@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/src/adapter/Runtime/StateTopicPublish.mjs

@@ -0,0 +1,204 @@
+// StateTopicPublish.mjs
+// B3.3: Postgres live-update publisher — the projection-Lambda-side counterpart
+// of the DynamoDB StateTopic Lambda (StateTopic_AppSync.res).
+//
+// On the DynamoDB path a shared Lambda reads the table's stream and POSTs a
+// change descriptor to the AppSync Events API. Postgres read models have no
+// stream, so (design (a), mirroring the reventless-local Sqlite/InMemory
+// backends) the projection Lambda publishes the SAME descriptor itself, right
+// after it writes the `qdb_<name>` row. The wire contract — channel layout,
+// descriptor shape, SigV4 signing — is byte-identical to StateTopic_AppSync so
+// the browser/AutoLive side cannot tell the two backends apart.
+//
+// Channel:  /default/{pathSegment(topicName)}/{pathSegment(entityKey)}
+// Descriptor: { changeKind: "Updated" | "Removed", id: <entityKey>,
+//               sortKeyValue?: <updatedAt | createdAt if present> }
+//
+// changeKind is fixed per operation (save→"Updated", delete→"Removed"): a
+// Postgres upsert doesn't distinguish insert vs update, and the Sqlite/InMemory
+// backends already collapse save→"Updated" (LocalBus.res:213) — the UI treats a
+// first-seen "Updated" row as an insert, so no Added detection is needed.
+//
+// Publish failures are LOGGED AND SWALLOWED: the projection row is already
+// committed when this runs, and the projection Lambda is at-least-once — throwing
+// would re-run the projection and duplicate work. A dropped live notification
+// only means the UI refreshes the list on its next load, not data loss.
+//
+// Uses native Node.js crypto + fetch with SigV4; credentials come from the
+// Lambda execution role via the process.env AWS_* variables.
+
+import { createHmac, createHash } from "node:crypto";
+
+function sha256hex(data) {
+  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
+}
+function hmacBuf(key, data) {
+  return createHmac("sha256", key).update(data).digest();
+}
+
+async function signedHeaders(host, path, body, region) {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+  const sessionToken = process.env.AWS_SESSION_TOKEN;
+  const now = new Date();
+  const amzDate = now.toISOString().replace(/[:\-]|\..../g, "").slice(0, 15) + "Z";
+  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
+  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
+  const canonH = Object.entries(headers).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}:${v}\n`).join("");
+  const signH = Object.keys(headers).sort().join(";");
+  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\n");
+  const scope = `${dateStamp}/${region}/appsync/aws4_request`;
+  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\n");
+  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
+  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, region), "appsync"), "aws4_request");
+  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
+  return { ...headers, Authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signH}, Signature=${sig}` };
+}
+
+// AppSync Events channel segments allow only [A-Za-z0-9-]; anything else
+// collapses to `-`. The descriptor body keeps the ORIGINAL entityKey so the UI
+// can match it against GraphQL row ids. Same rule as StateTopic_AppSync and the
+// UI's AutoLive.normalizeSegment.
+function pathSegment(value) {
+  return String(value).replace(/[^A-Za-z0-9-]/g, "-");
+}
+
+// Pick the natural sort timestamp from the saved state (updatedAt preferred,
+// createdAt fallback). Mirrors StateTopic_AppSync.pickSortKeyValue and
+// LocalBus.pickSortKeyValue.
+function pickSortKeyValue(state) {
+  if (state && typeof state === "object" && !Array.isArray(state)) {
+    if (typeof state.updatedAt === "string") return state.updatedAt;
+    if (typeof state.createdAt === "string") return state.createdAt;
+  }
+  return undefined;
+}
+
+// Build the descriptor + channel and POST to {endpoint}/event.
+// - endpoint:   base AppSync Events HTTP endpoint (no trailing /event).
+// - region:     AWS region for the SigV4 credential scope.
+// - topicName:  the plugin-prefixed query LIST field name (channel root).
+// - entityKey:  ORIGINAL entity key (id or `id-subKey`) — descriptor body + path.
+// - changeKind: "Updated" (save) | "Removed" (delete).
+// - sortKeyValue: optional; included when defined.
+// - dedupeId:   AppSync publish `id` (idempotency hint).
+export async function publishStateChange({ endpoint, region, topicName, entityKey, changeKind, sortKeyValue, dedupeId }) {
+  if (!endpoint || !topicName) return; // not live-enabled — no-op
+  try {
+    const url = new URL(endpoint);
+    const channel = "/default/" + pathSegment(topicName) + "/" + pathSegment(entityKey);
+    const descriptor = { changeKind, id: entityKey };
+    if (sortKeyValue !== undefined) descriptor.sortKeyValue = sortKeyValue;
+    const body = JSON.stringify({
+      id: dedupeId || (topicName + ":" + entityKey + ":" + changeKind),
+      channel,
+      events: [JSON.stringify(descriptor)],
+    });
+    const auth = await signedHeaders(url.hostname, "/event", body, region || process.env.AWS_REGION || "eu-west-1");
+    const res = await fetch(endpoint + "/event", {
+      method: "POST",
+      headers: {
+        accept: "application/json, text/javascript",
+        "content-encoding": "amz-1.0",
+        "content-type": "application/json; charset=UTF-8",
+        ...auth,
+      },
+      body,
+    });
+    if (!res.ok) {
+      const txt = await res.text();
+      // Swallow (see module docstring): the row is already committed. Log
+      // structurally so a CloudWatch metric filter on
+      // "PG_STATE_TOPIC_PUBLISH_FAILED" can surface persistent breakage.
+      console.error(
+        "PG_STATE_TOPIC_PUBLISH_FAILED status=" + res.status +
+        " channel=" + channel +
+        " body=" + txt.slice(0, 500)
+      );
+    }
+  } catch (e) {
+    console.error("PG_STATE_TOPIC_PUBLISH_FAILED status=network err=" + (e && e.message));
+  }
+}
+
+// Compose the entity key from a save/delete's id + optional sub-key. Matches
+// StateTopic_AppSync.entityKeyFromRecord and QueryDbStorage_Sqlite.entityKeyFor:
+// single-key tables → id; composite tables → `id-subKeyValue`.
+export function entityKeyFor(id, state, subIdField) {
+  if (subIdField === undefined || subIdField === null) return String(id);
+  const subValue =
+    state && typeof state === "object" && !Array.isArray(state) ? state[subIdField] : undefined;
+  return subValue === undefined || subValue === null
+    ? String(id)
+    : String(id) + "-" + String(subValue);
+}
+
+// Wrap a Postgres QueryDb operation set so every save/delete also publishes a
+// live-update descriptor. `liveConfig` = { endpoint, region, topicName,
+// subIdField }. When endpoint/topicName are absent the ops pass through
+// unchanged (non-stream / non-live read models pay nothing).
+//
+// Note on batch ops: saveBatch/deleteBatch fan out one publish per item, after
+// the batch write resolves — the row set is committed as a unit, and each row
+// gets its own descriptor exactly as N single writes would.
+export function withLiveUpdates(ops, liveConfig) {
+  const { endpoint, topicName, region, subIdField } = liveConfig || {};
+  if (!endpoint || !topicName) return ops;
+  // `publish` is injectable for headless testing (default = the real SigV4
+  // publisher); tests pass a capturing stub so the wrapping logic can be
+  // asserted without fetch/crypto.
+  const publish = (liveConfig && liveConfig.publish) || publishStateChange;
+
+  const publishSaved = async (id, state) =>
+    publish({
+      endpoint, region, topicName,
+      entityKey: entityKeyFor(id, state, subIdField),
+      changeKind: "Updated",
+      sortKeyValue: pickSortKeyValue(state),
+    });
+
+  const publishRemovedKey = async (entityKey) =>
+    publish({ endpoint, region, topicName, entityKey, changeKind: "Removed" });
+
+  // Resolve the entity keys a delete will remove — computed BEFORE the delete so
+  // a partition-wide delete on a composite table can still enumerate its rows
+  // (mirrors QueryDbStorage_Sqlite.delete's rowKeysForPartition). `subIdOpt` is
+  // the adapter's `option<(field, subValue)>`: undefined (partition-wide) or a
+  // `[field, subValue]` array (one specific row).
+  const removedKeysFor = async (id, subIdOpt) => {
+    if (subIdOpt) return [String(id) + "-" + String(subIdOpt[1])];
+    if (subIdField === undefined || subIdField === null) return [String(id)];
+    // Composite table, whole-partition delete (`Delete(id)` / `DeleteMany`):
+    // read the live rows so each removed sub-row gets its own descriptor,
+    // exactly as N DynamoDB stream REMOVE records would.
+    const res = await ops.load(id);
+    const rows = res && res.TAG === "Ok" ? res._0 : [];
+    return rows.map((row) => entityKeyFor(id, row, subIdField));
+  };
+
+  return {
+    ...ops,
+    save: async (id, state, saveMode, ttl) => {
+      const r = await ops.save(id, state, saveMode, ttl);
+      await publishSaved(id, state);
+      return r;
+    },
+    saveBatch: async (items) => {
+      const r = await ops.saveBatch(items);
+      await Promise.all(items.map(([id, state]) => publishSaved(id, state)));
+      return r;
+    },
+    delete: async (id, subIdOpt) => {
+      const keys = await removedKeysFor(id, subIdOpt);
+      const r = await ops.delete(id, subIdOpt);
+      await Promise.all(keys.map(publishRemovedKey));
+      return r;
+    },
+    deleteBatch: async (entries) => {
+      const keyGroups = await Promise.all(entries.map(([id, subIdOpt]) => removedKeysFor(id, subIdOpt)));
+      const r = await ops.deleteBatch(entries);
+      await Promise.all(keyGroups.flat().map(publishRemovedKey));
+      return r;
+    },
+  };
+}

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -11,6 +11,7 @@ import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/Req
 import { handleAction } from "@reventlessdev/reventless-core/src/Projection.res.mjs";
 import { load, loadStream, save, saveBatch, count, $$delete, deleteBatch } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
 import { opsFor as pgQdbOpsFor } from "@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs";
+import { withLiveUpdates } from "./StateTopicPublish.mjs";
 import { handleStreamEvent } from "@reventlessdev/reventless-aws/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -44,12 +45,22 @@ function groupBySource(records) {
 // `pgConnection`, when present, selects the Postgres QueryDb runtime for this
 // slice's view table (`queryDbTableName` is then the slice spec name, the shared
 // `qdb_<name>` discriminator). Absent → the DynamoDB path is byte-identical.
-function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName, pgConnection) {
+function buildJsonEventsHandler(specModule, projectionModule, queryDbTableName, pgConnection, stateTopicName) {
   let queryDbOps;
   if (pgConnection) {
     const indexes = (specModule.config && specModule.config.indexes) || [];
     const subIdField = specModule.subIdConfig ? specModule.subIdConfig.subIdField : undefined;
-    queryDbOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+    const pgOps = pgQdbOpsFor(pgConnection, queryDbTableName, indexes, subIdField);
+    // B3.3: subscription-enabled (Stream) Postgres view slice → publish a
+    // live-update descriptor after save/delete. `stateTopicName` + APPSYNC_ENDPOINT
+    // gate it; absent → withLiveUpdates passes pgOps through. The view slice's id
+    // is the save's first arg (no id injection), so no wrap-ordering concern.
+    queryDbOps = withLiveUpdates(pgOps, {
+      endpoint: process.env.APPSYNC_ENDPOINT,
+      region: process.env.AWS_REGION,
+      topicName: stateTopicName,
+      subIdField,
+    });
   } else {
     const table = makeTableRef(queryDbTableName);
     queryDbOps = {
@@ -105,6 +116,9 @@ function expandHandlers(config) {
       // Shared across a plugin's slices (all follow the platform backend toggle);
       // hoisted to the top level of the compressed config like base/sourceUrn.
       pgConnection: config.pgConnection,
+      // B3.3: per-slice AppSync Events channel root (list field name). Present
+      // only for subscription-enabled (Stream) Postgres view slices.
+      stateTopicName: h.t,
     };
   });
 }
@@ -118,7 +132,7 @@ async function buildAllHandlers() {
       dynamicImport(h.specModule),
       dynamicImport(h.projectionModule),
     ]);
-    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName, h.pgConnection);
+    const jsonEventsHandler = buildJsonEventsHandler(specModule, projectionModule, h.queryDbTableName, h.pgConnection, h.stateTopicName);
     const streamHandler = (event, context) => handleStreamEvent(jsonEventsHandler, event, context);
     const existing = handlers[h.sourceUrn] || [];
     existing.push(streamHandler);

package/src/adapter/Runtime/StateViewSliceRuntime_Builder_Single.res

@@ -13,6 +13,9 @@ type handlerEntry = {
   projectionModule: string,
   queryDbTableName: string,
   sourceUrn: string,
+  // B3.3: AppSync Events channel root for a subscription-enabled Postgres view
+  // slice; "" when the slice isn't live-enabled (compact key `t`, omitted then).
+  stateTopicName: string,
 }
 
 // Longest common prefix of a set of strings. Used to factor the shared
@@ -40,6 +43,27 @@ type sliceInfo = {
 
 let sliceInfos: dict<sliceInfo> = Dict.make()
 
+// B3.3: the AppSync Events API a Postgres-backed stream view slice publishes live
+// updates to. Set once by `Platform.makePlatform` before plugins build (mirrors
+// EventCollectorRuntime_Builder_Single). None → no live updates.
+type eventsApiConfig = {
+  endpoint: Pulumi.Output.t<string>,
+  apiArn: Pulumi.Output.t<string>,
+}
+let eventsApiConfig: ref<option<eventsApiConfig>> = ref(None)
+let setEventsApiConfig = (cfg: eventsApiConfig) => eventsApiConfig := Some(cfg)
+
+// Channel root for a subscription-enabled Postgres view slice (the plural LIST
+// field name, same source as the DynamoDB subscriptionInfraHook); "" when the
+// slice isn't stream-routed or there's no events API.
+let stateTopicNameFor = (name: string): string =>
+  QueryDbBackend.postgresStreamRegistry->Set.has(name) && eventsApiConfig.contents->Option.isSome
+    ? ReventlessCore.Plugin_Helpers.queryFieldNamesRegistry
+      ->Dict.get(name)
+      ->Option.map(qn => qn.listFieldName)
+      ->Option.getOr(name)
+    : ""
+
 let registerStateViewSlice = (
   ~name,
   ~specModulePath,
@@ -130,6 +154,9 @@ let buildLambda = (
   ~packageDirs,
   ~channelSpecs,
   ~feedQueue: option<PulumiAws.SQS.Queue.t>=None,
+  // B3.3: Some when any slice on this Lambda is a subscription-enabled Postgres
+  // view slice — arms the APPSYNC_ENDPOINT env + appsync:EventPublish IAM.
+  ~pgStreamConfig: option<eventsApiConfig>=None,
   ~memorySize=1024,
   ~timeout=30,
 ) => {
@@ -141,20 +168,9 @@ let buildLambda = (
   let qdbSelection = QueryDbBackend.get()
   let pgConnectionFragment = switch qdbSelection {
   | Some(sel) =>
-    sel.connectionConfig->Pulumi.Output.apply(cc => {
-      let pgConnectionJson =
-        [
-          ("host", cc.host->JSON.Encode.string),
-          ("port", cc.port->Int.toFloat->JSON.Encode.float),
-          ("database", cc.database->JSON.Encode.string),
-          ("username", cc.username->JSON.Encode.string),
-          ("secretArn", cc.secretArn->JSON.Encode.string),
-        ]
-        ->Dict.fromArray
-        ->JSON.Encode.object
-        ->JSON.stringify
-      `,"pgConnection":${pgConnectionJson}`
-    })
+    sel.connectionConfig->Pulumi.Output.apply(cc =>
+      `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+    )
   | None => Pulumi.Output.make("")
   }
 
@@ -191,11 +207,16 @@ let buildLambda = (
             ->JSON.stringifyAny
             ->Option.getOr(`""`)
           let q = h.queryDbTableName->JSON.stringifyAny->Option.getOr(`""`)
+          // B3.3: compact key `t` = live-update channel root; omit when empty.
+          let t =
+            h.stateTopicName == ""
+              ? ""
+              : `,"t":${h.stateTopicName->JSON.Encode.string->JSON.stringify}`
           if sharedUrn != "" {
-            `{"s":${s},"p":${p},"q":${q}}`
+            `{"s":${s},"p":${p},"q":${q}${t}}`
           } else {
             let u = h.sourceUrn->JSON.stringifyAny->Option.getOr(`""`)
-            `{"s":${s},"p":${p},"q":${q},"u":${u}}`
+            `{"s":${s},"p":${p},"q":${q},"u":${u}${t}}`
           }
         })
         ->Array.join(",")
@@ -207,6 +228,13 @@ let buildLambda = (
   let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
   envVars->Dict.set("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)
 
+  // B3.3: give the projection Lambda the AppSync Events endpoint when any of its
+  // slices publish live updates (IAM added below).
+  switch pgStreamConfig {
+  | Some(cfg) => envVars->Dict.set("APPSYNC_ENDPOINT", cfg.endpoint->Pulumi.Output.asInput)
+  | None => ()
+  }
+
   // Bundle the framework packages alongside the entry point so the deployed
   // Lambda picks up local edits without waiting for a Lambda Layer rebuild
   // (the layer fetches @reventlessdev/reventless-* from GitHub Packages, not
@@ -286,6 +314,35 @@ let buildLambda = (
   | None => ()
   }
 
+  // B3.3: grant appsync:EventPublish so subscription-enabled Postgres view slices
+  // can push live-update descriptors from this Lambda.
+  switch pgStreamConfig {
+  | Some(cfg) =>
+    let _ = cfg.apiArn->Pulumi.Output.apply(apiArn => {
+      open PulumiAws.PolicyDocument
+      PulumiAws.IAM.RolePolicy.make(
+        ~name="AllStateViewSlices-appsyncPublish",
+        ~args={
+          policy: PulumiAws.PolicyDocument.make(
+            ~id="AllStateViewSlices-appsyncPublishPolicy",
+            ~statements=[
+              {
+                sid: "AllowPublishAppSyncEvents",
+                effect: Allow,
+                actions: Action("appsync:EventPublish"),
+                resources: Resource(apiArn ++ "/*"),
+              },
+            ],
+          )
+          ->PulumiAws.PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+        },
+      )
+    })
+  | None => ()
+  }
+
   let _connectResources = EventCollectorChannel.connect(
     ~name="AllStateViewSlices",
     ~channelSpecs,
@@ -347,7 +404,7 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
         let packageDirs: dict<string> = Dict.make()
         let allQueryDbResources: array<ReventlessInfra.Adapter.resource> = []
 
-        sliceInfos->Dict.forEachWithKey((info, _name) => {
+        sliceInfos->Dict.forEachWithKey((info, name) => {
           info.queryDbResources->Array.forEach(r => allQueryDbResources->Array.push(r)->ignore)
           let specPkg = Util_Bundle.extractPackageName(info.specModulePath)
           packageDirs->Dict.set(specPkg, Util_Bundle.resolvePackageRoot(specPkg))
@@ -369,18 +426,24 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
                 projectionModule: info.projectionModulePath,
                 queryDbTableName: tableName,
                 sourceUrn: urn,
+                stateTopicName: stateTopicNameFor(name),
               }
               entry
             })
           let _ = handlerOutputs->Array.push(handlerJson)
         })
 
+        let anyPgStream =
+          sliceInfos
+          ->Dict.keysToArray
+          ->Array.some(n => QueryDbBackend.postgresStreamRegistry->Set.has(n))
         buildLambda(
           ~parent,
           ~handlerOutputs,
           ~packageDirs,
           ~channelSpecs=[{channel: channel, eventTopics, resources: allQueryDbResources}],
           ~feedQueue,
+          ~pgStreamConfig=anyPgStream ? eventsApiConfig.contents : None,
         )
       | None =>
         log.warn(
@@ -445,6 +508,7 @@ let finish = () =>
                   queryDbTableName: tableName,
                   // No stream resource (Postgres) → dispatch on the feed queue ARN.
                   sourceUrn: urns->Array.get(0)->Option.getOr(feedArn),
+                  stateTopicName: stateTopicNameFor(spec.componentName),
                 }
                 entry
               })
@@ -457,12 +521,17 @@ let finish = () =>
           }
         })
 
+        let anyPgStream =
+          storedSpecs->Array.some(spec =>
+            QueryDbBackend.postgresStreamRegistry->Set.has(spec.componentName)
+          )
         buildLambda(
           ~parent,
           ~handlerOutputs,
           ~packageDirs,
           ~channelSpecs=storedSpecs->Array.map(({channelSpec}) => channelSpec),
           ~feedQueue,
+          ~pgStreamConfig=anyPgStream ? eventsApiConfig.contents : None,
           ~memorySize=maxMemorySize,
           ~timeout=maxTimeout,
         )

package/src/adapter/Runtime/StateViewSliceRuntime_Builder_Single.res.mjs

@@ -13,8 +13,10 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as QueryDbBackend$ReventlessAws from "../QueryDb/QueryDbBackend.res.mjs";
+import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "../Postgres/PgProjectionFeed.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -38,6 +40,22 @@ function commonPrefix(strings) {
 
 let sliceInfos = {};
 
+let eventsApiConfig = {
+  contents: undefined
+};
+
+function setEventsApiConfig(cfg) {
+  eventsApiConfig.contents = cfg;
+}
+
+function stateTopicNameFor(name) {
+  if (QueryDbBackend$ReventlessAws.postgresStreamRegistry.has(name) && Stdlib_Option.isSome(eventsApiConfig.contents)) {
+    return Stdlib_Option.getOr(Stdlib_Option.map(Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name], qn => qn.listFieldName), name);
+  } else {
+    return "";
+  }
+}
+
 function registerStateViewSlice(name, specModulePath, projectionModulePath, queryDbTableName, queryDbResourcesOpt) {
   let queryDbResources = queryDbResourcesOpt !== undefined ? queryDbResourcesOpt : [];
   sliceInfos[name] = {
@@ -88,8 +106,9 @@ let finished = {
   contents: false
 };
 
-function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueueOpt, memorySizeOpt, timeoutOpt) {
+function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueueOpt, pgStreamConfigOpt, memorySizeOpt, timeoutOpt) {
   let feedQueue = feedQueueOpt !== undefined ? Primitive_option.valFromOption(feedQueueOpt) : undefined;
+  let pgStreamConfig = pgStreamConfigOpt !== undefined ? Primitive_option.valFromOption(pgStreamConfigOpt) : undefined;
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : 30;
   let opts_parent = parent;
@@ -97,31 +116,7 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueu
     parent: opts_parent
   };
   let qdbSelection = QueryDbBackend$ReventlessAws.get();
-  let pgConnectionFragment = qdbSelection !== undefined ? qdbSelection.connectionConfig.apply(cc => {
-      let pgConnectionJson = JSON.stringify(Object.fromEntries([
-        [
-          "host",
-          cc.host
-        ],
-        [
-          "port",
-          cc.port
-        ],
-        [
-          "database",
-          cc.database
-        ],
-        [
-          "username",
-          cc.username
-        ],
-        [
-          "secretArn",
-          cc.secretArn
-        ]
-      ]));
-      return `,"pgConnection":` + pgConnectionJson;
-    }) : Pulumi.output("");
+  let pgConnectionFragment = qdbSelection !== undefined ? qdbSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc))) : Pulumi.output("");
   let handlerConfigOutput = Pulumi.all([
     Pulumi.all(handlerOutputs),
     pgConnectionFragment
@@ -140,11 +135,12 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueu
       let s = Stdlib_Option.getOr(JSON.stringify(h.specModule.slice(baseLen, h.specModule.length)), `""`);
       let p = Stdlib_Option.getOr(JSON.stringify(h.projectionModule.slice(baseLen, h.projectionModule.length)), `""`);
       let q = Stdlib_Option.getOr(JSON.stringify(h.queryDbTableName), `""`);
+      let t = h.stateTopicName === "" ? "" : `,"t":` + JSON.stringify(h.stateTopicName);
       if (sharedUrn !== "") {
-        return `{"s":` + s + `,"p":` + p + `,"q":` + q + `}`;
+        return `{"s":` + s + `,"p":` + p + `,"q":` + q + t + `}`;
       }
       let u = Stdlib_Option.getOr(JSON.stringify(h.sourceUrn), `""`);
-      return `{"s":` + s + `,"p":` + p + `,"q":` + q + `,"u":` + u + `}`;
+      return `{"s":` + s + `,"p":` + p + `,"q":` + q + `,"u":` + u + t + `}`;
     }).join(",");
     let baseJson = Stdlib_Option.getOr(JSON.stringify(base), `""`);
     let urnJson = Stdlib_Option.getOr(JSON.stringify(sharedUrn), `""`);
@@ -152,6 +148,9 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueu
   });
   let envVars = {};
   envVars["HANDLER_CONFIG"] = handlerConfigOutput;
+  if (pgStreamConfig !== undefined) {
+    envVars["APPSYNC_ENDPOINT"] = pgStreamConfig.endpoint;
+  }
   packageDirs["@reventlessdev/reventless-aws"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-aws");
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-core");
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/StateViewSliceEntryPoint.mjs", packageDirs, undefined);
@@ -171,6 +170,17 @@ function buildLambda(parent, handlerOutputs, packageDirs, channelSpecs, feedQueu
       role: runtime.parts.lambdaRole.id
     }));
   }
+  if (pgStreamConfig !== undefined) {
+    pgStreamConfig.apiArn.apply(apiArn => new (Aws.iam.RolePolicy)("AllStateViewSlices-appsyncPublish", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllStateViewSlices-appsyncPublishPolicy", [{
+          Sid: "AllowPublishAppSyncEvents",
+          Effect: "Allow",
+          Action: "appsync:EventPublish",
+          Resource: apiArn + "/*"
+        }])),
+      role: runtime.parts.lambdaRole.id
+    }));
+  }
   EventCollectorChannel_DynamoDbStream$ReventlessAws.connect("AllStateViewSlices", channelSpecs, runtime, opts);
   if (feedQueue !== undefined) {
     return PgProjectionFeed$ReventlessAws.connect("AllStateViewSlicesFeed", feedQueue, runtime.parts.lambda, runtime.parts.lambdaRole, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts));
@@ -201,7 +211,7 @@ function finishWithDcbEventLog(dcbEventLog) {
       let handlerOutputs = [];
       let packageDirs = {};
       let allQueryDbResources = [];
-      Stdlib_Dict.forEachWithKey(sliceInfos, (info, _name) => {
+      Stdlib_Dict.forEachWithKey(sliceInfos, (info, name) => {
         info.queryDbResources.forEach(r => {
           allQueryDbResources.push(r);
         });
@@ -219,15 +229,17 @@ function finishWithDcbEventLog(dcbEventLog) {
           specModule: info.specModulePath,
           projectionModule: info.projectionModulePath,
           queryDbTableName: param[0],
-          sourceUrn: param[1]
+          sourceUrn: param[1],
+          stateTopicName: stateTopicNameFor(name)
         }));
         handlerOutputs.push(handlerJson);
       });
+      let anyPgStream = Object.keys(sliceInfos).some(n => QueryDbBackend$ReventlessAws.postgresStreamRegistry.has(n));
       buildLambda(parent, handlerOutputs, packageDirs, [{
           channel: channel,
           eventTopics: eventTopics,
           resources: allQueryDbResources
-        }], Primitive_option.some(feedQueue), undefined, undefined);
+        }], Primitive_option.some(feedQueue), Primitive_option.some(anyPgStream ? eventsApiConfig.contents : undefined), undefined, undefined);
     } else {
       log.warn("StateViewSliceRuntime_Builder_Single", undefined, "finishWithDcbEventLog: DCB EventLog has no parent");
     }
@@ -273,11 +285,13 @@ function finish() {
           specModule: info.specModulePath,
           projectionModule: info.projectionModulePath,
           queryDbTableName: param[0],
-          sourceUrn: Stdlib_Option.getOr(param[1][0], param[2])
+          sourceUrn: Stdlib_Option.getOr(param[1][0], param[2]),
+          stateTopicName: stateTopicNameFor(spec.componentName)
         }));
         handlerOutputs.push(handlerJson);
       });
-      buildLambda(parent, handlerOutputs, packageDirs, storedSpecs.map(param => param.channelSpec), Primitive_option.some(feedQueue), match[0], match[1]);
+      let anyPgStream = storedSpecs.some(spec => QueryDbBackend$ReventlessAws.postgresStreamRegistry.has(spec.componentName));
+      buildLambda(parent, handlerOutputs, packageDirs, storedSpecs.map(param => param.channelSpec), Primitive_option.some(feedQueue), Primitive_option.some(anyPgStream ? eventsApiConfig.contents : undefined), match[0], match[1]);
     } else {
       log.warn("StateViewSliceRuntime_Builder_Single", undefined, `finish: grandParent not set`);
     }
@@ -295,6 +309,9 @@ export {
   log,
   commonPrefix,
   sliceInfos,
+  eventsApiConfig,
+  setEventsApiConfig,
+  stateTopicNameFor,
   registerStateViewSlice,
   storedSpecs,
   grandParent,

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -354,8 +354,12 @@ let finish = (
       "index.mjs",
       Pulumi.Asset.stringAsset(handlerCode)->Pulumi.Archive.assetToAssetOrArchive,
     )
+    // ESM self-containment: the handler imports @aws-sdk/util-dynamodb, provided
+    // by the nodejs22.x runtime only under /var/runtime — unreachable from
+    // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
+    let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
     let code = Pulumi.Archive.assetArchive(archiveContents)
-    let sourceCodeHash = Util_Bundle.hashString(handlerCode)
+    let sourceCodeHash = Util_Bundle.hashString(handlerCode ++ "\n---\n" ++ loaderHash)
 
     let layers =
       Lambda.reventlessLayerArn
@@ -383,6 +387,8 @@ let finish = (
               ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
               ("APPSYNC_ENDPOINT", appsyncEndpoint->Pulumi.Output.asInput),
               ("STATE_TOPIC_MAP", topicMapJson->Pulumi.Output.asInput),
+              ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+              ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             ]),
           }: Lambda.Function.functionEnvironment
         )->Pulumi.Input.make,