@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.174

package/src/adapter/Runtime/AggregateRuntime_Builder_Micro.res.mjs

@@ -173,7 +173,7 @@ function finish() {
       cmdTopicEnvVars["HANDLER_CONFIG"] = cmdTopicHandlerConfigOutput;
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       let cmdTopicName = baseName + "CmdHandler";
-      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.commandTopicConnects.forEach(connect => connect(cmdTopicRuntime));
       if (spec.commandGeneratorConnects.length !== 0) {
         let cmdGenHandlerConfigOutput = Pulumi.all([
@@ -185,7 +185,7 @@ function finish() {
         cmdGenEnvVars["HANDLER_CONFIG"] = cmdGenHandlerConfigOutput;
         let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
         let cmdGenName = baseName + "CmdGen";
-        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
         spec.commandGeneratorConnects.forEach(connect => connect(cmdGenRuntime));
       }
       let match$2 = spec.eventCollectorChannelSpec;
@@ -208,7 +208,7 @@ function finish() {
       evtMapperPackageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
       let match$4 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventMapperEntryPoint.mjs", evtMapperPackageDirs, undefined);
       let evtMapperName = baseName + "EventMapper";
-      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, aggregateOpts);
+      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(evtMapperName, [match$2], evtMapperRuntime, aggregateOpts);
     });
   }

package/src/adapter/Runtime/AggregateRuntime_Builder_Micro_Async.res.mjs

@@ -173,7 +173,7 @@ function finish() {
       cmdTopicEnvVars["HANDLER_CONFIG"] = cmdTopicHandlerConfigOutput;
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       let cmdTopicName = baseName + "CmdHandler";
-      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+      let cmdTopicRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdTopicName, match.code, match.sourceCodeHash, cmdTopicEnvVars, Math.max(spec.commandTopicMemorySize, 1024), Math.max(spec.commandTopicTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.commandTopicConnects.forEach(connect => connect(cmdTopicRuntime));
       if (spec.commandGeneratorConnects.length !== 0) {
         let cmdGenHandlerConfigOutput = Pulumi.all([
@@ -186,7 +186,7 @@ function finish() {
         cmdGenEnvVars["DISPATCH_MODE"] = "async";
         let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
         let cmdGenName = baseName + "CmdGen";
-        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, aggregateOpts);
+        let cmdGenRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(cmdGenName, match$1.code, match$1.sourceCodeHash, cmdGenEnvVars, Math.max(spec.commandGeneratorMemorySize, 1024), Math.max(spec.commandGeneratorTimeout, 30), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
         spec.commandGeneratorConnects.forEach(connect => connect(cmdGenRuntime));
       }
       let match$2 = spec.eventCollectorChannelSpec;
@@ -209,7 +209,7 @@ function finish() {
       evtMapperPackageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
       let match$4 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventMapperEntryPoint.mjs", evtMapperPackageDirs, undefined);
       let evtMapperName = baseName + "EventMapper";
-      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, aggregateOpts);
+      let evtMapperRuntime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(evtMapperName, match$4.code, match$4.sourceCodeHash, evtMapperEnvVars, Math.max(spec.eventCollectorMemorySize, 2048), Math.max(spec.eventCollectorTimeout, 180), undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(evtMapperName, [match$2], evtMapperRuntime, aggregateOpts);
     });
   }

package/src/adapter/Runtime/AggregateRuntime_Builder_PerAggregate.res.mjs

@@ -152,7 +152,7 @@ function finish() {
       packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
       packageDirs[behaviorPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(behaviorPkg);
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(lambdaName, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, aggregateOpts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(lambdaName, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.connects.forEach(connect => connect(runtime));
       let channelSpecs = Stdlib_Option.mapOr(spec.eventCollectorChannelSpec, [], cs => [cs]);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(name, channelSpecs, runtime, aggregateOpts);

package/src/adapter/Runtime/AggregateRuntime_Builder_PerAggregate_Async.res.mjs

@@ -152,7 +152,7 @@ function finish() {
       packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
       packageDirs[behaviorPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(behaviorPkg);
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, aggregateOpts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, spec.memorySize, spec.timeout, undefined, undefined, undefined, undefined, undefined, aggregateOpts);
       spec.connects.forEach(connect => connect(runtime));
       let channelSpecs = Stdlib_Option.mapOr(spec.eventCollectorChannelSpec, [], cs => [cs]);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(name, channelSpecs, runtime, aggregateOpts);

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -187,7 +187,7 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, opts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
       let tableName$1 = pluginRmTableName.contents;
       if (tableName$1 !== undefined) {
         Pulumi.all([

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -174,7 +174,7 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Async$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, opts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
       specs.forEach(param => {
         param.connects.forEach(connect => connect(runtime));
       });

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -116,7 +116,7 @@ function finish() {
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AutomationSliceEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAutomationSlices", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, opts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAutomationSlices", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllAutomationSlices", channelSpecs, runtime, opts);
     } else {

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -22,6 +22,7 @@ import { makeGenerateCommand } from "@reventlessdev/reventless-core/src/componen
 import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
 import { json as jsonSchema } from "sury/src/S.res.mjs";
 import { read, append, readStream } from "@reventlessdev/reventless-aws/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgDcbEventLogOpsFor } from "@reventlessdev/reventless-aws/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs";
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -90,12 +91,25 @@ function getIdStringSchema() {
 // can drive the real `cmdGenHandler` end-to-end against DynamoDB Local.
 export async function buildHandlersForConfig(config, opts = {}) {
   const loadModule = opts.loadModule ?? dynamicImport;
-  const resolvedTable = { name: config.dcbEventLogTableName };
-  const rawStorageOps = {
-    read: read(resolvedTable),
-    append: append(resolvedTable),
-    readStream: readStream(resolvedTable),
-  };
+  // `pgConnection`, when present in HANDLER_CONFIG, selects the Postgres DCB
+  // runtime (dcbEventLogTableName doubles as the `dcb_event.log_name`); absence
+  // keeps the DynamoDB path byte-identical. NB: this swaps only the *storage*
+  // ops — event propagation (within-plugin projections + cross-plugin SNS) is
+  // stream-driven on AWS and is handled separately by the change-feed relay
+  // (see docs/plans/aws-postgres-change-feed-bridge.md), not by this Lambda.
+  const rawStorageOps = config.pgConnection
+    ? (() => {
+        const pgOps = pgDcbEventLogOpsFor(config.pgConnection, config.dcbEventLogTableName);
+        return { read: pgOps.read, append: pgOps.append, readStream: pgOps.readStream };
+      })()
+    : (() => {
+        const resolvedTable = { name: config.dcbEventLogTableName };
+        return {
+          read: read(resolvedTable),
+          append: append(resolvedTable),
+          readStream: readStream(resolvedTable),
+        };
+      })();
 
   const handlersByType = {};
   const sharedDcbEventLogOps = dcbEventLogOperationsMake({

package/src/adapter/Runtime/EventCollectorRuntime_Builder_PerEventCollector.res.mjs

@@ -61,7 +61,7 @@ function forEventCollector(param, eventTopics, resources, memorySizeOpt, timeout
   packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
   packageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs", packageDirs, undefined);
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts);
   EventCollectorChannel_DynamoDbStream$ReventlessAws.connect(name, [{
       channel: channel,
       eventTopics: eventTopics,

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res.mjs

@@ -108,7 +108,7 @@ function finish() {
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, opts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllReadModels", channelSpecs, runtime, opts);
     } else {

package/src/adapter/Runtime/ExtensionPointRuntime_Builder_PerExtensionPoint.res.mjs

@@ -39,7 +39,7 @@ function forCommandTopic(param, connect, memorySizeOpt, timeoutOpt, specModuleUr
   packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
   packageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ExtensionPointEntryPoint.mjs", packageDirs, undefined);
-  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts));
+  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
 }
 
 function finish() {

package/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs

@@ -0,0 +1,52 @@
+// PgChangeFeedRelay Lambda entry point (scheduled poll — B2.3).
+//
+// Triggered on a schedule (EventBridge rate rule). Each invocation drains every
+// Postgres DCB log listed in HANDLER_CONFIG from its checkpoint and relays the
+// events, transformed into the {id, meta, event} shape, onto the plugin
+// EventCollector SQS queue — which then fans out to projections, aggregate
+// command topics, and the cross-plugin SNS EventTopic.
+// See docs/plans/aws-postgres-change-feed-bridge.md.
+//
+// HANDLER_CONFIG shape:
+//   { "logs": [ { "pgConnection": {host,port,database,username,secretArn},
+//                 "logName": string,          // dcb_event.log_name
+//                 "subscriber": string,        // dcb_subscription checkpoint key
+//                 "targetQueueUrl": string,    // plugin EventCollector SQS URL
+//                 "partitionTag"?: <derivedPartitionTag> } ] }
+
+import { relay } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+import { sendMessage } from "@reventlessdev/reventless-aws/src/util/Util_SQS_Runtime.res.mjs";
+import { makeQueueRef, log } from "./HandlerFactoryHelpers.mjs";
+
+// Standard (non-FIFO) EventCollector queue — no message group id needed. The
+// SQS handler parses each body straight back to JSON (Util_SQS_Runtime.parseSqsRecord).
+function makeSendBatch(targetQueueUrl) {
+  const queue = makeQueueRef(targetQueueUrl);
+  return (jsons) =>
+    Promise.all(jsons.map((json) => sendMessage(queue, undefined, JSON.stringify(json)))).then(
+      () => {}
+    );
+}
+
+export async function handler(_event, _context) {
+  const configStr = process.env["HANDLER_CONFIG"] || '{"logs":[]}';
+  const config = JSON.parse(configStr);
+  const logs = config.logs || [];
+
+  await Promise.all(
+    logs.map(async (l) => {
+      const sendBatch = makeSendBatch(l.targetQueueUrl);
+      try {
+        const count = await relay(l.pgConnection, l.logName, l.subscriber, l.partitionTag, sendBatch);
+        log.debug("relayed " + count + " event(s) for " + l.logName, { comp: "PgChangeFeedRelay" });
+      } catch (err) {
+        // Log and continue — a failed log this tick is retried next tick from its
+        // unchanged checkpoint (at-least-once; projections are idempotent).
+        log.warn("relay failed for " + l.logName + ": " + (err?.message ?? String(err)), {
+          comp: "PgChangeFeedRelay",
+        });
+      }
+    })
+  );
+  return "";
+}

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -78,6 +78,11 @@ let makeFromCodeAsset: (
       Lambda's log group (command-handler Lambdas only). Requires a managed log
       group, so it only takes effect when `~logRetentionDays` is also set. */
   ~dcbMetrics: bool=?,
+  /** Place the Lambda in a VPC (needed to reach RDS/managed Postgres). When set,
+      the execution role also gets the EC2 network-interface permissions AWS
+      requires for VPC Lambdas. Build it from `PgConnection.{securityGroupId,
+      subnetIds}`. */
+  ~vpcConfig: Pulumi.Input.t<PulumiAws.Lambda.Function.vpcConfig>=?,
   ~opts: Pulumi.ComponentResource.options=?,
 ) => ReventlessCore.Runtime.environment<parts> = (
   ~name,
@@ -90,6 +95,7 @@ let makeFromCodeAsset: (
   ~ephemeralStorageMb=?,
   ~logRetentionDays=?,
   ~dcbMetrics=false,
+  ~vpcConfig=?,
   ~opts=?,
 ) => {
   open PulumiAws
@@ -102,6 +108,37 @@ let makeFromCodeAsset: (
     ~opts?,
   )
 
+  // VPC Lambdas must be able to manage ENIs in the target subnets. Attach the
+  // standard EC2 network-interface permissions (resource "*", as ENIs have no
+  // predictable ARN) whenever the function is VPC-placed.
+  vpcConfig->Option.forEach(_ => {
+    let _ = PulumiAws.IAM.RolePolicy.make(
+      ~name=`${name}VpcAccess`,
+      ~args={
+        policy: PolicyDocument.make(
+          ~id=`${name}VpcAccessPolicy`,
+          ~statements=[
+            {
+              sid: "AllowVpcEni",
+              effect: Allow,
+              actions: Actions([
+                "ec2:CreateNetworkInterface",
+                "ec2:DescribeNetworkInterfaces",
+                "ec2:DeleteNetworkInterface",
+                "ec2:AssignPrivateIpAddresses",
+                "ec2:UnassignPrivateIpAddresses",
+              ]),
+              resources: Resource("*"),
+            },
+          ],
+        )
+        ->PolicyDocument.toJsonString
+        ->Pulumi.Input.make,
+        role: lambdaRole.id->Pulumi.Output.asInput,
+      },
+    )
+  })
+
   // Create additional IAM policies registered by consumers.
   additionalIamPolicies->Array.forEach(({suffix, actions, resourceArn}) => {
     let _ = resourceArn->Pulumi.Output.apply(arn => {
@@ -160,6 +197,7 @@ let makeFromCodeAsset: (
       ),
       layers,
       tags,
+      vpcConfig: ?vpcConfig,
       environment: ({Lambda.Function.variables: variables}: Lambda.Function.functionEnvironment)
         ->Pulumi.Input.make,
     },

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -41,13 +41,30 @@ function make(name, handler, memorySizeOpt, timeoutOpt, opts) {
   };
 }
 
-function makeFromCodeAsset(name, code, sourceCodeHash, envVarsOpt, memorySizeOpt, timeoutOpt, reservedConcurrency, ephemeralStorageMb, logRetentionDays, dcbMetricsOpt, opts) {
+function makeFromCodeAsset(name, code, sourceCodeHash, envVarsOpt, memorySizeOpt, timeoutOpt, reservedConcurrency, ephemeralStorageMb, logRetentionDays, dcbMetricsOpt, vpcConfig, opts) {
   let envVars = envVarsOpt !== undefined ? envVarsOpt : ({});
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : Runtime$ReventlessCore.CommandHandlerDefaults.memorySize;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : Runtime$ReventlessCore.CommandHandlerDefaults.timeout;
   let dcbMetrics = dcbMetricsOpt !== undefined ? dcbMetricsOpt : false;
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), opts$1);
+  Stdlib_Option.forEach(vpcConfig, param => {
+    new (Aws.iam.RolePolicy)(name + `VpcAccess`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `VpcAccessPolicy`, [{
+          Sid: "AllowVpcEni",
+          Effect: "Allow",
+          Action: [
+            "ec2:CreateNetworkInterface",
+            "ec2:DescribeNetworkInterfaces",
+            "ec2:DeleteNetworkInterface",
+            "ec2:AssignPrivateIpAddresses",
+            "ec2:UnassignPrivateIpAddresses"
+          ],
+          Resource: "*"
+        }])),
+      role: lambdaRole.id
+    });
+  });
   additionalIamPolicies.forEach(param => {
     let actions = param.actions;
     let suffix = param.suffix;
@@ -91,7 +108,8 @@ function makeFromCodeAsset(name, code, sourceCodeHash, envVarsOpt, memorySizeOpt
     reservedConcurrentExecutions: Stdlib_Option.map(reservedConcurrency, prim => prim),
     ephemeralStorage: Stdlib_Option.map(ephemeralStorageMb, mb => ({
       size: mb
-    }))
+    })),
+    vpcConfig: vpcConfig
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   Stdlib_Option.forEach(logRetentionDays, days => {
     let logGroup = new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {

package/src/adapter/Runtime/SideEffectHandlerRuntime_Builder_Single.res.mjs

@@ -100,7 +100,7 @@ function finish() {
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/SideEffectEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllSideEffectHandlers", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, opts);
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllSideEffectHandlers", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllSideEffectHandlers", channelSpecs, runtime, opts);
     } else {

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -43,9 +43,16 @@ let forDcbCommandTopic = (
     let channelParts: Util.SQS.channelParts = Obj.magic(channel.parts)
     let queue = channelParts.queue
 
-    let dcbTableName = switch dcbTableName {
-    | Some(tableName) => tableName
-    | None => Pulumi.Output.make("NOT_AVAILABLE")
+    // B2.3c: on a Postgres-backed platform there is no DynamoDB table — DCB events
+    // live in `dcb_event` under the canonical log_name `<plugin>DcbEventLog`
+    // (= ComponentType.name(_, DcbEventLog), the same string the deploy-time
+    // storage + the change-feed relay use). The DcbCommandTopicEntryPoint Postgres
+    // branch reads `dcbEventLogTableName` as that log_name.
+    let pgSelection = DcbBackend.get()
+    let dcbTableName = switch (pgSelection, dcbTableName) {
+    | (Some(_), _) => Pulumi.Output.make(pluginName ++ "DcbEventLog")
+    | (None, Some(tableName)) => tableName
+    | (None, None) => Pulumi.Output.make("NOT_AVAILABLE")
     }
 
     // The async DCB CommandTopic is named `<Plugin>DcbAsync` by Dcb_Builder, so the
@@ -83,11 +90,33 @@ let forDcbCommandTopic = (
       })
       ->Array.join(",")
 
+    // B2.3c: on Postgres, add a `pgConnection` object so the entry point selects the
+    // Postgres DCB runtime (absent → DynamoDB path, unchanged). Built as a JSON
+    // fragment merged into HANDLER_CONFIG below.
+    let pgConnectionFragment = switch pgSelection {
+    | Some(sel) =>
+      sel.connectionConfig->Pulumi.Output.apply(cc => {
+        let pgConnectionJson =
+          [
+            ("host", cc.host->JSON.Encode.string),
+            ("port", cc.port->Int.toFloat->JSON.Encode.float),
+            ("database", cc.database->JSON.Encode.string),
+            ("username", cc.username->JSON.Encode.string),
+            ("secretArn", cc.secretArn->JSON.Encode.string),
+          ]
+          ->Dict.fromArray
+          ->JSON.Encode.object
+          ->JSON.stringify
+        `,"pgConnection":${pgConnectionJson}`
+      })
+    | None => Pulumi.Output.make("")
+    }
+
     let handlerConfigJson =
-      Pulumi.Output.all2((dcbTableName, queue.id))
-      ->Pulumi.Output.apply(((table, queueUrl)) => {
+      Pulumi.Output.all3((dcbTableName, queue.id, pgConnectionFragment))
+      ->Pulumi.Output.apply(((table, queueUrl, pgFragment)) => {
         let pluginNameJson = pluginName->JSON.stringifyAny->Option.getOr(`""`)
-        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]}`
+        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]${pgFragment}}`
       })
     envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
 
@@ -120,6 +149,26 @@ let forDcbCommandTopic = (
 
     cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.SQS.setBatchSize)
 
+    // B2.3c: Postgres-backed DCB → the command Lambda talks to RDS, so it must land
+    // in-VPC on the DB-access security group + private subnets. makeFromCodeAsset
+    // adds the EC2-ENI IAM automatically when vpcConfig is present (C1).
+    let vpcConfig = switch pgSelection {
+    | Some(sel) =>
+      Some(
+        sel.securityGroupId
+        ->Pulumi.Output.apply(sgId =>
+          (
+            {
+              PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+              securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+            }: PulumiAws.Lambda.Function.vpcConfig
+          )
+        )
+        ->Pulumi.Output.asInput,
+      )
+    | None => None
+    }
+
     let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
       ~name,
       ~code,
@@ -130,12 +179,41 @@ let forDcbCommandTopic = (
       ~reservedConcurrency=?cfg.reservedConcurrency,
       ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
       ~logRetentionDays=?cfg.logRetentionDays,
+      ~vpcConfig=?vpcConfig,
       // This is the StateChangeSlice command handler — provision the DCB
       // retry/conflict metric filters (takes effect when logRetentionDays is set).
       ~dcbMetrics=true,
       ~opts,
     )
 
+    // B2.3c: grant the Postgres command Lambda read access to the RDS-managed
+    // master secret so PgRuntime can resolve the DB password at cold start.
+    switch pgSelection {
+    | Some(sel) =>
+      let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+        PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-pgSecret`,
+          ~args={
+            policy: PulumiAws.PolicyDocument.make(
+              ~id=`${name}-pgSecretPolicy`,
+              ~statements=[
+                {
+                  sid: "AllowGetPgSecret",
+                  effect: Allow,
+                  actions: Action("secretsmanager:GetSecretValue"),
+                  resources: Resource(cc.secretArn),
+                },
+              ],
+            )
+            ->PulumiAws.PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
+        )
+      })
+    | None => ()
+    }
+
     // The DCB command topic Lambda is invoked directly by AppSync (Route 1) and
     // needs sqs:SendMessage to publish commands to the FIFO queue for processing.
     // makeWithDefaultPolicy only grants sqs:Receive* (for SQS trigger Route 2).

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS.res.mjs";
@@ -26,7 +27,10 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
   let channel = dcbCommandTopic.channel;
   let channelParts = channel.parts;
   let queue = channelParts.queue;
-  let dcbTableName$1 = dcbTableName !== undefined ? dcbTableName : Pulumi.output("NOT_AVAILABLE");
+  let pgSelection = DcbBackend$ReventlessAws.get();
+  let dcbTableName$1 = pgSelection !== undefined ? Pulumi.output(pluginName + "DcbEventLog") : (
+      dcbTableName !== undefined ? dcbTableName : Pulumi.output("NOT_AVAILABLE")
+    );
   let isAsync = baseName.endsWith("Async");
   let name = baseName + "CmdHandler";
   let cfg = isAsync ? asyncConfig : syncConfig;
@@ -47,12 +51,38 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
     let b = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
     return `{"spec":` + s + `,"behavior":` + b + `}`;
   }).join(",");
+  let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+      let pgConnectionJson = JSON.stringify(Object.fromEntries([
+        [
+          "host",
+          cc.host
+        ],
+        [
+          "port",
+          cc.port
+        ],
+        [
+          "database",
+          cc.database
+        ],
+        [
+          "username",
+          cc.username
+        ],
+        [
+          "secretArn",
+          cc.secretArn
+        ]
+      ]));
+      return `,"pgConnection":` + pgConnectionJson;
+    }) : Pulumi.output("");
   let handlerConfigJson = Pulumi.all([
     dcbTableName$1,
-    queue.id
+    queue.id,
+    pgConnectionFragment
   ]).apply(param => {
     let pluginNameJson = Stdlib_Option.getOr(JSON.stringify(pluginName), `""`);
-    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]}`;
+    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]` + param[2] + `}`;
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
   let packageDirs = {};
@@ -66,7 +96,22 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-core");
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs", packageDirs, undefined);
   Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS$ReventlessAws.setBatchSize);
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, true, opts);
+  let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+      subnetIds: pgSelection.subnetIds,
+      securityGroupIds: [sgId]
+    })) : undefined;
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, true, vpcConfig, opts);
+  if (pgSelection !== undefined) {
+    pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)(name + `-pgSecret`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-pgSecretPolicy`, [{
+          Sid: "AllowGetPgSecret",
+          Effect: "Allow",
+          Action: "secretsmanager:GetSecretValue",
+          Resource: cc.secretArn
+        }])),
+      role: runtime.parts.lambdaRole.id
+    }));
+  }
   queue.arn.apply(queueArn => new (Aws.iam.RolePolicy)(name + `-sqsSend`, {
     policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-sqsSendPolicy`, [{
         Sid: "AllowSqsSend",

package/src/adapter/Runtime/StateViewSliceRuntime_Builder_Single.res.mjs

@@ -117,7 +117,7 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, memorySi
   packageDirs["@reventlessdev/reventless-aws"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-aws");
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-core");
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/StateViewSliceEntryPoint.mjs", packageDirs, undefined);
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllStateViewSlices", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllStateViewSlices", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts);
   EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllStateViewSlices", channelSpecs, runtime, opts);
 }
 

package/src/adapter/Runtime/TaskRuntime_Builder_PerBucket.res.mjs

@@ -29,7 +29,7 @@ function forBucketCallback(param, connect, memorySizeOpt, timeoutOpt, name, call
   let pkg = Util_Bundle$ReventlessAws.extractPackageName(callbackModulePath);
   packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(pkg);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/TaskBucketEntryPoint.mjs", packageDirs, undefined);
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(fullName, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, {
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(fullName, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, {
     parent: resource
   });
   if (schedulerConfig !== undefined) {