@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/src/adapter/Postgres/PgConnection.res

@@ -35,6 +35,32 @@ type connectionConfig = {
   secretArn: string,
 }
 
+/** Serialize a resolved `connectionConfig` into the `pgConnection` JSON object
+  the runtime entry points read from `HANDLER_CONFIG` (and `PgRuntime.poolFor`
+  reconstructs). One shared producer so all seven deploy-time builders emit a
+  byte-identical shape — the field set is a cold-start contract with the entry
+  points, so a drift here silently breaks a Lambda. `~lockStrategy` is included
+  only on the DCB command path (the sole Postgres append that takes a lock);
+  omit it everywhere else. Kept pure (no Pulumi) so it is directly unit-testable. */
+let connectionConfigToJson = (
+  ~lockStrategy: option<ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy>=?,
+  cc: connectionConfig,
+): JSON.t => {
+  let fields = [
+    ("host", cc.host->JSON.Encode.string),
+    ("port", cc.port->Int.toFloat->JSON.Encode.float),
+    ("database", cc.database->JSON.Encode.string),
+    ("username", cc.username->JSON.Encode.string),
+    ("secretArn", cc.secretArn->JSON.Encode.string),
+  ]
+  switch lockStrategy {
+  | Some(#AdvisoryLocks) => fields->Array.push(("lockStrategy", "AdvisoryLocks"->JSON.Encode.string))
+  | Some(#RowLocks) => fields->Array.push(("lockStrategy", "RowLocks"->JSON.Encode.string))
+  | None => ()
+  }
+  fields->Dict.fromArray->JSON.Encode.object
+}
+
 type t = {
   /** Deploy-time resources (currently the RDS instance) for dependency wiring —
     e.g. the A3 migration Lambda and the B-phase adapters order after these. */
@@ -46,6 +72,14 @@ type t = {
   /** The DB's private subnets, echoed back for the Lambda `vpcConfig` so
     handlers land in the same subnets as the database. */
   subnetIds: array<Pulumi.Input.t<string>>,
+  /** DCB append lock strategy (C2). `#AdvisoryLocks` (default) is
+    transaction-scoped and lowest-overhead when Lambdas hold a few long-lived
+    pools **directly** against RDS, but it **pins connections on RDS Proxy**
+    (advisory locks are session state Proxy cannot multiplex). Choose
+    `#RowLocks` when fronting the DB with RDS Proxy so the Proxy can share
+    connections across invocations. Threaded to the DCB command Lambda via
+    `DcbBackend`; classic EventLog and QueryDb appends take no such lock. */
+  lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy,
 }
 
 /** Postgres wire port. */
@@ -65,8 +99,13 @@ let make = (
   ~backupRetentionPeriod=7,
   ~deletionProtection=true,
   ~skipFinalSnapshot=false,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
   ~opts: option<Pulumi.ComponentResource.options>=?,
 ): t => {
+  // Keep the caller's ComponentResource.options for sub-builders that take it
+  // directly (PgMigration_Builder → RuntimeEnvironment_Lambda); the RDS/SG/subnet
+  // resources below want the CustomResourceOptions form.
+  let componentOpts = opts
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
@@ -151,19 +190,40 @@ let make = (
       },
     })
 
+  // A3: run PgSchema.ensureSchema against the fresh instance via a one-shot
+  // in-VPC migration Lambda invoked during `pulumi up`. Its resources join the
+  // instance's so the B-phase storage adapters can order after the schema exists.
+  // The connection is passed as pre-serialized pieces to avoid a module cycle
+  // (PgMigration_Builder must not reference this module's `connectionConfig`).
+  let migrationHandlerConfig = connectionConfig->Pulumi.Output.apply(cc =>
+    `{"pgConnection":${cc->connectionConfigToJson->JSON.stringify}}`
+  )
+  let migrationResources = PgMigration_Builder.make(
+    ~name=`${name}-pg-migrate`,
+    ~handlerConfig=migrationHandlerConfig,
+    ~secretArn=connectionConfig->Pulumi.Output.apply(cc => cc.secretArn),
+    ~securityGroupId=sg.id,
+    ~subnetIds,
+    ~opts=?componentOpts,
+  )
+
   {
-    resources: [
-      ReventlessInfra.Adapter.make(
-        ~name=name->Pulumi.Output.make,
-        ~id=instance.id,
-        ~urn=instance.arn,
-        ~service="aws:rds"->Pulumi.Output.make,
-        ~role="postgres"->Pulumi.Output.make,
-        ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
-      ),
-    ],
+    resources: Array.concat(
+      [
+        ReventlessInfra.Adapter.make(
+          ~name=name->Pulumi.Output.make,
+          ~id=instance.id,
+          ~urn=instance.arn,
+          ~service="aws:rds"->Pulumi.Output.make,
+          ~role="postgres"->Pulumi.Output.make,
+          ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
+        ),
+      ],
+      migrationResources,
+    ),
     connectionConfig,
     securityGroupId: sg.id,
     subnetIds,
+    lockStrategy,
   }
 }

package/src/adapter/Postgres/PgConnection.res.mjs

@@ -9,6 +9,7 @@ import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js
 import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as EC2_SecurityGroup$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/EC2/EC2_SecurityGroup.res.mjs";
+import * as PgMigration_Builder$ReventlessAws from "./PgMigration_Builder.res.mjs";
 
 let connectionConfigSchema = S.schema(s => ({
   host: s.m(S.string),
@@ -18,7 +19,46 @@ let connectionConfigSchema = S.schema(s => ({
   secretArn: s.m(S.string)
 }));
 
-function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, opts) {
+function connectionConfigToJson(lockStrategy, cc) {
+  let fields = [
+    [
+      "host",
+      cc.host
+    ],
+    [
+      "port",
+      cc.port
+    ],
+    [
+      "database",
+      cc.database
+    ],
+    [
+      "username",
+      cc.username
+    ],
+    [
+      "secretArn",
+      cc.secretArn
+    ]
+  ];
+  if (lockStrategy !== undefined) {
+    if (lockStrategy === "AdvisoryLocks") {
+      fields.push([
+        "lockStrategy",
+        "AdvisoryLocks"
+      ]);
+    } else {
+      fields.push([
+        "lockStrategy",
+        "RowLocks"
+      ]);
+    }
+  }
+  return Object.fromEntries(fields);
+}
+
+function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, lockStrategyOpt, opts) {
   let databaseName = databaseNameOpt !== undefined ? databaseNameOpt : "reventless";
   let username = usernameOpt !== undefined ? usernameOpt : "reventless_admin";
   let engineVersion = engineVersionOpt !== undefined ? engineVersionOpt : "16";
@@ -29,6 +69,7 @@ function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersio
   let backupRetentionPeriod = backupRetentionPeriodOpt !== undefined ? backupRetentionPeriodOpt : 7;
   let deletionProtection = deletionProtectionOpt !== undefined ? deletionProtectionOpt : true;
   let skipFinalSnapshot = skipFinalSnapshotOpt !== undefined ? skipFinalSnapshotOpt : false;
+  let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
   let tags = Object.fromEntries([
     [
@@ -94,11 +135,14 @@ function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersio
       secretArn: secret !== undefined ? secret.secretArn : Stdlib_JsError.throwWithMessage("RDS instance exposes no master user secret — manageMasterUserPassword must be enabled")
     };
   });
+  let migrationHandlerConfig = connectionConfig.apply(cc => `{"pgConnection":` + JSON.stringify(connectionConfigToJson(undefined, cc)) + `}`);
+  let migrationResources = PgMigration_Builder$ReventlessAws.make(name + `-pg-migrate`, migrationHandlerConfig, connectionConfig.apply(cc => cc.secretArn), sg.id, subnetIds, opts);
   return {
-    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)],
+    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)].concat(migrationResources),
     connectionConfig: connectionConfig,
     securityGroupId: sg.id,
-    subnetIds: subnetIds
+    subnetIds: subnetIds,
+    lockStrategy: lockStrategy
   };
 }
 
@@ -106,6 +150,7 @@ let port = 5432;
 
 export {
   connectionConfigSchema,
+  connectionConfigToJson,
   port,
   make,
 }

package/src/adapter/Postgres/PgMigration_Builder.res

@@ -0,0 +1,127 @@
+// Deploy-time builder for the one-shot Postgres schema migration (A3).
+//
+// Provisions an in-VPC Lambda whose only job is to run `PgSchema.ensureSchema`
+// against the freshly-provisioned RDS instance, and an `aws.lambda.Invocation`
+// resource that invokes it once during `pulumi up`. Because the invocation runs
+// the Lambda *inside* the DB's VPC, the deploy runner itself needs no network
+// path to the private instance — the reason the plan (A3) chose a migration
+// Lambda over a Pulumi `command`/dynamic resource that would have to connect
+// from the runner.
+//
+// `PgConnection.make` calls this after creating the instance so every
+// `PgConnection` provisions its own schema; the returned resources are appended
+// to `PgConnection.t.resources` so the B-phase storage adapters order after the
+// migration. `ensureSchema` is idempotent (all `IF NOT EXISTS`), so the
+// invocation re-runs safely whenever the migration code or the Reventless Lambda
+// layer (which ships the DDL) changes.
+
+// Takes the connection as already-serialized pieces rather than the
+// `PgConnection.connectionConfig` record: `PgConnection` calls this builder, so
+// referencing its type here would form a module cycle. The caller passes:
+//   ~handlerConfig — the full HANDLER_CONFIG JSON (`{"pgConnection":{…}}`),
+//   ~secretArn     — the DB's RDS-managed master secret ARN (for the IAM grant).
+// ~securityGroupId: DB-access SG the migration Lambda attaches (PgConnection.securityGroupId).
+// ~subnetIds: private subnets for the in-VPC migration Lambda (PgConnection.subnetIds).
+let make = (
+  ~name: string,
+  ~handlerConfig: Pulumi.Output.t<string>,
+  ~secretArn: Pulumi.Output.t<string>,
+  ~securityGroupId: Pulumi.Output.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~opts: option<Pulumi.ComponentResource.options>=?,
+): array<ReventlessInfra.Adapter.resource> => {
+  open PulumiAws
+
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  let envVars = Dict.fromArray([("HANDLER_CONFIG", handlerConfig->Pulumi.Output.asInput)])
+
+  let vpcConfig =
+    securityGroupId
+    ->Pulumi.Output.apply(sgId =>
+      (
+        {
+          Lambda.Function.subnetIds: subnetIds->Pulumi.Input.make,
+          securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+        }: Lambda.Function.vpcConfig
+      )
+    )
+    ->Pulumi.Output.asInput
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~vpcConfig,
+    ~opts?,
+  )
+
+  // IAM: GetSecretValue on the DB's RDS-managed master secret. Built outside an
+  // Output.apply so the RolePolicy is a top-level resource the invocation can
+  // `dependsOn` (invoke only after the Lambda can read the secret).
+  let rolePolicy = {
+    open PulumiAws.PolicyDocument
+    IAM.RolePolicy.make(
+      ~name=`${name}MigrationAccess`,
+      ~args={
+        policy: secretArn
+        ->Pulumi.Output.apply(arn =>
+          PulumiAws.PolicyDocument.make(
+            ~id=`${name}MigrationAccessPolicy`,
+            ~statements=[
+              {
+                sid: "AllowGetSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(arn),
+              },
+            ],
+          )->PulumiAws.PolicyDocument.toJsonString
+        )
+        ->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+    )
+  }
+
+  // Re-invoke whenever the migration code or the Reventless layer (which ships
+  // PgSchema's DDL) changes; idempotent DDL makes an unchanged re-run a no-op.
+  let layerArn = PulumiAws.Lambda.reventlessLayerArn->Option.getOr("no-layer")
+  let inputJson =
+    [("trigger", `${sourceCodeHash}:${layerArn}`->JSON.Encode.string)]
+    ->Dict.fromArray
+    ->JSON.Encode.object
+    ->JSON.stringify
+
+  let invocation = Lambda.Invocation.make(
+    ~name=`${name}Migrate`,
+    ~args={
+      // Ordering: functionName ties to the Lambda, whose env depends on
+      // connectionConfig (the instance's resolved outputs), so the invocation
+      // waits for the DB to be available. dependsOn adds the secret-access policy.
+      functionName: runtime.parts.lambda->Pulumi.Output.flatMap(l => l.name)->Pulumi.Output.asInput,
+      input: inputJson->Pulumi.Input.make,
+    },
+    ~opts={
+      dependsOn: [rolePolicy->Pulumi.Resource.makeFromJs]->Pulumi.Input.make,
+    },
+  )
+
+  Array.concat(
+    runtime.resources,
+    [
+      ReventlessInfra.Adapter.make(
+        ~name=`${name}Migration`->Pulumi.Output.make,
+        ~id=invocation.id,
+        ~urn=invocation.id,
+        ~service="aws:lambda"->Pulumi.Output.make,
+        ~role="postgres-migration"->Pulumi.Output.make,
+        ~resourceType="aws:lambda:Invocation"->Pulumi.Output.make,
+      ),
+    ],
+  )
+}

package/src/adapter/Postgres/PgMigration_Builder.res.mjs

@@ -0,0 +1,51 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+function make(name, handlerConfig, secretArn, securityGroupId, subnetIds, opts) {
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs", {}, undefined);
+  let sourceCodeHash = match.sourceCodeHash;
+  let envVars = Object.fromEntries([[
+      "HANDLER_CONFIG",
+      handlerConfig
+    ]]);
+  let vpcConfig = securityGroupId.apply(sgId => ({
+    subnetIds: subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, sourceCodeHash, envVars, undefined, undefined, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  let rolePolicy = new (Aws.iam.RolePolicy)(name + `MigrationAccess`, {
+    policy: secretArn.apply(arn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `MigrationAccessPolicy`, [{
+        Sid: "AllowGetSecret",
+        Effect: "Allow",
+        Action: "secretsmanager:GetSecretValue",
+        Resource: arn
+      }]))),
+    role: runtime.parts.lambdaRole.id
+  });
+  let layerArn = Stdlib_Option.getOr(Lambda$PulumiAws.reventlessLayerArn, "no-layer");
+  let inputJson = JSON.stringify(Object.fromEntries([[
+      "trigger",
+      sourceCodeHash + `:` + layerArn
+    ]]));
+  let invocation = new (Aws.lambda.Invocation)(name + `Migrate`, {
+    functionName: Output$Pulumi.flatMap(runtime.parts.lambda, l => l.name),
+    input: inputJson
+  }, {
+    dependsOn: [rolePolicy]
+  });
+  return runtime.resources.concat([Adapter$ReventlessInfra.make(Pulumi.output(name + `Migration`), invocation.id, invocation.id, Pulumi.output("aws:lambda"), undefined, Pulumi.output("postgres-migration"), undefined, Pulumi.output("aws:lambda:Invocation"), undefined, undefined)]);
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -0,0 +1,279 @@
+// Deploy-time provisioner for the shared Postgres GraphQL-read Lambda (B3.2b).
+//
+// Postgres-backed read models have no per-table AppSync data source, so instead
+// of the direct DynamoDB resolvers there is ONE in-VPC "PgQueryResolver" Lambda
+// (PgQueryResolverEntryPoint.mjs → PgQueryResolver_Lambda.dispatch) registered
+// as a single AppSync Lambda data source. Every Postgres read model's resolvers
+// (QueryDbResolvers_Lambda) are thin APPSYNC_JS `Invoke` templates pointing at
+// this one data source.
+//
+// Ordering wrinkle: `QueryDbStorage_Postgres.make` runs DURING construct and
+// must return the data source name, but the Lambda's code bundle needs the set
+// of Postgres read models (their spec packages), known only AFTER construct. So
+// the data source name is a DEFERRED Output (`dataSourceName`), fulfilled by
+// `provision` — which the platform calls in makePlatform once every plugin is
+// built (alongside provisionPgChangeFeedRelay). The resolvers themselves are
+// created even later (inside the schema-pushed `resourcesMaker`), so they read
+// the name after `provision` has resolved it.
+
+open PulumiAws
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// -- Deferred data source name ----------------------------------------------
+// Created once at module load. `QueryDbStorage_Postgres.make` returns this for
+// every Postgres read model (one shared data source); `provision` resolves it.
+let resolveDataSourceName: ref<string => unit> = ref(_ => ())
+let dataSourceNamePromise: promise<string> = Promise.make((resolve, _reject) =>
+  resolveDataSourceName := resolve
+)
+let dataSourceName: Pulumi.Output.t<string> = Pulumi.Output.fromPromise(dataSourceNamePromise)
+
+// -- Resolver-binding registry ----------------------------------------------
+// Populated by QueryDbResolvers_Lambda.make during construct (per Postgres read
+// model): the bits `provision` bakes into the Lambda env config that the entry
+// point can't get from the spec module (they come from the deploy-time
+// queryFieldNamesRegistry). specModulePath is looked up from
+// EventCollectorRuntime_Builder_Single.readModelInfos at provision time.
+type resolverEntry = {
+  readModelName: string,
+  labelField: string,
+  includeIdParam: bool,
+}
+let entries: dict<resolverEntry> = Dict.make()
+let register = (entry: resolverEntry): unit =>
+  entries->Dict.set(entry.readModelName, entry)
+
+// Relay node type → read-model-name, populated per RM by QueryDbResolvers_Lambda.
+// Baked into the env config so the entry point can serve the shared node(id).
+let nodeTypes: dict<string> = Dict.make()
+let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
+  nodeTypes->Dict.set(typeName, readModelName)
+
+// -- Provision --------------------------------------------------------------
+let bool = b => b ? "true" : "false"
+
+// One `node(id: ID!)` resolver on the shared data source → Invoke {kind:"node"}.
+let nodeResolverCode =
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+// Serialize the shared connection config into the env-config JSON (same shape
+// EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
+let pgConnectionJson = (cc: PgConnection.connectionConfig): string =>
+  cc->PgConnection.connectionConfigToJson->JSON.stringify
+
+let provision = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~selection: QueryDbBackend.selection,
+  ~opts: Pulumi.ComponentResource.options,
+  // The shared node(id) resolver is a single resolver on the API's Query.node
+  // field. In plugin-stack mode each plugin stack deploys independently onto one
+  // shared API, so only ONE stack may own that field — and a per-plugin node
+  // resolver only knows its own plugin's types anyway. So node is provisioned in
+  // monolithic mode only; plugin stacks pass false. (Node is not wired on the
+  // DynamoDB path either — it stays a monolithic-only capability for now.)
+  ~createNodeResolver: bool=true,
+): unit => {
+  // Join the resolver-binding registry (labelField/includeIdParam) with the
+  // ReadModel runtime registry (specModulePath, pgBacked). Only read models
+  // that both got Lambda resolvers AND are Postgres-backed are handled here.
+  let handlers =
+    entries
+    ->Dict.valuesToArray
+    ->Array.filterMap(entry =>
+      switch EventCollectorRuntime_Builder_Single.readModelInfos->Dict.get(entry.readModelName) {
+      | Some(info) if info.pgBacked => Some((entry, info.specModulePath))
+      | _ => None
+      }
+    )
+  if handlers->Array.length == 0 {
+    // No Postgres read models with Lambda resolvers — nothing to provision.
+    ()
+  } else {
+    // makeFromCodeAsset takes ComponentResource.options (the original); the raw
+    // IAM / DataSource resources take the CustomResourceOptions projection.
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let name = "PgQueryResolver"
+
+    // Bundle the entry point plus each read model's spec package (imported at
+    // Lambda init for indexes / subIdField / schema → capability).
+    let packageDirs: dict<string> = Dict.make()
+    handlers->Array.forEach(((_entry, specModulePath)) => {
+      let pkg = Util_Bundle.extractPackageName(specModulePath)
+      packageDirs->Dict.set(pkg, Util_Bundle.resolvePackageRoot(pkg))
+    })
+
+    // Env config: shared pgConnection + one handler per read model. Sorted for
+    // deploy-stable output. specModule/labelField/includeIdParam are baked;
+    // indexes/subIdField/authorization come from the imported spec at runtime.
+    let handlerJsons =
+      handlers
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a.readModelName, b.readModelName))
+      ->Array.map(((entry, specModulePath)) => {
+        let specModule = specModulePath->JSON.stringifyAny->Option.getOr(`""`)
+        `{"readModelName":"${entry.readModelName}","specModule":${specModule},"labelField":"${entry.labelField}","includeIdParam":${bool(
+            entry.includeIdParam,
+          )}}`
+      })
+
+    // Relay node type → read-model map, baked so the entry point can serve node(id).
+    let nodeTypesJson =
+      nodeTypes
+      ->Dict.toArray
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a, b))
+      ->Array.map(((typeName, rm)) => `"${typeName}":"${rm}"`)
+      ->Array.join(",")
+
+    let queryResolverConfig =
+      selection.connectionConfig->Pulumi.Output.apply(cc =>
+        `{"pgConnection":${pgConnectionJson(cc)},"handlers":[${handlerJsons->Array.join(
+            ",",
+          )}],"nodeTypes":{${nodeTypesJson}}}`
+      )
+
+    let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
+    envVars->Dict.set("QUERY_RESOLVER_CONFIG", queryResolverConfig->Pulumi.Output.asInput)
+    envVars->Dict.set("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make)
+
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs",
+      ~packageDirs,
+    )
+
+    // In-VPC on the DB-access security group + private subnets (reach RDS).
+    let vpcConfig =
+      selection.securityGroupId
+      ->Pulumi.Output.apply(sgId =>
+        (
+          {
+            Lambda.Function.subnetIds: selection.subnetIds->Pulumi.Input.make,
+            securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+          }: Lambda.Function.vpcConfig
+        )
+      )
+      ->Pulumi.Output.asInput
+
+    let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+      ~name,
+      ~code,
+      ~sourceCodeHash,
+      ~envVars,
+      ~memorySize=512,
+      ~timeout=30,
+      ~vpcConfig,
+      ~opts,
+    )
+
+    // Read the RDS-managed secret so PgRuntime can resolve the DB password.
+    let _ = selection.connectionConfig->Pulumi.Output.apply(cc => {
+      open PolicyDocument
+      IAM.RolePolicy.make(
+        ~name=name ++ "-pgSecret",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "-pgSecretPolicy",
+            ~statements=[
+              {
+                sid: "AllowGetPgSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(cc.secretArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+        },
+      )
+    })
+
+    // AppSync → Lambda data source (one, shared by every Postgres RM's resolvers).
+    let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+      ~name=name ++ "DataSource",
+      ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+      ~opts=customOpts,
+    )
+    let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(l => l.arn)
+    let _ =
+      (lambdaArn, dataSourceRole.id)
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((arn, dsRoleId)) => {
+        open PolicyDocument
+        IAM.RolePolicy.make(
+          ~name=name ++ "DataSourceInvoke",
+          ~args={
+            policy: PolicyDocument.make(
+              ~id=name ++ "DataSourceInvokePolicy",
+              ~statements=[
+                {
+                  sid: "AllowDataSourceInvokeLambda",
+                  effect: Allow,
+                  actions: Action("lambda:InvokeFunction"),
+                  resources: Resource(arn),
+                },
+              ],
+            )
+            ->PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: dsRoleId->Pulumi.Input.make,
+          },
+        )
+      })
+
+    let dataSource = AppSync.DataSource.make(
+      ~name=name ++ "DataSource",
+      ~args={
+        type_: AWS_LAMBDA,
+        apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+        lambdaConfig: {
+          AppSync.DataSource.functionArn: lambdaArn->Pulumi.Output.asInput,
+        }->Pulumi.Input.make,
+        serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+      },
+      ~opts=Some(customOpts),
+    )
+
+    // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
+    // typeName in the Lambda. Only when some entity registered a node type
+    // (else the `node` field isn't in the schema) AND in monolithic mode
+    // (plugin stacks would collide on the single Query.node field).
+    if createNodeResolver && nodeTypes->Dict.toArray->Array.length > 0 {
+      let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
+        ~name=name ++ "NodeResolver",
+        ~api,
+        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+        ~type_="Query"->Pulumi.Input.make,
+        ~field="node"->Pulumi.Input.make,
+        ~code=nodeResolverCode,
+        ~opts=customOpts,
+      )
+    }
+
+    // Fulfil the deferred name the Postgres storage maker handed to resolvers.
+    let _ = dataSource.name->Pulumi.Output.apply(n => resolveDataSourceName.contents(n))
+    log.info(~comp="PgQueryResolver_Builder", `provisioned for ${handlers->Array.length->Int.toString} read model(s)`)
+  }
+}