@reventlessdev/reventless-aws 3.0.0-alpha.173 → 3.0.0-alpha.175

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs

@@ -1,11 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S from "sury/src/S.res.mjs";
 import * as Aws from "@pulumi/aws";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
@@ -60,6 +62,10 @@ function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts)
         "subscriber",
         l.subscriber
       ],
+      [
+        "partitionTag",
+        S.reverseConvertToJsonOrThrow(l.partitionTag, DcbTag$Reventless.derivedPartitionTagSchema)
+      ],
       [
         "targetQueueUrl",
         param[1]
@@ -132,4 +138,4 @@ function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts)
 export {
   make,
 }
-/* @pulumi/aws Not a pure module */
+/* S Not a pure module */

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -38,23 +38,32 @@ let toEventCollectorJson = (
 }
 
 /**
- * Drain a Postgres DCB log from its checkpoint and relay its events to the
- * EventCollector via the injected `sendBatch`. `sendBatch` is injected (rather than
- * hardcoding SQS) so the drain/transform is unit-testable; the relay entry point
- * wires it to the actual `SendMessage`. Returns the number of events processed.
+ * Drain a Postgres DCB log from its checkpoint on the given `pool` and relay its
+ * events to the EventCollector via the injected `sendBatch`. Both `pool` and
+ * `sendBatch` are injected (rather than hardcoding Secrets Manager / SQS) so the
+ * whole drain→transform→send path is integration-testable against a plain local
+ * Postgres (B2.4); the `relay` wrapper below builds the container pool for the
+ * deployed Lambda. Returns the number of events processed.
  *
  * At-least-once by construction: `PgChangeFeed.drain` replays the last page on a
  * crash before checkpoint, and EventCollector projections are idempotent
  * (event-sourced), so re-delivery is safe.
  */
-let relay = async (
-  ~config: PgConnection.connectionConfig,
+let relayWithPool = async (
+  ~pool: ReventlessPostgres.PgDriver.pool,
   ~logName: string,
   ~subscriber: string,
-  ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
+  // ~partitionTagJson: the DCB log's partition tag, sury-encoded into HANDLER_CONFIG
+  // by the relay builder (B2.3d). Parsed once via the shared derivedPartitionTagSchema
+  // so the `id` the relay emits matches the DynamoDB-stream path. Absent → None (a
+  // single-tag log derives the same id without it).
+  ~partitionTagJson: option<JSON.t>=?,
   ~sendBatch: array<JSON.t> => promise<unit>,
 ): int => {
-  let pool = PgRuntime.poolFor(config)
+  let partitionTag =
+    partitionTagJson->Option.map(json =>
+      json->S.parseJsonOrThrow(Reventless.DcbTag.derivedPartitionTagSchema)
+    )
   await ReventlessPostgres.PgChangeFeed.drain(pool, ~logName, ~subscriber, ~handle=async events => {
     let jsons = events->Array.filterMap(event => toEventCollectorJson(event, ~partitionTag?))
     if jsons->Array.length > 0 {
@@ -62,3 +71,19 @@ let relay = async (
     }
   })
 }
+
+/**
+ * Deployed-Lambda entry: resolve the container-lifetime pool from the injected
+ * `PgConnection.connectionConfig` (via Secrets Manager) and relay. Thin wrapper over
+ * `relayWithPool`.
+ */
+let relay = async (
+  ~config: PgConnection.connectionConfig,
+  ~logName: string,
+  ~subscriber: string,
+  ~partitionTagJson: option<JSON.t>=?,
+  ~sendBatch: array<JSON.t> => promise<unit>,
+): int => {
+  let pool = PgRuntime.poolFor(config)
+  await relayWithPool(~pool, ~logName, ~subscriber, ~partitionTagJson?, ~sendBatch)
+}

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs

@@ -1,6 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S from "sury/src/S.res.mjs";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as PgRuntime$ReventlessAws from "./PgRuntime.res.mjs";
 import * as PgChangeFeed$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgChangeFeed.res.mjs";
@@ -19,8 +22,8 @@ function toEventCollectorJson(event, partitionTag) {
   return Util_DynamoDbStream_Runtime$ReventlessAws.buildJsonEvent$p(item);
 }
 
-async function relay(config, logName, subscriber, partitionTag, sendBatch) {
-  let pool = PgRuntime$ReventlessAws.poolFor(config);
+async function relayWithPool(pool, logName, subscriber, partitionTagJson, sendBatch) {
+  let partitionTag = Stdlib_Option.map(partitionTagJson, json => S.parseJsonOrThrow(json, DcbTag$Reventless.derivedPartitionTagSchema));
   return await PgChangeFeed$ReventlessPostgres.drain(pool, logName, subscriber, undefined, async events => {
     let jsons = Stdlib_Array.filterMap(events, event => toEventCollectorJson(event, partitionTag));
     if (jsons.length !== 0) {
@@ -29,8 +32,14 @@ async function relay(config, logName, subscriber, partitionTag, sendBatch) {
   });
 }
 
+async function relay(config, logName, subscriber, partitionTagJson, sendBatch) {
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return await relayWithPool(pool, logName, subscriber, partitionTagJson, sendBatch);
+}
+
 export {
   toEventCollectorJson,
+  relayWithPool,
   relay,
 }
-/* Message-ReventlessCore Not a pure module */
+/* S Not a pure module */

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -43,9 +43,16 @@ let forDcbCommandTopic = (
     let channelParts: Util.SQS.channelParts = Obj.magic(channel.parts)
     let queue = channelParts.queue
 
-    let dcbTableName = switch dcbTableName {
-    | Some(tableName) => tableName
-    | None => Pulumi.Output.make("NOT_AVAILABLE")
+    // B2.3c: on a Postgres-backed platform there is no DynamoDB table — DCB events
+    // live in `dcb_event` under the canonical log_name `<plugin>DcbEventLog`
+    // (= ComponentType.name(_, DcbEventLog), the same string the deploy-time
+    // storage + the change-feed relay use). The DcbCommandTopicEntryPoint Postgres
+    // branch reads `dcbEventLogTableName` as that log_name.
+    let pgSelection = DcbBackend.get()
+    let dcbTableName = switch (pgSelection, dcbTableName) {
+    | (Some(_), _) => Pulumi.Output.make(pluginName ++ "DcbEventLog")
+    | (None, Some(tableName)) => tableName
+    | (None, None) => Pulumi.Output.make("NOT_AVAILABLE")
     }
 
     // The async DCB CommandTopic is named `<Plugin>DcbAsync` by Dcb_Builder, so the
@@ -83,11 +90,33 @@ let forDcbCommandTopic = (
       })
       ->Array.join(",")
 
+    // B2.3c: on Postgres, add a `pgConnection` object so the entry point selects the
+    // Postgres DCB runtime (absent → DynamoDB path, unchanged). Built as a JSON
+    // fragment merged into HANDLER_CONFIG below.
+    let pgConnectionFragment = switch pgSelection {
+    | Some(sel) =>
+      sel.connectionConfig->Pulumi.Output.apply(cc => {
+        let pgConnectionJson =
+          [
+            ("host", cc.host->JSON.Encode.string),
+            ("port", cc.port->Int.toFloat->JSON.Encode.float),
+            ("database", cc.database->JSON.Encode.string),
+            ("username", cc.username->JSON.Encode.string),
+            ("secretArn", cc.secretArn->JSON.Encode.string),
+          ]
+          ->Dict.fromArray
+          ->JSON.Encode.object
+          ->JSON.stringify
+        `,"pgConnection":${pgConnectionJson}`
+      })
+    | None => Pulumi.Output.make("")
+    }
+
     let handlerConfigJson =
-      Pulumi.Output.all2((dcbTableName, queue.id))
-      ->Pulumi.Output.apply(((table, queueUrl)) => {
+      Pulumi.Output.all3((dcbTableName, queue.id, pgConnectionFragment))
+      ->Pulumi.Output.apply(((table, queueUrl, pgFragment)) => {
         let pluginNameJson = pluginName->JSON.stringifyAny->Option.getOr(`""`)
-        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]}`
+        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]${pgFragment}}`
       })
     envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
 
@@ -120,6 +149,26 @@ let forDcbCommandTopic = (
 
     cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.SQS.setBatchSize)
 
+    // B2.3c: Postgres-backed DCB → the command Lambda talks to RDS, so it must land
+    // in-VPC on the DB-access security group + private subnets. makeFromCodeAsset
+    // adds the EC2-ENI IAM automatically when vpcConfig is present (C1).
+    let vpcConfig = switch pgSelection {
+    | Some(sel) =>
+      Some(
+        sel.securityGroupId
+        ->Pulumi.Output.apply(sgId =>
+          (
+            {
+              PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+              securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+            }: PulumiAws.Lambda.Function.vpcConfig
+          )
+        )
+        ->Pulumi.Output.asInput,
+      )
+    | None => None
+    }
+
     let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
       ~name,
       ~code,
@@ -130,12 +179,41 @@ let forDcbCommandTopic = (
       ~reservedConcurrency=?cfg.reservedConcurrency,
       ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
       ~logRetentionDays=?cfg.logRetentionDays,
+      ~vpcConfig=?vpcConfig,
       // This is the StateChangeSlice command handler — provision the DCB
       // retry/conflict metric filters (takes effect when logRetentionDays is set).
       ~dcbMetrics=true,
       ~opts,
     )
 
+    // B2.3c: grant the Postgres command Lambda read access to the RDS-managed
+    // master secret so PgRuntime can resolve the DB password at cold start.
+    switch pgSelection {
+    | Some(sel) =>
+      let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+        PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-pgSecret`,
+          ~args={
+            policy: PulumiAws.PolicyDocument.make(
+              ~id=`${name}-pgSecretPolicy`,
+              ~statements=[
+                {
+                  sid: "AllowGetPgSecret",
+                  effect: Allow,
+                  actions: Action("secretsmanager:GetSecretValue"),
+                  resources: Resource(cc.secretArn),
+                },
+              ],
+            )
+            ->PulumiAws.PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
+        )
+      })
+    | None => ()
+    }
+
     // The DCB command topic Lambda is invoked directly by AppSync (Route 1) and
     // needs sqs:SendMessage to publish commands to the FIFO queue for processing.
     // makeWithDefaultPolicy only grants sqs:Receive* (for SQS trigger Route 2).

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS.res.mjs";
@@ -26,7 +27,10 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
   let channel = dcbCommandTopic.channel;
   let channelParts = channel.parts;
   let queue = channelParts.queue;
-  let dcbTableName$1 = dcbTableName !== undefined ? dcbTableName : Pulumi.output("NOT_AVAILABLE");
+  let pgSelection = DcbBackend$ReventlessAws.get();
+  let dcbTableName$1 = pgSelection !== undefined ? Pulumi.output(pluginName + "DcbEventLog") : (
+      dcbTableName !== undefined ? dcbTableName : Pulumi.output("NOT_AVAILABLE")
+    );
   let isAsync = baseName.endsWith("Async");
   let name = baseName + "CmdHandler";
   let cfg = isAsync ? asyncConfig : syncConfig;
@@ -47,12 +51,38 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
     let b = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
     return `{"spec":` + s + `,"behavior":` + b + `}`;
   }).join(",");
+  let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+      let pgConnectionJson = JSON.stringify(Object.fromEntries([
+        [
+          "host",
+          cc.host
+        ],
+        [
+          "port",
+          cc.port
+        ],
+        [
+          "database",
+          cc.database
+        ],
+        [
+          "username",
+          cc.username
+        ],
+        [
+          "secretArn",
+          cc.secretArn
+        ]
+      ]));
+      return `,"pgConnection":` + pgConnectionJson;
+    }) : Pulumi.output("");
   let handlerConfigJson = Pulumi.all([
     dcbTableName$1,
-    queue.id
+    queue.id,
+    pgConnectionFragment
   ]).apply(param => {
     let pluginNameJson = Stdlib_Option.getOr(JSON.stringify(pluginName), `""`);
-    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]}`;
+    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]` + param[2] + `}`;
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
   let packageDirs = {};
@@ -66,7 +96,22 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-core");
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs", packageDirs, undefined);
   Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS$ReventlessAws.setBatchSize);
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, true, undefined, opts);
+  let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+      subnetIds: pgSelection.subnetIds,
+      securityGroupIds: [sgId]
+    })) : undefined;
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, true, vpcConfig, opts);
+  if (pgSelection !== undefined) {
+    pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)(name + `-pgSecret`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-pgSecretPolicy`, [{
+          Sid: "AllowGetPgSecret",
+          Effect: "Allow",
+          Action: "secretsmanager:GetSecretValue",
+          Resource: cc.secretArn
+        }])),
+      role: runtime.parts.lambdaRole.id
+    }));
+  }
   queue.arn.apply(queueArn => new (Aws.iam.RolePolicy)(name + `-sqsSend`, {
     policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-sqsSendPolicy`, [{
         Sid: "AllowSqsSend",

package/src/components/Api/AppSync_Adapter.res

@@ -268,7 +268,7 @@ let getClient = () =>
 // belong to — effectively blocking the field at the API layer.
 //
 // ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
-// A field flagged `iamCallable` (via `mutationSchemaEntry`/`querySchemaEntry`)
+// A field flagged `systemCallable` (via `mutationSchemaEntry`/`querySchemaEntry`)
 // must be reachable by BOTH the console UI (Cognito) and a deploy-time system
 // caller signing SigV4 with ambient AWS credentials (`Util_AppSync_Caller`,
 // the AWS_IAM additional auth provider). `@aws_auth(...)` is the single-mode
@@ -328,7 +328,7 @@ let injectAwsAuth = (
 
   let mutationAuthMap: Dict.t<array<string>> = Dict.make()
   mutationEntries->Array.forEach(entry => {
-    if entry.iamCallable->Option.getOr(false) {
+    if entry.systemCallable->Option.getOr(false) {
       entry.fieldNames->Array.forEach(fieldName => iamFields->Dict.set(fieldName, true))
     }
     switch entry.authorization {
@@ -356,7 +356,7 @@ let injectAwsAuth = (
   // Spec-level `permission` takes precedence over the legacy authorization.
   let queryAuthMap: Dict.t<array<string>> = Dict.make()
   queryEntries->Array.forEach(entry => {
-    if entry.iamCallable->Option.getOr(false) {
+    if entry.systemCallable->Option.getOr(false) {
       iamFields->Dict.set(entry.singleFieldName, true)
       iamFields->Dict.set(entry.listFieldName, true)
     }

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -220,7 +220,7 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let iamFields = {};
   let mutationAuthMap = {};
   mutationEntries.forEach(entry => {
-    if (Stdlib_Option.getOr(entry.iamCallable, false)) {
+    if (Stdlib_Option.getOr(entry.systemCallable, false)) {
       entry.fieldNames.forEach(fieldName => {
         iamFields[fieldName] = true;
       });
@@ -249,7 +249,7 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   });
   let queryAuthMap = {};
   queryEntries.forEach(entry => {
-    if (Stdlib_Option.getOr(entry.iamCallable, false)) {
+    if (Stdlib_Option.getOr(entry.systemCallable, false)) {
       iamFields[entry.singleFieldName] = true;
       iamFields[entry.listFieldName] = true;
     }

package/src/components/Plugin.res

@@ -21,7 +21,7 @@ module Make = (HooksConfig: ReventlessCore.Plugin_Helpers.HooksConfig) => {
     CommandTopicRemoteChannel.SQS,
     HeartbeatRunner.CloudwatchEvents,
     PluginRuntime_Builder.Make(EventCollectorChannel),
-    DcbEventLogStorage.DynamoDb,
+    DcbEventLogStorage.Selectable,
     EventTopicPublisher.DynamoDbStream,
     CommandTopicChannel.SQS_Sync,
     CommandTopicChannel.SQS_Async,

package/src/components/Plugin.res.mjs

@@ -4,13 +4,13 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as AppSync_Adapter$ReventlessAws from "./Api/AppSync_Adapter.res.mjs";
 import * as Plugin_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Builder.res.mjs";
+import * as DcbEventLogStorage$ReventlessAws from "../adapter/DcbEventLog/DcbEventLogStorage.res.mjs";
 import * as Util_ResourceNaming$ReventlessAws from "../util/Util_ResourceNaming.res.mjs";
 import * as QueryEngine_DynamoDb$ReventlessAws from "../adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as PluginRuntimeOperations$ReventlessAws from "../plugin/runtime/PluginRuntimeOperations.res.mjs";
 import * as EventCollectorChannel_SQS$ReventlessAws from "../adapter/EventCollector/EventCollectorChannel_SQS.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
-import * as DcbEventLogStorage_DynamoDb$ReventlessAws from "../adapter/DcbEventLog/DcbEventLogStorage_DynamoDb.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "../adapter/CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../adapter/CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
 import * as CommandTopicRemoteChannel_SQS$ReventlessAws from "../adapter/CommandTopic/CommandTopicRemoteChannel_SQS.res.mjs";
@@ -44,7 +44,7 @@ function Make(HooksConfig) {
   })(CommandTopicRemoteChannel_SQS$ReventlessAws)(HeartbeatRunner_CloudWatchEvents$ReventlessAws)(PluginRuntime_Builder$ReventlessAws.Make({
     make: EventCollectorChannel_SQS$ReventlessAws.make,
     connect: EventCollectorChannel_SQS$ReventlessAws.connect
-  }))(DcbEventLogStorage_DynamoDb$ReventlessAws)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
+  }))(DcbEventLogStorage$ReventlessAws.Selectable)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
     make: CommandTopicChannel_SQS_Sync$ReventlessAws.make
   })({
     make: CommandTopicChannel_SQS_Async$ReventlessAws.make

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -196,6 +196,26 @@ module Make = (
     let channelParts: Util.SQS.channelParts = Obj.magic(channel.parts)
     let queue = channelParts.queue
 
+    // B2.3d: if this plugin's DCB log is Postgres-backed, hand its EventCollector
+    // SQS queue to the change-feed relay registry. `resource.name` is the plugin
+    // component name (`<plugin>Plugin`), so the canonical log_name is
+    // `<plugin>DcbEventLog` — the key DcbEventLogStorage_Postgres registered under.
+    if DcbBackend.isPostgres() {
+      switch resource.name {
+      | Some(compName) =>
+        let pluginName =
+          compName->String.endsWith("Plugin")
+            ? compName->String.slice(~start=0, ~end=compName->String.length - 6)
+            : compName
+        DcbBackend.attachCollectorQueue(
+          ~logName=pluginName ++ "DcbEventLog",
+          ~url=queue.id,
+          ~arn=queue.arn,
+        )
+      | None => ()
+      }
+    }
+
     // Pull the per-EventCollector context registered by Plugin_Helpers.connect
     // (plugins) or synthesise an admin one if none registered.
     let context: ReventlessCore.Plugin_Helpers.eventCollectorContext =

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -7,6 +7,7 @@ import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../../adapter/DcbEventLog/DcbBackend.res.mjs";
 import * as Heartbeat$ReventlessCore from "@reventlessdev/reventless-core/src/components/Heartbeat/Heartbeat.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
@@ -166,6 +167,13 @@ function Make(EventCollectorChannel) {
     let channel = eventCollector.channel;
     let channelParts = channel.parts;
     let queue = channelParts.queue;
+    if (DcbBackend$ReventlessAws.isPostgres()) {
+      let compName = resource.__name;
+      if (compName !== undefined) {
+        let pluginName = compName.endsWith("Plugin") ? compName.slice(0, compName.length - 6 | 0) : compName;
+        DcbBackend$ReventlessAws.attachCollectorQueue(pluginName + "DcbEventLog", queue.id, queue.arn);
+      }
+    }
     let ctx = Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name];
     let context = ctx !== undefined ? ctx : synthesizeAdminContext();
     let envVars = {};

package/tests/AppSync_AdapterTest.res

@@ -349,12 +349,12 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
 
 // ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
 //
-// A field flagged `iamCallable` must be reachable by BOTH the console UI
+// A field flagged `systemCallable` must be reachable by BOTH the console UI
 // (Cognito) and the deploy-time SigV4 system caller (AWS_IAM). It switches from
 // the single-mode `@aws_auth(...)` form to the multi-auth
 // `@aws_cognito_user_pools(...) @aws_iam` form.
 
-describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
+describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
   let makeFragment = (mutationFields, queryFields) =>
     ReventlessCore.GraphQL_Stitcher.encode({
       types: [],
@@ -363,12 +363,12 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
       subscriptions: [],
     })
 
-  testSync("iamCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+  testSync("systemCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
-      iamCallable: true,
+      systemCallable: true,
     }
     let frag = makeFragment(["p_Sync(id: ID!): String"], [])
     let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
@@ -379,12 +379,12 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
     expect(m)->not_->toContain("@aws_auth")
   })
 
-  testSync("iamCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+  testSync("systemCallable mutation without a group restriction stays open to Cognito + IAM", () => {
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowAuthenticated)]),
-      iamCallable: true,
+      systemCallable: true,
     }
     let frag = makeFragment(["p_Sync(id: ID!): String"], [])
     let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
@@ -395,7 +395,7 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
     expect(m)->not_->toContain("@aws_auth")
   })
 
-  testSync("a non-iamCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+  testSync("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync", "p_Other"],
       commandSchema: S.unknown,
@@ -403,15 +403,15 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
         ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
         ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
       ]),
-      // iamCallable applies to every field in the entry; split the fields so only
+      // systemCallable applies to every field in the entry; split the fields so only
       // p_Sync opts in.
-      iamCallable: false,
+      systemCallable: false,
     }
     let iamEntry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
-      iamCallable: true,
+      systemCallable: true,
     }
     let frag = makeFragment(["p_Sync(id: ID!): String", "p_Other(id: ID!): String"], [])
     let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry, iamEntry], ~queryEntries=[])
@@ -424,7 +424,7 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
     }
   })
 
-  testSync("iamCallable query applies dual-auth to BOTH single and list fields", () => {
+  testSync("systemCallable query applies dual-auth to BOTH single and list fields", () => {
     let entry: ReventlessInfra.Api.querySchemaEntry = {
       singleFieldName: "p_Item",
       listFieldName: "p_Items",
@@ -432,7 +432,7 @@ describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
       stateSchema: S.unknown,
       authorization: None,
       permission: Reventless.Authorization.AllowGroups(["Admin"]),
-      iamCallable: true,
+      systemCallable: true,
     }
     let frag = makeFragment(
       [],