@reventlessdev/reventless-aws 3.0.0-alpha.175 → 3.0.0-alpha.176

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
@@ -7,7 +8,13 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as QueryDbBackend$ReventlessAws from "../QueryDb/QueryDbBackend.res.mjs";
+import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
+import * as PgProjectionFeed$ReventlessAws from "../Postgres/PgProjectionFeed.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
 
@@ -15,11 +22,13 @@ let log = Logger$ReventlessCore.fromEnv();
 
 let readModelInfos = {};
 
-function registerReadModel(readModelName, specModulePath, mappingsModulePath, queryDbTableName) {
+function registerReadModel(readModelName, specModulePath, mappingsModulePath, queryDbTableName, pgBackedOpt) {
+  let pgBacked = pgBackedOpt !== undefined ? pgBackedOpt : false;
   readModelInfos[readModelName] = {
     specModulePath: specModulePath,
     mappingsModulePath: mappingsModulePath,
-    queryDbTableName: queryDbTableName
+    queryDbTableName: queryDbTableName,
+    pgBacked: pgBacked
   };
 }
 
@@ -81,6 +90,36 @@ function finish() {
       let opts = {
         parent: opts_parent
       };
+      let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+      let feedQueue = EventLogBackend$ReventlessAws.isPostgres() || DcbBackend$ReventlessAws.isPostgres() ? PgProjectionFeed$ReventlessAws.makeQueue("AllReadModelsFeed", "aws-rm-feed", true, true, customOpts) : undefined;
+      let feedArnOutput = feedQueue !== undefined ? feedQueue.arn : Pulumi.output("");
+      let qdbSelection = QueryDbBackend$ReventlessAws.get();
+      let anyPgBacked = Object.values(readModelInfos).some(info => info.pgBacked);
+      let pgConnectionFragment = qdbSelection !== undefined && anyPgBacked ? qdbSelection.connectionConfig.apply(cc => {
+          let pgConnectionJson = JSON.stringify(Object.fromEntries([
+            [
+              "host",
+              cc.host
+            ],
+            [
+              "port",
+              cc.port
+            ],
+            [
+              "database",
+              cc.database
+            ],
+            [
+              "username",
+              cc.username
+            ],
+            [
+              "secretArn",
+              cc.secretArn
+            ]
+          ]));
+          return `,"pgConnection":` + pgConnectionJson;
+        }) : Pulumi.output("");
       let handlerOutputs = [];
       let packageDirs = {};
       let sortedSpecs = storedSpecs.toSorted((a, b) => Primitive_string.compare(a.componentName, b.componentName));
@@ -95,12 +134,15 @@ function finish() {
         packageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
         let specModule = Stdlib_Option.getOr(JSON.stringify(info.specModulePath), `""`);
         let mappingsModule = Stdlib_Option.getOr(JSON.stringify(info.mappingsModulePath), `""`);
+        let handlerPgFragment = info.pgBacked ? pgConnectionFragment : Pulumi.output("");
         let handlerJson = Pulumi.all([
           info.queryDbTableName,
-          spec.sourceUrns
+          spec.sourceUrns,
+          feedArnOutput,
+          handlerPgFragment
         ]).apply(param => {
-          let sourceUrn = param[1][0];
-          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"}`;
+          let sourceUrn = Stdlib_Option.getOr(param[1][0], param[2]);
+          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"` + param[3] + `}`;
         });
         handlerOutputs.push(handlerJson);
       });
@@ -108,9 +150,27 @@ function finish() {
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs", packageDirs, undefined);
-      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, undefined, opts);
+      let vpcConfig = qdbSelection !== undefined && anyPgBacked ? qdbSelection.securityGroupId.apply(sgId => ({
+          subnetIds: qdbSelection.subnetIds,
+          securityGroupIds: [sgId]
+        })) : undefined;
+      let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset("AllReadModels", match$1.code, match$1.sourceCodeHash, envVars, match[0], match[1], undefined, undefined, undefined, undefined, vpcConfig, opts);
+      if (qdbSelection !== undefined && anyPgBacked) {
+        qdbSelection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)("AllReadModels-pgSecret", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllReadModels-pgSecretPolicy", [{
+              Sid: "AllowGetPgSecret",
+              Effect: "Allow",
+              Action: "secretsmanager:GetSecretValue",
+              Resource: cc.secretArn
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllReadModels", channelSpecs, runtime, opts);
+      if (feedQueue !== undefined) {
+        PgProjectionFeed$ReventlessAws.connect("AllReadModelsFeed", feedQueue, runtime.parts.lambda, runtime.parts.lambdaRole, customOpts);
+      }
     } else {
       log.warn("EventCollectorRuntime_Builder_Single", undefined, `finish: grandParent not set`);
     }

package/src/adapter/Runtime/PgChangeFeedRelayEntryPoint.mjs

@@ -1,20 +1,22 @@
 // PgChangeFeedRelay Lambda entry point (scheduled poll — B2.3).
 //
 // Triggered on a schedule (EventBridge rate rule). Each invocation drains every
-// Postgres DCB log listed in HANDLER_CONFIG from its checkpoint and relays the
-// events, transformed into the {id, meta, event} shape, onto the plugin
-// EventCollector SQS queue — which then fans out to projections, aggregate
-// command topics, and the cross-plugin SNS EventTopic.
-// See docs/plans/aws-postgres-change-feed-bridge.md.
+// Postgres log listed in HANDLER_CONFIG from its checkpoint — DCB (`dcb_event`)
+// and classic aggregate (`event_log`) logs alike — and relays the events,
+// transformed into the {id, meta, event} shape, onto the plugin EventCollector
+// SQS queue — which then fans out to projections, aggregate command topics, and
+// the cross-plugin SNS EventTopic.
+// See docs/plans/done/aws-postgres-change-feed-bridge.md.
 //
 // HANDLER_CONFIG shape:
 //   { "logs": [ { "pgConnection": {host,port,database,username,secretArn},
-//                 "logName": string,          // dcb_event.log_name
-//                 "subscriber": string,        // dcb_subscription checkpoint key
+//                 "logName": string,          // dcb_event/event_log log_name
+//                 "subscriber": string,        // per-log checkpoint key
 //                 "targetQueueUrl": string,    // plugin EventCollector SQS URL
-//                 "partitionTag"?: <derivedPartitionTag> } ] }
+//                 "kind"?: "classic",          // absent → DCB
+//                 "partitionTag"?: <derivedPartitionTag> } ] }  // DCB only
 
-import { relay } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+import { relay, relayClassic } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
 import { sendMessage } from "@reventlessdev/reventless-aws/src/util/Util_SQS_Runtime.res.mjs";
 import { makeQueueRef, log } from "./HandlerFactoryHelpers.mjs";
 
@@ -37,7 +39,10 @@ export async function handler(_event, _context) {
     logs.map(async (l) => {
       const sendBatch = makeSendBatch(l.targetQueueUrl);
       try {
-        const count = await relay(l.pgConnection, l.logName, l.subscriber, l.partitionTag, sendBatch);
+        const count =
+          l.kind === "classic"
+            ? await relayClassic(l.pgConnection, l.logName, l.subscriber, sendBatch)
+            : await relay(l.pgConnection, l.logName, l.subscriber, l.partitionTag, sendBatch);
         log.debug("relayed " + count + " event(s) for " + l.logName, { comp: "PgChangeFeedRelay" });
       } catch (err) {
         // Log and continue — a failed log this tick is retried next tick from its

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -7,6 +7,7 @@ import { patchSpecId, makeTableRef, log, pluginName } from "./HandlerFactoryHelp
 import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 import { Make as readModelCallbackMake } from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel_Callback.res.mjs";
 import { load as qdbLoad, loadStream as qdbLoadStream, save as qdbSave, saveBatch as qdbSaveBatch, count as qdbCount, $$delete as qdbDelete, deleteBatch as qdbDeleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -69,21 +70,37 @@ function groupBySource(records) {
   return dict;
 }
 
-function buildReadModelHandler(specModule, mappingsModule, queryDbTableName) {
+// `pgConnection`, when present, is the resolved PgConnection.connectionConfig the
+// runtime builder injected for a Postgres-backed read model: bind the Postgres
+// operation set (queryDbTableName is then the read-model spec name, the shared
+// `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
+function buildReadModelHandler(specModule, mappingsModule, queryDbTableName, pgConnection) {
   const patchedSpec = patchSpecId(specModule);
-  const table = makeTableRef(queryDbTableName);
-  const rawSave = qdbSave(table);
-  const rawSaveBatch = qdbSaveBatch(table);
-
-  const operations = {
-    load: qdbLoad(table),
-    loadStream: qdbLoadStream(table),
-    save: mkInjectIdSave(rawSave),
-    saveBatch: mkInjectIdSaveBatch(rawSaveBatch),
-    count: qdbCount(table),
-    delete: qdbDelete(table),
-    deleteBatch: qdbDeleteBatch(table),
-  };
+  let operations;
+  if (pgConnection) {
+    const indexes = (patchedSpec.config && patchedSpec.config.indexes) || [];
+    const subIdField = patchedSpec.subIdConfig ? patchedSpec.subIdConfig.subIdField : undefined;
+    const pgOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+    operations = {
+      ...pgOps,
+      save: mkInjectIdSave(pgOps.save),
+      saveBatch: mkInjectIdSaveBatch(pgOps.saveBatch),
+    };
+  } else {
+    const table = makeTableRef(queryDbTableName);
+    const rawSave = qdbSave(table);
+    const rawSaveBatch = qdbSaveBatch(table);
+
+    operations = {
+      load: qdbLoad(table),
+      loadStream: qdbLoadStream(table),
+      save: mkInjectIdSave(rawSave),
+      saveBatch: mkInjectIdSaveBatch(rawSaveBatch),
+      count: qdbCount(table),
+      delete: qdbDelete(table),
+      deleteBatch: qdbDeleteBatch(table),
+    };
+  }
 
   const effectiveMappings = fixMappingsModule(mappingsModule);
   const callback = readModelCallbackMake(patchedSpec)(effectiveMappings)({
@@ -102,7 +119,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const mappingsModule = await dynamicImport(h.mappingsModule);
-    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName);
+    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName, h.pgConnection);
     // Multiple read models can share one source stream — e.g. every admin read
     // model (Plugins, PluginHistory, PlatformEventGraph, UIFragmentRegistry)
     // projects the Plugin aggregate's EventLog stream. Accumulate ALL handlers

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -10,6 +10,7 @@ import { makeTableRef, log, pluginName } from "./HandlerFactoryHelpers.mjs";
 import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 import { handleAction } from "@reventlessdev/reventless-core/src/Projection.res.mjs";
 import { load, loadStream, save, saveBatch, count, $$delete, deleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -40,17 +41,27 @@ function groupBySource(records) {
   return dict;
 }
 
-function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName) {
-  const table = makeTableRef(queryDbTableName);
-  const queryDbOps = {
-    load: load(table),
-    loadStream: loadStream(table),
-    save: save(table),
-    saveBatch: saveBatch(table),
-    count: count(table),
-    delete: $$delete(table),
-    deleteBatch: deleteBatch(table),
-  };
+// `pgConnection`, when present, selects the Postgres QueryDb runtime for this
+// slice's view table (`queryDbTableName` is then the slice spec name, the shared
+// `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
+function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName, pgConnection) {
+  let queryDbOps;
+  if (pgConnection) {
+    const indexes = (specModule.config && specModule.config.indexes) || [];
+    const subIdField = specModule.subIdConfig ? specModule.subIdConfig.subIdField : undefined;
+    queryDbOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+  } else {
+    const table = makeTableRef(queryDbTableName);
+    queryDbOps = {
+      load: load(table),
+      loadStream: loadStream(table),
+      save: save(table),
+      saveBatch: saveBatch(table),
+      count: count(table),
+      delete: $$delete(table),
+      deleteBatch: deleteBatch(table),
+    };
+  }
   // Spec module exports `consumedEventSchema`; the `project` function lives in
   // the sibling projection module (`<Name>_Projection.res`).
   const eventSchema = specModule.consumedEventSchema;
@@ -91,6 +102,9 @@ function expandHandlers(config) {
       projectionModule: base + h.p,
       queryDbTableName: h.q,
       sourceUrn: h.u !== undefined ? h.u : sharedUrn,
+      // Shared across a plugin's slices (all follow the platform backend toggle);
+      // hoisted to the top level of the compressed config like base/sourceUrn.
+      pgConnection: config.pgConnection,
     };
   });
 }
@@ -104,7 +118,7 @@ async function buildAllHandlers() {
       dynamicImport(h.specModule),
       dynamicImport(h.projectionModule),
     ]);
-    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName);
+    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName, h.pgConnection);
     const streamHandler = (event, context) => handleStreamEvent(jsonEventsHandler, event, context);
     const existing = handlers[h.sourceUrn] || [];
     existing.push(streamHandler);

package/src/adapter/Runtime/StateViewSliceRuntime_Builder_Single.res

@@ -129,18 +129,44 @@ let buildLambda = (
   ~handlerOutputs: array<Pulumi.Output.t<handlerEntry>>,
   ~packageDirs,
   ~channelSpecs,
+  ~feedQueue: option<PulumiAws.SQS.Queue.t>=None,
   ~memorySize=1024,
   ~timeout=30,
 ) => {
   let opts = {Pulumi.ComponentResource.parent: parent}
+
+  // B3.1: on a Postgres-backed platform every slice view table lives in
+  // Postgres (slices are never admin-exempt) — one shared `pgConnection` is
+  // hoisted to the top level of the compressed config, like base/sourceUrn.
+  let qdbSelection = QueryDbBackend.get()
+  let pgConnectionFragment = switch qdbSelection {
+  | Some(sel) =>
+    sel.connectionConfig->Pulumi.Output.apply(cc => {
+      let pgConnectionJson =
+        [
+          ("host", cc.host->JSON.Encode.string),
+          ("port", cc.port->Int.toFloat->JSON.Encode.float),
+          ("database", cc.database->JSON.Encode.string),
+          ("username", cc.username->JSON.Encode.string),
+          ("secretArn", cc.secretArn->JSON.Encode.string),
+        ]
+        ->Dict.fromArray
+        ->JSON.Encode.object
+        ->JSON.stringify
+      `,"pgConnection":${pgConnectionJson}`
+    })
+  | None => Pulumi.Output.make("")
+  }
+
   // Compress HANDLER_CONFIG to stay under AWS Lambda's 4KB env-var ceiling:
   // hoist the common module-path prefix (`base`) and the shared DCB stream
   // `sourceUrn` (identical across a plugin's slices) out of the per-handler
   // entries, and use short keys (s/p/q/u). StateViewSliceEntryPoint re-expands
   // these. Durable fix (externalize to S3/SSM) tracked in docs/plans.
   let handlerConfigOutput =
-    Pulumi.Output.all(handlerOutputs)
-    ->Pulumi.Output.apply(handlers => {
+    (Pulumi.Output.all(handlerOutputs), pgConnectionFragment)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((handlers, pgFragment)) => {
       let paths = []
       handlers->Array.forEach(h => {
         paths->Array.push(h.specModule)->ignore
@@ -175,7 +201,7 @@ let buildLambda = (
         ->Array.join(",")
       let baseJson = base->JSON.stringifyAny->Option.getOr(`""`)
       let urnJson = sharedUrn->JSON.stringifyAny->Option.getOr(`""`)
-      `{"v":2,"base":${baseJson},"sourceUrn":${urnJson},"handlers":[${entries}]}`
+      `{"v":2,"base":${baseJson},"sourceUrn":${urnJson},"handlers":[${entries}]${pgFragment}}`
     })
 
   let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
@@ -201,6 +227,25 @@ let buildLambda = (
     ~packageDirs,
   )
 
+  // Postgres-backed view tables → the projection Lambda writes to RDS, so it
+  // must land in-VPC on the DB-access security group + private subnets.
+  let vpcConfig = switch qdbSelection {
+  | Some(sel) =>
+    Some(
+      sel.securityGroupId
+      ->Pulumi.Output.apply(sgId =>
+        (
+          {
+            PulumiAws.Lambda.Function.subnetIds: sel.subnetIds->Pulumi.Input.make,
+            securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+          }: PulumiAws.Lambda.Function.vpcConfig
+        )
+      )
+      ->Pulumi.Output.asInput,
+    )
+  | None => None
+  }
+
   let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
     ~name="AllStateViewSlices",
     ~code,
@@ -208,15 +253,58 @@ let buildLambda = (
     ~envVars,
     ~memorySize,
     ~timeout,
+    ~vpcConfig=?vpcConfig,
     ~opts,
   )
 
+  // Grant the Postgres-backed projection Lambda read access to the RDS-managed
+  // master secret so PgRuntime can resolve the DB password at cold start.
+  switch qdbSelection {
+  | Some(sel) =>
+    let _ = sel.connectionConfig->Pulumi.Output.apply(cc => {
+      open PulumiAws.PolicyDocument
+      PulumiAws.IAM.RolePolicy.make(
+        ~name="AllStateViewSlices-pgSecret",
+        ~args={
+          policy: PulumiAws.PolicyDocument.make(
+            ~id="AllStateViewSlices-pgSecretPolicy",
+            ~statements=[
+              {
+                sid: "AllowGetPgSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(cc.secretArn),
+              },
+            ],
+          )
+          ->PulumiAws.PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+        },
+      )
+    })
+  | None => ()
+  }
+
   let _connectResources = EventCollectorChannel.connect(
     ~name="AllStateViewSlices",
     ~channelSpecs,
     ~runtime,
     ~opts,
   )
+
+  // B3.0: wire the Postgres feed queue into the Lambda (ESM + receive IAM).
+  switch feedQueue {
+  | Some(queue) =>
+    PgProjectionFeed.connect(
+      ~name="AllStateViewSlicesFeed",
+      ~queue,
+      ~lambda=runtime.parts.lambda,
+      ~lambdaRole=runtime.parts.lambdaRole,
+      ~opts=opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions,
+    )
+  | None => ()
+  }
 }
 
 let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component) =>
@@ -236,6 +324,25 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
           ~opts={Pulumi.ComponentResource.parent: parent},
         )
 
+        // B3.0: a Postgres-backed DCB log has no stream resource — provision the
+        // SQS feed queue the change-feed relay fans DCB events into. Its ARN is
+        // the handlers' sourceUrn dispatch key.
+        let feedQueue = DcbBackend.isPostgres()
+          ? Some(
+              PgProjectionFeed.makeQueue(
+                ~name="AllStateViewSlicesFeed",
+                ~scope="aws-svs-feed",
+                ~includeClassic=false,
+                ~includeDcb=true,
+                ~opts={Pulumi.CustomResourceOptions.parent: parent},
+              ),
+            )
+          : None
+        let feedArnOutput = switch feedQueue {
+        | Some(queue) => queue.arn
+        | None => Pulumi.Output.make("")
+        }
+
         let handlerOutputs: array<Pulumi.Output.t<handlerEntry>> = []
         let packageDirs: dict<string> = Dict.make()
         let allQueryDbResources: array<ReventlessInfra.Adapter.resource> = []
@@ -248,8 +355,11 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
           packageDirs->Dict.set(projectionPkg, Util_Bundle.resolvePackageRoot(projectionPkg))
 
           let etResources: array<ReventlessInfra.Adapter.resource> = dcbOutputs.eventTopic.resources
-          let sourceUrn = etResources->Array.getUnsafe(0)
-          let sourceUrn = sourceUrn.urn
+          // No stream resource (Postgres DCB) → dispatch on the feed queue ARN.
+          let sourceUrn = switch etResources->Array.get(0) {
+          | Some(resource) => resource.urn
+          | None => feedArnOutput
+          }
 
           let handlerJson =
             Pulumi.Output.all2((info.queryDbTableName, sourceUrn))
@@ -270,6 +380,7 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
           ~handlerOutputs,
           ~packageDirs,
           ~channelSpecs=[{channel: channel, eventTopics, resources: allQueryDbResources}],
+          ~feedQueue,
         )
       | None =>
         log.warn(
@@ -300,6 +411,23 @@ let finish = () =>
         let handlerOutputs: array<Pulumi.Output.t<handlerEntry>> = []
         let packageDirs: dict<string> = Dict.make()
 
+        // B3.0: Postgres-backed source logs have no stream — feed queue instead.
+        let feedQueue = DcbBackend.isPostgres()
+          ? Some(
+              PgProjectionFeed.makeQueue(
+                ~name="AllStateViewSlicesFeed",
+                ~scope="aws-svs-feed",
+                ~includeClassic=false,
+                ~includeDcb=true,
+                ~opts={Pulumi.CustomResourceOptions.parent: parent},
+              ),
+            )
+          : None
+        let feedArnOutput = switch feedQueue {
+        | Some(queue) => queue.arn
+        | None => Pulumi.Output.make("")
+        }
+
         storedSpecs->Array.forEach(spec => {
           switch sliceInfos->Dict.get(spec.componentName) {
           | Some(info) =>
@@ -309,13 +437,14 @@ let finish = () =>
             packageDirs->Dict.set(projectionPkg, Util_Bundle.resolvePackageRoot(projectionPkg))
 
             let handlerJson =
-              Pulumi.Output.all2((info.queryDbTableName, spec.sourceUrns))
-              ->Pulumi.Output.apply(((tableName, urns)) => {
+              Pulumi.Output.all3((info.queryDbTableName, spec.sourceUrns, feedArnOutput))
+              ->Pulumi.Output.apply(((tableName, urns, feedArn)) => {
                 let entry: handlerEntry = {
                   specModule: info.specModulePath,
                   projectionModule: info.projectionModulePath,
                   queryDbTableName: tableName,
-                  sourceUrn: urns->Array.getUnsafe(0),
+                  // No stream resource (Postgres) → dispatch on the feed queue ARN.
+                  sourceUrn: urns->Array.get(0)->Option.getOr(feedArn),
                 }
                 entry
               })
@@ -333,6 +462,7 @@ let finish = () =>
           ~handlerOutputs,
           ~packageDirs,
           ~channelSpecs=storedSpecs->Array.map(({channelSpec}) => channelSpec),
+          ~feedQueue,
           ~memorySize=maxMemorySize,
           ~timeout=maxTimeout,
         )