@reventlessdev/reventless-aws 3.0.0-alpha.174 → 3.0.0-alpha.176

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res

@@ -10,6 +10,10 @@ type readModelInfo = {
   specModulePath: string,
   mappingsModulePath: string,
   queryDbTableName: Pulumi.Output.t<string>,
+  /** B3.1: this read model's QueryDb is Postgres-backed — its HANDLER_CONFIG
+      entry carries a `pgConnection` (admin-exempt read models stay DynamoDB,
+      so the flag is per read model, not per Lambda). */
+  pgBacked: bool,
 }
 
 let readModelInfos: dict<readModelInfo> = Dict.make()
@@ -19,10 +23,11 @@ let registerReadModel = (
   ~specModulePath,
   ~mappingsModulePath,
   ~queryDbTableName,
+  ~pgBacked=false,
 ) =>
   readModelInfos->Dict.set(
     readModelName,
-    {specModulePath, mappingsModulePath, queryDbTableName},
+    {specModulePath, mappingsModulePath, queryDbTableName, pgBacked},
   )
 
 type storedSpec = {
@@ -110,6 +115,54 @@ let finish = () =>
       switch grandParent.contents {
       | Some(parent) =>
         let opts = {Pulumi.ComponentResource.parent: parent}
+        let customOpts =
+          opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+        // B3.0: Postgres-backed source logs have no DynamoDB stream — provision
+        // the SQS feed queue the change-feed relay fans events into. Its ARN
+        // doubles as the handlers' sourceUrn dispatch key (per-projection
+        // filtering makes over-delivery a no-op).
+        let feedQueue =
+          EventLogBackend.isPostgres() || DcbBackend.isPostgres()
+            ? Some(
+                PgProjectionFeed.makeQueue(
+                  ~name="AllReadModelsFeed",
+                  ~scope="aws-rm-feed",
+                  ~includeClassic=true,
+                  ~includeDcb=true,
+                  ~opts=customOpts,
+                ),
+              )
+            : None
+        let feedArnOutput = switch feedQueue {
+        | Some(queue) => queue.arn
+        | None => Pulumi.Output.make("")
+        }
+
+        // B3.1: Postgres-backed read models get a `pgConnection` in their handler
+        // entry (per read model — admin-exempt ones stay DynamoDB in the same
+        // Lambda). The Lambda itself goes in-VPC when any handler is pg-backed.
+        let qdbSelection = QueryDbBackend.get()
+        let anyPgBacked =
+          readModelInfos->Dict.valuesToArray->Array.some(info => info.pgBacked)
+        let pgConnectionFragment = switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | _ => Pulumi.Output.make("")
+        }
 
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
@@ -136,11 +189,21 @@ let finish = () =>
             let mappingsModule =
               info.mappingsModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
+            let handlerPgFragment = info.pgBacked
+              ? pgConnectionFragment
+              : Pulumi.Output.make("")
             let handlerJson =
-              Pulumi.Output.all2((info.queryDbTableName, spec.sourceUrns))
-              ->Pulumi.Output.apply(((tableName, urns)) => {
-                let sourceUrn = urns->Array.getUnsafe(0)
-                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"}`
+              Pulumi.Output.all4((
+                info.queryDbTableName,
+                spec.sourceUrns,
+                feedArnOutput,
+                handlerPgFragment,
+              ))
+              ->Pulumi.Output.apply(((tableName, urns, feedArn, pgFragment)) => {
+                // No stream resource (Postgres-backed source) → dispatch on the
+                // feed queue's ARN instead of a stream URN.
+                let sourceUrn = urns->Array.get(0)->Option.getOr(feedArn)
+                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}}`
               })
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -165,6 +228,25 @@ let finish = () =>
           ~packageDirs,
         )
 
+        // Postgres-backed read models → the projection Lambda writes to RDS, so
+        // it must land in-VPC on the DB-access security group + private subnets.
+        let vpcConfig = switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | _ => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllReadModels",
           ~code,
@@ -172,9 +254,39 @@ let finish = () =>
           ~envVars,
           ~memorySize=maxMemorySize,
           ~timeout=maxTimeout,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed projection Lambda read access to the
+        // RDS-managed master secret so PgRuntime can resolve the DB password.
+        switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllReadModels-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllReadModels-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | _ => ()
+        }
+
         let channelSpecs = storedSpecs->Array.map(({channelSpec}) => channelSpec)
         let _connectResources = EventCollectorChannel.connect(
           ~name="AllReadModels",
@@ -182,6 +294,19 @@ let finish = () =>
           ~runtime,
           ~opts,
         )
+
+        // B3.0: wire the Postgres feed queue into the Lambda (ESM + receive IAM).
+        switch feedQueue {
+        | Some(queue) =>
+          PgProjectionFeed.connect(
+            ~name="AllReadModelsFeed",
+            ~queue,
+            ~lambda=runtime.parts.lambda,
+            ~lambdaRole=runtime.parts.lambdaRole,
+            ~opts=customOpts,
+          )
+        | None => ()
+        }
       | None =>
         log.warn(
           ~comp="EventCollectorRuntime_Builder_Single",

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
@@ -7,7 +8,13 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as QueryDbBackend$ReventlessAws from "../QueryDb/QueryDbBackend.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
+import * as PgProjectionFeed$ReventlessAws from "../Postgres/PgProjectionFeed.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
 
@@ -15,11 +22,13 @@ let log = Logger$ReventlessCore.fromEnv();
 
 let readModelInfos = {};
 
-function registerReadModel(readModelName, specModulePath, mappingsModulePath, queryDbTableName) {
+function registerReadModel(readModelName, specModulePath, mappingsModulePath, queryDbTableName, pgBackedOpt) {
+  let pgBacked = pgBackedOpt !== undefined ? pgBackedOpt : false;
   readModelInfos[readModelName] = {
     specModulePath: specModulePath,
     mappingsModulePath: mappingsModulePath,
-    queryDbTableName: queryDbTableName
+    queryDbTableName: queryDbTableName,
+    pgBacked: pgBacked
   };
 }
 
@@ -81,6 +90,36 @@ function finish() {
       let opts = {
         parent: opts_parent
       };
+      let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+      let feedQueue = EventLogBackend$ReventlessAws.isPostgres() || DcbBackend$ReventlessAws.isPostgres() ? PgProjectionFeed$ReventlessAws.makeQueue("AllReadModelsFeed", "aws-rm-feed", true, true, customOpts) : undefined;
+      let feedArnOutput = feedQueue !== undefined ? feedQueue.arn : Pulumi.output("");
+      let qdbSelection = QueryDbBackend$ReventlessAws.get();
+      let anyPgBacked = Object.values(readModelInfos).some(info => info.pgBacked);
+      let pgConnectionFragment = qdbSelection !== undefined && anyPgBacked ? qdbSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       let handlerOutputs = [];
       let packageDirs = {};
       let sortedSpecs = storedSpecs.toSorted((a, b) => Primitive_string.compare(a.componentName, b.componentName));
@@ -95,12 +134,15 @@ function finish() {
         packageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
         let specModule = Stdlib_Option.getOr(JSON.stringify(info.specModulePath), `""`);
         let mappingsModule = Stdlib_Option.getOr(JSON.stringify(info.mappingsModulePath), `""`);
+        let handlerPgFragment = info.pgBacked ? pgConnectionFragment : Pulumi.output("");
         let handlerJson = Pulumi.all([
           info.queryDbTableName,
-          spec.sourceUrns
+          spec.sourceUrns,
+          feedArnOutput,
+          handlerPgFragment
         ]).apply(param => {
-          let sourceUrn = param[1][0];
-          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"}`;
+          let sourceUrn = Stdlib_Option.getOr(param[1][0], param[2]);
+          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"` + param[3] + `}`;
         });
         handlerOutputs.push(handlerJson);
       });
@@ -108,9 +150,27 @@ function finish() {
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
+      let vpcConfig = qdbSelection !== undefined && anyPgBacked ? qdbSelection.securityGroupId.apply(sgId => ({
+          subnetIds: qdbSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, vpcConfig, opts);
+      if (qdbSelection !== undefined && anyPgBacked) {
+        qdbSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllReadModels-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllReadModels-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllReadModels", channelSpecs, runtime, opts);
+      if (feedQueue !== undefined) {
+        PgProjectionFeed$ReventlessAws.connect("AllReadModelsFeed", feedQueue, runtime.parts.lambda, runtime.parts.lambdaRole, customOpts);
+      }
     } else {
       log.warn("EventCollectorRuntime_Builder_Single", undefined, `finish: grandParent not set`);
     }

package/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs

@@ -1,20 +1,22 @@
 // PgChangeFeedRelay Lambda entry point (scheduled poll — B2.3).
 //
 // Triggered on a schedule (EventBridge rate rule). Each invocation drains every
-// Postgres DCB log listed in HANDLER_CONFIG from its checkpoint and relays the
-// events, transformed into the {id, meta, event} shape, onto the plugin
-// EventCollector SQS queue — which then fans out to projections, aggregate
-// command topics, and the cross-plugin SNS EventTopic.
-// See docs/plans/aws-postgres-change-feed-bridge.md.
+// Postgres log listed in HANDLER_CONFIG from its checkpoint — DCB (`dcb_event`)
+// and classic aggregate (`event_log`) logs alike — and relays the events,
+// transformed into the {id, meta, event} shape, onto the plugin EventCollector
+// SQS queue — which then fans out to projections, aggregate command topics, and
+// the cross-plugin SNS EventTopic.
+// See docs/plans/done/aws-postgres-change-feed-bridge.md.
 //
 // HANDLER_CONFIG shape:
 //   { "logs": [ { "pgConnection": {host,port,database,username,secretArn},
-//                 "logName": string,          // dcb_event.log_name
-//                 "subscriber": string,        // dcb_subscription checkpoint key
+//                 "logName": string,          // dcb_event/event_log log_name
+//                 "subscriber": string,        // per-log checkpoint key
 //                 "targetQueueUrl": string,    // plugin EventCollector SQS URL
-//                 "partitionTag"?: <derivedPartitionTag> } ] }
+//                 "kind"?: "classic",          // absent → DCB
+//                 "partitionTag"?: <derivedPartitionTag> } ] }  // DCB only
 
-import { relay } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+import { relay, relayClassic } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
 import { sendMessage } from "@reventlessdev/reventless-aws/src/util/Util_SQS_Runtime.res.mjs";
 import { makeQueueRef, log } from "./HandlerFactoryHelpers.mjs";
 
@@ -37,7 +39,10 @@ export async function handler(_event, _context) {
     logs.map(async (l) => {
       const sendBatch = makeSendBatch(l.targetQueueUrl);
       try {
-        const count = await relay(l.pgConnection, l.logName, l.subscriber, l.partitionTag, sendBatch);
+        const count =
+          l.kind === "classic"
+            ? await relayClassic(l.pgConnection, l.logName, l.subscriber, sendBatch)
+            : await relay(l.pgConnection, l.logName, l.subscriber, l.partitionTag, sendBatch);
         log.debug("relayed " + count + " event(s) for " + l.logName, { comp: "PgChangeFeedRelay" });
       } catch (err) {
         // Log and continue — a failed log this tick is retried next tick from its

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -7,6 +7,7 @@ import { patchSpecId, makeTableRef, log, pluginName } from "./HandlerFactoryHelp
 import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 import { Make as readModelCallbackMake } from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel_Callback.res.mjs";
 import { load as qdbLoad, loadStream as qdbLoadStream, save as qdbSave, saveBatch as qdbSaveBatch, count as qdbCount, $$delete as qdbDelete, deleteBatch as qdbDeleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -69,21 +70,37 @@ function groupBySource(records) {
   return dict;
 }
 
-function buildReadModelHandler(specModule, mappingsModule, queryDbTableName) {
+// `pgConnection`, when present, is the resolved PgConnection.connectionConfig the
+// runtime builder injected for a Postgres-backed read model: bind the Postgres
+// operation set (queryDbTableName is then the read-model spec name, the shared
+// `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
+function buildReadModelHandler(specModule, mappingsModule, queryDbTableName, pgConnection) {
   const patchedSpec = patchSpecId(specModule);
-  const table = makeTableRef(queryDbTableName);
-  const rawSave = qdbSave(table);
-  const rawSaveBatch = qdbSaveBatch(table);
-
-  const operations = {
-    load: qdbLoad(table),
-    loadStream: qdbLoadStream(table),
-    save: mkInjectIdSave(rawSave),
-    saveBatch: mkInjectIdSaveBatch(rawSaveBatch),
-    count: qdbCount(table),
-    delete: qdbDelete(table),
-    deleteBatch: qdbDeleteBatch(table),
-  };
+  let operations;
+  if (pgConnection) {
+    const indexes = (patchedSpec.config && patchedSpec.config.indexes) || [];
+    const subIdField = patchedSpec.subIdConfig ? patchedSpec.subIdConfig.subIdField : undefined;
+    const pgOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+    operations = {
+      ...pgOps,
+      save: mkInjectIdSave(pgOps.save),
+      saveBatch: mkInjectIdSaveBatch(pgOps.saveBatch),
+    };
+  } else {
+    const table = makeTableRef(queryDbTableName);
+    const rawSave = qdbSave(table);
+    const rawSaveBatch = qdbSaveBatch(table);
+
+    operations = {
+      load: qdbLoad(table),
+      loadStream: qdbLoadStream(table),
+      save: mkInjectIdSave(rawSave),
+      saveBatch: mkInjectIdSaveBatch(rawSaveBatch),
+      count: qdbCount(table),
+      delete: qdbDelete(table),
+      deleteBatch: qdbDeleteBatch(table),
+    };
+  }
 
   const effectiveMappings = fixMappingsModule(mappingsModule);
   const callback = readModelCallbackMake(patchedSpec)(effectiveMappings)({
@@ -102,7 +119,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const mappingsModule = await dynamicImport(h.mappingsModule);
-    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName);
+    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName, h.pgConnection);
     // Multiple read models can share one source stream — e.g. every admin read
     // model (Plugins, PluginHistory, PlatformEventGraph, UIFragmentRegistry)
     // projects the Plugin aggregate's EventLog stream. Accumulate ALL handlers

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -10,6 +10,7 @@ import { makeTableRef, log, pluginName } from "./HandlerFactoryHelpers.mjs";
 import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 import { handleAction } from "@reventlessdev/reventless-core/src/Projection.res.mjs";
 import { load, loadStream, save, saveBatch, count, $$delete, deleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -40,17 +41,27 @@ function groupBySource(records) {
   return dict;
 }
 
-function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName) {
-  const table = makeTableRef(queryDbTableName);
-  const queryDbOps = {
-    load: load(table),
-    loadStream: loadStream(table),
-    save: save(table),
-    saveBatch: saveBatch(table),
-    count: count(table),
-    delete: $$delete(table),
-    deleteBatch: deleteBatch(table),
-  };
+// `pgConnection`, when present, selects the Postgres QueryDb runtime for this
+// slice's view table (`queryDbTableName` is then the slice spec name, the shared
+// `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
+function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName, pgConnection) {
+  let queryDbOps;
+  if (pgConnection) {
+    const indexes = (specModule.config && specModule.config.indexes) || [];
+    const subIdField = specModule.subIdConfig ? specModule.subIdConfig.subIdField : undefined;
+    queryDbOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+  } else {
+    const table = makeTableRef(queryDbTableName);
+    queryDbOps = {
+      load: load(table),
+      loadStream: loadStream(table),
+      save: save(table),
+      saveBatch: saveBatch(table),
+      count: count(table),
+      delete: $$delete(table),
+      deleteBatch: deleteBatch(table),
+    };
+  }
   // Spec module exports `consumedEventSchema`; the `project` function lives in
   // the sibling projection module (`<Name>_Projection.res`).
   const eventSchema = specModule.consumedEventSchema;
@@ -91,6 +102,9 @@ function expandHandlers(config) {
       projectionModule: base + h.p,
       queryDbTableName: h.q,
       sourceUrn: h.u !== undefined ? h.u : sharedUrn,
+      // Shared across a plugin's slices (all follow the platform backend toggle);
+      // hoisted to the top level of the compressed config like base/sourceUrn.
+      pgConnection: config.pgConnection,
     };
   });
 }
@@ -104,7 +118,7 @@ async function buildAllHandlers() {
       dynamicImport(h.specModule),
       dynamicImport(h.projectionModule),
     ]);
-    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName);
+    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName, h.pgConnection);
     const streamHandler = (event, context) => handleStreamEvent(jsonEventsHandler, event, context);
     const existing = handlers[h.sourceUrn] || [];
     existing.push(streamHandler);