@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.177

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.177 (2026-07-06)
+
+### Features
+
+* **reventless-aws:** AppSync read path for Postgres read models (B3.2b) ([a6dd6cb](https://github.com/ReventlessDev/reventless-core/commit/a6dd6cbddfc65410bf96da49bb2603c88670aced))
+* **reventless-aws:** cross-table @resolves/[@resolves](https://github.com/resolves)Many + node resolvers for Postgres reads (B3.2c) ([713b6ab](https://github.com/ReventlessDev/reventless-core/commit/713b6ab736715209e7198b2b4ab609c5447adef5))
+* **reventless-postgres,reventless-aws:** items (sub-id connection) resolver for Postgres reads (B3.2c) ([2477220](https://github.com/ReventlessDev/reventless-core/commit/247722062913f5d0bcb5895b152f05033d8297d8))
+
+
 # 3.0.0-alpha.176 (2026-07-06)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.176",
+  "version": "3.0.0-alpha.177",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,16 +9,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.25",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.25",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.14",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.143",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.89",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.5",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.67",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.143"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.6",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.67"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -1470,6 +1470,18 @@ module MakeWithConfig = (
     // built above, so the DcbBackend relay registry is complete).
     provisionPgChangeFeedRelay()
 
+    // B3.2b: provision the shared PgQueryResolver Lambda + AppSync data source for
+    // Postgres-backed read models (monolithic mode). Runs after construct so the
+    // resolver-binding registry (QueryDbResolvers_Lambda.make) and the ReadModel
+    // spec-module registry are complete; it fulfils the deferred `dataSourceName`
+    // the Postgres storage maker handed to the (schema-pushed) resolvers. App read
+    // model resolvers attach to the Domain API. Plugin-stack mode is deferred —
+    // it needs a per-stack data-source name to avoid collisions on the shared API.
+    switch QueryDbBackend.get() {
+    | Some(sel) => PgQueryResolver_Builder.provision(~api=domainApi, ~selection=sel, ~opts={})
+    | None => ()
+    }
+
     // Admin schema push is fired by preAdminResolversSchemaHook from inside
     // Admin.construct (with createResolvers gated on it). Only exports below.
     if Config.splitApi {

package/src/Platform.res.mjs

@@ -61,6 +61,7 @@ import * as Task_Builder_PerBucket$ReventlessAws from "./components/Task_Builder
 import * as AutomationSlice_Builder$ReventlessAws from "./components/AutomationSlice_Builder.res.mjs";
 import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/EventTopicPublisher_SNS.res.mjs";
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
+import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
 import * as StateChangeSlice_Builder$ReventlessAws from "./components/StateChangeSlice_Builder.res.mjs";
@@ -981,6 +982,10 @@ function MakeWithConfig(Config) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
+    }
     if (Config.splitApi) {
       Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
       Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
@@ -2185,6 +2190,10 @@ function Make($star) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {});
+    }
     Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
     Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
     Pulumi$Pulumi.$$export("platformApiRoleArn", Output$Pulumi.flatMap(platformApiRole, role => role.arn));

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -0,0 +1,281 @@
+// Deploy-time provisioner for the shared Postgres GraphQL-read Lambda (B3.2b).
+//
+// Postgres-backed read models have no per-table AppSync data source, so instead
+// of the direct DynamoDB resolvers there is ONE in-VPC "PgQueryResolver" Lambda
+// (PgQueryResolverEntryPoint.mjs → PgQueryResolver_Lambda.dispatch) registered
+// as a single AppSync Lambda data source. Every Postgres read model's resolvers
+// (QueryDbResolvers_Lambda) are thin APPSYNC_JS `Invoke` templates pointing at
+// this one data source.
+//
+// Ordering wrinkle: `QueryDbStorage_Postgres.make` runs DURING construct and
+// must return the data source name, but the Lambda's code bundle needs the set
+// of Postgres read models (their spec packages), known only AFTER construct. So
+// the data source name is a DEFERRED Output (`dataSourceName`), fulfilled by
+// `provision` — which the platform calls in makePlatform once every plugin is
+// built (alongside provisionPgChangeFeedRelay). The resolvers themselves are
+// created even later (inside the schema-pushed `resourcesMaker`), so they read
+// the name after `provision` has resolved it.
+
+open PulumiAws
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// -- Deferred data source name ----------------------------------------------
+// Created once at module load. `QueryDbStorage_Postgres.make` returns this for
+// every Postgres read model (one shared data source); `provision` resolves it.
+let resolveDataSourceName: ref<string => unit> = ref(_ => ())
+let dataSourceNamePromise: promise<string> = Promise.make((resolve, _reject) =>
+  resolveDataSourceName := resolve
+)
+let dataSourceName: Pulumi.Output.t<string> = Pulumi.Output.fromPromise(dataSourceNamePromise)
+
+// -- Resolver-binding registry ----------------------------------------------
+// Populated by QueryDbResolvers_Lambda.make during construct (per Postgres read
+// model): the bits `provision` bakes into the Lambda env config that the entry
+// point can't get from the spec module (they come from the deploy-time
+// queryFieldNamesRegistry). specModulePath is looked up from
+// EventCollectorRuntime_Builder_Single.readModelInfos at provision time.
+type resolverEntry = {
+  readModelName: string,
+  labelField: string,
+  includeIdParam: bool,
+}
+let entries: dict<resolverEntry> = Dict.make()
+let register = (entry: resolverEntry): unit =>
+  entries->Dict.set(entry.readModelName, entry)
+
+// Relay node type → read-model-name, populated per RM by QueryDbResolvers_Lambda.
+// Baked into the env config so the entry point can serve the shared node(id).
+let nodeTypes: dict<string> = Dict.make()
+let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
+  nodeTypes->Dict.set(typeName, readModelName)
+
+// -- Provision --------------------------------------------------------------
+let bool = b => b ? "true" : "false"
+
+// One `node(id: ID!)` resolver on the shared data source → Invoke {kind:"node"}.
+let nodeResolverCode =
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+// Serialize the shared connection config into the env-config JSON (same shape
+// EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
+let pgConnectionJson = (cc: PgConnection.connectionConfig): string =>
+  [
+    ("host", cc.host->JSON.Encode.string),
+    ("port", cc.port->Int.toFloat->JSON.Encode.float),
+    ("database", cc.database->JSON.Encode.string),
+    ("username", cc.username->JSON.Encode.string),
+    ("secretArn", cc.secretArn->JSON.Encode.string),
+  ]
+  ->Dict.fromArray
+  ->JSON.Encode.object
+  ->JSON.stringify
+
+let provision = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~selection: QueryDbBackend.selection,
+  ~opts: Pulumi.ComponentResource.options,
+): unit => {
+  // Join the resolver-binding registry (labelField/includeIdParam) with the
+  // ReadModel runtime registry (specModulePath, pgBacked). Only read models
+  // that both got Lambda resolvers AND are Postgres-backed are handled here.
+  let handlers =
+    entries
+    ->Dict.valuesToArray
+    ->Array.filterMap(entry =>
+      switch EventCollectorRuntime_Builder_Single.readModelInfos->Dict.get(entry.readModelName) {
+      | Some(info) if info.pgBacked => Some((entry, info.specModulePath))
+      | _ => None
+      }
+    )
+  if handlers->Array.length == 0 {
+    // No Postgres read models with Lambda resolvers — nothing to provision.
+    ()
+  } else {
+    // makeFromCodeAsset takes ComponentResource.options (the original); the raw
+    // IAM / DataSource resources take the CustomResourceOptions projection.
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let name = "PgQueryResolver"
+
+    // Bundle the entry point plus each read model's spec package (imported at
+    // Lambda init for indexes / subIdField / schema → capability).
+    let packageDirs: dict<string> = Dict.make()
+    handlers->Array.forEach(((_entry, specModulePath)) => {
+      let pkg = Util_Bundle.extractPackageName(specModulePath)
+      packageDirs->Dict.set(pkg, Util_Bundle.resolvePackageRoot(pkg))
+    })
+
+    // Env config: shared pgConnection + one handler per read model. Sorted for
+    // deploy-stable output. specModule/labelField/includeIdParam are baked;
+    // indexes/subIdField/authorization come from the imported spec at runtime.
+    let handlerJsons =
+      handlers
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a.readModelName, b.readModelName))
+      ->Array.map(((entry, specModulePath)) => {
+        let specModule = specModulePath->JSON.stringifyAny->Option.getOr(`""`)
+        `{"readModelName":"${entry.readModelName}","specModule":${specModule},"labelField":"${entry.labelField}","includeIdParam":${bool(
+            entry.includeIdParam,
+          )}}`
+      })
+
+    // Relay node type → read-model map, baked so the entry point can serve node(id).
+    let nodeTypesJson =
+      nodeTypes
+      ->Dict.toArray
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a, b))
+      ->Array.map(((typeName, rm)) => `"${typeName}":"${rm}"`)
+      ->Array.join(",")
+
+    let queryResolverConfig =
+      selection.connectionConfig->Pulumi.Output.apply(cc =>
+        `{"pgConnection":${pgConnectionJson(cc)},"handlers":[${handlerJsons->Array.join(
+            ",",
+          )}],"nodeTypes":{${nodeTypesJson}}}`
+      )
+
+    let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
+    envVars->Dict.set("QUERY_RESOLVER_CONFIG", queryResolverConfig->Pulumi.Output.asInput)
+    envVars->Dict.set("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make)
+
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs",
+      ~packageDirs,
+    )
+
+    // In-VPC on the DB-access security group + private subnets (reach RDS).
+    let vpcConfig =
+      selection.securityGroupId
+      ->Pulumi.Output.apply(sgId =>
+        (
+          {
+            Lambda.Function.subnetIds: selection.subnetIds->Pulumi.Input.make,
+            securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+          }: Lambda.Function.vpcConfig
+        )
+      )
+      ->Pulumi.Output.asInput
+
+    let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+      ~name,
+      ~code,
+      ~sourceCodeHash,
+      ~envVars,
+      ~memorySize=512,
+      ~timeout=30,
+      ~vpcConfig,
+      ~opts,
+    )
+
+    // Read the RDS-managed secret so PgRuntime can resolve the DB password.
+    let _ = selection.connectionConfig->Pulumi.Output.apply(cc => {
+      open PolicyDocument
+      IAM.RolePolicy.make(
+        ~name=name ++ "-pgSecret",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "-pgSecretPolicy",
+            ~statements=[
+              {
+                sid: "AllowGetPgSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(cc.secretArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+        },
+      )
+    })
+
+    // AppSync → Lambda data source (one, shared by every Postgres RM's resolvers).
+    let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+      ~name=name ++ "DataSource",
+      ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+      ~opts=customOpts,
+    )
+    let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(l => l.arn)
+    let _ =
+      (lambdaArn, dataSourceRole.id)
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((arn, dsRoleId)) => {
+        open PolicyDocument
+        IAM.RolePolicy.make(
+          ~name=name ++ "DataSourceInvoke",
+          ~args={
+            policy: PolicyDocument.make(
+              ~id=name ++ "DataSourceInvokePolicy",
+              ~statements=[
+                {
+                  sid: "AllowDataSourceInvokeLambda",
+                  effect: Allow,
+                  actions: Action("lambda:InvokeFunction"),
+                  resources: Resource(arn),
+                },
+              ],
+            )
+            ->PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: dsRoleId->Pulumi.Input.make,
+          },
+        )
+      })
+
+    let dataSource = AppSync.DataSource.make(
+      ~name=name ++ "DataSource",
+      ~args={
+        type_: AWS_LAMBDA,
+        apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+        lambdaConfig: {
+          AppSync.DataSource.functionArn: lambdaArn->Pulumi.Output.asInput,
+        }->Pulumi.Input.make,
+        serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+      },
+      ~opts=Some(customOpts),
+    )
+
+    // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
+    // typeName in the Lambda. Only when some entity registered a node type
+    // (else the `node` field isn't in the schema). Mirrors NodeResolver_AppSync,
+    // which likewise creates the node resolver directly at deploy time.
+    if nodeTypes->Dict.toArray->Array.length > 0 {
+      let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
+        ~name=name ++ "NodeResolver",
+        ~api,
+        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+        ~type_="Query"->Pulumi.Input.make,
+        ~field="node"->Pulumi.Input.make,
+        ~code=nodeResolverCode,
+        ~opts=customOpts,
+      )
+    }
+
+    // Fulfil the deferred name the Postgres storage maker handed to resolvers.
+    let _ = dataSource.name->Pulumi.Output.apply(n => resolveDataSourceName.contents(n))
+    log.info(~comp="PgQueryResolver_Builder", `provisioned for ${handlers->Array.length->Int.toString} read model(s)`)
+  }
+}

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -0,0 +1,189 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "../Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let resolveDataSourceName = {
+  contents: param => {}
+};
+
+let dataSourceNamePromise = new Promise((resolve, _reject) => {
+  resolveDataSourceName.contents = resolve;
+});
+
+let entries = {};
+
+function register(entry) {
+  entries[entry.readModelName] = entry;
+}
+
+let nodeTypes = {};
+
+function registerNodeType(typeName, readModelName) {
+  nodeTypes[typeName] = readModelName;
+}
+
+function bool(b) {
+  if (b) {
+    return "true";
+  } else {
+    return "false";
+  }
+}
+
+let nodeResolverCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function pgConnectionJson(cc) {
+  return JSON.stringify(Object.fromEntries([
+    [
+      "host",
+      cc.host
+    ],
+    [
+      "port",
+      cc.port
+    ],
+    [
+      "database",
+      cc.database
+    ],
+    [
+      "username",
+      cc.username
+    ],
+    [
+      "secretArn",
+      cc.secretArn
+    ]
+  ]));
+}
+
+function provision(api, selection, opts) {
+  let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
+    let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
+    if (info !== undefined && info.pgBacked) {
+      return [
+        entry,
+        info.specModulePath
+      ];
+    }
+  });
+  if (handlers.length === 0) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PgQueryResolver";
+  let packageDirs = {};
+  handlers.forEach(param => {
+    let pkg = Util_Bundle$ReventlessAws.extractPackageName(param[1]);
+    packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(pkg);
+  });
+  let handlerJsons = handlers.toSorted((param, param$1) => Primitive_string.compare(param[0].readModelName, param$1[0].readModelName)).map(param => {
+    let entry = param[0];
+    let specModule = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
+    return `{"readModelName":"` + entry.readModelName + `","specModule":` + specModule + `,"labelField":"` + entry.labelField + `","includeIdParam":` + (
+      entry.includeIdParam ? "true" : "false"
+    ) + `}`;
+  });
+  let nodeTypesJson = Object.entries(nodeTypes).toSorted((param, param$1) => Primitive_string.compare(param[0], param$1[0])).map(param => `"` + param[0] + `":"` + param[1] + `"`).join(",");
+  let queryResolverConfig = selection.connectionConfig.apply(cc => `{"pgConnection":` + pgConnectionJson(cc) + `,"handlers":[` + handlerJsons.join(",") + `],"nodeTypes":{` + nodeTypesJson + `}}`);
+  let envVars = {};
+  envVars["QUERY_RESOLVER_CONFIG"] = queryResolverConfig;
+  envVars["Environment"] = Pulumi.getStack();
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs", packageDirs, undefined);
+  let vpcConfig = selection.securityGroupId.apply(sgId => ({
+    subnetIds: selection.subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, 512, 30, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  selection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)(name + "-pgSecret", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "-pgSecretPolicy", [{
+        Sid: "AllowGetPgSecret",
+        Effect: "Allow",
+        Action: "secretsmanager:GetSecretValue",
+        Resource: cc.secretArn
+      }])),
+    role: runtime.parts.lambdaRole.id
+  }));
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), customOpts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, l => l.arn);
+  Pulumi.all([
+    lambdaArn,
+    dataSourceRole.id
+  ]).apply(param => new (Aws.iam.RolePolicy)(name + "DataSourceInvoke", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourceInvokePolicy", [{
+        Sid: "AllowDataSourceInvokeLambda",
+        Effect: "Allow",
+        Action: "lambda:InvokeFunction",
+        Resource: param[0]
+      }])),
+    role: param[1]
+  }));
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, a => a.id),
+    lambdaConfig: {
+      functionArn: lambdaArn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, customOpts);
+  if (Object.entries(nodeTypes).length !== 0) {
+    AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
+  }
+  dataSource.name.apply(n => resolveDataSourceName.contents(n));
+  log.info("PgQueryResolver_Builder", undefined, `provisioned for ` + handlers.length.toString() + ` read model(s)`);
+}
+
+let dataSourceName = dataSourceNamePromise;
+
+export {
+  log,
+  resolveDataSourceName,
+  dataSourceNamePromise,
+  dataSourceName,
+  entries,
+  register,
+  nodeTypes,
+  registerNodeType,
+  bool,
+  nodeResolverCode,
+  pgConnectionJson,
+  provision,
+}
+/* log Not a pure module */