@reventlessdev/reventless-aws 3.0.0-alpha.175 → 3.0.0-alpha.177

package/src/adapter/QueryDb/QueryDbResolvers.res

@@ -1,2 +1,51 @@
 module AppSync = QueryDbResolvers_AppSync
 module NoOp = QueryDbResolvers_NoOp
+module Lambda = QueryDbResolvers_Lambda
+
+// B3.2b: Postgres-backed read models have no DynamoDB data source — their
+// GraphQL Query fields are served by the shared PgQueryResolver Lambda data
+// source (`QueryDbResolvers_Lambda`, Invoke templates → PgQueryResolver_Lambda).
+// DynamoDB-backed (incl. admin-exempt) read models keep the direct resolver set.
+module Selectable = {
+  type api = QueryDbResolvers_AppSync_NoOp.api
+  type role = QueryDbResolvers_AppSync_NoOp.role
+  let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
+    ~name,
+    ~api,
+    ~apiRole,
+    ~dataSourceName,
+    ~indexes,
+    ~subIdField,
+    ~idResolverConfigs,
+    ~idsResolverConfigs,
+    ~authorization,
+    ~opts,
+  ) =>
+    if QueryDbBackend.isPostgresFor(name) {
+      QueryDbResolvers_Lambda.make(
+        ~name,
+        ~api,
+        ~apiRole,
+        ~dataSourceName,
+        ~indexes,
+        ~subIdField,
+        ~idResolverConfigs,
+        ~idsResolverConfigs,
+        ~authorization,
+        ~opts,
+      )
+    } else {
+      QueryDbResolvers_AppSync.make(
+        ~name,
+        ~api,
+        ~apiRole,
+        ~dataSourceName,
+        ~indexes,
+        ~subIdField,
+        ~idResolverConfigs,
+        ~idsResolverConfigs,
+        ~authorization,
+        ~opts,
+      )
+    }
+}

package/src/adapter/QueryDb/QueryDbResolvers.res.mjs

@@ -1,12 +1,31 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as QueryDbBackend$ReventlessAws from "./QueryDbBackend.res.mjs";
+import * as QueryDbResolvers_Lambda$ReventlessAws from "./QueryDbResolvers_Lambda.res.mjs";
+import * as QueryDbResolvers_AppSync$ReventlessAws from "./QueryDbResolvers_AppSync.res.mjs";
+
+function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolverConfigs, idsResolverConfigs, authorization, opts) {
+  if (QueryDbBackend$ReventlessAws.isPostgresFor(name)) {
+    return QueryDbResolvers_Lambda$ReventlessAws.make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolverConfigs, idsResolverConfigs, authorization, opts);
+  } else {
+    return QueryDbResolvers_AppSync$ReventlessAws.make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolverConfigs, idsResolverConfigs, authorization, opts);
+  }
+}
+
+let Selectable = {
+  make: make
+};
 
 let AppSync;
 
 let NoOp;
 
+let Lambda;
+
 export {
   AppSync,
   NoOp,
+  Lambda,
+  Selectable,
 }
-/* No side effect */
+/* QueryDbResolvers_Lambda-ReventlessAws Not a pure module */

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res

@@ -0,0 +1,264 @@
+// AppSync resolvers for Postgres-backed read models (B3.2b) — the Lambda-data-
+// source parallel to QueryDbResolvers_AppSync's direct DynamoDB resolvers.
+//
+// Every Query field becomes a thin APPSYNC_JS unit resolver whose `Invoke`
+// template carries { readModelName, kind, index?, arguments, identity } to the
+// ONE shared PgQueryResolver Lambda (PgQueryResolver_Builder), which dispatches
+// via PgQueryResolver_Lambda.dispatch. `dataSourceName` is the shared data
+// source's (deferred) name, the same for every Postgres read model.
+//
+// Field names / includeIdParam / connectionSpec come from the same registry the
+// AppSync path reads, so the SDL emitted by GraphQL_FragmentGenerator stays in
+// lockstep. Kinds covered: getById, list (connection), index, byIds. Deferred to
+// B3.2c: items (sub-id connection), @resolves/@resolvesMany, node, auth-table.
+
+module Resolver = AppSync_Resolver_Retrying
+open Reventless.ReadModel
+
+type api = Types.AppSync.api
+type role = Types.AppSync.role
+
+// Identity block shared by every Invoke template (Cognito vs IAM), matching the
+// shape PgQueryResolver_Lambda decodes (Reventless.Identity.t).
+let identityBlock = `id != null && id.sub != null
+      ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+      : id != null
+        ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+        : null`
+
+let invokeTemplate = (~readModelName: string, ~kind: string, ~index: option<string>=?) => {
+  let indexFrag = switch index {
+  | Some(ix) => `\n      index: '${ix}',`
+  | None => ""
+  }
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '${readModelName}',
+      kind: '${kind}',${indexFrag}
+      arguments: ctx.args,
+      identity: ${identityBlock}
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+}
+
+// Cross-table field resolver (@resolves/@resolvesMany, B3.2c): on a parent
+// entity type's field, carrying the parent object (ctx.source) + baked target
+// metadata (`extra`). `sourceType` is the parent read model (used only for auth
+// scoping in dispatch); `target` is the target read model's binding key.
+let invokeFieldTemplate = (~sourceType: string, ~kind: string, ~target: string, ~extra: string) =>
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '${sourceType}',
+      kind: '${kind}',
+      target: '${target}',
+      source: ctx.source,
+      arguments: ctx.args,${extra}
+      identity: ${identityBlock}
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
+  ~name: string,
+  ~api: api,
+  ~apiRole as _: role,
+  ~dataSourceName,
+  ~indexes: array<indexConfig>,
+  ~subIdField,
+  ~idResolverConfigs: array<idResolverConfig>,
+  ~idsResolverConfigs: array<idsResolverConfig>,
+  ~authorization as _: Reventless.Authorization.permission,
+  ~opts,
+) => {
+  let dataSourceName = dataSourceName->Pulumi.Output.asInput
+  let name = name->String.capitalize
+  let registryEntry = ReventlessCore.Plugin_Helpers.queryFieldNamesRegistry->Dict.get(name)
+
+  let fieldNameForSingle = switch registryEntry {
+  | Some({singleFieldName}) => singleFieldName
+  | None => name->Resolver.Functions.uncapitalize
+  }
+  let includeIdParam = switch registryEntry {
+  | Some({includeIdParam}) => includeIdParam
+  | None => true
+  }
+  let connectionSpec = switch registryEntry {
+  | Some({connectionSpec}) => connectionSpec
+  | None => true
+  }
+  let fieldNameForAll = switch registryEntry {
+  | Some({listFieldName}) => listFieldName
+  | None => name ++ "s"
+  }
+  let labelField = switch registryEntry {
+  | Some({labelField: ?lf}) => lf->Option.getOr("id")
+  | None => "id"
+  }
+  let returnTypeName = switch registryEntry {
+  | Some({returnTypeName: rt}) => rt
+  | None => name
+  }
+
+  // Register the binding info the shared Lambda's env config needs (the entry
+  // point gets indexes/subIdField/schema from the spec module; labelField and
+  // includeIdParam come from this deploy-time registry). Keyed by spec name.
+  PgQueryResolver_Builder.register({readModelName: name, labelField, includeIdParam})
+
+  // Relay node type → this read model (for the shared node(id) resolver, B3.2c).
+  // Only entities addressable by id participate in node resolution.
+  if includeIdParam {
+    PgQueryResolver_Builder.registerNodeType(~typeName=returnTypeName, ~readModelName=name)
+  }
+
+  let mkResolver = (~resolverName, ~field, ~kind, ~index=?) =>
+    Resolver.makeUnitJsResolver(
+      ~name=resolverName,
+      ~api,
+      ~dataSourceName,
+      ~type_="Query"->Pulumi.Input.make,
+      ~field=field->Pulumi.Input.make,
+      ~code=invokeTemplate(~readModelName=name, ~kind, ~index?),
+      ~opts,
+    )
+
+  let stripLeadingBy = s =>
+    if s->String.startsWith("by") && s->String.length > 2 {
+      s->String.slice(~start=2, ~end=s->String.length)
+    } else {
+      s
+    }
+
+  // Resolvers are deferred into resourcesMaker (created inside the schema-pushed
+  // builderOutputs.apply, like the AppSync path) — so they only exist after the
+  // fields are ACTIVE and after PgQueryResolver_Builder.provision has resolved
+  // the shared data source name.
+  let resourcesMaker: ReventlessCore.QueryDb.resolversResourcesMaker = _allQueryDbs => {
+    // getById (or listAll when the read model has no id param, e.g. singletons).
+    let byId = mkResolver(
+      ~resolverName=fieldNameForSingle->String.capitalize,
+      ~field=fieldNameForSingle,
+      ~kind=includeIdParam ? "getById" : "list",
+    )
+
+    // Main list — Relay connection (or legacy list when connectionSpec=false).
+    let all = mkResolver(
+      ~resolverName=fieldNameForAll->String.capitalize,
+      ~field=fieldNameForAll,
+      ~kind=connectionSpec ? "list" : "list",
+    )
+
+    // Sub-id connection — {single}Items(id, filter, …); only when subId configured.
+    let items = switch subIdField {
+    | Some(_) => [
+        mkResolver(
+          ~resolverName=fieldNameForSingle->String.capitalize ++ "Items",
+          ~field=fieldNameForSingle ++ "Items",
+          ~kind="items",
+        ),
+      ]
+    | None => []
+    }
+
+    // Batched-by-ids — single-key projections only (mirrors the SDL).
+    let byIds = if includeIdParam && subIdField === None {
+      let byIdsField = fieldNameForAll ++ "ByIds"
+      [
+        mkResolver(
+          ~resolverName=byIdsField->String.capitalize,
+          ~field=byIdsField,
+          ~kind="byIds",
+        ),
+      ]
+    } else {
+      []
+    }
+
+    // Per-index equality queries: {single}By{Index}.
+    let byIndex = indexes->Array.map(({index}) => {
+      let resolverName =
+        fieldNameForSingle->String.capitalize ++ "By" ++ index->stripLeadingBy->String.capitalize
+      let field = fieldNameForSingle ++ "By" ++ index->stripLeadingBy->String.capitalize
+      mkResolver(~resolverName, ~field, ~kind="index", ~index)
+    })
+
+    // @resolves — single cross-table field resolver on this (parent) type. The
+    // target's binding key is its capitalized spec name (mirrors how the binding
+    // registry is keyed); the parent object flows via ctx.source.
+    let idResolvers = idResolverConfigs->Array.map(config => {
+      let {source: {idField, subId, resolvedField}, target} = config
+      let targetKey = target.tableName->String.capitalize
+      let (field, multi) = switch resolvedField {
+      | Single(f) => (f, false)
+      | Multi(f) => (f, true)
+      }
+      let targetFrag = switch target.idField {
+      | Index(ix) => `\n      targetIndex: '${ix}',\n      targetIndexIdField: '${ix}',`
+      | IndexWithId(ix, idf) => `\n      targetIndex: '${ix}',\n      targetIndexIdField: '${idf}',`
+      | Id => ""
+      }
+      let subIdFrag = switch subId {
+      | Field(f) => `\n      sourceSubId: { kind: 'field', name: '${f}' },`
+      | Argument(a) => `\n      sourceSubId: { kind: 'arg', name: '${a}' },`
+      | NoSubId => ""
+      }
+      let extra =
+        `\n      sourceIdField: '${idField}',\n      multi: ${multi ? "true" : "false"},` ++
+        targetFrag ++
+        subIdFrag
+      Resolver.makeUnitJsResolver(
+        ~name=name ++ field->String.capitalize,
+        ~api,
+        ~dataSourceName,
+        ~type_=name->Pulumi.Input.make,
+        ~field=field->Pulumi.Input.make,
+        ~code=invokeFieldTemplate(~sourceType=name, ~kind="resolveOne", ~target=targetKey, ~extra),
+        ~opts,
+      )
+    })
+
+    // @resolvesMany — batch cross-table field resolver (BatchGet by ids).
+    let idsResolvers = idsResolverConfigs->Array.map(config => {
+      let {source: {idsField, resolvedField}, target} = config
+      let targetKey = target.tableName->String.capitalize
+      let extra = `\n      sourceIdsField: '${idsField}',`
+      Resolver.makeUnitJsResolver(
+        ~name=name ++ resolvedField->String.capitalize,
+        ~api,
+        ~dataSourceName,
+        ~type_=name->Pulumi.Input.make,
+        ~field=resolvedField->Pulumi.Input.make,
+        ~code=invokeFieldTemplate(~sourceType=name, ~kind="resolveMany", ~target=targetKey, ~extra),
+        ~opts,
+      )
+    })
+
+    [byId, all]
+    ->Array.concat(items)
+    ->Array.concat(byIds)
+    ->Array.concat(byIndex)
+    ->Array.concat(idResolvers)
+    ->Array.concat(idsResolvers)
+    ->Array.map(Util.AppSync.toResourceNative)
+  }
+
+  {ReventlessCore.QueryDb_Adapter.resources: [], resourcesMaker}
+}

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res.mjs

@@ -0,0 +1,164 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Util_AppSync$ReventlessAws from "../../util/Util_AppSync.res.mjs";
+import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+import * as PgQueryResolver_Builder$ReventlessAws from "./PgQueryResolver_Builder.res.mjs";
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
+
+let identityBlock = `id != null && id.sub != null
+      ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+      : id != null
+        ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+        : null`;
+
+function invokeTemplate(readModelName, kind, index) {
+  let indexFrag = index !== undefined ? `\n      index: '` + index + `',` : "";
+  return `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '` + readModelName + `',
+      kind: '` + kind + `',` + indexFrag + `
+      arguments: ctx.args,
+      identity: ` + identityBlock + `
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+}
+
+function invokeFieldTemplate(sourceType, kind, target, extra) {
+  return `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '` + sourceType + `',
+      kind: '` + kind + `',
+      target: '` + target + `',
+      source: ctx.source,
+      arguments: ctx.args,` + extra + `
+      identity: ` + identityBlock + `
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+}
+
+function make(name, api, param, dataSourceName, indexes, subIdField, idResolverConfigs, idsResolverConfigs, param$1, opts) {
+  let name$1 = Stdlib_String.capitalize(name);
+  let registryEntry = Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name$1];
+  let fieldNameForSingle = registryEntry !== undefined ? registryEntry.singleFieldName : AppSync_Resolver_Functions$PulumiAws.uncapitalize(name$1);
+  let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
+  let fieldNameForAll = registryEntry !== undefined ? registryEntry.listFieldName : name$1 + "s";
+  let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
+  let returnTypeName = registryEntry !== undefined ? registryEntry.returnTypeName : name$1;
+  PgQueryResolver_Builder$ReventlessAws.register({
+    readModelName: name$1,
+    labelField: labelField,
+    includeIdParam: includeIdParam
+  });
+  if (includeIdParam) {
+    PgQueryResolver_Builder$ReventlessAws.registerNodeType(returnTypeName, name$1);
+  }
+  let mkResolver = (resolverName, field, kind, index) => AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, invokeTemplate(name$1, kind, index), opts);
+  let stripLeadingBy = s => {
+    if (s.startsWith("by") && s.length > 2) {
+      return s.slice(2, s.length);
+    } else {
+      return s;
+    }
+  };
+  let resourcesMaker = _allQueryDbs => {
+    let byId = mkResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, includeIdParam ? "getById" : "list", undefined);
+    let all = mkResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, "list", undefined);
+    let items = subIdField !== undefined ? [mkResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", "items", undefined)] : [];
+    let byIds;
+    if (includeIdParam && subIdField === undefined) {
+      let byIdsField = fieldNameForAll + "ByIds";
+      byIds = [mkResolver(Stdlib_String.capitalize(byIdsField), byIdsField, "byIds", undefined)];
+    } else {
+      byIds = [];
+    }
+    let byIndex = indexes.map(param => {
+      let index = param.index;
+      let resolverName = Stdlib_String.capitalize(fieldNameForSingle) + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
+      let field = fieldNameForSingle + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
+      return mkResolver(resolverName, field, "index", index);
+    });
+    let idResolvers = idResolverConfigs.map(config => {
+      let target = config.target;
+      let match = config.source;
+      let resolvedField = match.resolvedField;
+      let subId = match.subId;
+      let targetKey = Stdlib_String.capitalize(target.tableName);
+      let match$1;
+      match$1 = resolvedField.TAG === "Single" ? [
+          resolvedField._0,
+          false
+        ] : [
+          resolvedField._0,
+          true
+        ];
+      let field = match$1[0];
+      let ix = target.idField;
+      let targetFrag;
+      if (typeof ix !== "object") {
+        targetFrag = "";
+      } else if (ix.TAG === "Index") {
+        let ix$1 = ix._0;
+        targetFrag = `\n      targetIndex: '` + ix$1 + `',\n      targetIndexIdField: '` + ix$1 + `',`;
+      } else {
+        targetFrag = `\n      targetIndex: '` + ix._0 + `',\n      targetIndexIdField: '` + ix._1 + `',`;
+      }
+      let subIdFrag;
+      subIdFrag = typeof subId !== "object" ? "" : (
+          subId.TAG === "Field" ? `\n      sourceSubId: { kind: 'field', name: '` + subId._0 + `' },` : `\n      sourceSubId: { kind: 'arg', name: '` + subId._0 + `' },`
+        );
+      let extra = `\n      sourceIdField: '` + match.idField + `',\n      multi: ` + (
+        match$1[1] ? "true" : "false"
+      ) + `,` + targetFrag + subIdFrag;
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(field), api, dataSourceName, name$1, field, invokeFieldTemplate(name$1, "resolveOne", targetKey, extra), opts);
+    });
+    let idsResolvers = idsResolverConfigs.map(config => {
+      let match = config.source;
+      let resolvedField = match.resolvedField;
+      let targetKey = Stdlib_String.capitalize(config.target.tableName);
+      let extra = `\n      sourceIdsField: '` + match.idsField + `',`;
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(resolvedField), api, dataSourceName, name$1, resolvedField, invokeFieldTemplate(name$1, "resolveMany", targetKey, extra), opts);
+    });
+    return [
+      byId,
+      all
+    ].concat(items).concat(byIds).concat(byIndex).concat(idResolvers).concat(idsResolvers).map(Util_AppSync$ReventlessAws.toResourceNative);
+  };
+  return {
+    resources: [],
+    resourcesMaker: resourcesMaker
+  };
+}
+
+let Resolver;
+
+export {
+  Resolver,
+  identityBlock,
+  invokeTemplate,
+  invokeFieldTemplate,
+  make,
+}
+/* Util_AppSync-ReventlessAws Not a pure module */

package/src/adapter/QueryDb/QueryDbStorage.res

@@ -3,3 +3,47 @@ let name = "QueryDbStorage"
 module DynamoDb = QueryDbStorage_DynamoDb
 module DynamoDbStream = QueryDbStorage_DynamoDbStream
 module DynamoDb_Runtime = QueryDbStorage_DynamoDb_Runtime
+module Postgres = QueryDbStorage_Postgres
+
+// Build-time QueryDb storage selectors (B3.1). Read `QueryDbBackend` — set by the
+// platform when a `PgConnection` is supplied — and dispatch per read model:
+// Postgres (no table, no data source) unless the name is admin-exempt. The Stream
+// selector falls back to the streamed DynamoDB maker; on Postgres there is no
+// stream — live updates for Postgres-backed read models are deferred (B3.3).
+module Selectable = {
+  type api = QueryDbStorage_Postgres.api
+  type role = QueryDbStorage_Postgres.role
+  let make: ReventlessCore.QueryDb_Adapter.storageMaker<api, role> = (
+    ~name,
+    ~indexes,
+    ~subIdField=?,
+    ~ttl=?,
+    ~api,
+    ~apiRole,
+    ~opts,
+  ) =>
+    if QueryDbBackend.isPostgresFor(name) {
+      Postgres.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)
+    } else {
+      DynamoDb.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)
+    }
+}
+
+module SelectableStream = {
+  type api = QueryDbStorage_Postgres.api
+  type role = QueryDbStorage_Postgres.role
+  let make: ReventlessCore.QueryDb_Adapter.storageMaker<api, role> = (
+    ~name,
+    ~indexes,
+    ~subIdField=?,
+    ~ttl=?,
+    ~api,
+    ~apiRole,
+    ~opts,
+  ) =>
+    if QueryDbBackend.isPostgresFor(name) {
+      Postgres.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)
+    } else {
+      DynamoDbStream.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)
+    }
+}

package/src/adapter/QueryDb/QueryDbStorage.res.mjs

@@ -1,5 +1,33 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as QueryDbBackend$ReventlessAws from "./QueryDbBackend.res.mjs";
+import * as QueryDbStorage_DynamoDb$ReventlessAws from "./QueryDbStorage_DynamoDb.res.mjs";
+import * as QueryDbStorage_Postgres$ReventlessAws from "./QueryDbStorage_Postgres.res.mjs";
+import * as QueryDbStorage_DynamoDbStream$ReventlessAws from "./QueryDbStorage_DynamoDbStream.res.mjs";
+
+function make(name, indexes, subIdField, ttl, api, apiRole, opts) {
+  if (QueryDbBackend$ReventlessAws.isPostgresFor(name)) {
+    return QueryDbStorage_Postgres$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
+  } else {
+    return QueryDbStorage_DynamoDb$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
+  }
+}
+
+let Selectable = {
+  make: make
+};
+
+function make$1(name, indexes, subIdField, ttl, api, apiRole, opts) {
+  if (QueryDbBackend$ReventlessAws.isPostgresFor(name)) {
+    return QueryDbStorage_Postgres$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
+  } else {
+    return QueryDbStorage_DynamoDbStream$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
+  }
+}
+
+let SelectableStream = {
+  make: make$1
+};
 
 let name = "QueryDbStorage";
 
@@ -9,10 +37,15 @@ let DynamoDbStream;
 
 let DynamoDb_Runtime;
 
+let Postgres;
+
 export {
   name,
   DynamoDb,
   DynamoDbStream,
   DynamoDb_Runtime,
+  Postgres,
+  Selectable,
+  SelectableStream,
 }
-/* No side effect */
+/* QueryDbStorage_DynamoDb-ReventlessAws Not a pure module */

package/src/adapter/QueryDb/QueryDbStorage_Postgres.res

@@ -0,0 +1,47 @@
+// Deploy-time QueryDb storage for the Postgres backend (B3.1) — the read-model
+// analogue of `EventLogStorage_Postgres` / `DcbEventLogStorage_Postgres`.
+//
+// Creates NO DynamoDB table and NO AppSync data source: read-model state lives in
+// Postgres (`qdb_<name>`, JSONB) and is written by the projection Lambdas via the
+// runtime ops. Returns:
+//   - `resources: []` — no stream, no direct AppSync resolvers (suppressed by
+//     `QueryDbResolvers.Selectable` until B3.2's Lambda data source);
+//   - `dataSourceName: ""` — nothing to attach resolvers to;
+//   - `operations` — the Postgres op set bound to the shared `PgConnection` pool.
+//     Schema setup is lazy (first operation), so nothing connects during
+//     `pulumi up` — a real query only runs inside a Lambda at runtime.
+//
+// Selected by `QueryDbStorage.Selectable(Stream)` when `QueryDbBackend` holds a
+// selection and the read model is not admin-exempt.
+
+type api = Types.AppSync.api
+type role = Types.AppSync.role
+
+let make: ReventlessCore.QueryDb_Adapter.storageMaker<api, role> = (
+  ~name,
+  ~indexes,
+  ~subIdField=?,
+  ~ttl as _=?,
+  ~api as _,
+  ~apiRole as _,
+  ~opts as _,
+) => {
+  let operations = switch QueryDbBackend.get() {
+  | Some({connectionConfig}) =>
+    connectionConfig->Pulumi.Output.apply(config =>
+      QueryDbStorage_Postgres_Runtime.opsFor(config, ~name, ~indexes, ~subIdField?)
+    )
+  | None =>
+    // Selectable only routes here when a selection is set; guard defensively.
+    JsError.throwWithMessage("QueryDbStorage_Postgres.make called without a QueryDbBackend selection")
+  }
+  {
+    ReventlessCore.QueryDb_Adapter.resources: [],
+    // B3.2b: the shared PgQueryResolver Lambda data source. Deferred — resolved
+    // by PgQueryResolver_Builder.provision after every plugin is built (the
+    // resolvers that read it are created even later, inside the schema-pushed
+    // resourcesMaker). Same value for every Postgres read model.
+    dataSourceName: PgQueryResolver_Builder.dataSourceName,
+    operations,
+  }
+}

package/src/adapter/QueryDb/QueryDbStorage_Postgres.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as QueryDbBackend$ReventlessAws from "./QueryDbBackend.res.mjs";
+import * as PgQueryResolver_Builder$ReventlessAws from "./PgQueryResolver_Builder.res.mjs";
+import * as QueryDbStorage_Postgres_Runtime$ReventlessAws from "./QueryDbStorage_Postgres_Runtime.res.mjs";
+
+function make(name, indexes, subIdField, param, param$1, param$2, param$3) {
+  let match = QueryDbBackend$ReventlessAws.get();
+  let operations = match !== undefined ? match.connectionConfig.apply(config => QueryDbStorage_Postgres_Runtime$ReventlessAws.opsFor(config, name, indexes, subIdField)) : Stdlib_JsError.throwWithMessage("QueryDbStorage_Postgres.make called without a QueryDbBackend selection");
+  return {
+    resources: [],
+    dataSourceName: PgQueryResolver_Builder$ReventlessAws.dataSourceName,
+    operations: operations
+  };
+}
+
+export {
+  make,
+}
+/* PgQueryResolver_Builder-ReventlessAws Not a pure module */