@reventlessdev/reventless-aws 3.0.0-alpha.229 → 3.0.0-alpha.231

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs

@@ -0,0 +1,226 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
+import * as CommandTopic_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Callback.res.mjs";
+import * as ExtensionPoint_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/ExtensionPoint/ExtensionPoint_Callback.res.mjs";
+import * as PluginExtensionPointSpec$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/PluginExtensionPointSpec.res.mjs";
+import * as Util_PluginMessage_Runtime$ReventlessAws from "../../plugin/runtime/Util_PluginMessage_Runtime.res.mjs";
+import * as PluginExtensionPoint_Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/connect/PluginExtensionPoint_Plugin.res.mjs";
+import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
+import * as ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res.mjs";
+
+function setRequestId(prim) {
+  HandlerFactoryHelpersMjs.setRequestId(prim);
+}
+
+function runEffect(prim0, prim1) {
+  return HandlerFactoryHelpersMjs.runEffect(prim0, prim1);
+}
+
+function extractMetaField(prim0, prim1) {
+  return HandlerFactoryHelpersMjs.extractMetaField(prim0, prim1);
+}
+
+function extractSentTimestamp(prim) {
+  return HandlerFactoryHelpersMjs.extractSentTimestamp(prim);
+}
+
+function extractRetryCount(prim) {
+  return HandlerFactoryHelpersMjs.extractRetryCount(prim);
+}
+
+function logDebug(prim0, prim1) {
+  HandlerFactoryHelpersMjs.log.debug(prim0, prim1);
+}
+
+function scanByTableName(prim0, prim1, prim2) {
+  return HandlerFactoryHelpersMjs.scanByTableName(prim0, prim1, prim2);
+}
+
+let config = JSON.parse(Stdlib_Option.getOr(process.env["HANDLER_CONFIG"], "{}"));
+
+let runtimeOps = {
+  messagePublish: {
+    sendMessageToChannel: Util_PluginMessage_Runtime$ReventlessAws.sendMessage
+  }
+};
+
+let environment = Stdlib_Option.getOr(process.env["Environment"], "unknown");
+
+let EpSpec = {
+  runtimeOps: runtimeOps,
+  environment: environment,
+  updateApiSchema: undefined,
+  manageSubscriptions: undefined
+};
+
+let PluginMappingInstance = PluginExtensionPoint_Plugin$ReventlessCore.Make(EpSpec);
+
+let mappings = [PluginMappingInstance.Mapping];
+
+let Mappings = {
+  mappings: mappings
+};
+
+let publishToAggregates = Object.fromEntries(Object.entries(Stdlib_Option.getOr(config.publishToAggregates, {})).map(param => {
+  let queueUrl = Stdlib_Option.getOr(process.env[param[1]], "");
+  let queue = {
+    id: queueUrl,
+    name: queueUrl,
+    arn: ""
+  };
+  return [
+    param[0],
+    CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO")
+  ];
+}));
+
+let pluginReadModelTableName = Stdlib_Option.getOr(config.pluginReadModelTableName, "");
+
+function queryEngine_scan(param, filterConfigs, limit) {
+  return HandlerFactoryHelpersMjs.scanByTableName(pluginReadModelTableName, filterConfigs, limit);
+}
+
+async function queryEngine_query(param, param$1, param$2, param$3, param$4, param$5, param$6) {
+  return Stdlib_JsError.throwWithMessage("QueryEngine.query not available in bundled Plugin EP handler");
+}
+
+let queryEngine = {
+  scan: queryEngine_scan,
+  query: queryEngine_query
+};
+
+let scheduler_createSchedule = ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.createSchedule(Stdlib_Option.getOr(config.schedulerRoleArn, ""));
+
+let scheduler = {
+  createSchedule: scheduler_createSchedule,
+  deleteSchedule: ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.deleteSchedule
+};
+
+let schedulerQueueArn = Stdlib_Option.getOr(config.schedulerQueueArn, "");
+
+let schedulerQueueName = Stdlib_Option.getOr(config.schedulerQueueName, "");
+
+let commandTopicResources = schedulerQueueArn === "" ? [] : [{
+      name: schedulerQueueName,
+      id: schedulerQueueName,
+      urn: schedulerQueueArn,
+      resourceInfo: "NoInfo",
+      service: "unknown",
+      role: "",
+      region: "",
+      resourceType: "",
+      configuration: {},
+      tags: {}
+    }];
+
+let invalidNameChars = /[^.\-_a-zA-Z0-9]/g;
+
+function resourceNaming_validateName(n) {
+  return n.replace(invalidNameChars, "_");
+}
+
+function resourceNaming_urnName(arn) {
+  return Stdlib_Option.getOr(Stdlib_Option.filter(arn.split(":")[5], s => s !== ""), "unknown");
+}
+
+let resourceNaming = {
+  validateName: resourceNaming_validateName,
+  urnName: resourceNaming_urnName
+};
+
+let Callback = ExtensionPoint_Callback$ReventlessCore.Make({
+  publishToAggregates: publishToAggregates,
+  commandTopicResources: commandTopicResources,
+  scheduler: scheduler,
+  queryEngine: queryEngine,
+  resourceNaming: resourceNaming
+})({
+  name: PluginExtensionPointSpec$ReventlessInfra.name,
+  moduleUrl: PluginExtensionPointSpec$ReventlessInfra.moduleUrl,
+  commandSchema: PluginExtensionPointSpec$ReventlessInfra.commandSchema,
+  eventSchema: PluginExtensionPointSpec$ReventlessInfra.eventSchema,
+  directiveSchema: PluginExtensionPointSpec$ReventlessInfra.directiveSchema
+})(Mappings);
+
+let SpecWithId = {
+  Id: undefined,
+  name: PluginExtensionPointSpec$ReventlessInfra.name,
+  commandSchema: PluginExtensionPointSpec$ReventlessInfra.commandSchema
+};
+
+let CommandTopicCallback = CommandTopic_Callback$ReventlessCore.Make({
+  Id: Id$Reventless.$$String,
+  name: PluginExtensionPointSpec$ReventlessInfra.name,
+  commandSchema: PluginExtensionPointSpec$ReventlessInfra.commandSchema
+})({
+  Spec: {
+    Id: Id$Reventless.$$String,
+    name: PluginExtensionPointSpec$ReventlessInfra.name,
+    commandSchema: PluginExtensionPointSpec$ReventlessInfra.commandSchema
+  },
+  commandsHandler: Callback.handleIncomingCommands
+});
+
+let queue_id = Stdlib_Option.getOr(config.queueUrl, "");
+
+let queue_name = Stdlib_Option.getOr(config.queueUrl, "");
+
+let queue = {
+  id: queue_id,
+  name: queue_name,
+  arn: ""
+};
+
+let sqsHandler = CommandTopicChannel_SQS_Runtime$ReventlessAws.handleQueueEvent(queue, CommandTopicCallback.handleJsonCommands);
+
+let comp = `ExtensionPoint(` + PluginExtensionPointSpec$ReventlessInfra.name + `)`;
+
+async function handler(event, context) {
+  HandlerFactoryHelpersMjs.setRequestId(context.awsRequestId);
+  let records = event.Records;
+  let prim0 = `processing ` + records.length.toString() + ` record(s)`;
+  HandlerFactoryHelpersMjs.log.debug(prim0, {
+    comp: "PluginExtensionPointRuntime"
+  });
+  await HandlerFactoryHelpersMjs.runEffect(sqsHandler(event, context), {
+    correlationId: HandlerFactoryHelpersMjs.extractMetaField(records, "correlationId"),
+    causationId: HandlerFactoryHelpersMjs.extractMetaField(records, "causationId"),
+    comp: comp,
+    timestamp: HandlerFactoryHelpersMjs.extractSentTimestamp(records),
+    retryCount: HandlerFactoryHelpersMjs.extractRetryCount(records)
+  });
+  return "";
+}
+
+export {
+  setRequestId,
+  runEffect,
+  extractMetaField,
+  extractSentTimestamp,
+  extractRetryCount,
+  logDebug,
+  scanByTableName,
+  config,
+  EpSpec,
+  PluginMappingInstance,
+  Mappings,
+  publishToAggregates,
+  pluginReadModelTableName,
+  queryEngine,
+  scheduler,
+  commandTopicResources,
+  invalidNameChars,
+  resourceNaming,
+  Callback,
+  SpecWithId,
+  CommandTopicCallback,
+  queue,
+  sqsHandler,
+  comp,
+  handler,
+}
+/* config Not a pure module */

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -13,10 +13,22 @@
 
 let log = ReventlessCore.Logger.fromEnv()
 
+// `(specPath, translationPath)` module specifiers per InboundTranslationSlice,
+// plus the resolved audit QueryDb table-name Output (None on the Postgres path or
+// if the component hasn't reported it). The entry point imports both modules,
+// builds `InboundTranslationSlice_Callback.Make(Spec)(Translation).receive`, and
+// — when `auditTableName` is present — persists the audit rows to that table.
+type inboundSlicePaths = {
+  specPath: string,
+  translationPath: string,
+  auditTableName: option<Pulumi.Output.t<string>>,
+}
+
 // `slicePaths`: `(specPath, behaviorPath)` per StateChangeSlice (already merged
 // from auto- and manually-registered sources by the caller).
 let forDcbCommandTopic = (
   ~slicePaths: array<(string, string)>,
+  ~inboundSlices: array<inboundSlicePaths>=[],
   ~dcbTableName: option<Pulumi.Output.t<string>>,
   ~pluginName: string,
   ~syncConfig: ReventlessCore.Runtime.commandHandlerConfig,
@@ -29,7 +41,7 @@ let forDcbCommandTopic = (
   ~connect,
   dcbCommandTopic,
 ) =>
-  if slicePaths->Array.length == 0 {
+  if slicePaths->Array.length == 0 && inboundSlices->Array.length == 0 {
     log.warn(
       ~comp="StateChangeSliceRuntime_Builder_Single",
       "forDcbCommandTopic skipped (no slice specs)",
@@ -122,11 +134,37 @@ let forDcbCommandTopic = (
     | None => Pulumi.Output.make("")
     }
 
+    // InboundTranslationSlice modules — spec + translation paths and the resolved
+    // audit table name (Pulumi-generated, so it must be resolved here). Emitted as
+    // a `,"inboundTranslationSliceModules":[…]` fragment merged into HANDLER_CONFIG
+    // (absent → the entry point has no Route 0 registry, unchanged behaviour).
+    let inboundFragment = switch inboundSlices {
+    | [] => Pulumi.Output.make("")
+    | slices =>
+      slices
+      ->Array.map(s => s.auditTableName->Option.getOr(Pulumi.Output.make("")))
+      ->Pulumi.Output.all
+      ->Pulumi.Output.apply(tableNames => {
+        let entries =
+          slices
+          ->Array.mapWithIndex((s, i) => {
+            let spec = s.specPath->JSON.stringifyAny->Option.getOr(`""`)
+            let translation = s.translationPath->JSON.stringifyAny->Option.getOr(`""`)
+            let tableName = tableNames->Array.getUnsafe(i)
+            let auditJson =
+              tableName == "" ? "null" : tableName->JSON.stringifyAny->Option.getOr("null")
+            `{"spec":${spec},"translation":${translation},"auditTableName":${auditJson}}`
+          })
+          ->Array.join(",")
+        `,"inboundTranslationSliceModules":[${entries}]`
+      })
+    }
+
     let handlerConfigJson =
-      Pulumi.Output.all3((dcbTableName, queue.id, pgConnectionFragment))
-      ->Pulumi.Output.apply(((table, queueUrl, pgFragment)) => {
+      Pulumi.Output.all4((dcbTableName, queue.id, pgConnectionFragment, inboundFragment))
+      ->Pulumi.Output.apply(((table, queueUrl, pgFragment, inbFragment)) => {
         let pluginNameJson = pluginName->JSON.stringifyAny->Option.getOr(`""`)
-        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]${pgFragment}}`
+        `{"dcbEventLogTableName":"${table}","queueUrl":"${queueUrl}","pluginName":${pluginNameJson},"stateChangeSliceModules":[${sliceModulesJson}]${pgFragment}${inbFragment}}`
       })
     envVars->Dict.set("HANDLER_CONFIG", handlerConfigJson->Pulumi.Output.asInput)
 
@@ -138,6 +176,13 @@ let forDcbCommandTopic = (
       let behaviorPkg = Util_Bundle.extractPackageName(behaviorPath)
       packageDirs->Dict.set(behaviorPkg, Util_Bundle.resolvePackageRoot(behaviorPkg))
     })
+    // Inbound slice spec + translation packages the entry point imports for Route 0.
+    inboundSlices->Array.forEach(s => {
+      let specPkg = Util_Bundle.extractPackageName(s.specPath)
+      packageDirs->Dict.set(specPkg, Util_Bundle.resolvePackageRoot(specPkg))
+      let translationPkg = Util_Bundle.extractPackageName(s.translationPath)
+      packageDirs->Dict.set(translationPkg, Util_Bundle.resolvePackageRoot(translationPkg))
+    })
     // Include the framework packages alongside the entry point so the deployed
     // Lambda picks up uncommitted local changes without waiting for the Lambda
     // Layer rebuild (the layer fetches @reventlessdev/reventless-* from GitHub

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -16,10 +16,11 @@ import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_L
 
 let log = Logger$ReventlessCore.fromEnv();
 
-function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, asyncConfig, sliceMemoryFloorOpt, sliceTimeoutFloorOpt, connect, dcbCommandTopic) {
+function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginName, syncConfig, asyncConfig, sliceMemoryFloorOpt, sliceTimeoutFloorOpt, connect, dcbCommandTopic) {
+  let inboundSlices = inboundSlicesOpt !== undefined ? inboundSlicesOpt : [];
   let sliceMemoryFloor = sliceMemoryFloorOpt !== undefined ? sliceMemoryFloorOpt : 0;
   let sliceTimeoutFloor = sliceTimeoutFloorOpt !== undefined ? sliceTimeoutFloorOpt : 0;
-  if (slicePaths.length === 0) {
+  if (slicePaths.length === 0 && inboundSlices.length === 0) {
     return log.warn("StateChangeSliceRuntime_Builder_Single", undefined, "forDcbCommandTopic skipped (no slice specs)");
   }
   let commandTopicResource = Component$ReventlessCore.toPulumiResource(dcbCommandTopic);
@@ -58,13 +59,24 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
     return `{"spec":` + s + `,"behavior":` + b + `}`;
   }).join(",");
   let pgConnectionFragment = pgSelection !== undefined ? pgSelection.connectionConfig.apply(cc => `,"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(pgSelection.lockStrategy, cc))) : Pulumi.output("");
+  let inboundFragment = inboundSlices.length !== 0 ? Pulumi.all(inboundSlices.map(s => Stdlib_Option.getOr(s.auditTableName, Pulumi.output("")))).apply(tableNames => {
+      let entries = inboundSlices.map((s, i) => {
+        let spec = Stdlib_Option.getOr(JSON.stringify(s.specPath), `""`);
+        let translation = Stdlib_Option.getOr(JSON.stringify(s.translationPath), `""`);
+        let tableName = tableNames[i];
+        let auditJson = tableName === "" ? "null" : Stdlib_Option.getOr(JSON.stringify(tableName), "null");
+        return `{"spec":` + spec + `,"translation":` + translation + `,"auditTableName":` + auditJson + `}`;
+      }).join(",");
+      return `,"inboundTranslationSliceModules":[` + entries + `]`;
+    }) : Pulumi.output("");
   let handlerConfigJson = Pulumi.all([
     dcbTableName$1,
     queue.id,
-    pgConnectionFragment
+    pgConnectionFragment,
+    inboundFragment
   ]).apply(param => {
     let pluginNameJson = Stdlib_Option.getOr(JSON.stringify(pluginName), `""`);
-    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]` + param[2] + `}`;
+    return `{"dcbEventLogTableName":"` + param[0] + `","queueUrl":"` + param[1] + `","pluginName":` + pluginNameJson + `,"stateChangeSliceModules":[` + sliceModulesJson + `]` + param[2] + param[3] + `}`;
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
   let packageDirs = {};
@@ -74,6 +86,12 @@ function forDcbCommandTopic(slicePaths, dcbTableName, pluginName, syncConfig, as
     let behaviorPkg = Util_Bundle$ReventlessAws.extractPackageName(param[1]);
     packageDirs[behaviorPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(behaviorPkg);
   });
+  inboundSlices.forEach(s => {
+    let specPkg = Util_Bundle$ReventlessAws.extractPackageName(s.specPath);
+    packageDirs[specPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(specPkg);
+    let translationPkg = Util_Bundle$ReventlessAws.extractPackageName(s.translationPath);
+    packageDirs[translationPkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(translationPkg);
+  });
   packageDirs["@reventlessdev/reventless-aws"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-aws");
   packageDirs["@reventlessdev/reventless-core"] = Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-core");
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs", packageDirs, undefined);

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -1,156 +1,25 @@
 // Direct-to-S3 upload presign service behind a public Lambda Function URL.
 //
-// Deploy-time: `make` provisions a CallbackFunction (handler closure serialized
-// by Pulumi), an IAM execution role scoped to `s3:PutObject` on the target
-// bucket, and a Function URL (no auth) so a browser can request a presigned PUT.
+// Deploy-time only: `make` provisions a compiled-EntryPoint Lambda (a plain
+// `Lambda.Function` whose code archive re-exports `handler` from the compiled,
+// type-checked runtime module `Upload_Presign_S3_Ops` and ships the shared ESM
+// resolve-hook loader), an IAM execution role scoped to CloudWatch Logs +
+// `s3:PutObject` on the target bucket, and a Function URL (no auth) so a browser
+// can request a presigned PUT.
 //
-// Runtime: `handlePresign` reads a JSON body `{fileName, contentType}`, derives
-// a target key `uploads/<identity?>/<uuid>/<fileName>`, presigns a PUT to the
-// bucket named in `UPLOAD_BUCKET` (expires in 300s), and returns
-// `{uploadUrl, storageRef}`. A Bearer token, when present, is decoded (no
-// signature verification here — that is the auth layer's job) and its `sub`
-// namespaces the key; anonymous callers are still served for the demo.
+// Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the
+// AWS SDK v3 S3 presigner. A serialized closure bakes the deploy machine's
+// version-specific SDK internals into the archive but then resolves `@smithy/*`
+// and `@aws-sdk/*` transitives from independently-versioned layer/runtime sources
+// that disagree at cold start (an inlined `client-s3` against a newer
+// `@smithy/smithy-client` base whose constructor no longer sets `middlewareStack`
+// → `new S3Client()` throws). Shipping the compiled `_Ops` module with bare
+// `@aws-sdk/*` imports, resolved through the resolve-hook (`@aws-sdk/*` from the
+// runtime, `@smithy/*`/`@reventlessdev/*` from the layer), loads one internally
+// consistent SDK instead. The runtime logic lives in [Upload_Presign_S3_Ops.res].
 
 open PulumiAws
 
-// ── AWS SDK v3 bindings ─────────────────────────────────────────────────────
-
-type s3Client
-
-type putObjectInput = {
-  @as("Bucket") bucket: string,
-  @as("Key") key: string,
-  @as("ContentType") contentType?: string,
-}
-type putObjectCommand
-
-@module("@aws-sdk/client-s3") @new external makeS3Client: unit => s3Client = "S3Client"
-
-@module("@aws-sdk/client-s3") @new
-external makePutObjectCommand: putObjectInput => putObjectCommand = "PutObjectCommand"
-
-type presignOptions = {expiresIn: int}
-
-@module("@aws-sdk/s3-request-presigner")
-external getSignedUrl: (s3Client, putObjectCommand, presignOptions) => promise<string> =
-  "getSignedUrl"
-
-// ── Function URL event / response shapes (payload format 2.0) ────────────────
-
-type functionUrlEvent = {
-  body?: string,
-  headers?: dict<string>,
-}
-
-type response = {
-  statusCode: int,
-  headers?: dict<string>,
-  body: string,
-}
-
-let getEnv: string => option<string> = %raw(`
-  function(k) { var v = process.env[k]; return (v === undefined || v === null || v === "") ? undefined : v; }
-`)
-
-// Node 22 exposes globalThis.crypto.randomUUID; fall back to node:crypto.
-let genUuid: unit => string = %raw(`
-  function() {
-    return (globalThis.crypto && globalThis.crypto.randomUUID)
-      ? globalThis.crypto.randomUUID()
-      : require("crypto").randomUUID();
-  }
-`)
-
-// Decode a JWT payload's `sub` claim without verifying the signature (the auth
-// layer verifies; here we only namespace the storage key).
-let decodeJwtSub: string => option<string> = %raw(`
-  function(header) {
-    try {
-      var token = header.indexOf("Bearer ") === 0 ? header.slice(7) : header;
-      var parts = token.split(".");
-      if (parts.length < 2) return undefined;
-      var base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      var json = Buffer.from(base64, "base64").toString("utf8");
-      var claims = JSON.parse(json);
-      return (claims && claims.sub) ? String(claims.sub) : undefined;
-    } catch (_) { return undefined; }
-  }
-`)
-
-let corsHeaders = () =>
-  Dict.fromArray([
-    ("content-type", "application/json"),
-    ("access-control-allow-origin", "*"),
-    ("access-control-allow-methods", "POST,OPTIONS"),
-    ("access-control-allow-headers", "*"),
-  ])
-
-// Key prefix from the caller identity when a Bearer token is present.
-let identityPrefix = (event: functionUrlEvent): string => {
-  let authHeader =
-    event.headers->Option.flatMap(h =>
-      h->Dict.get("authorization")->Option.orElse(h->Dict.get("Authorization"))
-    )
-  switch authHeader->Option.flatMap(decodeJwtSub) {
-  | Some(sub) => `${sub}/`
-  | None => ""
-  }
-}
-
-// ── Runtime handler ─────────────────────────────────────────────────────────
-
-let handlePresign = async (event: functionUrlEvent, _context: Lambda.context): response => {
-  try {
-    let bucket = getEnv("UPLOAD_BUCKET")->Option.getOr("")
-    let parsed =
-      event.body
-      ->Option.getOr("{}")
-      ->JSON.parseOrThrow
-      ->JSON.Decode.object
-      ->Option.getOr(Dict.make())
-    let fileName =
-      parsed->Dict.get("fileName")->Option.flatMap(JSON.Decode.string)->Option.getOr("upload")
-    let contentType = parsed->Dict.get("contentType")->Option.flatMap(JSON.Decode.string)
-
-    // The object key doubles as the served path segment: it is rooted at the
-    // served prefix (`SERVED_PREFIX`, e.g. `uploads`) so the CloudFront
-    // `{prefix}/*` behavior fronts it. Callers PUT to this exact key.
-    let servedPrefix = getEnv("SERVED_PREFIX")->Option.getOr("uploads")
-    let key = `${servedPrefix}/${identityPrefix(event)}${genUuid()}/${fileName}`
-    let client = makeS3Client()
-    let command = makePutObjectCommand({bucket, key, contentType: ?contentType})
-    let uploadUrl = await getSignedUrl(client, command, {expiresIn: 300})
-
-    // The stored ref is a same-origin relative URL `/{key}`: the served bucket is
-    // fronted read-only by the UI's own CloudFront distribution under
-    // `{prefix}/*`, so a command stores this directly-renderable value and an
-    // `image`-semantic field thumbnails it with no post-processing and no public
-    // bucket. See [docs/plans/done/ui-served-buckets.md].
-    let storageRef = `/${key}`
-
-    {
-      statusCode: 200,
-      headers: corsHeaders(),
-      body: Dict.fromArray([
-        ("uploadUrl", JSON.Encode.string(uploadUrl)),
-        ("storageRef", JSON.Encode.string(storageRef)),
-      ])
-      ->JSON.Encode.object
-      ->JSON.stringify,
-    }
-  } catch {
-  | _ => {
-      statusCode: 400,
-      headers: corsHeaders(),
-      body: Dict.fromArray([("error", JSON.Encode.string("presign_failed"))])
-      ->JSON.Encode.object
-      ->JSON.stringify,
-    }
-  }
-}
-
-// ── Deploy-time factory ─────────────────────────────────────────────────────
-
 type serviceOutputs = {
   url: Pulumi.Output.t<string>,
   resources: array<Pulumi.Output.t<string>>,
@@ -181,7 +50,8 @@ let make = (
     ~opts?,
   )
 
-  // Least-privilege: PutObject on any key under the target bucket.
+  // CloudWatch Logs (so failures are observable) plus least-privilege
+  // `s3:PutObject` on any key under the target bucket.
   let _policy =
     bucketName
     ->Pulumi.Output.fromInput
@@ -193,6 +63,12 @@ let make = (
           policy: PolicyDocument.make(
             ~id=`${serviceName}Policy`,
             ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Actions(["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
               {
                 sid: "AllowUploadPut",
                 effect: Allow,
@@ -209,29 +85,54 @@ let make = (
       )
     })
 
-  let environment: Lambda.CallbackFunction.Args.functionEnvironment = {
-    // CallbackFunction under-types env values as `dict<string>`; Pulumi resolves
-    // Output-valued variables at deploy time, so bridge the Input here.
-    variables: Dict.fromArray([
-      ("UPLOAD_BUCKET", bucketName),
-      ("SERVED_PREFIX", Pulumi.Input.make(servedPrefix)),
-    ])->Obj.magic,
-  }
+  // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
+  // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook.
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs",
+    ~packageDirs,
+  )
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
 
-  let lambda = Lambda.CallbackFunction.make(
+  let lambda = Lambda.Function.make(
     ~name=serviceName,
-    ~args=Lambda.CallbackFunction.Args.make(
-      ~callback=handlePresign,
-      ~role=lambdaRole,
-      ~environment,
-      ~timeout=30->Pulumi.Input.make,
-      ~tags=AWS.Tags.make(
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 256->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(
         ~name=serviceName,
         ~kind=ReventlessCore.ComponentType.Platform,
         ~role=Runtime,
         ~scope=Platform,
       ),
-    ),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("UPLOAD_BUCKET", bucketName),
+            ("SERVED_PREFIX", Pulumi.Input.make(servedPrefix)),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+    },
     ~opts?,
   )