduleExpression.every(Minutes(intervalMinutes)),
+      },
+      ~opts=?customOpts,
+    )
+  }
+
+  let lambda = runtime.parts.lambda
+  let _wire =
+    (lambda->Pulumi.Output.flatMap(l => l.arn), lambda->Pulumi.Output.flatMap(l => l.name))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
+      let _permission = PulumiAws.Lambda.Permission.make(
+        ~name=`${name}SchedulePermission`,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: lambdaName->Pulumi.Input.make,
+          principal: AWS.CloudwatchEventRule.principal,
+        },
+        ~opts=?customOpts,
+      )
+      let _target = {
+        open PulumiAws.Cloudwatch
+        EventTarget.make(
+          ~name,
+          ~args={
+            rule: EventTarget.Rule.ofEventRule(rule),
+            arn: lambdaArn->Pulumi.Input.make,
+          },
+          ~opts=?customOpts,
+        )
+      }
+    })
+
+  [
+    lambda
+    ->Pulumi.Output.apply(l => l->Util_Lambda.toResource)
+    ->ReventlessCore.Adapter.outputToResource,
+    rule->Util_Cloudwatch.EventRule.toResource,
+  ]
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs

@@ -0,0 +1,141 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_Cloudwatch$ReventlessAws from "../../util/Util_Cloudwatch.res.mjs";
+import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
+import * as Cloudwatch_EventTarget$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventTarget.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts) {
+  let intervalMinutes = intervalMinutesOpt !== undefined ? intervalMinutesOpt : 1;
+  let customOpts = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs", {}, undefined);
+  let logJsonOutputs = logs.map(l => Pulumi.all([
+    l.connectionConfig,
+    l.targetQueueUrl
+  ]).apply(param => {
+    let cc = param[0];
+    let pgConnectionJson = Object.fromEntries([
+      [
+        "host",
+        cc.host
+      ],
+      [
+        "port",
+        cc.port
+      ],
+      [
+        "database",
+        cc.database
+      ],
+      [
+        "username",
+        cc.username
+      ],
+      [
+        "secretArn",
+        cc.secretArn
+      ]
+    ]);
+    return JSON.stringify(Object.fromEntries([
+      [
+        "pgConnection",
+        pgConnectionJson
+      ],
+      [
+        "logName",
+        l.logName
+      ],
+      [
+        "subscriber",
+        l.subscriber
+      ],
+      [
+        "partitionTag",
+        S.reverseConvertToJsonOrThrow(l.partitionTag, DcbTag$Reventless.derivedPartitionTagSchema)
+      ],
+      [
+        "targetQueueUrl",
+        param[1]
+      ]
+    ]));
+  }));
+  let handlerConfigOutput = Pulumi.all(logJsonOutputs).apply(items => `{"logs":[` + items.join(",") + `]}`);
+  let envVars = Object.fromEntries([[
+      "HANDLER_CONFIG",
+      handlerConfigOutput
+    ]]);
+  let vpcConfig = securityGroupId.apply(sgId => ({
+    subnetIds: subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, undefined, undefined, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  let secretArns = logs.map(l => l.connectionConfig.apply(cc => cc.secretArn));
+  let queueArns = logs.map(l => l.targetQueueArn);
+  Pulumi.all([
+    Pulumi.all(secretArns),
+    Pulumi.all(queueArns),
+    runtime.parts.lambdaRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + `RelayAccess`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `RelayAccessPolicy`, [
+        {
+          Sid: "AllowGetSecret",
+          Effect: "Allow",
+          Action: "secretsmanager:GetSecretValue",
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowSendSqs",
+          Effect: "Allow",
+          Action: "sqs:SendMessage",
+          Resource: param[1]
+        }
+      ])),
+      role: param[2]
+    });
+  });
+  let rule = new (Aws.cloudwatch.EventRule)(Pulumi.getStack() + `-` + name, {
+    description: "Poll Postgres DCB change feed and relay to EventCollector",
+    scheduleExpression: Primitive_option.some(Cloudwatch_EventRule$PulumiAws.ScheduleExpression.every({
+      TAG: "Minutes",
+      _0: intervalMinutes
+    }))
+  }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  let lambda = runtime.parts.lambda;
+  Pulumi.all([
+    Output$Pulumi.flatMap(lambda, l => l.arn),
+    Output$Pulumi.flatMap(lambda, l => l.name)
+  ]).apply(param => {
+    new (Aws.lambda.Permission)(name + `SchedulePermission`, {
+      action: "lambda:InvokeFunction",
+      function: param[1],
+      principal: AWS$ReventlessAws.CloudwatchEventRule.principal
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+    new (Aws.cloudwatch.EventTarget)(name, {
+      rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(rule),
+      arn: param[0]
+    }, customOpts !== undefined ? Primitive_option.valFromOption(customOpts) : undefined);
+  });
+  return [
+    Adapter$ReventlessCore.outputToResource(lambda.apply(l => Util_Lambda$ReventlessAws.toResource(undefined, l))),
+    Util_Cloudwatch$ReventlessAws.EventRule.toResource(rule)
+  ];
+}
+
+export {
+  make,
+}
+/* S Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -0,0 +1,72 @@
+// Postgres change-feed relay runtime (B2.2).
+//
+// Drains a Postgres DCB log via `PgChangeFeed` and pushes each event — transformed
+// into the `{id, meta, event}` shape the plugin EventCollector SQS handler
+// consumes — onto that queue. The plugin EventCollector (`AdminEventCollectorEntryPoint`)
+// then drives the full fan-out: read-model projections, aggregate command topics,
+// and the cross-plugin SNS EventTopic. See
+// docs/plans/aws-postgres-change-feed-bridge.md.
+//
+// The transform reuses the canonical DynamoDB shape producers
+// (`derivePartitionKey` + `buildJsonEvent'`) so the emitted body is byte-identical
+// to the DynamoDB-stream path — the SQS handler cannot tell the difference.
+
+/**
+ * Transform one feed event into the EventCollector JSON body. Rebuilds the same
+ * unmarshalled-item dict the DCB DynamoDB-stream decoder would see (id from the
+ * partition tag, position, event type, data, decomposed meta) and runs it through
+ * `buildJsonEvent'` — the exact decoder the SQS handler expects. Returns `None`
+ * for a malformed event (mirrors `buildJsonEvent'`).
+ */
+let toEventCollectorJson = (
+  event: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent,
+  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+): option<JSON.t> => {
+  let item = Dict.make()
+  item->Dict.set(
+    "id",
+    DcbEventLogStorage_DynamoDb_Runtime.derivePartitionKey(~partitionTag?, event.tags)
+    ->JSON.Encode.string,
+  )
+  item->Dict.set("position", event.position->JSON.Encode.string)
+  item->Dict.set("event", event.eventType->JSON.Encode.string)
+  item->Dict.set("data", event.data)
+  ReventlessCore.Message.decomposeMeta(event.meta)->Array.forEach(((key, value)) =>
+    item->Dict.set(key, value)
+  )
+  Util_DynamoDbStream_Runtime.buildJsonEvent'(item)
+}
+
+/**
+ * Drain a Postgres DCB log from its checkpoint and relay its events to the
+ * EventCollector via the injected `sendBatch`. `sendBatch` is injected (rather than
+ * hardcoding SQS) so the drain/transform is unit-testable; the relay entry point
+ * wires it to the actual `SendMessage`. Returns the number of events processed.
+ *
+ * At-least-once by construction: `PgChangeFeed.drain` replays the last page on a
+ * crash before checkpoint, and EventCollector projections are idempotent
+ * (event-sourced), so re-delivery is safe.
+ */
+let relay = async (
+  ~config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~subscriber: string,
+  // ~partitionTagJson: the DCB log's partition tag, sury-encoded into HANDLER_CONFIG
+  // by the relay builder (B2.3d). Parsed once via the shared derivedPartitionTagSchema
+  // so the `id` the relay emits matches the DynamoDB-stream path. Absent → None (a
+  // single-tag log derives the same id without it).
+  ~partitionTagJson: option<JSON.t>=?,
+  ~sendBatch: array<JSON.t> => promise<unit>,
+): int => {
+  let partitionTag =
+    partitionTagJson->Option.map(json =>
+      json->S.parseJsonOrThrow(Reventless.DcbTag.derivedPartitionTagSchema)
+    )
+  let pool = PgRuntime.poolFor(config)
+  await ReventlessPostgres.PgChangeFeed.drain(pool, ~logName, ~subscriber, ~handle=async events => {
+    let jsons = events->Array.filterMap(event => toEventCollectorJson(event, ~partitionTag?))
+    if jsons->Array.length > 0 {
+      await sendBatch(jsons)
+    }
+  })
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs

@@ -0,0 +1,40 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as PgRuntime$ReventlessAws from "./PgRuntime.res.mjs";
+import * as PgChangeFeed$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgChangeFeed.res.mjs";
+import * as Util_DynamoDbStream_Runtime$ReventlessAws from "../../util/Util_DynamoDbStream_Runtime.res.mjs";
+import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
+
+function toEventCollectorJson(event, partitionTag) {
+  let item = {};
+  item["id"] = DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.derivePartitionKey(partitionTag, event.tags);
+  item["position"] = event.position;
+  item["event"] = event.eventType;
+  item["data"] = event.data;
+  Message$ReventlessCore.decomposeMeta(event.meta).forEach(param => {
+    item[param[0]] = param[1];
+  });
+  return Util_DynamoDbStream_Runtime$ReventlessAws.buildJsonEvent$p(item);
+}
+
+async function relay(config, logName, subscriber, partitionTagJson, sendBatch) {
+  let partitionTag = Stdlib_Option.map(partitionTagJson, json => S.parseJsonOrThrow(json, DcbTag$Reventless.derivedPartitionTagSchema));
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return await PgChangeFeed$ReventlessPostgres.drain(pool, logName, subscriber, undefined, async events => {
+    let jsons = Stdlib_Array.filterMap(events, event => toEventCollectorJson(event, partitionTag));
+    if (jsons.length !== 0) {
+      return await sendBatch(jsons);
+    }
+  });
+}
+
+export {
+  toEventCollectorJson,
+  relay,
+}
+/* S Not a pure module */

package/src/adapter/Runtime/AggregateEntryPoint.mjs

@@ -12,6 +12,7 @@ import { Make as commandTopicCallbackMake } from "@reventlessdev/reventless-core
 import { makeGenerateCommand } from "@reventlessdev/reventless-core/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
 import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
 import { append, replay, replayStream, appendStream } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgEventLogOpsFor } from "@reventlessdev/reventless-aws/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs";
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import { DynamoDBClient, ScanCommand } from "@aws-sdk/client-dynamodb";
 import { unmarshall } from "@aws-sdk/util-dynamodb";
@@ -118,15 +119,32 @@ async function checkPluginStatus(event) {
 // Route 2 (SQS event source): the in-process command handler (used both as the
 // inline dispatch target and as the SQS message handler) plus the resolved
 // queue ref for the fire-and-forget async path.
-function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl) {
+// `pgConnection`, when present, is the resolved PgConnection.connectionConfig
+// ({host,port,database,username,secretArn}) serialized into HANDLER_CONFIG by the
+// runtime builder for a Postgres-backed aggregate. Its presence selects the
+// Postgres EventLog runtime; absence keeps the DynamoDB path byte-identical.
+// `eventLogTableName` doubles as the Postgres `event_log.log_name` discriminator
+// (all aggregates share one Postgres table, unlike DynamoDB's table-per-aggregate).
+function buildAggregateParts(specModule, behaviorModule, eventLogTableName, queueUrl, pgConnection) {
   const patchedSpec = patchSpecId(specModule);
-  const resolvedTable = { name: eventLogTableName };
-  const rawStorageOps = {
-    append: append(resolvedTable),
-    replay: replay(resolvedTable),
-    replayStream: replayStream(resolvedTable),
-    appendStream: appendStream(resolvedTable),
-  };
+  let rawStorageOps;
+  if (pgConnection) {
+    const pgOps = pgEventLogOpsFor(pgConnection, eventLogTableName);
+    rawStorageOps = {
+      append: pgOps.append,
+      replay: pgOps.replay,
+      replayStream: pgOps.replayStream,
+      appendStream: pgOps.appendStream,
+    };
+  } else {
+    const resolvedTable = { name: eventLogTableName };
+    rawStorageOps = {
+      append: append(resolvedTable),
+      replay: replay(resolvedTable),
+      replayStream: replayStream(resolvedTable),
+      appendStream: appendStream(resolvedTable),
+    };
+  }
   const eventLogOps = eventLogOperationsMake(patchedSpec)({
     Spec: patchedSpec,
     EventTopic: { Spec: patchedSpec },
@@ -246,7 +264,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const behaviorModule = await dynamicImport(h.behaviorModule);
-    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl);
+    const parts = buildAggregateParts(specModule, behaviorModule, h.eventLogTable, h.queueUrl, h.pgConnection);
     cmdTopicHandlers[h.queueArn] = parts.sqsHandler;
     cmdGenHandlers[specModule.name] = buildCommandGeneratorHandler(parts, DISPATCH_MODE);
   }));