@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -201,20 +201,9 @@ let finish = () =>
         let pgSelection = EventLogBackend.get()
         let pgConnectionFragment = switch pgSelection {
         | Some(sel) =>
-          sel.connectionConfig->Pulumi.Output.apply(cc => {
-            let pgConnectionJson =
-              [
-                ("host", cc.host->JSON.Encode.string),
-                ("port", cc.port->Int.toFloat->JSON.Encode.float),
-                ("database", cc.database->JSON.Encode.string),
-                ("username", cc.username->JSON.Encode.string),
-                ("secretArn", cc.secretArn->JSON.Encode.string),
-              ]
-              ->Dict.fromArray
-              ->JSON.Encode.object
-              ->JSON.stringify
-            `,"pgConnection":${pgConnectionJson}`
-          })
+          sel.connectionConfig->Pulumi.Output.apply(cc =>
+            `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+          )
         | None => Pulumi.Output.make("")
         }
 

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
@@ -148,31 +149,7 @@ function finish() {
       let handlerOutputs = [];
       let packageDirs = {};
       let pgSelection = EventLogBackend$ReventlessAws.get();
-      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
-          let pgConnectionJson = JSON.stringify(Object.fromEntries([
-            [
-              "host",
-              cc.host
-            ],
-            [
-              "port",
-              cc.port
-            ],
-            [
-              "database",
-              cc.database
-            ],
-            [
-              "username",
-              cc.username
-            ],
-            [
-              "secretArn",
-              cc.secretArn
-            ]
-          ]));
-          return `,"pgConnection":` + pgConnectionJson;
-        }) : Pulumi.output("");
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc))) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -99,7 +99,13 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // (see docs/plans/aws-postgres-change-feed-bridge.md), not by this Lambda.
   const rawStorageOps = config.pgConnection
     ? (() => {
-        const pgOps = pgDcbEventLogOpsFor(config.pgConnection, config.dcbEventLogTableName);
+        // C2: `lockStrategy` ("AdvisoryLocks" | "RowLocks") is the polyvariant's
+        // string name; `opsFor` defaults to "AdvisoryLocks" when it's absent.
+        const pgOps = pgDcbEventLogOpsFor(
+          config.pgConnection,
+          config.dcbEventLogTableName,
+          config.pgConnection.lockStrategy,
+        );
         return { read: pgOps.read, append: pgOps.append, readStream: pgOps.readStream };
       })()
     : (() => {

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res

@@ -18,6 +18,18 @@ type readModelInfo = {
 
 let readModelInfos: dict<readModelInfo> = Dict.make()
 
+// B3.3: the AppSync Events API a Postgres-backed stream read model publishes live
+// updates to. Set once by `Platform.makePlatform` (monolithic mode) before the
+// plugins build, so `finish` can add the APPSYNC_ENDPOINT env + appsync:EventPublish
+// IAM to the projection Lambda. None → no live updates (no events API, or the
+// platform runs without one).
+type eventsApiConfig = {
+  endpoint: Pulumi.Output.t<string>,
+  apiArn: Pulumi.Output.t<string>,
+}
+let eventsApiConfig: ref<option<eventsApiConfig>> = ref(None)
+let setEventsApiConfig = (cfg: eventsApiConfig) => eventsApiConfig := Some(cfg)
+
 let registerReadModel = (
   ~readModelName,
   ~specModulePath,
@@ -147,20 +159,9 @@ let finish = () =>
           readModelInfos->Dict.valuesToArray->Array.some(info => info.pgBacked)
         let pgConnectionFragment = switch (qdbSelection, anyPgBacked) {
         | (Some(sel), true) =>
-          sel.connectionConfig->Pulumi.Output.apply(cc => {
-            let pgConnectionJson =
-              [
-                ("host", cc.host->JSON.Encode.string),
-                ("port", cc.port->Int.toFloat->JSON.Encode.float),
-                ("database", cc.database->JSON.Encode.string),
-                ("username", cc.username->JSON.Encode.string),
-                ("secretArn", cc.secretArn->JSON.Encode.string),
-              ]
-              ->Dict.fromArray
-              ->JSON.Encode.object
-              ->JSON.stringify
-            `,"pgConnection":${pgConnectionJson}`
-          })
+          sel.connectionConfig->Pulumi.Output.apply(cc =>
+            `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+          )
         | _ => Pulumi.Output.make("")
         }
 
@@ -192,6 +193,23 @@ let finish = () =>
             let handlerPgFragment = info.pgBacked
               ? pgConnectionFragment
               : Pulumi.Output.make("")
+            // B3.3: a subscription-enabled Postgres read model publishes live
+            // updates from the projection Lambda — bake its AppSync Events channel
+            // root (the plural LIST field name, same source as the DynamoDB
+            // subscriptionInfraHook). Deploy-time resolved, so a plain string.
+            let stateTopicFragment =
+              info.pgBacked &&
+              QueryDbBackend.postgresStreamRegistry->Set.has(spec.componentName) &&
+              eventsApiConfig.contents->Option.isSome
+                ? {
+                    let topic =
+                      ReventlessCore.Plugin_Helpers.queryFieldNamesRegistry
+                      ->Dict.get(spec.componentName)
+                      ->Option.map(qn => qn.listFieldName)
+                      ->Option.getOr(spec.componentName)
+                    `,"stateTopicName":${topic->JSON.Encode.string->JSON.stringify}`
+                  }
+                : ""
             let handlerJson =
               Pulumi.Output.all4((
                 info.queryDbTableName,
@@ -203,7 +221,7 @@ let finish = () =>
                 // No stream resource (Postgres-backed source) → dispatch on the
                 // feed queue's ARN instead of a stream URN.
                 let sourceUrn = urns->Array.get(0)->Option.getOr(feedArn)
-                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}}`
+                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}${stateTopicFragment}}`
               })
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -223,6 +241,22 @@ let finish = () =>
         let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
         envVars->Dict.set("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)
 
+        // B3.3: when any Postgres-backed read model is subscription-enabled, the
+        // projection Lambda publishes live updates to the AppSync Events API —
+        // give it the endpoint (env) and appsync:EventPublish (IAM, below).
+        let anyPgStream =
+          readModelInfos
+          ->Dict.keysToArray
+          ->Array.some(rmName =>
+            (readModelInfos->Dict.get(rmName)->Option.mapOr(false, i => i.pgBacked)) &&
+              QueryDbBackend.postgresStreamRegistry->Set.has(rmName)
+          )
+        let pgStreamConfig = anyPgStream ? eventsApiConfig.contents : None
+        switch pgStreamConfig {
+        | Some(cfg) => envVars->Dict.set("APPSYNC_ENDPOINT", cfg.endpoint->Pulumi.Output.asInput)
+        | None => ()
+        }
+
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
           ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs",
           ~packageDirs,
@@ -287,6 +321,35 @@ let finish = () =>
         | _ => ()
         }
 
+        // B3.3: grant the projection Lambda appsync:EventPublish on the events API
+        // so a Postgres-backed stream read model can push live-update descriptors.
+        switch pgStreamConfig {
+        | Some(cfg) =>
+          let _ = cfg.apiArn->Pulumi.Output.apply(apiArn => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllReadModels-appsyncPublish",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllReadModels-appsyncPublishPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowPublishAppSyncEvents",
+                      effect: Allow,
+                      actions: Action("appsync:EventPublish"),
+                      resources: Resource(apiArn ++ "/*"),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         let channelSpecs = storedSpecs->Array.map(({channelSpec}) => channelSpec)
         let _connectResources = EventCollectorChannel.connect(
           ~name="AllReadModels",

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res.mjs

@@ -11,9 +11,11 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as QueryDbBackend$ReventlessAws from "../QueryDb/QueryDbBackend.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
+import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "../Postgres/PgProjectionFeed.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -22,6 +24,14 @@ let log = Logger$ReventlessCore.fromEnv();
 
 let readModelInfos = {};
 
+let eventsApiConfig = {
+  contents: undefined
+};
+
+function setEventsApiConfig(cfg) {
+  eventsApiConfig.contents = cfg;
+}
+
 function registerReadModel(readModelName, specModulePath, mappingsModulePath, queryDbTableName, pgBackedOpt) {
   let pgBacked = pgBackedOpt !== undefined ? pgBackedOpt : false;
   readModelInfos[readModelName] = {
@@ -95,31 +105,7 @@ function finish() {
       let feedArnOutput = feedQueue !== undefined ? feedQueue.arn : Pulumi.output("");
       let qdbSelection = QueryDbBackend$ReventlessAws.get();
       let anyPgBacked = Object.values(readModelInfos).some(info => info.pgBacked);
-      let pgConnectionFragment = qdbSelection !== undefined && anyPgBacked ? qdbSelection.connectionConfig.apply(cc => {
-          let pgConnectionJson = JSON.stringify(Object.fromEntries([
-            [
-              "host",
-              cc.host
-            ],
-            [
-              "port",
-              cc.port
-            ],
-            [
-              "database",
-              cc.database
-            ],
-            [
-              "username",
-              cc.username
-            ],
-            [
-              "secretArn",
-              cc.secretArn
-            ]
-          ]));
-          return `,"pgConnection":` + pgConnectionJson;
-        }) : Pulumi.output("");
+      let pgConnectionFragment = qdbSelection !== undefined && anyPgBacked ? qdbSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc))) : Pulumi.output("");
       let handlerOutputs = [];
       let packageDirs = {};
       let sortedSpecs = storedSpecs.toSorted((a, b) => Primitive_string.compare(a.componentName, b.componentName));
@@ -135,6 +121,13 @@ function finish() {
         let specModule = Stdlib_Option.getOr(JSON.stringify(info.specModulePath), `""`);
         let mappingsModule = Stdlib_Option.getOr(JSON.stringify(info.mappingsModulePath), `""`);
         let handlerPgFragment = info.pgBacked ? pgConnectionFragment : Pulumi.output("");
+        let stateTopicFragment;
+        if (info.pgBacked && QueryDbBackend$ReventlessAws.postgresStreamRegistry.has(spec.componentName) && Stdlib_Option.isSome(eventsApiConfig.contents)) {
+          let topic = Stdlib_Option.getOr(Stdlib_Option.map(Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[spec.componentName], qn => qn.listFieldName), spec.componentName);
+          stateTopicFragment = `,"stateTopicName":` + JSON.stringify(topic);
+        } else {
+          stateTopicFragment = "";
+        }
         let handlerJson = Pulumi.all([
           info.queryDbTableName,
           spec.sourceUrns,
@@ -142,13 +135,24 @@ function finish() {
           handlerPgFragment
         ]).apply(param => {
           let sourceUrn = Stdlib_Option.getOr(param[1][0], param[2]);
-          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"` + param[3] + `}`;
+          return `{"specModule":` + specModule + `,"mappingsModule":` + mappingsModule + `,"queryDbTableName":"` + param[0] + `","sourceUrn":"` + sourceUrn + `"` + param[3] + stateTopicFragment + `}`;
         });
         handlerOutputs.push(handlerJson);
       });
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
+      let anyPgStream = Object.keys(readModelInfos).some(rmName => {
+        if (Stdlib_Option.mapOr(readModelInfos[rmName], false, i => i.pgBacked)) {
+          return QueryDbBackend$ReventlessAws.postgresStreamRegistry.has(rmName);
+        } else {
+          return false;
+        }
+      });
+      let pgStreamConfig = anyPgStream ? eventsApiConfig.contents : undefined;
+      if (pgStreamConfig !== undefined) {
+        envVars["APPSYNC_ENDPOINT"] = pgStreamConfig.endpoint;
+      }
       let match$1 = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs", packageDirs, undefined);
       let vpcConfig = qdbSelection !== undefined && anyPgBacked ? qdbSelection.securityGroupId.apply(sgId => ({
           subnetIds: qdbSelection.subnetIds,
@@ -166,6 +170,17 @@ function finish() {
           role: runtime.parts.lambdaRole.id
         }));
       }
+      if (pgStreamConfig !== undefined) {
+        pgStreamConfig.apiArn.apply(apiArn => new (Aws.iam.RolePolicy)("AllReadModels-appsyncPublish", {
+          policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllReadModels-appsyncPublishPolicy", [{
+              Sid: "AllowPublishAppSyncEvents",
+              Effect: "Allow",
+              Action: "appsync:EventPublish",
+              Resource: apiArn + "/*"
+            }])),
+          role: runtime.parts.lambdaRole.id
+        }));
+      }
       let channelSpecs = storedSpecs.map(param => param.channelSpec);
       EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllReadModels", channelSpecs, runtime, opts);
       if (feedQueue !== undefined) {
@@ -187,6 +202,8 @@ export {
   RuntimeEnvironment,
   log,
   readModelInfos,
+  eventsApiConfig,
+  setEventsApiConfig,
   registerReadModel,
   storedSpecs,
   grandParent,

package/src/adapter/Runtime/PgMigrationEntryPoint.mjs

@@ -0,0 +1,40 @@
+// One-shot Postgres schema-migration Lambda entry point (A3).
+//
+// Invoked once during `pulumi up` by an `aws.lambda.Invocation` resource, from
+// INSIDE the DB's VPC, so the deploy runner needs no network path to a private
+// RDS instance. Runs the exact idempotent `PgSchema.ensureSchema` the local
+// backend runs at startup (reventless-local's `postgres` smart constructor), so
+// the AWS schema is byte-identical to local — zero drift. Every statement is
+// `IF NOT EXISTS`, so re-invocation (e.g. after a schema-DDL change bumps the
+// Lambda layer) is safe.
+//
+// HANDLER_CONFIG shape:
+//   { "pgConnection": { host, port, database, username, secretArn } }
+
+import { poolFor } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgRuntime.res.mjs";
+import { ensureSchema } from "@reventlessdev/reventless-postgres/src/PgSchema.res.mjs";
+import { log } from "./HandlerFactoryHelpers.mjs";
+
+// Config parse → pool → ensureSchema, with the pool source injectable so the
+// orchestration is integration-testable against a real Postgres without the
+// Secrets Manager round-trip (mirrors PgChangeFeedRelay_Runtime's
+// relayWithPool/relay split). `opts.makePool` defaults to the production `poolFor`.
+export async function runMigration(config, opts = {}) {
+  if (!config.pgConnection) {
+    throw new Error("PgMigrationEntryPoint: HANDLER_CONFIG has no pgConnection");
+  }
+  // `poolFor` memoises one pool per secret ARN per container and resolves the
+  // RDS-managed password from Secrets Manager via a cached provider.
+  const makePool = opts.makePool ?? poolFor;
+  const pool = makePool(config.pgConnection);
+  await ensureSchema(pool);
+  log.info("ensureSchema completed for " + config.pgConnection.database, {
+    comp: "PgMigration",
+  });
+  return "ok";
+}
+
+export async function handler(_event, _context) {
+  const config = JSON.parse(process.env["HANDLER_CONFIG"] || "{}");
+  return runMigration(config);
+}

package/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs

@@ -0,0 +1,88 @@
+// Shared PgQueryResolver Lambda entry point (B3.2b).
+//
+// One in-VPC Lambda serves every Postgres-backed read model's GraphQL Query
+// fields (they have no per-table AppSync data source). At cold start it reads
+// QUERY_RESOLVER_CONFIG (one shared pgConnection + one handler per read model),
+// dynamically imports each spec package, and registers a per-read-model
+// `binding` (ops + QueryEnginePostgres push-downs + indexes/subIdField/capability
+// + baked labelField/includeIdParam + authorization) into
+// PgQueryResolver_Lambda. AppSync invokes `handler` with the resolver payload
+// { readModelName, kind, index?, arguments, identity }, which
+// PgQueryResolver_Lambda.dispatch routes.
+//
+// ReScript labeled args compile positionally, so the engine push-downs
+// (indexLookup/byIds/listPage/scan) are assigned straight into the `pushdowns`
+// record — same calling convention PgQueryResolver_Lambda.dispatch invokes them
+// with (verified against the compiled QueryEnginePostgres output).
+
+import { poolFor } from "@reventlessdev/reventless-aws/src/adapter/Postgres/PgRuntime.res.mjs";
+import { Make as makeEngine } from "@reventlessdev/reventless-postgres/src/QueryEnginePostgres.res.mjs";
+import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
+import { deriveServerCapability } from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
+import { register, registerNodeType, handler as dispatchHandler } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs";
+import { patchSpecId, log } from "./HandlerFactoryHelpers.mjs";
+
+const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
+
+// A bounded full-materialisation for the list fallback (shapes listPage
+// declines). Kept high; the fallback is only hit for search/searchPrefix/ids/
+// backward pagination, which the AutoUI does not issue for large models.
+const SCAN_ALL_LIMIT = 100000;
+
+async function buildAllBindings() {
+  const configStr = process.env["QUERY_RESOLVER_CONFIG"] || '{"handlers":[]}';
+  const config = JSON.parse(configStr);
+  const pgConnection = config.pgConnection;
+  if (!pgConnection) {
+    log.warn("no pgConnection in QUERY_RESOLVER_CONFIG", { comp: "PgQueryResolver" });
+    return;
+  }
+  // Container-lifetime pool (memoised by poolFor); the engine and the ops set
+  // share it, so a Lambda holds one pool regardless of read model count.
+  const pool = poolFor(pgConnection);
+  const engine = makeEngine({ pool });
+
+  // Relay node type → read-model map (B3.2c), baked into the config.
+  for (const [typeName, rm] of Object.entries(config.nodeTypes || {})) {
+    registerNodeType(typeName, rm);
+  }
+
+  const pushdowns = {
+    indexLookup: engine.indexLookup,
+    byIds: engine.byIds,
+    listPage: engine.listPage,
+    itemsPage: engine.itemsPage,
+    scanAll: (readModelName) => engine.scan(readModelName, [], SCAN_ALL_LIMIT),
+  };
+
+  await Promise.all((config.handlers || []).map(async h => {
+    const specModule = patchSpecId(await dynamicImport(h.specModule));
+    const indexes = (specModule.config && specModule.config.indexes) || [];
+    const subIdField = specModule.subIdConfig ? specModule.subIdConfig.subIdField : undefined;
+    const capability = deriveServerCapability(specModule.stateSchema);
+    const ops = pgQdbOpsFor(pgConnection, h.readModelName, indexes, subIdField);
+
+    register(h.readModelName, {
+      ops,
+      pushdowns,
+      indexes,
+      subIdField,
+      capability,
+      labelField: h.labelField,
+      includeIdParam: h.includeIdParam,
+      // Compiled string variant (e.g. "AllowAuthenticated"), injected on the
+      // spec by @@reventless.spec — the shape Reventless.Authorization.isAllowed
+      // matches on.
+      authorization: specModule.authorization,
+    });
+    log.debug("registered resolver binding for " + h.readModelName, { comp: "PgQueryResolver" });
+  }));
+}
+
+const initPromise = buildAllBindings();
+
+// AppSync Lambda data source: the invocation payload IS the event.
+export async function handler(event, context) {
+  await initPromise;
+  return dispatchHandler(event, context);
+}

package/src/adapter/Runtime/ReadModelEntryPoint.mjs

@@ -8,6 +8,7 @@ import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/Req
 import { Make as readModelCallbackMake } from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel_Callback.res.mjs";
 import { load as qdbLoad, loadStream as qdbLoadStream, save as qdbSave, saveBatch as qdbSaveBatch, count as qdbCount, $$delete as qdbDelete, deleteBatch as qdbDeleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
 import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
+import { withLiveUpdates } from "./StateTopicPublish.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -74,17 +75,28 @@ function groupBySource(records) {
 // runtime builder injected for a Postgres-backed read model: bind the Postgres
 // operation set (queryDbTableName is then the read-model spec name, the shared
 // `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
-function buildReadModelHandler(specModule, mappingsModule, queryDbTableName, pgConnection) {
+function buildReadModelHandler(specModule, mappingsModule, queryDbTableName, pgConnection, stateTopicName) {
   const patchedSpec = patchSpecId(specModule);
   let operations;
   if (pgConnection) {
     const indexes = (patchedSpec.config && patchedSpec.config.indexes) || [];
     const subIdField = patchedSpec.subIdConfig ? patchedSpec.subIdConfig.subIdField : undefined;
     const pgOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+    // B3.3: on a subscription-enabled (Stream) Postgres read model, publish a
+    // live-update descriptor after each save/delete (no DynamoDB stream exists).
+    // `stateTopicName` (present only for stream RMs) + APPSYNC_ENDPOINT gate it;
+    // absent → withLiveUpdates returns pgOps unchanged. Wrap BEFORE mkInjectIdSave
+    // so the publish sees the id-injected state (id, subId, updatedAt).
+    const livePgOps = withLiveUpdates(pgOps, {
+      endpoint: process.env.APPSYNC_ENDPOINT,
+      region: process.env.AWS_REGION,
+      topicName: stateTopicName,
+      subIdField,
+    });
     operations = {
-      ...pgOps,
-      save: mkInjectIdSave(pgOps.save),
-      saveBatch: mkInjectIdSaveBatch(pgOps.saveBatch),
+      ...livePgOps,
+      save: mkInjectIdSave(livePgOps.save),
+      saveBatch: mkInjectIdSaveBatch(livePgOps.saveBatch),
     };
   } else {
     const table = makeTableRef(queryDbTableName);
@@ -119,7 +131,7 @@ async function buildAllHandlers() {
   await Promise.all(config.handlers.map(async h => {
     const specModule = await dynamicImport(h.specModule);
     const mappingsModule = await dynamicImport(h.mappingsModule);
-    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName, h.pgConnection);
+    const handler = buildReadModelHandler(specModule, mappingsModule, h.queryDbTableName, h.pgConnection, h.stateTopicName);
     // Multiple read models can share one source stream — e.g. every admin read
     // model (Plugins, PluginHistory, PlatformEventGraph, UIFragmentRegistry)
     // projects the Plugin aggregate's EventLog stream. Accumulate ALL handlers

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -180,6 +180,16 @@ let makeFromCodeAsset: (
     variables->Dict.set(key, value)
   })
 
+  // ESM self-containment (Option C): every code archive built by
+  // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at
+  // /var/task. --import registers the resolve hook so the ESM entry point (and the
+  // user spec/behavior modules it dynamically imports) can resolve bare specifiers
+  // — @reventlessdev/*, effect, sury from the layer, @aws-sdk/* from the runtime —
+  // that ESM `import` would otherwise not find outside /var/task. Framework
+  // invariant: set last so it wins over any caller-supplied value.
+  variables->Dict.set("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make)
+  variables->Dict.set("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make)
+
   let tags = AWS.Tags.make(~name, ReventlessCore.CommandTopic.componentType)
   let lambda = Lambda.Function.make(
     ~name,

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -13,6 +13,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as Runtime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Runtime/Runtime.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
@@ -91,6 +92,8 @@ function makeFromCodeAsset(name, code, sourceCodeHash, envVarsOpt, memorySizeOpt
   Stdlib_Dict.forEachWithKey(additionalEnvVars, (value, key) => {
     variables[key] = value;
   });
+  variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
+  variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   let tags = AWS_Tags$ReventlessAws.make(name, CommandTopic$ReventlessCore.componentType);
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -95,20 +95,15 @@ let forDcbCommandTopic = (
     // fragment merged into HANDLER_CONFIG below.
     let pgConnectionFragment = switch pgSelection {
     | Some(sel) =>
-      sel.connectionConfig->Pulumi.Output.apply(cc => {
-        let pgConnectionJson =
-          [
-            ("host", cc.host->JSON.Encode.string),
-            ("port", cc.port->Int.toFloat->JSON.Encode.float),
-            ("database", cc.database->JSON.Encode.string),
-            ("username", cc.username->JSON.Encode.string),
-            ("secretArn", cc.secretArn->JSON.Encode.string),
-          ]
-          ->Dict.fromArray
-          ->JSON.Encode.object
-          ->JSON.stringify
-        `,"pgConnection":${pgConnectionJson}`
-      })
+      // C2: the DCB command Lambda is the only Postgres path that takes an append
+      // lock, so `lockStrategy` rides in this fragment (not in `connectionConfig`,
+      // which the classic/QueryDb paths share). The entry point passes it to
+      // `DcbEventLogStorage_Postgres_Runtime.opsFor`.
+      sel.connectionConfig->Pulumi.Output.apply(cc =>
+        `,"pgConnection":${cc
+          ->PgConnection.connectionConfigToJson(~lockStrategy=sel.lockStrategy)
+          ->JSON.stringify}`
+      )
     | None => Pulumi.Output.make("")
     }
 

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -9,6 +9,7 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 
@@ -51,31 +52,7 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
     let b = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
     return `{"spec":` + s + `,"behavior":` + b + `}`;
   }).join(",");
-  let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
-      let pgConnectionJson = JSON.stringify(Object.fromEntries([
-        [
-          "host",
-          cc.host
-        ],
-        [
-          "port",
-          cc.port
-        ],
-        [
-          "database",
-          cc.database
-        ],
-        [
-          "username",
-          cc.username
-        ],
-        [
-          "secretArn",
-          cc.secretArn
-        ]
-      ]));
-      return `,"pgConnection":` + pgConnectionJson;
-    }) : Pulumi.output("");
+  let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(pgSelection.lockStrategy, cc))) : Pulumi.output("");
   let handlerConfigJson = Pulumi.all([
     dcbTableName$1,
     queue.id,