@reventlessdev/reventless-aws 3.0.0-alpha.175 → 3.0.0-alpha.176

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res

@@ -0,0 +1,19 @@
+// AWS-side runtime QueryDb operations for the Postgres backend. Mirrors the role
+// of QueryDbStorage_DynamoDb_Runtime: turn a resolved connection config into the
+// read-model operation set, bound to the container-lifetime pool from PgRuntime.
+// Consumed by ReadModelEntryPoint.mjs / StateViewSliceEntryPoint.mjs (Postgres
+// branch, selected when the handler's HANDLER_CONFIG entry carries a
+// `pgConnection`).
+//
+// `name` is the read-model spec name — the same discriminator the deploy-time
+// maker used, so runtime and deploy-time ops target the same `qdb_<name>` table.
+
+let opsFor = (
+  config: PgConnection.connectionConfig,
+  ~name: string,
+  ~indexes: array<Reventless.ReadModel.indexConfig>=[],
+  ~subIdField: option<string>=?,
+): ReventlessCore.QueryDb_Adapter.operations => {
+  let pool = PgRuntime.poolFor(config)
+  ReventlessPostgres.QueryDbStorage_Postgres.makeOperations(~pool, ~name, ~indexes, ~subIdField)
+}

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as QueryDbStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/QueryDbStorage_Postgres.res.mjs";
+
+function opsFor(config, name, indexesOpt, subIdField) {
+  let indexes = indexesOpt !== undefined ? indexesOpt : [];
+  let pool = PgRuntime$ReventlessAws.poolFor(config);
+  return QueryDbStorage_Postgres$ReventlessPostgres.makeOperations(pool, name, indexes, subIdField);
+}
+
+export {
+  opsFor,
+}
+/* PgRuntime-ReventlessAws Not a pure module */

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res

@@ -144,7 +144,18 @@ let scanByTableName = (~tableName, ~filterConfigs, ~limit) => {
 }
 
 let make: ReventlessCore.QueryDb_Adapter.queryEngineMaker = allQueryDbs => {
-  let allRuntimeQueryDbsOutputs = Dict.mapValues(allQueryDbs, (
+  // B3.1: Postgres-backed read models have NO DynamoDB resource — exclude them
+  // instead of failing findResource at deploy time. They are not reachable via
+  // this engine (getRuntimeResource raises its explicit not-found error at
+  // query time); see docs/plans/aws-postgres-querydb-adapter.md § B3.1b.
+  let dynamoDbQueryDbs =
+    allQueryDbs
+    ->Dict.toArray
+    ->Array.filter(((_, queryDb: ReventlessCore.QueryDb.outputs)) =>
+      queryDb.resources->Array.length > 0
+    )
+    ->Dict.fromArray
+  let allRuntimeQueryDbsOutputs = Dict.mapValues(dynamoDbQueryDbs, (
     queryDb: ReventlessCore.QueryDb.outputs,
   ) =>
     queryDb.resources

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs

@@ -203,7 +203,8 @@ function scanByTableName(tableName, filterConfigs, limit) {
 }
 
 function make(allQueryDbs) {
-  let allRuntimeQueryDbsOutputs = Pulumi.all(Stdlib_Dict.mapValues(allQueryDbs, queryDb => Adapter$ReventlessCore.resourceToResolvedOutput(Util_DynamoDb$ReventlessAws.findResource(queryDb.resources))));
+  let dynamoDbQueryDbs = Object.fromEntries(Object.entries(allQueryDbs).filter(param => param[1].resources.length !== 0));
+  let allRuntimeQueryDbsOutputs = Pulumi.all(Stdlib_Dict.mapValues(dynamoDbQueryDbs, queryDb => Adapter$ReventlessCore.resourceToResolvedOutput(Util_DynamoDb$ReventlessAws.findResource(queryDb.resources))));
   return allRuntimeQueryDbsOutputs.apply(allRuntimeQueryDbs => ({
     scan: (readModelName, filterConfigs, limit) => scanByTableName(Util_QueryDbRuntime$ReventlessCore.getRuntimeResource(allRuntimeQueryDbs, readModelName).name, filterConfigs, limit),
     query: (readModelName, key, id, subIdConfig, filterConfigs, ascending, limit) => queryByTableName(Util_QueryDbRuntime$ReventlessCore.getRuntimeResource(allRuntimeQueryDbs, readModelName).name, key, id, subIdConfig, filterConfigs, ascending, limit)

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -207,6 +207,30 @@ let finish = () =>
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
 
+        // Classic Postgres backend: add a `pgConnection` object to every handler
+        // entry so the AggregateEntryPoint Postgres branch activates (absent →
+        // DynamoDB path, unchanged). Whole-Lambda toggle — all aggregates follow
+        // the platform selection, matching EventLogStorage.Selectable.
+        let pgSelection = EventLogBackend.get()
+        let pgConnectionFragment = switch pgSelection {
+        | Some(sel) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | None => Pulumi.Output.make("")
+        }
+
         specs->Array.forEach(spec => {
           switch aggregateInfos->Dict.get(spec.aggregateName) {
           | Some(info) =>
@@ -223,9 +247,14 @@ let finish = () =>
               info.behaviorModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
             let handlerJson =
-              Pulumi.Output.all3((info.eventLogTableName, spec.queueUrl, spec.queueArn))
-              ->Pulumi.Output.apply(((table, queueUrl, queueArn)) =>
-                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"}`
+              Pulumi.Output.all4((
+                info.eventLogTableName,
+                spec.queueUrl,
+                spec.queueArn,
+                pgConnectionFragment,
+              ))
+              ->Pulumi.Output.apply(((table, queueUrl, queueArn, pgFragment)) =>
+                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"${pgFragment}}`
               )
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -270,6 +299,27 @@ let finish = () =>
         // so the next flavor's `finish()` starts from a clean slate.
         cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.setBatchSize)
 
+        // Postgres-backed classic EventLog → the command Lambda talks to RDS, so it
+        // must land in-VPC on the DB-access security group + private subnets.
+        // makeFromCodeAsset adds the EC2-ENI IAM automatically when vpcConfig is
+        // present (C1).
+        let vpcConfig = switch pgSelection {
+        | Some(sel) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | None => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllAggregatesCmdHandler",
           ~code,
@@ -280,9 +330,39 @@ let finish = () =>
           ~reservedConcurrency=?cfg.reservedConcurrency,
           ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
           ~logRetentionDays=?cfg.logRetentionDays,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed command Lambda read access to the RDS-managed
+        // master secret so PgRuntime can resolve the DB password at cold start.
+        switch pgSelection {
+        | Some(sel) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllAggregatesCmdHandler-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllAggregatesCmdHandler-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         // Grant the AllAggregates Lambda dynamodb:Scan on the Plugin RM table so
         // the in-Lambda plugin status gate (AggregateEntryPoint.mjs::checkPluginStatus)
         // can read plugin status at command-dispatch time. Skipped if the platform

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -154,6 +155,32 @@ function finish() {
       };
       let handlerOutputs = [];
       let packageDirs = {};
+      let pgSelection = EventLogBackend$ReventlessAws.get();
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {
@@ -168,8 +195,9 @@ function finish() {
         let handlerJson = Pulumi.all([
           info.eventLogTableName,
           spec.queueUrl,
-          spec.queueArn
-        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"}`);
+          spec.queueArn,
+          pgConnectionFragment
+        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"` + param[3] + `}`);
         handlerOutputs.push(handlerJson);
       });
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
@@ -187,7 +215,22 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
+      let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+          subnetIds: pgSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, vpcConfig, opts);
+      if (pgSelection !== undefined) {
+        pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllAggregatesCmdHandler-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAggregatesCmdHandler-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       let tableName$1 = pluginRmTableName.contents;
       if (tableName$1 !== undefined) {
         Pulumi.all([

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -194,6 +194,30 @@ let finish = () =>
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
 
+        // Classic Postgres backend: add a `pgConnection` object to every handler
+        // entry so the AggregateEntryPoint Postgres branch activates (absent →
+        // DynamoDB path, unchanged). Whole-Lambda toggle — all aggregates follow
+        // the platform selection, matching EventLogStorage.Selectable.
+        let pgSelection = EventLogBackend.get()
+        let pgConnectionFragment = switch pgSelection {
+        | Some(sel) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | None => Pulumi.Output.make("")
+        }
+
         specs->Array.forEach(spec => {
           switch aggregateInfos->Dict.get(spec.aggregateName) {
           | Some(info) =>
@@ -208,9 +232,14 @@ let finish = () =>
               info.behaviorModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
             let handlerJson =
-              Pulumi.Output.all3((info.eventLogTableName, spec.queueUrl, spec.queueArn))
-              ->Pulumi.Output.apply(((table, queueUrl, queueArn)) =>
-                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"}`
+              Pulumi.Output.all4((
+                info.eventLogTableName,
+                spec.queueUrl,
+                spec.queueArn,
+                pgConnectionFragment,
+              ))
+              ->Pulumi.Output.apply(((table, queueUrl, queueArn, pgFragment)) =>
+                `{"specModule":${specModule},"behaviorModule":${behaviorModule},"eventLogTable":"${table}","queueUrl":"${queueUrl}","queueArn":"${queueArn}"${pgFragment}}`
               )
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -249,6 +278,27 @@ let finish = () =>
 
         cfg.sqsBatchSize->Option.forEach(CommandTopicChannel.setBatchSize)
 
+        // Postgres-backed classic EventLog → the command Lambda talks to RDS, so it
+        // must land in-VPC on the DB-access security group + private subnets.
+        // makeFromCodeAsset adds the EC2-ENI IAM automatically when vpcConfig is
+        // present (C1).
+        let vpcConfig = switch pgSelection {
+        | Some(sel) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | None => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllAggregatesAsyncCmdHandler",
           ~code,
@@ -259,9 +309,39 @@ let finish = () =>
           ~reservedConcurrency=?cfg.reservedConcurrency,
           ~ephemeralStorageMb=?cfg.ephemeralStorageMb,
           ~logRetentionDays=?cfg.logRetentionDays,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed command Lambda read access to the RDS-managed
+        // master secret so PgRuntime can resolve the DB password at cold start.
+        switch pgSelection {
+        | Some(sel) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllAggregatesAsyncCmdHandler-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllAggregatesAsyncCmdHandler-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         specs->Array.forEach(({connects}) => {
           connects->Array.forEach(connect => connect(~runtime))
         })

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
@@ -7,7 +8,9 @@ import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -144,6 +147,32 @@ function finish() {
       };
       let handlerOutputs = [];
       let packageDirs = {};
+      let pgSelection = EventLogBackend$ReventlessAws.get();
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {
@@ -158,8 +187,9 @@ function finish() {
         let handlerJson = Pulumi.all([
           info.eventLogTableName,
           spec.queueUrl,
-          spec.queueArn
-        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"}`);
+          spec.queueArn,
+          pgConnectionFragment
+        ]).apply(param => `{"specModule":` + specModule + `,"behaviorModule":` + behaviorModule + `,"eventLogTable":"` + param[0] + `","queueUrl":"` + param[1] + `","queueArn":"` + param[2] + `"` + param[3] + `}`);
         handlerOutputs.push(handlerJson);
       });
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
@@ -174,7 +204,22 @@ function finish() {
       }));
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Async$ReventlessAws.setBatchSize);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, undefined, opts);
+      let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({
+          subnetIds: pgSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllAggregatesAsyncCmdHandler", match.code, match.sourceCodeHash, envVars, cfg.memorySize, cfg.timeout, cfg.reservedConcurrency, cfg.ephemeralStorageMb, cfg.logRetentionDays, undefined, vpcConfig, opts);
+      if (pgSelection !== undefined) {
+        pgSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllAggregatesAsyncCmdHandler-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAggregatesAsyncCmdHandler-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       specs.forEach(param => {
         param.connects.forEach(connect => connect(runtime));
       });

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res

@@ -10,6 +10,10 @@ type readModelInfo = {
   specModulePath: string,
   mappingsModulePath: string,
   queryDbTableName: Pulumi.Output.t<string>,
+  /** B3.1: this read model's QueryDb is Postgres-backed — its HANDLER_CONFIG
+      entry carries a `pgConnection` (admin-exempt read models stay DynamoDB,
+      so the flag is per read model, not per Lambda). */
+  pgBacked: bool,
 }
 
 let readModelInfos: dict<readModelInfo> = Dict.make()
@@ -19,10 +23,11 @@ let registerReadModel = (
   ~specModulePath,
   ~mappingsModulePath,
   ~queryDbTableName,
+  ~pgBacked=false,
 ) =>
   readModelInfos->Dict.set(
     readModelName,
-    {specModulePath, mappingsModulePath, queryDbTableName},
+    {specModulePath, mappingsModulePath, queryDbTableName, pgBacked},
   )
 
 type storedSpec = {
@@ -110,6 +115,54 @@ let finish = () =>
       switch grandParent.contents {
       | Some(parent) =>
         let opts = {Pulumi.ComponentResource.parent: parent}
+        let customOpts =
+          opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+        // B3.0: Postgres-backed source logs have no DynamoDB stream — provision
+        // the SQS feed queue the change-feed relay fans events into. Its ARN
+        // doubles as the handlers' sourceUrn dispatch key (per-projection
+        // filtering makes over-delivery a no-op).
+        let feedQueue =
+          EventLogBackend.isPostgres() || DcbBackend.isPostgres()
+            ? Some(
+                PgProjectionFeed.makeQueue(
+                  ~name="AllReadModelsFeed",
+                  ~scope="aws-rm-feed",
+                  ~includeClassic=true,
+                  ~includeDcb=true,
+                  ~opts=customOpts,
+                ),
+              )
+            : None
+        let feedArnOutput = switch feedQueue {
+        | Some(queue) => queue.arn
+        | None => Pulumi.Output.make("")
+        }
+
+        // B3.1: Postgres-backed read models get a `pgConnection` in their handler
+        // entry (per read model — admin-exempt ones stay DynamoDB in the same
+        // Lambda). The Lambda itself goes in-VPC when any handler is pg-backed.
+        let qdbSelection = QueryDbBackend.get()
+        let anyPgBacked =
+          readModelInfos->Dict.valuesToArray->Array.some(info => info.pgBacked)
+        let pgConnectionFragment = switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          sel.connectionConfig->Pulumi.Output.apply(cc => {
+            let pgConnectionJson =
+              [
+                ("host", cc.host->JSON.Encode.string),
+                ("port", cc.port->Int.toFloat->JSON.Encode.float),
+                ("database", cc.database->JSON.Encode.string),
+                ("username", cc.username->JSON.Encode.string),
+                ("secretArn", cc.secretArn->JSON.Encode.string),
+              ]
+              ->Dict.fromArray
+              ->JSON.Encode.object
+              ->JSON.stringify
+            `,"pgConnection":${pgConnectionJson}`
+          })
+        | _ => Pulumi.Output.make("")
+        }
 
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
@@ -136,11 +189,21 @@ let finish = () =>
             let mappingsModule =
               info.mappingsModulePath->JSON.stringifyAny->Option.getOr(`""`)
 
+            let handlerPgFragment = info.pgBacked
+              ? pgConnectionFragment
+              : Pulumi.Output.make("")
             let handlerJson =
-              Pulumi.Output.all2((info.queryDbTableName, spec.sourceUrns))
-              ->Pulumi.Output.apply(((tableName, urns)) => {
-                let sourceUrn = urns->Array.getUnsafe(0)
-                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"}`
+              Pulumi.Output.all4((
+                info.queryDbTableName,
+                spec.sourceUrns,
+                feedArnOutput,
+                handlerPgFragment,
+              ))
+              ->Pulumi.Output.apply(((tableName, urns, feedArn, pgFragment)) => {
+                // No stream resource (Postgres-backed source) → dispatch on the
+                // feed queue's ARN instead of a stream URN.
+                let sourceUrn = urns->Array.get(0)->Option.getOr(feedArn)
+                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}}`
               })
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -165,6 +228,25 @@ let finish = () =>
           ~packageDirs,
         )
 
+        // Postgres-backed read models → the projection Lambda writes to RDS, so
+        // it must land in-VPC on the DB-access security group + private subnets.
+        let vpcConfig = switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          Some(
+            sel.securityGroupId
+            ->Pulumi.Output.apply(sgId =>
+              (
+                {
+                  PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+                  securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+                }: PulumiAws.Lambda.Function.vpcConfig
+              )
+            )
+            ->Pulumi.Output.asInput,
+          )
+        | _ => None
+        }
+
         let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
           ~name="AllReadModels",
           ~code,
@@ -172,9 +254,39 @@ let finish = () =>
           ~envVars,
           ~memorySize=maxMemorySize,
           ~timeout=maxTimeout,
+          ~vpcConfig=?vpcConfig,
           ~opts,
         )
 
+        // Grant the Postgres-backed projection Lambda read access to the
+        // RDS-managed master secret so PgRuntime can resolve the DB password.
+        switch (qdbSelection, anyPgBacked) {
+        | (Some(sel), true) =>
+          let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllReadModels-pgSecret",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllReadModels-pgSecretPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowGetPgSecret",
+                      effect: Allow,
+                      actions: Action("secretsmanager:GetSecretValue"),
+                      resources: Resource(cc.secretArn),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | _ => ()
+        }
+
         let channelSpecs = storedSpecs->Array.map(({channelSpec}) => channelSpec)
         let _connectResources = EventCollectorChannel.connect(
           ~name="AllReadModels",
@@ -182,6 +294,19 @@ let finish = () =>
           ~runtime,
           ~opts,
         )
+
+        // B3.0: wire the Postgres feed queue into the Lambda (ESM + receive IAM).
+        switch feedQueue {
+        | Some(queue) =>
+          PgProjectionFeed.connect(
+            ~name="AllReadModelsFeed",
+            ~queue,
+            ~lambda=runtime.parts.lambda,
+            ~lambdaRole=runtime.parts.lambdaRole,
+            ~opts=customOpts,
+          )
+        | None => ()
+        }
       | None =>
         log.warn(
           ~comp="EventCollectorRuntime_Builder_Single",