@reventlessdev/reventless-aws 3.0.0-alpha.229 → 3.0.0-alpha.231

package/src/adapter/Geocoder/Geocoder_AwsLocation_Ops.res.mjs

@@ -0,0 +1,124 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as ClientLocation from "@aws-sdk/client-location";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function corsHeaders() {
+  return Object.fromEntries([
+    [
+      "content-type",
+      "application/json"
+    ],
+    [
+      "access-control-allow-origin",
+      "*"
+    ],
+    [
+      "access-control-allow-methods",
+      "GET,OPTIONS"
+    ],
+    [
+      "access-control-allow-headers",
+      "*"
+    ]
+  ]);
+}
+
+function readQueryParam(event) {
+  let q = Stdlib_Option.flatMap(event.queryStringParameters, p => p["q"]);
+  if (q !== undefined) {
+    return q;
+  } else {
+    return Stdlib_Option.flatMap(event.rawQueryString, raw => Stdlib_Array.findMap(raw.split("&"), pair => {
+      let match = pair.split("=");
+      if (match.length !== 2) {
+        return;
+      }
+      let k = match[0];
+      let v = match[1];
+      if (k === "q") {
+        return decodeURIComponent(v);
+      }
+    }));
+  }
+}
+
+async function handler(event) {
+  try {
+    let indexName = Stdlib_Option.getOr(getEnv("PLACE_INDEX_NAME"), "");
+    let q = Stdlib_Option.getOr(readQueryParam(event), "");
+    if (indexName === "" || q === "") {
+      return {
+        statusCode: 200,
+        headers: corsHeaders(),
+        body: "[]"
+      };
+    }
+    let client = new ClientLocation.LocationClient();
+    let resp = await client.send(new ClientLocation.SearchPlaceIndexForTextCommand({
+      IndexName: indexName,
+      Text: q,
+      MaxResults: 5
+    }));
+    let results = Stdlib_Array.filterMap(Stdlib_Option.getOr(resp.Results, []), r => {
+      let place = r.Place;
+      if (place === undefined) {
+        return;
+      }
+      let label = Stdlib_Option.getOr(place.Label, "");
+      let pt = Stdlib_Option.flatMap(place.Geometry, g => g.Point);
+      if (pt === undefined) {
+        return;
+      }
+      if (pt.length < 2) {
+        return;
+      }
+      let lng = pt[0];
+      let lat = pt[1];
+      return Object.fromEntries([
+        [
+          "label",
+          label
+        ],
+        [
+          "lat",
+          lat
+        ],
+        [
+          "lng",
+          lng
+        ]
+      ]);
+    });
+    return {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: JSON.stringify(results)
+    };
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    console.error("Geocoder: search failed", exn);
+    return {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: "[]"
+    };
+  }
+}
+
+export {
+  getEnv,
+  corsHeaders,
+  readQueryParam,
+  handler,
+}
+/* @aws-sdk/client-location Not a pure module */

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -25,7 +25,8 @@ import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessde
 // per-slice handler building (functor + decode + handleCommands), all
 // compiler-checked against the framework signatures (see the module header and
 // docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
-import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
+import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler, buildInboundReceiver } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
+import { makeDynamoQueryDbOps } from "./QueryDbEntryPoint_Ops.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
 
@@ -145,6 +146,32 @@ export async function buildHandlersForConfig(config, opts = {}) {
   const sqsHandler = handleQueueEvent(resolvedQueue, compositeJsonCommandsHandler);
   const publishJsons = sqsPublishJsons(resolvedQueue, "SQS_FIFO");
 
+  // Route 0 registry: InboundTranslationSlice receive handlers keyed by their
+  // AppSync mutation field name. The resolver invokes this Lambda with
+  // {__inboundTranslation, fieldName, arguments}; the field name is
+  // `<pluginName>_<sliceName>` (Api_Naming.sliceMutationField — the deploy side
+  // uses the same `name` that HANDLER_CONFIG.pluginName carries). The spec +
+  // translation modules are the one untyped seam (dynamic import); the typed
+  // `buildInboundReceiver` owns the functor call + audit persistence. Audit ops
+  // are DynamoDB-only for now (makeDynamoQueryDbOps); Postgres audit is a
+  // follow-up, so on that backend the receiver runs without persistence.
+  const inboundModules = config.inboundTranslationSliceModules || [];
+  const inboundReceiversByField = {};
+  await Promise.all(inboundModules.map(async ({ spec, translation, auditTableName }) => {
+    const specModule = await loadModule(spec);
+    const translationModule = await loadModule(translation);
+    const auditOps = (auditTableName && !config.pgConnection)
+      ? makeDynamoQueryDbOps(auditTableName)
+      : undefined;
+    const fieldName = config.pluginName + "_" + specModule.name;
+    inboundReceiversByField[fieldName] = buildInboundReceiver(
+      specModule,
+      translationModule,
+      publishJsons,
+      auditOps,
+    );
+  }));
+
   // Sync (default): inline-dispatch the command via the same composite handler
   // that Route 2 uses, so the AppSync resolver gets a typed Accepted/Rejected
   // outcome. Async: undefined → makeCommandGenerator falls back to publishJsons
@@ -185,10 +212,11 @@ export async function buildHandlersForConfig(config, opts = {}) {
     return generateCommand({ ...event, meta, identity });
   };
 
-  // Third element is additive — existing callers (the integration tests) keep
-  // destructuring the first two. No deploy-time `plugin` fragment needed here:
-  // this Lambda serves exactly one plugin and HANDLER_CONFIG already names it.
-  return [sqsHandler, cmdGenHandler, dcbComp(config.pluginName), config.pluginName];
+  // Elements past the first two are additive — existing callers (the integration
+  // tests) keep destructuring the first two. No deploy-time `plugin` fragment
+  // needed here: this Lambda serves exactly one plugin and HANDLER_CONFIG already
+  // names it. The 5th element is the Route 0 inbound-translation registry.
+  return [sqsHandler, cmdGenHandler, dcbComp(config.pluginName), config.pluginName, inboundReceiversByField];
 }
 
 async function buildHandler() {
@@ -205,7 +233,24 @@ const initPromise = buildHandler();
 
 export async function handler(event, context) {
   setRequestId(context?.awsRequestId);
-  const [sqsHandler, cmdGenHandler, comp, plugin] = await initPromise;
+  const [sqsHandler, cmdGenHandler, comp, plugin, inboundReceivers] = await initPromise;
+
+  // Route 0: InboundTranslationSlice mutation — the AppSync resolver invokes this
+  // Lambda with `{__inboundTranslation: true, fieldName, arguments}` (no `command`,
+  // no `Records`). Dispatch to the field's receive handler, which translates +
+  // publishes and returns a commandOutcome JSON byte-compatible with Route 1's
+  // `commandOutcomeToJson`. Without this branch the payload fell through to Route 2
+  // and crashed on `event.records` being undefined.
+  if (event.__inboundTranslation === true) {
+    const fieldName = event.fieldName;
+    const receiver = (inboundReceivers || {})[fieldName];
+    if (receiver === undefined) {
+      log.warn("no inbound translation receiver for field: " + fieldName, { comp: "DcbCommandTopicRuntime" });
+      throw new Error("no inbound translation receiver for field: " + fieldName);
+    }
+    log.debug("InboundTranslation invocation (" + fieldName + ")", { comp: "DcbCommandTopicRuntime" });
+    return await receiver(event.arguments);
+  }
 
   // Route 1: AppSync direct invocation — payload carries the CommandGenerator.payload
   // shape (`{command, arguments, meta, identity?}`).

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -219,3 +219,63 @@ let buildSliceHandler = (
     callback.handleCommands(~tagKeysByEventType, ~crossPartitionTagKeys, dcbEventLog, decodedStream)
   }
 }
+
+// ── Inbound translation receiver wiring (Route 0) ───────────────────────────
+// The DCB command Lambda is also the target of every InboundTranslationSlice
+// mutation on the plugin's API — its AppSync resolver invokes this Lambda with an
+// `{__inboundTranslation, fieldName, arguments}` payload. Building the per-field
+// `receive` here keeps the curried `InboundTranslationSlice_Callback.Make` functor
+// call compiler-checked (same rationale as `buildSliceHandler`) and mirrors the
+// in-process composite handler in `Dcb_Builder.res`, so the deployed surface and
+// the local surface encode the same `commandOutcome`.
+
+// The dynamically-imported Translation module — opaque; a clean pass-through to
+// the functor (only `translate` is read, inside the compiled callback).
+type translationModule
+
+type inboundCallback = {
+  receive: (
+    ReventlessInfra.CommandTopic.publishJsons,
+    JSON.t,
+  ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+  auditLog: dict<ReventlessCore.InboundTranslationSlice_Callback.auditRow>,
+}
+@module("@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs")
+external makeInboundCallback: specModule => translationModule => inboundCallback = "Make"
+
+// Builds the inbound receive handler: run the slice's `receive` (which validates
+// the external input against the spec schema, translates, and publishes the mapped
+// commands via `publishJsons`), then — when an audit table name was threaded —
+// drain the in-memory audit log to that table (best-effort, matching
+// `InboundTranslationSlice_Builder`'s inline `syncToQueryDb`). Returns the
+// `commandOutcome` JSON, byte-compatible with the AppSync direct-invocation route.
+let buildInboundReceiver = (
+  spec: specModule,
+  translation: translationModule,
+  ~publishJsons: ReventlessInfra.CommandTopic.publishJsons,
+  ~auditQueryDbOps: option<ReventlessCore.QueryDb_Adapter.operations>,
+) => {
+  let callback = makeInboundCallback(spec)(translation)
+  async (args: JSON.t): JSON.t => {
+    let result = await callback.receive(publishJsons, args)
+    switch auditQueryDbOps {
+    | Some(ops) =>
+      let rows = callback.auditLog->Dict.toArray
+      let _ = await rows->Array.reduce(Promise.resolve(), async (prev, (id, row)) => {
+        let _ = await prev
+        let json = row->S.reverseConvertToJsonOrThrow(
+          ReventlessCore.InboundTranslationSlice_Callback.auditRowSchema,
+        )
+        try {
+          let _ = await ops.save(id, json, ReventlessCore.QueryDb.Overwrite, None)
+        } catch {
+        | _ => ()
+        }
+      })
+    | None => ()
+    }
+    result
+    ->ReventlessCore.InboundTranslationSlice.receiveResultToOutcome
+    ->ReventlessCore.CommandTopic.commandOutcomeToJson
+  }
+}

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs

@@ -1,5 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
@@ -7,9 +9,13 @@ import * as Stream from "effect/Stream";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
+import * as InboundTranslationSlice$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice.res.mjs";
+import * as InboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
 import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
 import * as DcbEventLogStorage_Postgres_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs";
 import * as StateChangeSlice_CallbackResMjs from "@reventlessdev/reventless-core/src/components/StateChangeSlice/StateChangeSlice_Callback.res.mjs";
+import * as InboundTranslationSlice_CallbackResMjs from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
 
 function deriveScope(specs) {
   let scope = DcbTag$Reventless.deriveEffectiveScope(specs.map(s => ({
@@ -93,6 +99,27 @@ function buildSliceHandler(spec, behavior, tagKeysByEventType, crossPartitionTag
   };
 }
 
+function buildInboundReceiver(spec, translation, publishJsons, auditQueryDbOps) {
+  let callback = InboundTranslationSlice_CallbackResMjs.Make(spec)(translation);
+  return async args => {
+    let result = await callback.receive(publishJsons, args);
+    if (auditQueryDbOps !== undefined) {
+      let rows = Object.entries(callback.auditLog);
+      await Stdlib_Array.reduce(rows, Promise.resolve(), async (prev, param) => {
+        await prev;
+        let json = S.reverseConvertToJsonOrThrow(param[1], InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema);
+        try {
+          await auditQueryDbOps.save(param[0], json, "Overwrite", undefined);
+          return;
+        } catch (exn) {
+          return;
+        }
+      });
+    }
+    return CommandTopic$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice$ReventlessCore.receiveResultToOutcome(result));
+  };
+}
+
 export {
   deriveScope,
   commandTypeNames,
@@ -100,5 +127,6 @@ export {
   makePostgresStorageOps,
   makeStorageOps,
   buildSliceHandler,
+  buildInboundReceiver,
 }
-/* Id-Reventless Not a pure module */
+/* S Not a pure module */

package/src/adapter/Runtime/HeartbeatEntryPoint.res

@@ -0,0 +1,44 @@
+// Heartbeat Lambda entry point — compiled, type-checked ReScript (replaces the
+// hand-written HeartbeatEntryPoint.mjs shell; no dynamic user-module import, so
+// no untyped seam is needed).
+//
+// Publishes a Heartbeat(timeout) command to the PluginExtensionPoint
+// CommandTopic. Triggered by CloudWatch Events on a schedule. Runtime-pure: no
+// Pulumi value reaches this module's import graph (deploy-time wiring lives in
+// PluginRuntime_Builder.forPluginHeartbeat).
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+// === Initialize eagerly at module load (Lambda cold start) ===
+
+let epQueueUrl = processEnv->Dict.get("EP_QUEUE_URL")->Option.getOr("")
+let pluginId = processEnv->Dict.get("PLUGIN_ID")->Option.getOr("")
+// Mirrors the former shell's `parseInt(…) || 10`: unset, unparsable, and 0 all
+// fall back to the 10-minute default.
+let timeout =
+  processEnv
+  ->Dict.get("HEARTBEAT_TIMEOUT")
+  ->Option.flatMap(s => Int.fromString(s))
+  ->Option.filter(n => n != 0)
+  ->Option.getOr(10)
+
+let queue: Util_SQS_Runtime.resolvedQueue = {id: epQueueUrl, name: epQueueUrl, arn: ""}
+let publishJsons = queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO)
+
+// === Exported handler ===
+
+let handler = async (_event: JSON.t, _context: PulumiAws.Lambda.context) => {
+  let message: ReventlessCore.Message.commandJson = {
+    id: pluginId,
+    meta: ReventlessCore.Message.generateMeta(
+      ~service=ReventlessInfra.PluginExtensionPointSpec.name,
+      ~ip="",
+      ~user="Heartbeat",
+    ),
+    commandJson: ReventlessInfra.PluginExtensionPointSpec.Heartbeat(
+      timeout,
+    )->S.reverseConvertToJsonOrThrow(ReventlessInfra.PluginExtensionPointSpec.commandSchema),
+  }
+  await publishJsons([message])
+  ""
+}

package/src/adapter/Runtime/HeartbeatEntryPoint.res.mjs

@@ -0,0 +1,47 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as PluginExtensionPointSpec$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/PluginExtensionPointSpec.res.mjs";
+import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
+
+let epQueueUrl = Stdlib_Option.getOr(process.env["EP_QUEUE_URL"], "");
+
+let pluginId = Stdlib_Option.getOr(process.env["PLUGIN_ID"], "");
+
+let timeout = Stdlib_Option.getOr(Stdlib_Option.filter(Stdlib_Option.flatMap(process.env["HEARTBEAT_TIMEOUT"], s => Stdlib_Int.fromString(s, undefined)), n => n !== 0), 10);
+
+let queue = {
+  id: epQueueUrl,
+  name: epQueueUrl,
+  arn: ""
+};
+
+let publishJsons = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO");
+
+async function handler(_event, _context) {
+  let message_meta = Message$ReventlessCore.generateMeta(PluginExtensionPointSpec$ReventlessInfra.name, "", "Heartbeat", undefined, undefined, undefined, undefined, undefined);
+  let message_commandJson = S.reverseConvertToJsonOrThrow({
+    TAG: "Heartbeat",
+    _0: timeout
+  }, PluginExtensionPointSpec$ReventlessInfra.commandSchema);
+  let message = {
+    id: pluginId,
+    meta: message_meta,
+    commandJson: message_commandJson
+  };
+  await publishJsons([message]);
+  return "";
+}
+
+export {
+  epQueueUrl,
+  pluginId,
+  timeout,
+  queue,
+  publishJsons,
+  handler,
+}
+/* epQueueUrl Not a pure module */

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res

@@ -0,0 +1,234 @@
+// PluginExtensionPoint Lambda entry point — compiled, type-checked ReScript
+// (replaces the hand-written PluginExtensionPointEntryPoint.mjs shell).
+//
+// All wiring is framework modules — no user modules, hence no dynamic-import
+// seam and no reason to stay untyped. Handles Heartbeat, Cloner, and other
+// plugin-level extension point commands.
+//
+// The former shell's `patchSpecId` hack (re-adding the `Id` module that the
+// ESM export of a `module Id = …` alias drops) disappears: `SpecWithId` below
+// binds the Id module at the ReScript level, mirroring ExtensionPoint_Builder.
+// Runtime-pure: no Pulumi value reaches this module's import graph.
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+// ── Shim bindings (HandlerFactoryHelpers.mjs) ───────────────────────────────
+// The structured-log + Effect dispatch boundary shared by every deployed entry
+// point (single place where invocations get their log annotations and
+// RequestContext), and the DynamoDB scan backing the read-model query engine.
+
+// Extra fields threaded onto the dispatch boundary / log lines. The shim reads
+// them structurally, so one record serves both `runEffect` and `log.debug`.
+type dispatchOpts = {
+  correlationId?: string,
+  causationId?: string,
+  comp?: string,
+  timestamp?: float,
+  retryCount?: int,
+}
+
+@module("./HandlerFactoryHelpers.mjs")
+external setRequestId: string => unit = "setRequestId"
+@module("./HandlerFactoryHelpers.mjs")
+external runEffect: (Effect.t<'a, 'e, 'r>, dispatchOpts) => promise<unit> = "runEffect"
+@module("./HandlerFactoryHelpers.mjs")
+external extractMetaField: (array<PulumiAws.SQS.Queue.record>, string) => option<string> =
+  "extractMetaField"
+@module("./HandlerFactoryHelpers.mjs")
+external extractSentTimestamp: array<PulumiAws.SQS.Queue.record> => option<float> =
+  "extractSentTimestamp"
+@module("./HandlerFactoryHelpers.mjs")
+external extractRetryCount: array<PulumiAws.SQS.Queue.record> => int = "extractRetryCount"
+@module("./HandlerFactoryHelpers.mjs") @scope("log")
+external logDebug: (string, dispatchOpts) => unit = "debug"
+@module("./HandlerFactoryHelpers.mjs")
+external scanByTableName: (
+  string,
+  array<Reventless.QueryEngine.Filter.config>,
+  int,
+) => promise<array<JSON.t>> = "scanByTableName"
+
+// ── HANDLER_CONFIG ──────────────────────────────────────────────────────────
+// Written by PluginExtensionPointRuntime_Builder.forCommandTopic; all fields
+// optional so a partial config degrades like the former shell's `|| ""` reads.
+
+type handlerConfig = {
+  queueUrl?: string,
+  pluginReadModelTableName?: string,
+  schedulerRoleArn?: string,
+  schedulerQueueArn?: string,
+  schedulerQueueName?: string,
+  publishToAggregates?: dict<string>,
+}
+@val @scope("JSON") external parseHandlerConfig: string => handlerConfig = "parse"
+
+// === Initialize eagerly at module load (Lambda cold start) ===
+
+let config = processEnv->Dict.get("HANDLER_CONFIG")->Option.getOr("{}")->parseHandlerConfig
+
+// Instantiate the Plugin EP mapping. updateApiSchema and manageSubscriptions
+// are admin-only hooks; this Lambda only handles incoming commands (Heartbeat,
+// ForwardCommand) so they stay None here. Only sendMessageToChannel is used by
+// the incoming-command path (ForwardCommand) — cross-plugin subscribe /
+// unsubscribe directives were retired in Phase 3 Step 3.
+//
+// `environment` prefixes the disconnect schedule's EventBridge rule name, so it
+// must be stable across deploys and unique per stack. The stack name is both;
+// AWS_LAMBDA_FUNCTION_NAME is neither — it carries a content hash, so replacing
+// this Lambda would orphan every outstanding rule the previous generation
+// created. EventCollectorEntryPoint instantiates the same EP module and must
+// agree, or one Lambda creates rules the other cannot delete.
+module EpSpec = {
+  let runtimeOps: ReventlessCore.PluginRuntimeOperations.operations = {
+    messagePublish: {sendMessageToChannel: Util_PluginMessage_Runtime.sendMessage},
+  }
+  let environment = processEnv->Dict.get("Environment")->Option.getOr("unknown")
+  let updateApiSchema: option<Reventless.QueryEngine.operations => promise<unit>> = None
+  let manageSubscriptions: option<
+    (Reventless.Plugin.pluginDefinition, [#connect | #disconnect]) => promise<unit>,
+  > = None
+}
+module PluginMappingInstance = ReventlessCore.PluginExtensionPoint_Plugin.Make(EpSpec)
+
+module Mappings = {
+  module type Mapping = ReventlessInfra.ExtensionPointMapping.T
+    with module ExtensionPoint := ReventlessInfra.PluginExtensionPointSpec
+  // Parity with the former shell: only the Plugin lifecycle mapping. The
+  // in-process wiring (PluginExtensionPoint_Builder) additionally registers
+  // PluginExtensionPoint_UiFragment.Mapping — divergence tracked in
+  // docs/plans/entry-point-rescript-conversion.md.
+  let mappings: array<module(Mapping)> = [module(PluginMappingInstance.Mapping)]
+}
+
+// Reconstruct publishToAggregates. The deploy-side builder writes
+// HANDLER_CONFIG.publishToAggregates as { aggregateName: envVarName }
+// (see PluginExtensionPointRuntime_Builder.res), so iterate accordingly.
+let publishToAggregates: dict<ReventlessCore.CommandTopic.publishJsons> =
+  config.publishToAggregates
+  ->Option.getOr(Dict.make())
+  ->Dict.toArray
+  ->Array.map(((aggName, envVarName)) => {
+    let queueUrl = processEnv->Dict.get(envVarName)->Option.getOr("")
+    let queue: Util_SQS_Runtime.resolvedQueue = {id: queueUrl, name: queueUrl, arn: ""}
+    (aggName, queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO))
+  })
+  ->Dict.fromArray
+
+// Reconstruct queryEngine: scans go to the plugin read-model table; query is
+// not available in this bundled handler (same restriction as the former shell).
+let pluginReadModelTableName = config.pluginReadModelTableName->Option.getOr("")
+let queryEngine: Reventless.QueryEngine.operations = {
+  scan: (~readModelName as _, ~filterConfigs, ~limit) =>
+    scanByTableName(pluginReadModelTableName, filterConfigs, limit),
+  query: async (
+    ~readModelName as _,
+    ~key as _=?,
+    ~id as _,
+    ~subIdConfig as _=?,
+    ~filterConfigs as _=?,
+    ~ascending as _=?,
+    ~limit as _=?,
+  ) => JsError.throwWithMessage("QueryEngine.query not available in bundled Plugin EP handler"),
+}
+
+// Reconstruct scheduler
+let scheduler: ReventlessCore.Scheduler.operations = {
+  createSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(
+    ~roleArn=config.schedulerRoleArn->Option.getOr(""),
+  ),
+  deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule,
+}
+
+// CommandTopic resources for scheduler targets
+let commandTopicResources: array<ReventlessInfra.Adapter.resolvedResource> = {
+  let schedulerQueueArn = config.schedulerQueueArn->Option.getOr("")
+  let schedulerQueueName = config.schedulerQueueName->Option.getOr("")
+  schedulerQueueArn == ""
+    ? []
+    : [
+        {
+          name: schedulerQueueName,
+          id: schedulerQueueName,
+          urn: schedulerQueueArn,
+          service: "unknown",
+          resourceInfo: ReventlessInfra.Adapter.NoInfo,
+          role: "",
+          region: "",
+          resourceType: "",
+          configuration: Dict.make(),
+          tags: Dict.make(),
+        },
+      ]
+}
+
+let invalidNameChars = %re("/[^.\-_a-zA-Z0-9]/g")
+let resourceNaming: ReventlessInfra.ResourceNaming.operations = {
+  validateName: n => n->String.replaceRegExp(invalidNameChars, "_"),
+  urnName: arn =>
+    arn
+    ->String.split(":")
+    ->Array.get(5)
+    ->Option.filter(s => s != "")
+    ->Option.getOr("unknown"),
+}
+
+module Callback = ReventlessCore.ExtensionPoint_Callback.Make(
+  {
+    let publishToAggregates = publishToAggregates
+    let commandTopicResources = commandTopicResources
+    let scheduler = scheduler
+    let queryEngine = queryEngine
+    let resourceNaming = resourceNaming
+  },
+  ReventlessInfra.PluginExtensionPointSpec,
+  Mappings,
+)
+
+module SpecWithId = {
+  module Id = Reventless.Id.String
+  let name = ReventlessInfra.PluginExtensionPointSpec.name
+  type command = ReventlessInfra.PluginExtensionPointSpec.command
+  let commandSchema = ReventlessInfra.PluginExtensionPointSpec.commandSchema
+}
+
+module CommandTopicCallback = ReventlessCore.CommandTopic_Callback.Make(
+  SpecWithId,
+  {
+    module Spec = SpecWithId
+    let commandsHandler = Callback.handleIncomingCommands
+  },
+)
+
+let queue: Util_SQS_Runtime.resolvedQueue = {
+  id: config.queueUrl->Option.getOr(""),
+  name: config.queueUrl->Option.getOr(""),
+  arn: "",
+}
+let sqsHandler = CommandTopicChannel_SQS_Runtime.handleQueueEvent(
+  queue,
+  CommandTopicCallback.handleJsonCommands,
+)
+let comp = `ExtensionPoint(${ReventlessInfra.PluginExtensionPointSpec.name})`
+
+// === Exported handler ===
+
+let handler = async (event: PulumiAws.SQS.Queue.event, context: PulumiAws.Lambda.context) => {
+  setRequestId(context.awsRequestId)
+  let records = event.records
+
+  logDebug(
+    `processing ${records->Array.length->Int.toString} record(s)`,
+    {comp: "PluginExtensionPointRuntime"},
+  )
+  await runEffect(
+    sqsHandler(event, context),
+    {
+      correlationId: ?extractMetaField(records, "correlationId"),
+      causationId: ?extractMetaField(records, "causationId"),
+      comp,
+      timestamp: ?extractSentTimestamp(records),
+      retryCount: extractRetryCount(records),
+    },
+  )
+  ""
+}