@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.178 (2026-07-06)
+
+### Bug Fixes
+
+* **reventless-aws:** make deployed ESM Lambdas self-contained via layer resolver hook ([3fc768c](https://github.com/ReventlessDev/reventless-core/commit/3fc768cba5ef72fca6e4a706eb855f67ac7f0b30))
+### Features
+
+* **reventless-aws:** auth-table pipeline for group-restricted Postgres indexes (B3.2c) ([52be859](https://github.com/ReventlessDev/reventless-core/commit/52be8590ed934a2ffbc898cef381ca4ce50d8cda))
+* **reventless-aws:** deploy-time Postgres schema provisioning via in-VPC migration Lambda (A3) ([44c8eee](https://github.com/ReventlessDev/reventless-core/commit/44c8eeebd351e883f2d2e21460108e2963a061ce))
+* **reventless-aws:** expose DCB Postgres lock-strategy knob (C2) ([3991862](https://github.com/ReventlessDev/reventless-core/commit/3991862aa50eb939796413236a04deae80a61aa3))
+* **reventless-aws:** Postgres read-model live updates via projection Lambda (B3.3) ([ff8fc43](https://github.com/ReventlessDev/reventless-core/commit/ff8fc43049a8fc7134e340a473c2a1665a139140))
+* **reventless-aws:** provision the Postgres read path in plugin-stack mode (B3.2) ([719efbc](https://github.com/ReventlessDev/reventless-core/commit/719efbc20ab6e8bf5bb46499150fe07e54d9eca5))
+
+
+# 3.0.0-alpha.177 (2026-07-06)
+
+### Features
+
+* **reventless-aws:** AppSync read path for Postgres read models (B3.2b) ([a6dd6cb](https://github.com/ReventlessDev/reventless-core/commit/a6dd6cbddfc65410bf96da49bb2603c88670aced))
+* **reventless-aws:** cross-table @resolves/[@resolves](https://github.com/resolves)Many + node resolvers for Postgres reads (B3.2c) ([713b6ab](https://github.com/ReventlessDev/reventless-core/commit/713b6ab736715209e7198b2b4ab609c5447adef5))
+* **reventless-postgres,reventless-aws:** items (sub-id connection) resolver for Postgres reads (B3.2c) ([2477220](https://github.com/ReventlessDev/reventless-core/commit/247722062913f5d0bcb5895b152f05033d8297d8))
+
+
 # 3.0.0-alpha.176 (2026-07-06)
 
 ### Bug Fixes

package/docker-compose.postgres.yml

@@ -0,0 +1,21 @@
+# Postgres sidecar for the PG_URL-gated integration suites (change-feed relay,
+# projection pipeline, schema-migration entry point).
+# Booted/torn down by scripts/run-pg-integration-tests.sh.
+#
+# tmpfs keeps the data dir in RAM (no on-disk state to clean up); the suites
+# ensureSchema + truncateAll themselves, and run serially, so one shared DB is
+# fine.
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+    command: "-c fsync=off -c full_page_writes=off"
+    tmpfs:
+      - /var/lib/postgresql/data
+    # Non-standard host port so the sidecar never collides with a dev's own
+    # Postgres on 5432 (the run script exports a matching PG_URL).
+    ports:
+      - "55433:5432"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.176",
+  "version": "3.0.0-alpha.178",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,14 +11,14 @@
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.25",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.45",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.46",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.14",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.143",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.89",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.5",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.67",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.143"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.6",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.67"
   },
   "devDependencies": {
     "rescript": "^12.3.0",
@@ -36,7 +36,8 @@
     ],
     "testPathIgnorePatterns": [
       "/node_modules/",
-      "<rootDir>/tests/integration/"
+      "<rootDir>/tests/integration/",
+      "Pg.*IntegrationTest\\.res\\.mjs$"
     ],
     "moduleFileExtensions": [
       "js",

package/scripts/run-pg-integration-tests.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Boot a Postgres sidecar, run the PG_URL integration suites against it (serially,
+# via jest.integration.pg.config.js), tear down. Safe to run anywhere: if Docker
+# is unavailable the suites are skipped (the CI step is continue-on-error, and not
+# every dev machine has Docker running).
+#
+# If PG_URL is already set (a dev's own Postgres), the sidecar is skipped and the
+# suites run against that database instead.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+COMPOSE="$ROOT/reventless/reventless-aws/docker-compose.postgres.yml"
+
+run_jest() {
+  cd "$ROOT"
+  NODE_OPTIONS='--experimental-vm-modules --no-warnings' \
+    npx jest --config jest.integration.pg.config.js "$@"
+}
+
+# Honour a pre-set PG_URL (dev's own database) — no sidecar needed.
+if [ -n "${PG_URL:-}" ]; then
+  echo "▶  Using existing PG_URL — running PG integration suites"
+  run_jest "$@"
+  exit $?
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "⏭  Docker not available — skipping PG integration tests"
+  exit 0
+fi
+if ! docker info >/dev/null 2>&1; then
+  echo "⏭  Docker daemon not running — skipping PG integration tests"
+  exit 0
+fi
+
+cleanup() { docker compose -f "$COMPOSE" down -v >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+echo "▶  Starting Postgres…"
+docker compose -f "$COMPOSE" up -d
+
+echo "⏳  Waiting for Postgres…"
+for i in $(seq 1 30); do
+  if docker compose -f "$COMPOSE" exec -T postgres pg_isready -U postgres >/dev/null 2>&1; then
+    echo "✓  Postgres is up"
+    break
+  fi
+  if [ "$i" -eq 30 ]; then
+    echo "✗  Postgres did not start within 30s"
+    exit 1
+  fi
+  sleep 1
+done
+
+# Host port matches docker-compose.postgres.yml's mapping (55433 → container 5432),
+# chosen to avoid colliding with a dev's own Postgres on 5432.
+export PG_URL="postgres://postgres:postgres@localhost:55433/postgres"
+run_jest "$@"

package/src/Platform.res

@@ -91,6 +91,7 @@ module MakeWithConfig = (
       connectionConfig: pg.connectionConfig,
       securityGroupId: pg.securityGroupId,
       subnetIds: pg.subnetIds,
+      lockStrategy: pg.lockStrategy,
     })
     EventLogBackend.set({
       connectionConfig: pg.connectionConfig,
@@ -332,6 +333,25 @@ module MakeWithConfig = (
       Some(eventsApi)
     }
 
+  // B3.3: publish the events-API endpoint + ARN to the projection-Lambda runtime
+  // builders, so a subscription-enabled Postgres read model / view slice gets the
+  // APPSYNC_ENDPOINT env + appsync:EventPublish IAM at their `finish`. Set once
+  // here (before plugins build) in both monolithic and plugin-stack mode — the
+  // phantom events API carries apiArn + dns, so httpEndpoint resolves either way.
+  switch domainEventsApiOpt {
+  | Some(eventsApi) =>
+    let cfg = {
+      EventCollectorRuntime_Builder_Single.endpoint: AppSync_EventsApi.httpEndpoint(eventsApi),
+      apiArn: eventsApi.api.apiArn,
+    }
+    EventCollectorRuntime_Builder_Single.setEventsApiConfig(cfg)
+    StateViewSliceRuntime_Builder_Single.setEventsApiConfig({
+      StateViewSliceRuntime_Builder_Single.endpoint: AppSync_EventsApi.httpEndpoint(eventsApi),
+      apiArn: eventsApi.api.apiArn,
+    })
+  | None => ()
+  }
+
   // Returns the AppSync API/role to attach resolvers to for the current deploy target.
   // Hoisted above ApiConfig so the module can reference them as thunks.
   let resolveTargetApi = () =>
@@ -1470,6 +1490,18 @@ module MakeWithConfig = (
     // built above, so the DcbBackend relay registry is complete).
     provisionPgChangeFeedRelay()
 
+    // B3.2b: provision the shared PgQueryResolver Lambda + AppSync data source for
+    // Postgres-backed read models (monolithic mode). Runs after construct so the
+    // resolver-binding registry (QueryDbResolvers_Lambda.make) and the ReadModel
+    // spec-module registry are complete; it fulfils the deferred `dataSourceName`
+    // the Postgres storage maker handed to the (schema-pushed) resolvers. App read
+    // model resolvers attach to the Domain API. Plugin-stack mode is deferred —
+    // it needs a per-stack data-source name to avoid collisions on the shared API.
+    switch QueryDbBackend.get() {
+    | Some(sel) => PgQueryResolver_Builder.provision(~api=domainApi, ~selection=sel, ~opts={})
+    | None => ()
+    }
+
     // Admin schema push is fired by preAdminResolversSchemaHook from inside
     // Admin.construct (with createResolvers gated on it). Only exports below.
     if Config.splitApi {
@@ -2034,6 +2066,23 @@ module MakeWithConfig = (
     // plugin's Postgres DCB log(s) + collector queue were registered during P.make()).
     provisionPgChangeFeedRelay()
 
+    // B3.2b/c: provision this plugin stack's PgQueryResolver Lambda + AppSync data
+    // source for its Postgres-backed read models (registered during P.make()). App
+    // read model resolvers attach to the Domain API. Per-plugin Lambda + auto-named
+    // data source, so plugin stacks don't collide. The node(id) resolver is skipped
+    // in plugin-stack mode — it's a single shared Query.node field only one stack
+    // may own (monolithic-only; see PgQueryResolver_Builder.provision).
+    switch QueryDbBackend.get() {
+    | Some(sel) =>
+      PgQueryResolver_Builder.provision(
+        ~api=domainApi,
+        ~selection=sel,
+        ~opts={},
+        ~createNodeResolver=false,
+      )
+    | None => ()
+    }
+
     // Zero-downtime handover (Part 3.1): fire ONE synthetic heartbeat for the
     // just-deployed plugin so its new version runs the connect handshake within
     // seconds instead of waiting for the CloudWatch heartbeat rule's first

package/src/Platform.res.mjs

@@ -61,6 +61,7 @@ import * as Task_Builder_PerBucket$ReventlessAws from "./components/Task_Builder
 import * as AutomationSlice_Builder$ReventlessAws from "./components/AutomationSlice_Builder.res.mjs";
 import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/EventTopicPublisher_SNS.res.mjs";
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
+import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
 import * as StateChangeSlice_Builder$ReventlessAws from "./components/StateChangeSlice_Builder.res.mjs";
@@ -88,6 +89,7 @@ import * as EventTopicPublisher_DynamoDbStream$ReventlessAws from "./adapter/Eve
 import * as InboundTranslationResolvers_AppSync$ReventlessAws from "./adapter/CommandGenerator/InboundTranslationResolvers_AppSync.res.mjs";
 import * as PluginExtensionPointRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginExtensionPointRuntime_Builder.res.mjs";
 import * as ReadModel_Builder_NoResolver_Stream$ReventlessAws from "./components/ReadModel_Builder_NoResolver_Stream.res.mjs";
+import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "./adapter/Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
 import * as Platform_ComponentDefinitions_Lambda$ReventlessAws from "./adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs";
 import * as StateViewSliceRuntime_Builder_Single$ReventlessAws from "./adapter/Runtime/StateViewSliceRuntime_Builder_Single.res.mjs";
 import * as AggregateRuntime_Builder_Single_Async$ReventlessAws from "./adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs";
@@ -127,7 +129,8 @@ function MakeWithConfig(Config) {
     DcbBackend$ReventlessAws.set({
       connectionConfig: pg.connectionConfig,
       securityGroupId: pg.securityGroupId,
-      subnetIds: pg.subnetIds
+      subnetIds: pg.subnetIds,
+      lockStrategy: pg.lockStrategy
     });
     EventLogBackend$ReventlessAws.set({
       connectionConfig: pg.connectionConfig,
@@ -273,6 +276,19 @@ function MakeWithConfig(Config) {
     let awsRegion = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
     domainEventsApiOpt = AppSync_EventsApi$ReventlessAws.make("DomainEventsApi", cognitoPool.poolId, awsRegion, {});
   }
+  if (domainEventsApiOpt !== undefined) {
+    let cfg_endpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt);
+    let cfg_apiArn = domainEventsApiOpt.api.apiArn;
+    let cfg = {
+      endpoint: cfg_endpoint,
+      apiArn: cfg_apiArn
+    };
+    EventCollectorRuntime_Builder_Single$ReventlessAws.setEventsApiConfig(cfg);
+    StateViewSliceRuntime_Builder_Single$ReventlessAws.setEventsApiConfig({
+      endpoint: AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt),
+      apiArn: domainEventsApiOpt.api.apiArn
+    });
+  }
   let resolveTargetApi = () => {
     let match = currentDeployTarget.contents;
     if (match === "Domain") {
@@ -981,6 +997,10 @@ function MakeWithConfig(Config) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {}, undefined);
+    }
     if (Config.splitApi) {
       Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
       Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
@@ -1255,6 +1275,10 @@ function MakeWithConfig(Config) {
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {}, false);
+    }
     let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
     let match = IndexJs.isDryRun();
     let match$1 = hbConfig.epQueueUrl;
@@ -1337,7 +1361,8 @@ function Make($star) {
     DcbBackend$ReventlessAws.set({
       connectionConfig: pg.connectionConfig,
       securityGroupId: pg.securityGroupId,
-      subnetIds: pg.subnetIds
+      subnetIds: pg.subnetIds,
+      lockStrategy: pg.lockStrategy
     });
     EventLogBackend$ReventlessAws.set({
       connectionConfig: pg.connectionConfig,
@@ -1483,6 +1508,19 @@ function Make($star) {
     let awsRegion = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
     domainEventsApiOpt = AppSync_EventsApi$ReventlessAws.make("DomainEventsApi", cognitoPool.poolId, awsRegion, {});
   }
+  if (domainEventsApiOpt !== undefined) {
+    let cfg_endpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt);
+    let cfg_apiArn = domainEventsApiOpt.api.apiArn;
+    let cfg = {
+      endpoint: cfg_endpoint,
+      apiArn: cfg_apiArn
+    };
+    EventCollectorRuntime_Builder_Single$ReventlessAws.setEventsApiConfig(cfg);
+    StateViewSliceRuntime_Builder_Single$ReventlessAws.setEventsApiConfig({
+      endpoint: AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt),
+      apiArn: domainEventsApiOpt.api.apiArn
+    });
+  }
   let resolveTargetApi = () => {
     let match = currentDeployTarget.contents;
     if (match === "Domain") {
@@ -2185,6 +2223,10 @@ function Make($star) {
       Plugin_Helpers$ReventlessCore.exportPluginOutputs(Component$ReventlessCore.outputs(Primitive_option.valFromOption(pluginComponent)));
     }
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {}, undefined);
+    }
     Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));
     Pulumi$Pulumi.$$export("platformApiEndpoint", Output$Pulumi.flatMap(platformApi, api => api.uris.apply(uris => uris.GRAPHQL)));
     Pulumi$Pulumi.$$export("platformApiRoleArn", Output$Pulumi.flatMap(platformApiRole, role => role.arn));
@@ -2441,6 +2483,10 @@ function Make($star) {
     let pluginOutputs = Component$ReventlessCore.outputs(pluginComponent);
     Plugin_Helpers$ReventlessCore.exportPluginOutputs(pluginOutputs);
     provisionPgChangeFeedRelay();
+    let sel = QueryDbBackend$ReventlessAws.get();
+    if (sel !== undefined) {
+      PgQueryResolver_Builder$ReventlessAws.provision(domainApi, sel, {}, false);
+    }
     let hbConfig = PluginRuntime_Builder$ReventlessAws.heartbeatConfigRef.contents;
     let match = IndexJs.isDryRun();
     let match$1 = hbConfig.epQueueUrl;

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -147,8 +147,12 @@ let make = (
     "index.mjs",
     Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
   )
+  // ESM self-containment: the handler imports @aws-sdk/* bare specifiers the
+  // nodejs22.x runtime provides only under /var/runtime — unreachable from
+  // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
+  let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
   let code = Pulumi.Archive.assetArchive(archiveContents)
-  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub ++ "\n---\n" ++ loaderHash)
 
   let layers =
     Lambda.reventlessLayerArn
@@ -173,6 +177,8 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -119,8 +119,9 @@ function make(api, pluginReadModelTableName, opts) {
   let archiveContents = {};
   let handlerCodeStub = makeHandlerCode("", adminEntryJson);
   archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCodeStub);
+  let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(archiveContents);
   let code = new (Pulumi.asset.AssetArchive)(archiveContents);
-  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub + "\n---\n" + loaderHash);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
@@ -140,6 +141,14 @@ function make(api, pluginReadModelTableName, opts) {
         [
           "PLUGIN_RM_TABLE",
           pluginReadModelTableName
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
         ]
       ])
     },

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -138,8 +138,12 @@ let make = (
     "index.mjs",
     Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
   )
+  // ESM self-containment: the handler imports @aws-sdk/* bare specifiers the
+  // nodejs22.x runtime provides only under /var/runtime — unreachable from
+  // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
+  let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
   let code = Pulumi.Archive.assetArchive(archiveContents)
-  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub ++ "\n---\n" ++ loaderHash)
 
   let layers =
     Lambda.reventlessLayerArn
@@ -164,6 +168,8 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("UI_FRAGMENT_RM_TABLE", uiFragmentRegistryTableName->Pulumi.Output.asInput),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -185,8 +185,9 @@ export async function handler() {
 }
 `;
   archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCodeStub);
+  let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(archiveContents);
   let code = new (Pulumi.asset.AssetArchive)(archiveContents);
-  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub + "\n---\n" + loaderHash);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
@@ -206,6 +207,14 @@ export async function handler() {
         [
           "UI_FRAGMENT_RM_TABLE",
           uiFragmentRegistryTableName
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
         ]
       ])
     },

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res

@@ -47,27 +47,12 @@ let make: ReventlessCore.Counter_Adapter.handlerMaker = (
   packageDirs->Dict.set(specPkg, Util_Bundle.resolvePackageRoot(specPkg))
   packageDirs->Dict.set(mappingsPkg, Util_Bundle.resolvePackageRoot(mappingsPkg))
 
-  let reExportCode = `export { handler } from "@reventlessdev/reventless-aws/src/adapter/Runtime/CounterEntryPoint.mjs";`
-
-  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
-  archiveContents->Dict.set(
-    "index.mjs",
-    Pulumi.Asset.stringAsset(reExportCode)->Pulumi.Archive.assetToAssetOrArchive,
-  )
-  let packageContentHashes: ref<array<string>> = ref([])
-  packageDirs->Dict.forEachWithKey((pkgRoot, pkgName) => {
-    let (archive, contentHash) = Util_Bundle.createFilteredPackageArchive(pkgRoot)
-    archiveContents->Dict.set(
-      `node_modules/${pkgName}`,
-      archive->Pulumi.Archive.archiveToAssetOrArchive,
-    )
-    packageContentHashes.contents->Array.push(`${pkgName}:${contentHash}`)
-  })
-
-  let code = Pulumi.Archive.assetArchive(archiveContents)
-  packageContentHashes.contents->Array.sort(String.compare)
-  let sourceCodeHash = Util_Bundle.hashString(
-    reExportCode ++ packageContentHashes.contents->Array.join(","),
+  // buildCodeArchive centralises the entry-point re-export, package bundling, and
+  // the ESM self-containment loader (register-hook.mjs / layer-resolver.mjs) that
+  // makeFromCodeAsset's NODE_OPTIONS=--import depends on.
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/CounterEntryPoint.mjs",
+    ~packageDirs,
   )
 
   let componentOpts: Pulumi.ComponentResource.options = {parent: ?opts.parent}

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -1,9 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
-import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStream.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
@@ -34,25 +32,12 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
   let mappingsPkg = Util_Bundle$ReventlessAws.extractPackageName(mappingsModulePath);
   packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
   packageDirs[mappingsPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(mappingsPkg);
-  let reExportCode = `export { handler } from "@reventlessdev/reventless-aws/src/adapter/Runtime/CounterEntryPoint.mjs";`;
-  let archiveContents = {};
-  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(reExportCode);
-  let packageContentHashes = {
-    contents: []
-  };
-  Stdlib_Dict.forEachWithKey(packageDirs, (pkgRoot, pkgName) => {
-    let match = Util_Bundle$ReventlessAws.createFilteredPackageArchive(pkgRoot);
-    archiveContents[`node_modules/` + pkgName] = match[0];
-    packageContentHashes.contents.push(pkgName + `:` + match[1]);
-  });
-  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
-  packageContentHashes.contents.sort(Primitive_string.compare);
-  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(reExportCode + packageContentHashes.contents.join(","));
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/CounterEntryPoint.mjs", packageDirs, undefined);
   let componentOpts_parent = opts.parent;
   let componentOpts = {
     parent: componentOpts_parent
   };
-  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, code, sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
   let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
   subscribe(referencesName, referencesStream);

package/src/adapter/DcbEventLog/DcbBackend.res

@@ -19,6 +19,10 @@ type selection = {
   securityGroupId: Pulumi.Output.t<string>,
   /** Private subnets for the in-VPC DCB/relay Lambdas (PgConnection.subnetIds). */
   subnetIds: array<Pulumi.Input.t<string>>,
+  /** DCB append lock strategy (C2), carried from `PgConnection.lockStrategy` and
+    serialized into the DCB command Lambda's HANDLER_CONFIG. Default
+    `#AdvisoryLocks`; `#RowLocks` for RDS-Proxy-fronted deployments. */
+  lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy,
 }
 
 let selectionRef: ref<option<selection>> = ref(None)

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res

@@ -26,9 +26,9 @@ let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
   DcbBackend.registerRelayLog(~logName=name, ~partitionTag)
 
   let operations = switch DcbBackend.get() {
-  | Some({connectionConfig}) =>
+  | Some({connectionConfig, lockStrategy}) =>
     connectionConfig->Pulumi.Output.apply(config =>
-      DcbEventLogStorage_Postgres_Runtime.opsFor(config, ~logName=name)
+      DcbEventLogStorage_Postgres_Runtime.opsFor(config, ~logName=name, ~lockStrategy)
     )
   | None =>
     // Selectable only routes here when a selection is set; guard defensively.

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res.mjs

@@ -8,7 +8,13 @@ function make(name, param, partitionTag, $staropt$star, param$1) {
   $staropt$star !== undefined;
   DcbBackend$ReventlessAws.registerRelayLog(name, partitionTag);
   let match = DcbBackend$ReventlessAws.get();
-  let operations = match !== undefined ? match.connectionConfig.apply(config => DcbEventLogStorage_Postgres_Runtime$ReventlessAws.opsFor(config, name, undefined)) : Stdlib_JsError.throwWithMessage("DcbEventLogStorage_Postgres.make called without a DcbBackend selection");
+  let operations;
+  if (match !== undefined) {
+    let lockStrategy = match.lockStrategy;
+    operations = match.connectionConfig.apply(config => DcbEventLogStorage_Postgres_Runtime$ReventlessAws.opsFor(config, name, lockStrategy));
+  } else {
+    operations = Stdlib_JsError.throwWithMessage("DcbEventLogStorage_Postgres.make called without a DcbBackend selection");
+  }
   return {
     resources: [],
     operations: operations

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res

@@ -58,18 +58,8 @@ let make = (
     (l.connectionConfig, l.targetQueueUrl)
     ->Pulumi.Output.all2
     ->Pulumi.Output.apply(((cc, queueUrl)) => {
-      let pgConnectionJson =
-        [
-          ("host", cc.host->JSON.Encode.string),
-          ("port", cc.port->Int.toFloat->JSON.Encode.float),
-          ("database", cc.database->JSON.Encode.string),
-          ("username", cc.username->JSON.Encode.string),
-          ("secretArn", cc.secretArn->JSON.Encode.string),
-        ]
-        ->Dict.fromArray
-        ->JSON.Encode.object
       let entries = [
-        ("pgConnection", pgConnectionJson),
+        ("pgConnection", cc->PgConnection.connectionConfigToJson),
         ("logName", l.logName->JSON.Encode.string),
         ("subscriber", l.subscriber->JSON.Encode.string),
         ("targetQueueUrl", queueUrl->JSON.Encode.string),

package/src/adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs

@@ -12,6 +12,7 @@ import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adap
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
+import * as PgConnection$ReventlessAws from "./PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_Cloudwatch$ReventlessAws from "../../util/Util_Cloudwatch.res.mjs";
 import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
@@ -26,33 +27,10 @@ function make(name, logs, securityGroupId, subnetIds, intervalMinutesOpt, opts)
     l.connectionConfig,
     l.targetQueueUrl
   ]).apply(param => {
-    let cc = param[0];
-    let pgConnectionJson = Object.fromEntries([
-      [
-        "host",
-        cc.host
-      ],
-      [
-        "port",
-        cc.port
-      ],
-      [
-        "database",
-        cc.database
-      ],
-      [
-        "username",
-        cc.username
-      ],
-      [
-        "secretArn",
-        cc.secretArn
-      ]
-    ]);
     let entries = [
       [
         "pgConnection",
-        pgConnectionJson
+        PgConnection$ReventlessAws.connectionConfigToJson(undefined, param[0])
       ],
       [
         "logName",