@reventlessdev/reventless-aws 3.0.0-alpha.174 → 3.0.0-alpha.176

package/src/adapter/QueryDb/QueryDbStorage_Postgres.res

@@ -0,0 +1,43 @@
+// Deploy-time QueryDb storage for the Postgres backend (B3.1) — the read-model
+// analogue of `EventLogStorage_Postgres` / `DcbEventLogStorage_Postgres`.
+//
+// Creates NO DynamoDB table and NO AppSync data source: read-model state lives in
+// Postgres (`qdb_<name>`, JSONB) and is written by the projection Lambdas via the
+// runtime ops. Returns:
+//   - `resources: []` — no stream, no direct AppSync resolvers (suppressed by
+//     `QueryDbResolvers.Selectable` until B3.2's Lambda data source);
+//   - `dataSourceName: ""` — nothing to attach resolvers to;
+//   - `operations` — the Postgres op set bound to the shared `PgConnection` pool.
+//     Schema setup is lazy (first operation), so nothing connects during
+//     `pulumi up` — a real query only runs inside a Lambda at runtime.
+//
+// Selected by `QueryDbStorage.Selectable(Stream)` when `QueryDbBackend` holds a
+// selection and the read model is not admin-exempt.
+
+type api = Types.AppSync.api
+type role = Types.AppSync.role
+
+let make: ReventlessCore.QueryDb_Adapter.storageMaker<api, role> = (
+  ~name,
+  ~indexes,
+  ~subIdField=?,
+  ~ttl as _=?,
+  ~api as _,
+  ~apiRole as _,
+  ~opts as _,
+) => {
+  let operations = switch QueryDbBackend.get() {
+  | Some({connectionConfig}) =>
+    connectionConfig->Pulumi.Output.apply(config =>
+      QueryDbStorage_Postgres_Runtime.opsFor(config, ~name, ~indexes, ~subIdField?)
+    )
+  | None =>
+    // Selectable only routes here when a selection is set; guard defensively.
+    JsError.throwWithMessage("QueryDbStorage_Postgres.make called without a QueryDbBackend selection")
+  }
+  {
+    ReventlessCore.QueryDb_Adapter.resources: [],
+    dataSourceName: ""->Pulumi.Output.make,
+    operations,
+  }
+}

package/src/adapter/QueryDb/QueryDbStorage_Postgres.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as QueryDbBackend$ReventlessAws from "./QueryDbBackend.res.mjs";
+import * as QueryDbStorage_Postgres_Runtime$ReventlessAws from "./QueryDbStorage_Postgres_Runtime.res.mjs";
+
+function make(name, indexes, subIdField, param, param$1, param$2, param$3) {
+  let match = QueryDbBackend$ReventlessAws.get();
+  let operations = match !== undefined ? match.connectionConfig.apply(config => QueryDbStorage_Postgres_Runtime$ReventlessAws.opsFor(config, name, indexes, subIdField)) : Stdlib_JsError.throwWithMessage("QueryDbStorage_Postgres.make called without a QueryDbBackend selection");
+  return {
+    resources: [],
+    dataSourceName: Pulumi.output(""),
+    operations: operations
+  };
+}
+
+export {
+  make,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res

@@ -0,0 +1,19 @@
+// AWS-side runtime QueryDb operations for the Postgres backend. Mirrors the role
+// of QueryDbStorage_DynamoDb_Runtime: turn a resolved connection config into the
+// read-model operation set, bound to the container-lifetime pool from PgRuntime.
+// Consumed by ReadModelEntryPoint.mjs / StateViewSliceEntryPoint.mjs (Postgres
+// branch, selected when the handler's HANDLER_CONFIG entry carries a
+// `pgConnection`).
+//
+// `name` is the read-model spec name — the same discriminator the deploy-time
+// maker used, so runtime and deploy-time ops target the same `qdb_<name>` table.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~name: string,
+  ~indexes: array<Reventless.ReadModel.indexConfig>=[],
+  ~subIdField: option<string>=?,
+): ReventlessCore.QueryDb_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  ReventlessPostgres.QueryDbStorage_Postgres.makeOperations(~pool, ~name, ~indexes, ~subIdField)
+}

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as QueryDbStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/QueryDbStorage_Postgres.res.mjs";
+
+function opsFor(config, name, indexesOpt, subIdField) {
+  let indexes = indexesOpt !== undefined ? indexesOpt : [];
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return QueryDbStorage_Postgres$ReventlessPostgres.makeOperations(pool, name, indexes, subIdField);
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res

@@ -144,7 +144,18 @@ let scanByTableName = (~tableName, ~filterConfigs, ~limit) => {
 }
 
 let make: ReventlessCore.QueryDb_Adapter.queryEngineMaker = allQueryDbs => {
-  let allRuntimeQueryDbsOutputs = Dict.mapValues(allQueryDbs, (
+  // B3.1: Postgres-backed read models have NO DynamoDB resource — exclude them
+  // instead of failing findResource at deploy time. They are not reachable via
+  // this engine (getRuntimeResource raises its explicit not-found error at
+  // query time); see docs/plans/aws-postgres-querydb-adapter.md § B3.1b.
+  let dynamoDbQueryDbs =
+    allQueryDbs
+    ->Dict.toArray
+    ->Array.filter(((_, queryDb: ReventlessCore.QueryDb.outputs)) =>
+      queryDb.resources->Array.length > 0
+    )
+    ->Dict.fromArray
+  let allRuntimeQueryDbsOutputs = Dict.mapValues(dynamoDbQueryDbs, (
     queryDb: ReventlessCore.QueryDb.outputs,
   ) =>
     queryDb.resources

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs

@@ -203,7 +203,8 @@ function scanByTableName(tableName, filterConfigs, limit) {
 }
 
 function make(allQueryDbs) {
-  let allRuntimeQueryDbsOutputs = Pulumi.all(Stdlib_Dict.mapValues(allQueryDbs, queryDb => Adapter$ReventlessCore.resourceToResolvedOutput(Util_DynamoDb$ReventlessAws.findResource(queryDb.resources))));
+  let dynamoDbQueryDbs = Object.fromEntries(Object.entries(allQueryDbs).filter(param => param[1].resources.length !== 0));
+  let allRuntimeQueryDbsOutputs = Pulumi.all(Stdlib_Dict.mapValues(dynamoDbQueryDbs, queryDb => Adapter$ReventlessCore.resourceToResolvedOutput(Util_DynamoDb$ReventlessAws.findResource(queryDb.resources))));
   return allRuntimeQueryDbsOutputs.apply(allRuntimeQueryDbs => ({
     scan: (readModelName, filterConfigs, limit) => scanByTableName(Util_QueryDbRuntime$ReventlessCore.getRuntimeResource(allRuntimeQueryDbs, readModelName).name, filterConfigs, limit),
     query: (readModelName, key, id, subIdConfig, filterConfigs, ascending, limit) => queryByTableName(Util_QueryDbRuntime$ReventlessCore.getRuntimeResource(allRuntimeQueryDbs, readModelName).name, key, id, subIdConfig, filterConfigs, ascending, limit)

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -207,6 +207,30 @@ let finish = () =>
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
 
+        // Classic Postgres backend: add a `pgConnection` object to every handler
+        // entry so the AggregateEntryPoint Postgres branch activates (absent →
+        // DynamoDB path, unchanged). Whole-Lambda toggle — all aggregates follow
+        // the platform selection, matching EventLogStorage.Selectable.
+        let pgSelection = EventLogBackend.get()
+        let pgConnectionFragment = switch pgSelection {
+        | Some(sel) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | None => Pulumi.Output.make("")
+        }
+
         specs->Array.forEach(spec => {
           switch aggregateInfos->Dict.get(spec.aggregateName) {
           | Some(info) =>
@@ -223,9 +247,14 @@ let finish = () =>
               info.behaviorModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
             let handlerJson =
-              Pulumi.Output.all3((info.eventLogTableName, spec.queueUrl, spec.queueArn))
-              ->Pulumi.Output.apply(((table, queueUrl, queueArn)) =>
-                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"}`
+              Pulumi.Output.all4((
+                info.eventLogTableName,
+                spec.queueUrl,
+                spec.queueArn,
+                pgConnectionFragment,
+              ))
+              ->Pulumi.Output.apply(((table, queueUrl, queueArn, pgFragment)) =>
+                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"${pgFragment}}`
               )
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -270,6 +299,27 @@ let finish = () =>
         // so the next flavor's `finish()` starts from a clean slate.
         cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.setBatchSize)
 
+        // Postgres-backed classic EventLog → the command Lambda talks to RDS, so it
+        // must land in-VPC on the DB-access security group + private subnets.
+        // makeFromCodeAsset adds the EC2-ENI IAM automatically when vpcConfig is
+        // present (C1).
+        let vpcConfig = switch pgSelection {
+        | Some(sel) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | None => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllAggregatesCmdHandler",
           ~code,
@@ -280,9 +330,39 @@ let finish = () =>
           ~reservedConcurrency=?cfg.reservedConcurrency,
           ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
           ~logRetentionDays=?cfg.logRetentionDays,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed command Lambda read access to the RDS-managed
+        // master secret so PgRuntime can resolve the DB password at cold start.
+        switch pgSelection {
+        | Some(sel) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllAggregatesCmdHandler-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllAggregatesCmdHandler-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         // Grant the AllAggregates Lambda dynamodb:Scan on the Plugin RM table so
         // the in-Lambda plugin status gate (AggregateEntryPoint.mjs::checkPluginStatus)
         // can read plugin status at command-dispatch time. Skipped if the platform

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -154,6 +155,32 @@ function finish() {
       };
       let handlerOutputs = [];
       let packageDirs = {};
+      let pgSelection = EventLogBackend$ReventlessAws.get();
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {
@@ -168,8 +195,9 @@ function finish() {
         let handlerJson = Pulumi.all([
           info.eventLogTableName,
           spec.queueUrl,
-          spec.queueArn
-        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"}`);
+          spec.queueArn,
+          pgConnectionFragment
+        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"` + param[3] + `}`);
         handlerOutputs.push(handlerJson);
       });
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
@@ -187,7 +215,22 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
+      let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+          subnetIds: pgSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, vpcConfig, opts);
+      if (pgSelection !== undefined) {
+        pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllAggregatesCmdHandler-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAggregatesCmdHandler-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       let tableName$1 = pluginRmTableName.contents;
       if (tableName$1 !== undefined) {
         Pulumi.all([

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -194,6 +194,30 @@ let finish = () =>
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
 
+        // Classic Postgres backend: add a `pgConnection` object to every handler
+        // entry so the AggregateEntryPoint Postgres branch activates (absent →
+        // DynamoDB path, unchanged). Whole-Lambda toggle — all aggregates follow
+        // the platform selection, matching EventLogStorage.Selectable.
+        let pgSelection = EventLogBackend.get()
+        let pgConnectionFragment = switch pgSelection {
+        | Some(sel) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | None => Pulumi.Output.make("")
+        }
+
         specs->Array.forEach(spec => {
           switch aggregateInfos->Dict.get(spec.aggregateName) {
           | Some(info) =>
@@ -208,9 +232,14 @@ let finish = () =>
               info.behaviorModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
             let handlerJson =
-              Pulumi.Output.all3((info.eventLogTableName, spec.queueUrl, spec.queueArn))
-              ->Pulumi.Output.apply(((table, queueUrl, queueArn)) =>
-                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"}`
+              Pulumi.Output.all4((
+                info.eventLogTableName,
+                spec.queueUrl,
+                spec.queueArn,
+                pgConnectionFragment,
+              ))
+              ->Pulumi.Output.apply(((table, queueUrl, queueArn, pgFragment)) =>
+                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"${pgFragment}}`
               )
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -249,6 +278,27 @@ let finish = () =>
 
         cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.setBatchSize)
 
+        // Postgres-backed classic EventLog → the command Lambda talks to RDS, so it
+        // must land in-VPC on the DB-access security group + private subnets.
+        // makeFromCodeAsset adds the EC2-ENI IAM automatically when vpcConfig is
+        // present (C1).
+        let vpcConfig = switch pgSelection {
+        | Some(sel) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | None => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllAggregatesAsyncCmdHandler",
           ~code,
@@ -259,9 +309,39 @@ let finish = () =>
           ~reservedConcurrency=?cfg.reservedConcurrency,
           ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
           ~logRetentionDays=?cfg.logRetentionDays,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed command Lambda read access to the RDS-managed
+        // master secret so PgRuntime can resolve the DB password at cold start.
+        switch pgSelection {
+        | Some(sel) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllAggregatesAsyncCmdHandler-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllAggregatesAsyncCmdHandler-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         specs->Array.forEach(({connects}) => {
           connects->Array.forEach(connect => connect(~runtime))
         })

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
@@ -7,7 +8,9 @@ import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -144,6 +147,32 @@ function finish() {
       };
       let handlerOutputs = [];
       let packageDirs = {};
+      let pgSelection = EventLogBackend$ReventlessAws.get();
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {
@@ -158,8 +187,9 @@ function finish() {
         let handlerJson = Pulumi.all([
           info.eventLogTableName,
           spec.queueUrl,
-          spec.queueArn
-        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"}`);
+          spec.queueArn,
+          pgConnectionFragment
+        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"` + param[3] + `}`);
         handlerOutputs.push(handlerJson);
       });
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
@@ -174,7 +204,22 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Async$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
+      let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+          subnetIds: pgSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, vpcConfig, opts);
+      if (pgSelection !== undefined) {
+        pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllAggregatesAsyncCmdHandler-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAggregatesAsyncCmdHandler-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       specs.forEach(param => {
         param.connects.forEach(connect => connect(runtime));
       });