@reventlessdev/reventless-aws 3.0.0-alpha.229 → 3.0.0-alpha.231

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -1,113 +1,16 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Aws from "@pulumi/aws";
-import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
-import * as ClientS3 from "@aws-sdk/client-s3";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
-import * as S3RequestPresigner from "@aws-sdk/s3-request-presigner";
-
-let getEnv = (function(k) { var v = process.env[k]; return (v === undefined || v === null || v === "") ? undefined : v; });
-
-let genUuid = (function() {
-    return (globalThis.crypto && globalThis.crypto.randomUUID)
-      ? globalThis.crypto.randomUUID()
-      : require("crypto").randomUUID();
-  });
-
-let decodeJwtSub = (function(header) {
-    try {
-      var token = header.indexOf("Bearer ") === 0 ? header.slice(7) : header;
-      var parts = token.split(".");
-      if (parts.length < 2) return undefined;
-      var base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      var json = Buffer.from(base64, "base64").toString("utf8");
-      var claims = JSON.parse(json);
-      return (claims && claims.sub) ? String(claims.sub) : undefined;
-    } catch (_) { return undefined; }
-  });
-
-function corsHeaders() {
-  return Object.fromEntries([
-    [
-      "content-type",
-      "application/json"
-    ],
-    [
-      "access-control-allow-origin",
-      "*"
-    ],
-    [
-      "access-control-allow-methods",
-      "POST,OPTIONS"
-    ],
-    [
-      "access-control-allow-headers",
-      "*"
-    ]
-  ]);
-}
-
-function identityPrefix(event) {
-  let authHeader = Stdlib_Option.flatMap(event.headers, h => Stdlib_Option.orElse(h["authorization"], h["Authorization"]));
-  let sub = Stdlib_Option.flatMap(authHeader, decodeJwtSub);
-  if (sub !== undefined) {
-    return sub + `/`;
-  } else {
-    return "";
-  }
-}
-
-async function handlePresign(event, _context) {
-  try {
-    let bucket = Stdlib_Option.getOr(getEnv("UPLOAD_BUCKET"), "");
-    let parsed = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(Stdlib_Option.getOr(event.body, "{}"))), {});
-    let fileName = Stdlib_Option.getOr(Stdlib_Option.flatMap(parsed["fileName"], Stdlib_JSON.Decode.string), "upload");
-    let contentType = Stdlib_Option.flatMap(parsed["contentType"], Stdlib_JSON.Decode.string);
-    let servedPrefix = Stdlib_Option.getOr(getEnv("SERVED_PREFIX"), "uploads");
-    let key = servedPrefix + `/` + identityPrefix(event) + genUuid() + `/` + fileName;
-    let client = new ClientS3.S3Client();
-    let command = new ClientS3.PutObjectCommand({
-      Bucket: bucket,
-      Key: key,
-      ContentType: contentType
-    });
-    let uploadUrl = await S3RequestPresigner.getSignedUrl(client, command, {
-      expiresIn: 300
-    });
-    let storageRef = `/` + key;
-    return {
-      statusCode: 200,
-      headers: corsHeaders(),
-      body: JSON.stringify(Object.fromEntries([
-        [
-          "uploadUrl",
-          uploadUrl
-        ],
-        [
-          "storageRef",
-          storageRef
-        ]
-      ]))
-    };
-  } catch (exn) {
-    return {
-      statusCode: 400,
-      headers: corsHeaders(),
-      body: JSON.stringify(Object.fromEntries([[
-          "error",
-          "presign_failed"
-        ]]))
-    };
-  }
-}
 
 function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
@@ -118,28 +21,68 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
   bucketName.apply(b => {
     let arn = `arn:aws:s3:::` + b + `/*`;
     new (Aws.iam.RolePolicy)(serviceName + `Policy`, {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, serviceName + `Policy`, [{
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, serviceName + `Policy`, [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
           Sid: "AllowUploadPut",
           Effect: "Allow",
           Action: "s3:PutObject",
           Resource: arn
-        }])),
+        }
+      ])),
       role: lambdaRole.id
     }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   });
-  let environment = {
-    variables: Object.fromEntries([
-      [
-        "UPLOAD_BUCKET",
-        bucketName
-      ],
-      [
-        "SERVED_PREFIX",
-        servedPrefix
-      ]
-    ])
-  };
-  let lambda = new (Aws.lambda.CallbackFunction)(serviceName, Lambda$PulumiAws.CallbackFunction.Args.make(handlePresign, lambdaRole, undefined, undefined, undefined, undefined, 30, undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined), environment), opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let lambda = new (Aws.lambda.Function)(serviceName, {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: match.code,
+    role: lambdaRole.arn,
+    memorySize: 256,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "UPLOAD_BUCKET",
+          bucketName
+        ],
+        [
+          "SERVED_PREFIX",
+          servedPrefix
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ]
+      ])
+    },
+    sourceCodeHash: match.sourceCodeHash
+  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
     authorizationType: "NONE",
     functionName: lambda.name,
@@ -159,12 +102,6 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
 }
 
 export {
-  getEnv,
-  genUuid,
-  decodeJwtSub,
-  corsHeaders,
-  identityPrefix,
-  handlePresign,
   make,
 }
 /* @pulumi/aws Not a pure module */

package/src/adapter/Upload/Upload_Presign_S3_Ops.res

@@ -0,0 +1,157 @@
+// Runtime handler for the upload presign service — compiled, type-checked, and
+// Pulumi-free so it can be shipped as an EntryPoint module (`Upload_Presign_S3`
+// bundles it and re-exports `handler` from the code archive). Keeping it out of
+// the deploy-time module is what avoids both the serialized-closure SDK skew and
+// the deploy-time Pulumi import leaking into the Lambda's cold-start graph.
+//
+// Reads a JSON body `{fileName, contentType}`, derives a target key
+// `uploads/<identity?>/<uuid>/<fileName>`, presigns a PUT to `UPLOAD_BUCKET`
+// (expires in 300s), and returns `{uploadUrl, storageRef}`. A Bearer token, when
+// present, is decoded (no signature verification here — the auth layer verifies;
+// here we only namespace the storage key) and its `sub` namespaces the key.
+
+// ── AWS SDK v3 bindings ─────────────────────────────────────────────────────
+
+type s3Client
+
+type putObjectInput = {
+  @as("Bucket") bucket: string,
+  @as("Key") key: string,
+  @as("ContentType") contentType?: string,
+}
+type putObjectCommand
+
+@module("@aws-sdk/client-s3") @new external makeS3Client: unit => s3Client = "S3Client"
+
+@module("@aws-sdk/client-s3") @new
+external makePutObjectCommand: putObjectInput => putObjectCommand = "PutObjectCommand"
+
+type presignOptions = {expiresIn: int}
+
+@module("@aws-sdk/s3-request-presigner")
+external getSignedUrl: (s3Client, putObjectCommand, presignOptions) => promise<string> =
+  "getSignedUrl"
+
+// ── Node bindings (replacing the former `%raw` helpers with typed externals) ──
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+@module("node:crypto") external randomUUID: unit => string = "randomUUID"
+
+type buffer
+@val @scope("Buffer") external bufferFromBase64: (string, string) => buffer = "from"
+@send external bufferToString: (buffer, string) => string = "toString"
+
+// Read an env var, mapping "" / unset to None.
+let getEnv = (k: string): option<string> =>
+  switch processEnv->Dict.get(k) {
+  | Some("") | None => None
+  | Some(v) => Some(v)
+  }
+
+// ── Function URL event / response shapes (payload format 2.0) ────────────────
+
+type functionUrlEvent = {
+  body?: string,
+  headers?: dict<string>,
+}
+
+type response = {
+  statusCode: int,
+  headers?: dict<string>,
+  body: string,
+}
+
+let corsHeaders = () =>
+  Dict.fromArray([
+    ("content-type", "application/json"),
+    ("access-control-allow-origin", "*"),
+    ("access-control-allow-methods", "POST,OPTIONS"),
+    ("access-control-allow-headers", "*"),
+  ])
+
+// Decode a JWT payload's `sub` claim without verifying the signature.
+let decodeJwtSub = (header: string): option<string> =>
+  try {
+    let token =
+      header->String.startsWith("Bearer ")
+        ? header->String.slice(~start=7, ~end=header->String.length)
+        : header
+    switch token->String.split(".")->Array.get(1) {
+    | Some(payload) =>
+      let base64 = payload->String.replaceAll("-", "+")->String.replaceAll("_", "/")
+      switch JSON.parseOrThrow(bufferFromBase64(base64, "base64")->bufferToString("utf8")) {
+      | Object(obj) => obj->Dict.get("sub")->Option.flatMap(JSON.Decode.string)
+      | _ => None
+      }
+    | None => None
+    }
+  } catch {
+  | _ => None
+  }
+
+// Key prefix from the caller identity when a Bearer token is present.
+let identityPrefix = (event: functionUrlEvent): string => {
+  let authHeader =
+    event.headers->Option.flatMap(h =>
+      h->Dict.get("authorization")->Option.orElse(h->Dict.get("Authorization"))
+    )
+  switch authHeader->Option.flatMap(decodeJwtSub) {
+  | Some(sub) => `${sub}/`
+  | None => ""
+  }
+}
+
+// ── Runtime handler ─────────────────────────────────────────────────────────
+
+let handler = async (event: functionUrlEvent): response => {
+  try {
+    let bucket = getEnv("UPLOAD_BUCKET")->Option.getOr("")
+    let parsed =
+      event.body
+      ->Option.getOr("{}")
+      ->JSON.parseOrThrow
+      ->JSON.Decode.object
+      ->Option.getOr(Dict.make())
+    let fileName =
+      parsed->Dict.get("fileName")->Option.flatMap(JSON.Decode.string)->Option.getOr("upload")
+    let contentType = parsed->Dict.get("contentType")->Option.flatMap(JSON.Decode.string)
+
+    // The object key doubles as the served path segment: it is rooted at the
+    // served prefix (`SERVED_PREFIX`, e.g. `uploads`) so the CloudFront
+    // `{prefix}/*` behavior fronts it. Callers PUT to this exact key.
+    let servedPrefix = getEnv("SERVED_PREFIX")->Option.getOr("uploads")
+    let key = `${servedPrefix}/${identityPrefix(event)}${randomUUID()}/${fileName}`
+    let client = makeS3Client()
+    let command = makePutObjectCommand({bucket, key, contentType: ?contentType})
+    let uploadUrl = await getSignedUrl(client, command, {expiresIn: 300})
+
+    // The stored ref is a same-origin relative URL `/{key}`: the served bucket is
+    // fronted read-only by the UI's own CloudFront distribution under
+    // `{prefix}/*`, so a command stores this directly-renderable value and an
+    // `image`-semantic field thumbnails it with no post-processing and no public
+    // bucket. See [docs/plans/done/ui-served-buckets.md].
+    let storageRef = `/${key}`
+
+    {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: Dict.fromArray([
+        ("uploadUrl", JSON.Encode.string(uploadUrl)),
+        ("storageRef", JSON.Encode.string(storageRef)),
+      ])
+      ->JSON.Encode.object
+      ->JSON.stringify,
+    }
+  } catch {
+  | exn =>
+    Console.error2("UploadPresign: presign failed", exn)
+    {
+      statusCode: 400,
+      headers: corsHeaders(),
+      body: Dict.fromArray([("error", JSON.Encode.string("presign_failed"))])
+      ->JSON.Encode.object
+      ->JSON.stringify,
+    }
+  }
+}

package/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs

@@ -0,0 +1,120 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as ClientS3 from "@aws-sdk/client-s3";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as S3RequestPresigner from "@aws-sdk/s3-request-presigner";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function corsHeaders() {
+  return Object.fromEntries([
+    [
+      "content-type",
+      "application/json"
+    ],
+    [
+      "access-control-allow-origin",
+      "*"
+    ],
+    [
+      "access-control-allow-methods",
+      "POST,OPTIONS"
+    ],
+    [
+      "access-control-allow-headers",
+      "*"
+    ]
+  ]);
+}
+
+function decodeJwtSub(header) {
+  try {
+    let token = header.startsWith("Bearer ") ? header.slice(7, header.length) : header;
+    let payload = token.split(".")[1];
+    if (payload === undefined) {
+      return;
+    }
+    let base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+    let obj = JSON.parse(Buffer.from(base64, "base64").toString("utf8"));
+    if (typeof obj === "object" && obj !== null && !Array.isArray(obj)) {
+      return Stdlib_Option.flatMap(obj["sub"], Stdlib_JSON.Decode.string);
+    } else {
+      return;
+    }
+  } catch (exn) {
+    return;
+  }
+}
+
+function identityPrefix(event) {
+  let authHeader = Stdlib_Option.flatMap(event.headers, h => Stdlib_Option.orElse(h["authorization"], h["Authorization"]));
+  let sub = Stdlib_Option.flatMap(authHeader, decodeJwtSub);
+  if (sub !== undefined) {
+    return sub + `/`;
+  } else {
+    return "";
+  }
+}
+
+async function handler(event) {
+  try {
+    let bucket = Stdlib_Option.getOr(getEnv("UPLOAD_BUCKET"), "");
+    let parsed = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(Stdlib_Option.getOr(event.body, "{}"))), {});
+    let fileName = Stdlib_Option.getOr(Stdlib_Option.flatMap(parsed["fileName"], Stdlib_JSON.Decode.string), "upload");
+    let contentType = Stdlib_Option.flatMap(parsed["contentType"], Stdlib_JSON.Decode.string);
+    let servedPrefix = Stdlib_Option.getOr(getEnv("SERVED_PREFIX"), "uploads");
+    let key = servedPrefix + `/` + identityPrefix(event) + Nodecrypto.randomUUID() + `/` + fileName;
+    let client = new ClientS3.S3Client();
+    let command = new ClientS3.PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      ContentType: contentType
+    });
+    let uploadUrl = await S3RequestPresigner.getSignedUrl(client, command, {
+      expiresIn: 300
+    });
+    let storageRef = `/` + key;
+    return {
+      statusCode: 200,
+      headers: corsHeaders(),
+      body: JSON.stringify(Object.fromEntries([
+        [
+          "uploadUrl",
+          uploadUrl
+        ],
+        [
+          "storageRef",
+          storageRef
+        ]
+      ]))
+    };
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    console.error("UploadPresign: presign failed", exn);
+    return {
+      statusCode: 400,
+      headers: corsHeaders(),
+      body: JSON.stringify(Object.fromEntries([[
+          "error",
+          "presign_failed"
+        ]]))
+    };
+  }
+}
+
+export {
+  getEnv,
+  corsHeaders,
+  decodeJwtSub,
+  identityPrefix,
+  handler,
+}
+/* node:crypto Not a pure module */

package/src/components/InboundTranslationSlice_Builder.res

@@ -15,11 +15,37 @@ module Make = (Api: {
     Spec: Reventless.InboundTranslationSlice.Spec,
     Translation: Reventless.InboundTranslationSlice.Translation with module Spec := Spec,
   ): (ReventlessCore.InboundTranslationSlice.T with module Spec = Spec) => {
+    // Register spec + translation module paths so the shared DCB command Lambda's
+    // entry point can import them and route `__inboundTranslation` payloads to this
+    // slice's `receive` (mirrors StateChangeSlice_Builder's path registration).
+    PluginRuntime_Builder.registerInboundTranslationSliceSpec(
+      ~specName=Spec.name,
+      ~specPath=Util_Bundle.getModuleSpecifier(Spec.moduleUrl),
+      ~translationPath=Util_Bundle.getModuleSpecifier(Translation.moduleUrl),
+    )
     module InnerMake = Inner.Make(Spec, Translation)
     module Spec = Spec
     module Translation = Translation
     type component = InnerMake.component
     let queryDbName = InnerMake.queryDbName
-    let make = InnerMake.make
+
+    let make = (~publishJsons, ~runtime=?, ~opts=?) => {
+      let component = InnerMake.make(~publishJsons, ~runtime?, ~opts?)
+      // The audit QueryDb's physical table name is Pulumi-generated, so it can only
+      // be read off the constructed component's outputs (resolved synchronously here,
+      // before forDcbCommandTopic builds HANDLER_CONFIG). Thread it so the entry
+      // point's Route 0 can persist the audit rows the in-process path writes inline.
+      let outputs: ReventlessInfra.InboundTranslationSlice.outputs =
+        component->ReventlessCore.Component.outputs
+      switch outputs.queryDb.resources->Array.get(0) {
+      | Some(tableResource) =>
+        PluginRuntime_Builder.registerInboundAuditTableName(
+          ~specName=Spec.name,
+          tableResource.name,
+        )
+      | None => ()
+      }
+      component
+    }
   }
 }

package/src/components/InboundTranslationSlice_Builder.res.mjs

@@ -1,5 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../util/Util_Bundle.res.mjs";
+import * as PluginRuntime_Builder$ReventlessAws from "../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as QueryDbStorage_DynamoDb$ReventlessAws from "../adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs";
 import * as QueryDbResolvers_AppSync$ReventlessAws from "../adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs";
 import * as InboundTranslationSlice_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs";
@@ -11,12 +14,22 @@ function Make(Api) {
     make: QueryDbResolvers_AppSync$ReventlessAws.make
   })(Api);
   let Make$1 = Spec => (Translation => {
+    PluginRuntime_Builder$ReventlessAws.registerInboundTranslationSliceSpec(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl));
     let InnerMake = Inner.Make(Spec)(Translation);
+    let make = (publishJsons, runtime, opts) => {
+      let component = InnerMake.make(publishJsons, runtime, opts);
+      let outputs = Component$ReventlessCore.outputs(component);
+      let tableResource = outputs.queryDb.resources[0];
+      if (tableResource !== undefined) {
+        PluginRuntime_Builder$ReventlessAws.registerInboundAuditTableName(Spec.name, tableResource.name);
+      }
+      return component;
+    };
     return {
       Spec: Spec,
       Translation: Translation,
       queryDbName: InnerMake.queryDbName,
-      make: InnerMake.make
+      make: make
     };
   });
   return {
@@ -28,4 +41,4 @@ function Make(Api) {
 export {
   Make,
 }
-/* QueryDbStorage_DynamoDb-ReventlessAws Not a pure module */
+/* Component-ReventlessCore Not a pure module */

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res

@@ -96,7 +96,7 @@ let forCommandTopic = (
 
   // No user packages — all framework imports are in the Layer
   let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
-    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs",
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs",
     ~packageDirs=Dict.make(),
   )
 

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res.mjs

@@ -65,7 +65,7 @@ function forCommandTopic(param, connect, memorySizeOpt, timeoutOpt, param$1, par
     return `{"queueUrl":"` + queueUrl + `","pluginReadModelTableName":"` + rmTable + `","schedulerRoleArn":"` + schedRoleArn + `","schedulerQueueArn":"` + schedQueueArn + `","schedulerQueueName":"` + schedQueueName + `","publishToAggregates":{` + publishToAggregatesJson + `}}`;
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs", {}, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.res.mjs", {}, undefined);
   return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, "CommandHandler", "ExtensionPoint", match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
 }
 

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -43,6 +43,44 @@ let registerStateChangeSliceSpec = (~specPath: string, ~behaviorPath: string) =>
   let _ = registeredSliceModulePaths->Array.push({specPath, behaviorPath})
 }
 
+// InboundTranslationSlice registration for the shared DCB command Lambda. Unlike
+// StateChangeSlices (routed by command TAG), inbound slices are invoked directly
+// by their AppSync mutation resolver with an `__inboundTranslation` payload — the
+// entry point routes those to a `receive` handler built from the spec + translation
+// modules. Registration is two-phase: the AWS `InboundTranslationSlice_Builder`
+// functor registers the module paths at instantiation (spec/translation `moduleUrl`,
+// like StateChangeSlice), and its wrapped `make` registers the audit QueryDb's
+// resolved table-name Output once the component is constructed (the physical name
+// is Pulumi-generated, so it can't be reconstructed at runtime). Both fire before
+// `forDcbCommandTopic` reads them.
+type inboundSliceReg = {
+  specPath: string,
+  translationPath: string,
+  mutable auditTableName: option<Pulumi.Output.t<string>>,
+}
+let registeredInboundSlices: dict<inboundSliceReg> = Dict.make()
+
+let registerInboundTranslationSliceSpec = (
+  ~specName: string,
+  ~specPath: string,
+  ~translationPath: string,
+) =>
+  switch registeredInboundSlices->Dict.get(specName) {
+  | Some(reg) => registeredInboundSlices->Dict.set(specName, {...reg, specPath, translationPath})
+  | None =>
+    registeredInboundSlices->Dict.set(specName, {specPath, translationPath, auditTableName: None})
+  }
+
+let registerInboundAuditTableName = (~specName: string, tableName: Pulumi.Output.t<string>) =>
+  switch registeredInboundSlices->Dict.get(specName) {
+  | Some(reg) => reg.auditTableName = Some(tableName)
+  | None =>
+    registeredInboundSlices->Dict.set(
+      specName,
+      {specPath: "", translationPath: "", auditTableName: Some(tableName)},
+    )
+  }
+
 /**
 Redundant with the seams that populate `dcbConfigRef` automatically:
 `pluginName` is set by `registerPluginName` (called from `Plugin_Builder.make`
@@ -731,7 +769,7 @@ module Make = (
 
       // Static re-export from Layer entry point — no esbuild, no user packages
       let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
-        ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.mjs",
+        ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.res.mjs",
         ~packageDirs=Dict.make(),
       )
 
@@ -768,8 +806,28 @@ module Make = (
       registeredSliceModulePaths
       ->Array.concat(dcbConfig.stateChangeSliceModulePaths)
       ->Array.map(({specPath, behaviorPath}) => (specPath, behaviorPath))
+    // Drop registrations that never received their module paths (a bare
+    // audit-table registration with no matching spec functor — shouldn't happen,
+    // but keeps a half-registered slice out of HANDLER_CONFIG).
+    let inboundSlices =
+      registeredInboundSlices
+      ->Dict.valuesToArray
+      ->Array.filterMap(reg =>
+        reg.specPath == ""
+          ? None
+          : Some(
+              (
+                {
+                  StateChangeSliceRuntime_Builder_Single.specPath: reg.specPath,
+                  translationPath: reg.translationPath,
+                  auditTableName: reg.auditTableName,
+                }: StateChangeSliceRuntime_Builder_Single.inboundSlicePaths
+              ),
+            )
+      )
     StateChangeSliceRuntime_Builder_Single.forDcbCommandTopic(
       ~slicePaths,
+      ~inboundSlices,
       ~dcbTableName=dcbConfig.dcbTableName,
       ~pluginName=dcbConfig.pluginName,
       ~syncConfig=syncStateChangesConfigRef.contents,