@reventlessdev/reventless-aws 3.0.0-alpha.177 → 3.0.0-alpha.178

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
@@ -11,6 +12,15 @@ import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core
 
 let log = Logger$ReventlessCore.fromEnv();
 
+function authIdField(group) {
+  let c = group[0];
+  if (c !== undefined) {
+    return c.toLowerCase() + group.slice(1, group.length) + "Id";
+  } else {
+    return "Id";
+  }
+}
+
 function argObj(args) {
   return Stdlib_Option.getOr(Stdlib_JSON.Decode.object(args), {});
 }
@@ -55,7 +65,8 @@ async function runInterceptor(binding, payload) {
   }
 }
 
-async function dispatch(binding, payload) {
+async function dispatch(binding, lookupBindingOpt, payload) {
+  let lookupBinding = lookupBindingOpt !== undefined ? lookupBindingOpt : param => {};
   let rm = payload.readModelName;
   let match = await runInterceptor(binding, payload);
   if (typeof match !== "object") {
@@ -84,7 +95,25 @@ async function dispatch(binding, payload) {
         let indexName = Stdlib_Option.getOr(payload.index, "");
         let field = Stdlib_Option.getOr(Stdlib_Option.flatMap(binding.indexes.find(ic => ic.index === indexName), ic => ic.idField), indexName);
         let value = Stdlib_Option.getOr(argStr(payload.arguments, indexName), "");
-        return await binding.pushdowns.indexLookup(rm, field, value);
+        let match$1 = payload.authGroup;
+        let match$2 = payload.authTable;
+        let authorized;
+        if (match$1 !== undefined && match$2 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$1)) {
+          let authBinding = lookupBinding(match$2);
+          if (authBinding !== undefined) {
+            let items$1 = await authBinding.ops.load(value);
+            authorized = items$1.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items$1._0[0], row => argStr(row, authIdField(match$1))), false, owner => owner === payload.identity.username) : false;
+          } else {
+            authorized = false;
+          }
+        } else {
+          authorized = true;
+        }
+        if (authorized) {
+          return await binding.pushdowns.indexLookup(rm, field, value);
+        } else {
+          return [];
+        }
       case "items" :
         let subIdField = binding.subIdField;
         if (subIdField === undefined) {
@@ -98,8 +127,8 @@ async function dispatch(binding, payload) {
         if (conn !== undefined) {
           return conn;
         }
-        let items$1 = await binding.pushdowns.scanAll(rm);
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, param => {});
+        let items$2 = await binding.pushdowns.scanAll(rm);
+        return QueryDbListQuery$ReventlessCore.run(items$2, argsDict, binding.capability, binding.labelField, param => {});
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
@@ -110,23 +139,23 @@ async function dispatch(binding, payload) {
         let source$1 = Stdlib_Option.getOr(payload.source, null);
         let key = Stdlib_Option.getOr(argStr(source$1, Stdlib_Option.getOr(payload.sourceIdField, "")), "");
         let ix = payload.targetIndex;
-        let items$2;
+        let items$3;
         if (ix !== undefined) {
-          items$2 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
+          items$3 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
         } else {
-          let items$3 = await binding.ops.load(key);
-          items$2 = items$3.TAG === "Ok" ? items$3._0 : [];
+          let items$4 = await binding.ops.load(key);
+          items$3 = items$4.TAG === "Ok" ? items$4._0 : [];
         }
-        let match$1 = payload.sourceSubId;
-        let match$2 = binding.subIdField;
+        let match$3 = payload.sourceSubId;
+        let match$4 = binding.subIdField;
         let filtered;
-        if (match$1 !== undefined && match$2 !== undefined) {
-          let name = match$1.name;
-          let tmp = match$1.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
+        if (match$3 !== undefined && match$4 !== undefined) {
+          let name = match$3.name;
+          let tmp = match$3.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
           let subVal = Stdlib_Option.getOr(tmp, "");
-          filtered = items$2.filter(it => Stdlib_Option.getOr(argStr(it, match$2), "") === subVal);
+          filtered = items$3.filter(it => Stdlib_Option.getOr(argStr(it, match$4), "") === subVal);
         } else {
-          filtered = items$2;
+          filtered = items$3;
         }
         if (Stdlib_Option.getOr(payload.multi, false)) {
           return filtered;
@@ -143,8 +172,8 @@ async function dispatch(binding, payload) {
     }
   } else {
     let isMulti = Stdlib_Option.getOr(payload.multi, false);
-    let match$3 = payload.kind;
-    switch (match$3) {
+    let match$5 = payload.kind;
+    switch (match$5) {
       case "getById" :
         return null;
       case "items" :
@@ -227,7 +256,7 @@ async function handler(payload, _context) {
   }
   let binding = bindings[bindingKey];
   if (binding !== undefined) {
-    return await dispatch(binding, payload);
+    return await dispatch(binding, name => bindings[name], payload);
   } else {
     return Stdlib_JsError.throwWithMessage("PgQueryResolver: no binding registered for read model " + bindingKey);
   }
@@ -235,6 +264,7 @@ async function handler(payload, _context) {
 
 export {
   log,
+  authIdField,
   argObj,
   argStr,
   argStrs,

package/src/adapter/QueryDb/QueryDbBackend.res

@@ -50,3 +50,11 @@ let isPostgresFor = (name: string): bool =>
 /** Whether ANY read model on this platform is Postgres-backed (used to decide
     whether the projection Lambdas need VPC/secret access). */
 let isPostgres = (): bool => selectionRef.contents->Option.isSome
+
+// B3.3: Postgres read models routed through `QueryDbStorage.SelectableStream`
+// (i.e. subscription-enabled). Lives here — a leaf both the storage selector and
+// the projection-Lambda runtime builders already import — so the runtime builder
+// can consult it without pulling in QueryDbStorage (which would close a build
+// cycle via QueryDbStorage_Postgres → PgQueryResolver_Builder). Membership means
+// "publish live updates from the projection Lambda after save/delete".
+let postgresStreamRegistry: Set.t<string> = Set.make()

package/src/adapter/QueryDb/QueryDbBackend.res.mjs

@@ -32,6 +32,8 @@ function isPostgres() {
   return Stdlib_Option.isSome(selectionRef.contents);
 }
 
+let postgresStreamRegistry = new Set();
+
 export {
   selectionRef,
   set,
@@ -40,5 +42,6 @@ export {
   exempt,
   isPostgresFor,
   isPostgres,
+  postgresStreamRegistry,
 }
-/* No side effect */
+/* postgresStreamRegistry Not a pure module */

package/src/adapter/QueryDb/QueryDbResolvers.res.mjs

@@ -28,4 +28,4 @@ export {
   Lambda,
   Selectable,
 }
-/* QueryDbResolvers_Lambda-ReventlessAws Not a pure module */
+/* QueryDbBackend-ReventlessAws Not a pure module */

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res

@@ -26,11 +26,21 @@ let identityBlock = `id != null && id.sub != null
         ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
         : null`
 
-let invokeTemplate = (~readModelName: string, ~kind: string, ~index: option<string>=?) => {
+let invokeTemplate = (
+  ~readModelName: string,
+  ~kind: string,
+  ~index: option<string>=?,
+  ~authTable: option<string>=?,
+  ~authGroup: option<string>=?,
+) => {
   let indexFrag = switch index {
   | Some(ix) => `\n      index: '${ix}',`
   | None => ""
   }
+  let authFrag = switch (authTable, authGroup) {
+  | (Some(t), Some(g)) => `\n      authTable: '${t}',\n      authGroup: '${g}',`
+  | _ => ""
+  }
   `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   const id = ctx.identity;
@@ -38,7 +48,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       readModelName: '${readModelName}',
-      kind: '${kind}',${indexFrag}
+      kind: '${kind}',${indexFrag}${authFrag}
       arguments: ctx.args,
       identity: ${identityBlock}
     }
@@ -129,14 +139,14 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     PgQueryResolver_Builder.registerNodeType(~typeName=returnTypeName, ~readModelName=name)
   }
 
-  let mkResolver = (~resolverName, ~field, ~kind, ~index=?) =>
+  let mkResolver = (~resolverName, ~field, ~kind, ~index=?, ~authTable=?, ~authGroup=?) =>
     Resolver.makeUnitJsResolver(
       ~name=resolverName,
       ~api,
       ~dataSourceName,
       ~type_="Query"->Pulumi.Input.make,
       ~field=field->Pulumi.Input.make,
-      ~code=invokeTemplate(~readModelName=name, ~kind, ~index?),
+      ~code=invokeTemplate(~readModelName=name, ~kind, ~index?, ~authTable?, ~authGroup?),
       ~opts,
     )
 
@@ -192,12 +202,26 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       []
     }
 
-    // Per-index equality queries: {single}By{Index}.
-    let byIndex = indexes->Array.map(({index}) => {
+    // Per-index equality queries: {single}By{Index}. A group-restricted index
+    // (indexConfig.authorization) bakes the auth-table pipeline params — the
+    // Lambda verifies group membership + ownership against the auth read model.
+    let byIndex = indexes->Array.map((ic: indexConfig) => {
+      let index = ic.index
       let resolverName =
         fieldNameForSingle->String.capitalize ++ "By" ++ index->stripLeadingBy->String.capitalize
       let field = fieldNameForSingle ++ "By" ++ index->stripLeadingBy->String.capitalize
-      mkResolver(~resolverName, ~field, ~kind="index", ~index)
+      switch ic.authorization {
+      | Some({tableName, group}) =>
+        mkResolver(
+          ~resolverName,
+          ~field,
+          ~kind="index",
+          ~index,
+          ~authTable=tableName->String.capitalize,
+          ~authGroup=group,
+        )
+      | None => mkResolver(~resolverName, ~field, ~kind="index", ~index)
+      }
     })
 
     // @resolves — single cross-table field resolver on this (parent) type. The

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res.mjs

@@ -14,8 +14,9 @@ let identityBlock = `id != null && id.sub != null
         ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
         : null`;
 
-function invokeTemplate(readModelName, kind, index) {
+function invokeTemplate(readModelName, kind, index, authTable, authGroup) {
   let indexFrag = index !== undefined ? `\n      index: '` + index + `',` : "";
+  let authFrag = authTable !== undefined && authGroup !== undefined ? `\n      authTable: '` + authTable + `',\n      authGroup: '` + authGroup + `',` : "";
   return `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   const id = ctx.identity;
@@ -23,7 +24,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       readModelName: '` + readModelName + `',
-      kind: '` + kind + `',` + indexFrag + `
+      kind: '` + kind + `',` + indexFrag + authFrag + `
       arguments: ctx.args,
       identity: ` + identityBlock + `
     }
@@ -75,7 +76,7 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
   if (includeIdParam) {
     PgQueryResolver_Builder$ReventlessAws.registerNodeType(returnTypeName, name$1);
   }
-  let mkResolver = (resolverName, field, kind, index) => AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, invokeTemplate(name$1, kind, index), opts);
+  let mkResolver = (resolverName, field, kind, index, authTable, authGroup) => AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, invokeTemplate(name$1, kind, index, authTable, authGroup), opts);
   let stripLeadingBy = s => {
     if (s.startsWith("by") && s.length > 2) {
       return s.slice(2, s.length);
@@ -84,21 +85,26 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
     }
   };
   let resourcesMaker = _allQueryDbs => {
-    let byId = mkResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, includeIdParam ? "getById" : "list", undefined);
-    let all = mkResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, "list", undefined);
-    let items = subIdField !== undefined ? [mkResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", "items", undefined)] : [];
+    let byId = mkResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, includeIdParam ? "getById" : "list", undefined, undefined, undefined);
+    let all = mkResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, "list", undefined, undefined, undefined);
+    let items = subIdField !== undefined ? [mkResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", "items", undefined, undefined, undefined)] : [];
     let byIds;
     if (includeIdParam && subIdField === undefined) {
       let byIdsField = fieldNameForAll + "ByIds";
-      byIds = [mkResolver(Stdlib_String.capitalize(byIdsField), byIdsField, "byIds", undefined)];
+      byIds = [mkResolver(Stdlib_String.capitalize(byIdsField), byIdsField, "byIds", undefined, undefined, undefined)];
     } else {
       byIds = [];
     }
-    let byIndex = indexes.map(param => {
-      let index = param.index;
+    let byIndex = indexes.map(ic => {
+      let index = ic.index;
       let resolverName = Stdlib_String.capitalize(fieldNameForSingle) + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
       let field = fieldNameForSingle + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
-      return mkResolver(resolverName, field, "index", index);
+      let match = ic.authorization;
+      if (match !== undefined) {
+        return mkResolver(resolverName, field, "index", index, Stdlib_String.capitalize(match.tableName), match.group);
+      } else {
+        return mkResolver(resolverName, field, "index", index, undefined, undefined);
+      }
     });
     let idResolvers = idResolverConfigs.map(config => {
       let target = config.target;

package/src/adapter/QueryDb/QueryDbStorage.res

@@ -9,7 +9,11 @@ module Postgres = QueryDbStorage_Postgres
 // platform when a `PgConnection` is supplied — and dispatch per read model:
 // Postgres (no table, no data source) unless the name is admin-exempt. The Stream
 // selector falls back to the streamed DynamoDB maker; on Postgres there is no
-// stream — live updates for Postgres-backed read models are deferred (B3.3).
+// stream, so live updates (B3.3) are published from the projection Lambda after
+// each save/delete instead. SelectableStream records subscription-enabled
+// Postgres read models in `QueryDbBackend.postgresStreamRegistry` (a leaf module,
+// to avoid a build cycle) so the projection-Lambda runtime builder knows which
+// handlers need the AppSync-Events publish wiring.
 module Selectable = {
   type api = QueryDbStorage_Postgres.api
   type role = QueryDbStorage_Postgres.role
@@ -42,6 +46,7 @@ module SelectableStream = {
     ~opts,
   ) =>
     if QueryDbBackend.isPostgresFor(name) {
+      QueryDbBackend.postgresStreamRegistry->Set.add(name)
       Postgres.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)
     } else {
       DynamoDbStream.make(~name, ~indexes, ~subIdField?, ~ttl?, ~api, ~apiRole, ~opts)

package/src/adapter/QueryDb/QueryDbStorage.res.mjs

@@ -19,6 +19,7 @@ let Selectable = {
 
 function make$1(name, indexes, subIdField, ttl, api, apiRole, opts) {
   if (QueryDbBackend$ReventlessAws.isPostgresFor(name)) {
+    QueryDbBackend$ReventlessAws.postgresStreamRegistry.add(name);
     return QueryDbStorage_Postgres$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
   } else {
     return QueryDbStorage_DynamoDbStream$ReventlessAws.make(name, indexes, subIdField, ttl, api, apiRole, opts);
@@ -48,4 +49,4 @@ export {
   Selectable,
   SelectableStream,
 }
-/* QueryDbStorage_DynamoDb-ReventlessAws Not a pure module */
+/* QueryDbBackend-ReventlessAws Not a pure module */

package/src/adapter/QueryDb/QueryDbStorage_Postgres.res.mjs

@@ -18,4 +18,4 @@ function make(name, indexes, subIdField, param, param$1, param$2, param$3) {
 export {
   make,
 }
-/* PgQueryResolver_Builder-ReventlessAws Not a pure module */
+/* QueryDbBackend-ReventlessAws Not a pure module */

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -214,20 +214,9 @@ let finish = () =>
         let pgSelection = EventLogBackend.get()
         let pgConnectionFragment = switch pgSelection {
         | Some(sel) =>
-          sel.connectionConfig->Pulumi.Output.apply(cc => {
-            let pgConnectionJson =
-              [
-                ("host", cc.host->JSON.Encode.string),
-                ("port", cc.port->Int.toFloat->JSON.Encode.float),
-                ("database", cc.database->JSON.Encode.string),
-                ("username", cc.username->JSON.Encode.string),
-                ("secretArn", cc.secretArn->JSON.Encode.string),
-              ]
-              ->Dict.fromArray
-              ->JSON.Encode.object
-              ->JSON.stringify
-            `,"pgConnection":${pgConnectionJson}`
-          })
+          sel.connectionConfig->Pulumi.Output.apply(cc =>
+            `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+          )
         | None => Pulumi.Output.make("")
         }
 

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
@@ -156,31 +157,7 @@ function finish() {
       let handlerOutputs = [];
       let packageDirs = {};
       let pgSelection = EventLogBackend$ReventlessAws.get();
-      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
-          let pgConnectionJson = JSON.stringify(Object.fromEntries([
-            [
-              "host",
-              cc.host
-            ],
-            [
-              "port",
-              cc.port
-            ],
-            [
-              "database",
-              cc.database
-            ],
-            [
-              "username",
-              cc.username
-            ],
-            [
-              "secretArn",
-              cc.secretArn
-            ]
-          ]));
-          return `,"pgConnection":` + pgConnectionJson;
-        }) : Pulumi.output("");
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc))) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -201,20 +201,9 @@ let finish = () =>
         let pgSelection = EventLogBackend.get()
         let pgConnectionFragment = switch pgSelection {
         | Some(sel) =>
-          sel.connectionConfig->Pulumi.Output.apply(cc => {
-            let pgConnectionJson =
-              [
-                ("host", cc.host->JSON.Encode.string),
-                ("port", cc.port->Int.toFloat->JSON.Encode.float),
-                ("database", cc.database->JSON.Encode.string),
-                ("username", cc.username->JSON.Encode.string),
-                ("secretArn", cc.secretArn->JSON.Encode.string),
-              ]
-              ->Dict.fromArray
-              ->JSON.Encode.object
-              ->JSON.stringify
-            `,"pgConnection":${pgConnectionJson}`
-          })
+          sel.connectionConfig->Pulumi.Output.apply(cc =>
+            `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+          )
         | None => Pulumi.Output.make("")
         }
 

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../EventLog/EventLogBackend.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
@@ -148,31 +149,7 @@ function finish() {
       let handlerOutputs = [];
       let packageDirs = {};
       let pgSelection = EventLogBackend$ReventlessAws.get();
-      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => {
-          let pgConnectionJson = JSON.stringify(Object.fromEntries([
-            [
-              "host",
-              cc.host
-            ],
-            [
-              "port",
-              cc.port
-            ],
-            [
-              "database",
-              cc.database
-            ],
-            [
-              "username",
-              cc.username
-            ],
-            [
-              "secretArn",
-              cc.secretArn
-            ]
-          ]));
-          return `,"pgConnection":` + pgConnectionJson;
-        }) : Pulumi.output("");
+      let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc))) : Pulumi.output("");
       specs.forEach(spec => {
         let info = aggregateInfos[spec.aggregateName];
         if (info === undefined) {

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -99,7 +99,13 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // (see docs/plans/aws-postgres-change-feed-bridge.md), not by this Lambda.
   const rawStorageOps = config.pgConnection
     ? (() => {
-        const pgOps = pgDcbEventLogOpsFor(config.pgConnection, config.dcbEventLogTableName);
+        // C2: `lockStrategy` ("AdvisoryLocks" | "RowLocks") is the polyvariant's
+        // string name; `opsFor` defaults to "AdvisoryLocks" when it's absent.
+        const pgOps = pgDcbEventLogOpsFor(
+          config.pgConnection,
+          config.dcbEventLogTableName,
+          config.pgConnection.lockStrategy,
+        );
         return { read: pgOps.read, append: pgOps.append, readStream: pgOps.readStream };
       })()
     : (() => {

package/src/adapter/Runtime/EventCollectorRuntime_Builder_Single.res

@@ -18,6 +18,18 @@ type readModelInfo = {
 
 let readModelInfos: dict<readModelInfo> = Dict.make()
 
+// B3.3: the AppSync Events API a Postgres-backed stream read model publishes live
+// updates to. Set once by `Platform.makePlatform` (monolithic mode) before the
+// plugins build, so `finish` can add the APPSYNC_ENDPOINT env + appsync:EventPublish
+// IAM to the projection Lambda. None → no live updates (no events API, or the
+// platform runs without one).
+type eventsApiConfig = {
+  endpoint: Pulumi.Output.t<string>,
+  apiArn: Pulumi.Output.t<string>,
+}
+let eventsApiConfig: ref<option<eventsApiConfig>> = ref(None)
+let setEventsApiConfig = (cfg: eventsApiConfig) => eventsApiConfig := Some(cfg)
+
 let registerReadModel = (
   ~readModelName,
   ~specModulePath,
@@ -147,20 +159,9 @@ let finish = () =>
           readModelInfos->Dict.valuesToArray->Array.some(info => info.pgBacked)
         let pgConnectionFragment = switch (qdbSelection, anyPgBacked) {
         | (Some(sel), true) =>
-          sel.connectionConfig->Pulumi.Output.apply(cc => {
-            let pgConnectionJson =
-              [
-                ("host", cc.host->JSON.Encode.string),
-                ("port", cc.port->Int.toFloat->JSON.Encode.float),
-                ("database", cc.database->JSON.Encode.string),
-                ("username", cc.username->JSON.Encode.string),
-                ("secretArn", cc.secretArn->JSON.Encode.string),
-              ]
-              ->Dict.fromArray
-              ->JSON.Encode.object
-              ->JSON.stringify
-            `,"pgConnection":${pgConnectionJson}`
-          })
+          sel.connectionConfig->Pulumi.Output.apply(cc =>
+            `,"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}`
+          )
         | _ => Pulumi.Output.make("")
         }
 
@@ -192,6 +193,23 @@ let finish = () =>
             let handlerPgFragment = info.pgBacked
               ? pgConnectionFragment
               : Pulumi.Output.make("")
+            // B3.3: a subscription-enabled Postgres read model publishes live
+            // updates from the projection Lambda — bake its AppSync Events channel
+            // root (the plural LIST field name, same source as the DynamoDB
+            // subscriptionInfraHook). Deploy-time resolved, so a plain string.
+            let stateTopicFragment =
+              info.pgBacked &&
+              QueryDbBackend.postgresStreamRegistry->Set.has(spec.componentName) &&
+              eventsApiConfig.contents->Option.isSome
+                ? {
+                    let topic =
+                      ReventlessCore.Plugin_Helpers.queryFieldNamesRegistry
+                      ->Dict.get(spec.componentName)
+                      ->Option.map(qn => qn.listFieldName)
+                      ->Option.getOr(spec.componentName)
+                    `,"stateTopicName":${topic->JSON.Encode.string->JSON.stringify}`
+                  }
+                : ""
             let handlerJson =
               Pulumi.Output.all4((
                 info.queryDbTableName,
@@ -203,7 +221,7 @@ let finish = () =>
                 // No stream resource (Postgres-backed source) → dispatch on the
                 // feed queue's ARN instead of a stream URN.
                 let sourceUrn = urns->Array.get(0)->Option.getOr(feedArn)
-                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}}`
+                `{"specModule":${specModule},"mappingsModule":${mappingsModule},"queryDbTableName":"${tableName}","sourceUrn":"${sourceUrn}"${pgFragment}${stateTopicFragment}}`
               })
             let _ = handlerOutputs->Array.push(handlerJson)
           | None =>
@@ -223,6 +241,22 @@ let finish = () =>
         let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
         envVars->Dict.set("HANDLER_CONFIG", handlerConfigOutput->Pulumi.Output.asInput)
 
+        // B3.3: when any Postgres-backed read model is subscription-enabled, the
+        // projection Lambda publishes live updates to the AppSync Events API —
+        // give it the endpoint (env) and appsync:EventPublish (IAM, below).
+        let anyPgStream =
+          readModelInfos
+          ->Dict.keysToArray
+          ->Array.some(rmName =>
+            (readModelInfos->Dict.get(rmName)->Option.mapOr(false, i => i.pgBacked)) &&
+              QueryDbBackend.postgresStreamRegistry->Set.has(rmName)
+          )
+        let pgStreamConfig = anyPgStream ? eventsApiConfig.contents : None
+        switch pgStreamConfig {
+        | Some(cfg) => envVars->Dict.set("APPSYNC_ENDPOINT", cfg.endpoint->Pulumi.Output.asInput)
+        | None => ()
+        }
+
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
           ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/ReadModelEntryPoint.mjs",
           ~packageDirs,
@@ -287,6 +321,35 @@ let finish = () =>
         | _ => ()
         }
 
+        // B3.3: grant the projection Lambda appsync:EventPublish on the events API
+        // so a Postgres-backed stream read model can push live-update descriptors.
+        switch pgStreamConfig {
+        | Some(cfg) =>
+          let _ = cfg.apiArn->Pulumi.Output.apply(apiArn => {
+            open PulumiAws.PolicyDocument
+            PulumiAws.IAM.RolePolicy.make(
+              ~name="AllReadModels-appsyncPublish",
+              ~args={
+                policy: PulumiAws.PolicyDocument.make(
+                  ~id="AllReadModels-appsyncPublishPolicy",
+                  ~statements=[
+                    {
+                      sid: "AllowPublishAppSyncEvents",
+                      effect: Allow,
+                      actions: Action("appsync:EventPublish"),
+                      resources: Resource(apiArn ++ "/*"),
+                    },
+                  ],
+                )
+                ->PulumiAws.PolicyDocument.toJsonString
+                ->Pulumi.Input.make,
+                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+              },
+            )
+          })
+        | None => ()
+        }
+
         let channelSpecs = storedSpecs->Array.map(({channelSpec}) => channelSpec)
         let _connectResources = EventCollectorChannel.connect(
           ~name="AllReadModels",