@reventlessdev/reventless-aws 3.0.0-alpha.232 → 3.0.0-alpha.233

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.233 (2026-07-27)
+
+### Bug Fixes
+
+* **aws:** grant DCB command Lambda write access to InboundTranslationSlice audit tables ([2c445fa](https://github.com/ReventlessDev/reventless-core/commit/2c445faf9692573d0eab2f0d4a456e8c5d723b41))
+* refactor(aws)!: convert remaining Group-1 entry points to typed-core/thin-shell; fix Counter publish + EP stub wiring ([d7f1aeb](https://github.com/ReventlessDev/reventless-core/commit/d7f1aeb90cfc122106ccc3ffa522911fba5db2de))
+
+### BREAKING CHANGES
+
+* reventless-postgres QueryEnginePostgres.Make no longer
+exposes the dead deploy-time `make` (queryEngineMaker); its Pulumi.Output
+wrap was the last @pulumi/pulumi import in the PgQueryResolver Lambda's
+cold-start graph. Pure helpers now alias QueryDbStorage_Postgres_Ops.
+
+
+
 # 3.0.0-alpha.232 (2026-07-27)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.232",
+  "version": "3.0.0-alpha.233",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,17 +11,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.24",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.60",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
-    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.183",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.184",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.105",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.47",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.81"
+    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.81",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.48"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Api/AppSyncEventsSigner_Ops.res

@@ -0,0 +1,137 @@
+// Shared SigV4 signer + AppSync Events publisher for the two stream-relay
+// Lambdas (EventLogSubscription, StateTopic). Both sign a `POST /event` to the
+// AppSync Events HTTP API with the ambient Lambda execution-role credentials and
+// publish onto a channel.
+//
+// Runtime-pure and dependency-free by design: the signing is hand-rolled on
+// `node:crypto` (always present, no SDK) rather than @smithy/signature-v4 — so
+// the Lambda cold-start graph carries NO AWS SDK and cannot hit the SDK-version
+// skew ("Frankenstein SDK") class of failure. This is a faithful port of the
+// former inline JS `signedHeaders` the two handler strings duplicated verbatim;
+// AppSyncEventsSigner_ParityFixture.mjs pins that original as a golden reference
+// and AppSyncEventsSigner_OpsTest asserts byte-for-byte equality.
+
+// ── node:crypto (string- and buffer-keyed HMAC; the signing key chain feeds a
+//    Buffer digest back in as the next key) ──────────────────────────────────
+
+type buffer
+
+type hmac
+@module("node:crypto") external createHmacStr: (string, string) => hmac = "createHmac"
+@module("node:crypto") external createHmacBuf: (string, buffer) => hmac = "createHmac"
+@send external hmacUpdate: (hmac, string) => hmac = "update"
+@send external hmacDigestBuf: hmac => buffer = "digest"
+@send external hmacDigestHex: (hmac, string) => string = "digest"
+
+type hash
+@module("node:crypto") external createHash: string => hash = "createHash"
+@send external hashUpdate: (hash, string) => hash = "update"
+@send external hashDigestHex: (hash, string) => string = "digest"
+
+let sha256hex = (data: string): string => createHash("sha256")->hashUpdate(data)->hashDigestHex("hex")
+
+let hmacFromStr = (key: string, data: string): buffer =>
+  createHmacStr("sha256", key)->hmacUpdate(data)->hmacDigestBuf
+let hmacFromBuf = (key: buffer, data: string): buffer =>
+  createHmacBuf("sha256", key)->hmacUpdate(data)->hmacDigestBuf
+
+// ── SigV4 ───────────────────────────────────────────────────────────────────
+
+type creds = {accessKeyId: string, secretAccessKey: string, sessionToken: option<string>}
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+// Ambient Lambda execution-role credentials (the managed runtime injects these).
+let envCreds = (): creds => {
+  accessKeyId: processEnv->Dict.get("AWS_ACCESS_KEY_ID")->Option.getOr(""),
+  secretAccessKey: processEnv->Dict.get("AWS_SECRET_ACCESS_KEY")->Option.getOr(""),
+  sessionToken: processEnv->Dict.get("AWS_SESSION_TOKEN"),
+}
+
+let region = (): string => processEnv->Dict.get("AWS_REGION")->Option.getOr("eu-west-1")
+
+// Sign a `POST <path>` for service `appsync`. `isoNow` is a Date().toISOString()
+// string, taken as an argument so the signer is pure and parity-testable. The
+// amzDate / dateStamp are derived by fixed slicing of the ISO-8601 layout
+// ("YYYY-MM-DDTHH:MM:SS.sssZ") — equivalent to the former regex strip, without
+// the regex. Returns the headers (host, x-amz-date, [security-token],
+// Authorization) to merge into the request.
+let signedHeaders = (
+  ~host: string,
+  ~path: string,
+  ~body: string,
+  ~region: string,
+  ~isoNow: string,
+  ~creds: creds,
+): dict<string> => {
+  let sl = (a, b) => isoNow->String.slice(~start=a, ~end=b)
+  let dateStamp = sl(0, 4) ++ sl(5, 7) ++ sl(8, 10)
+  let amzDate = dateStamp ++ "T" ++ sl(11, 13) ++ sl(14, 16) ++ sl(17, 19) ++ "Z"
+
+  let baseHeaders = [("host", host), ("x-amz-date", amzDate)]
+  let headers = switch creds.sessionToken {
+  | Some(token) if token != "" => baseHeaders->Array.concat([("x-amz-security-token", token)])
+  | _ => baseHeaders
+  }
+  // Codepoint sort matches both the JS `localeCompare` (canonical headers) and
+  // the default `.sort()` (signed-headers list) for these lowercase-ASCII keys.
+  let sorted = headers->Array.toSorted(((a, _), (b, _)) => String.compare(a, b))
+  let canonicalHeaders = sorted->Array.map(((k, v)) => `${k}:${v}\n`)->Array.join("")
+  let signedHeaderList = sorted->Array.map(((k, _)) => k)->Array.join(";")
+
+  let canonicalRequest =
+    ["POST", path, "", canonicalHeaders, signedHeaderList, sha256hex(body)]->Array.join("\n")
+  let scope = `${dateStamp}/${region}/appsync/aws4_request`
+  let stringToSign =
+    ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(canonicalRequest)]->Array.join("\n")
+
+  let kDate = hmacFromStr("AWS4" ++ creds.secretAccessKey, dateStamp)
+  let kRegion = hmacFromBuf(kDate, region)
+  let kService = hmacFromBuf(kRegion, "appsync")
+  let kSigning = hmacFromBuf(kService, "aws4_request")
+  let signature = createHmacBuf("sha256", kSigning)->hmacUpdate(stringToSign)->hmacDigestHex("hex")
+
+  let authorization = `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaderList}, Signature=${signature}`
+  let out = Dict.fromArray(sorted)
+  out->Dict.set("Authorization", authorization)
+  out
+}
+
+// ── AppSync Events publish (Node 18+ global fetch) ──────────────────────────
+
+type url
+@new external parseUrl: string => url = "URL"
+@get external urlHostname: url => string = "hostname"
+
+type fetchInit = {method: string, headers: dict<string>, body: string}
+type fetchResponse
+@val external fetch: (string, fetchInit) => promise<fetchResponse> = "fetch"
+@get external responseOk: fetchResponse => bool = "ok"
+@get external responseStatus: fetchResponse => int = "status"
+@send external responseText: fetchResponse => promise<string> = "text"
+
+// Sign and POST one AppSync Events request body to `<endpoint>/event`. The
+// caller builds `body` (channel + events) and inspects the response; error
+// handling differs per handler (log-and-continue vs. transient/permanent split).
+let postEvent = async (
+  ~endpoint: string,
+  ~region: string,
+  ~isoNow: string,
+  ~creds: creds,
+  ~body: string,
+): fetchResponse => {
+  let host = parseUrl(endpoint)->urlHostname
+  let auth = signedHeaders(~host, ~path="/event", ~body, ~region, ~isoNow, ~creds)
+  let headers = Dict.fromArray([
+    ("accept", "application/json, text/javascript"),
+    ("content-encoding", "amz-1.0"),
+    ("content-type", "application/json; charset=UTF-8"),
+  ])
+  auth->Dict.forEachWithKey((v, k) => headers->Dict.set(k, v))
+  await fetch(`${endpoint}/event`, {method: "POST", headers, body})
+}
+
+// AppSync Events channel segments allow only [A-Za-z0-9-]; anything else
+// collapses to `-`. Mirrors the UI's AutoLive.normalizeSegment.
+let pathSegment = (value: string): string =>
+  value->String.replaceRegExp(%re("/[^A-Za-z0-9-]/g"), "-")

package/src/adapter/Api/AppSyncEventsSigner_Ops.res.mjs

@@ -0,0 +1,121 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+
+function sha256hex(data) {
+  return Nodecrypto.createHash("sha256").update(data).digest("hex");
+}
+
+function hmacFromStr(key, data) {
+  return Nodecrypto.createHmac("sha256", key).update(data).digest();
+}
+
+function hmacFromBuf(key, data) {
+  return Nodecrypto.createHmac("sha256", key).update(data).digest();
+}
+
+function envCreds() {
+  return {
+    accessKeyId: Stdlib_Option.getOr(process.env["AWS_ACCESS_KEY_ID"], ""),
+    secretAccessKey: Stdlib_Option.getOr(process.env["AWS_SECRET_ACCESS_KEY"], ""),
+    sessionToken: process.env["AWS_SESSION_TOKEN"]
+  };
+}
+
+function region() {
+  return Stdlib_Option.getOr(process.env["AWS_REGION"], "eu-west-1");
+}
+
+function signedHeaders(host, path, body, region, isoNow, creds) {
+  let sl = (a, b) => isoNow.slice(a, b);
+  let dateStamp = sl(0, 4) + sl(5, 7) + sl(8, 10);
+  let amzDate = dateStamp + "T" + sl(11, 13) + sl(14, 16) + sl(17, 19) + "Z";
+  let baseHeaders = [
+    [
+      "host",
+      host
+    ],
+    [
+      "x-amz-date",
+      amzDate
+    ]
+  ];
+  let token = creds.sessionToken;
+  let headers = token !== undefined && token !== "" ? baseHeaders.concat([[
+        "x-amz-security-token",
+        token
+      ]]) : baseHeaders;
+  let sorted = headers.toSorted((param, param$1) => Primitive_string.compare(param[0], param$1[0]));
+  let canonicalHeaders = sorted.map(param => param[0] + `:` + param[1] + `\n`).join("");
+  let signedHeaderList = sorted.map(param => param[0]).join(";");
+  let canonicalRequest = [
+    "POST",
+    path,
+    "",
+    canonicalHeaders,
+    signedHeaderList,
+    sha256hex(body)
+  ].join("\n");
+  let scope = dateStamp + `/` + region + `/appsync/aws4_request`;
+  let stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    sha256hex(canonicalRequest)
+  ].join("\n");
+  let kDate = hmacFromStr("AWS4" + creds.secretAccessKey, dateStamp);
+  let kRegion = hmacFromBuf(kDate, region);
+  let kService = hmacFromBuf(kRegion, "appsync");
+  let kSigning = hmacFromBuf(kService, "aws4_request");
+  let signature = Nodecrypto.createHmac("sha256", kSigning).update(stringToSign).digest("hex");
+  let authorization = `AWS4-HMAC-SHA256 Credential=` + creds.accessKeyId + `/` + scope + `, SignedHeaders=` + signedHeaderList + `, Signature=` + signature;
+  let out = Object.fromEntries(sorted);
+  out["Authorization"] = authorization;
+  return out;
+}
+
+async function postEvent(endpoint, region, isoNow, creds, body) {
+  let host = new URL(endpoint).hostname;
+  let auth = signedHeaders(host, "/event", body, region, isoNow, creds);
+  let headers = Object.fromEntries([
+    [
+      "accept",
+      "application/json, text/javascript"
+    ],
+    [
+      "content-encoding",
+      "amz-1.0"
+    ],
+    [
+      "content-type",
+      "application/json; charset=UTF-8"
+    ]
+  ]);
+  Stdlib_Dict.forEachWithKey(auth, (v, k) => {
+    headers[k] = v;
+  });
+  return await fetch(endpoint + `/event`, {
+    method: "POST",
+    headers: headers,
+    body: body
+  });
+}
+
+function pathSegment(value) {
+  return value.replace(/[^A-Za-z0-9-]/g, "-");
+}
+
+export {
+  sha256hex,
+  hmacFromStr,
+  hmacFromBuf,
+  envCreds,
+  region,
+  signedHeaders,
+  postEvent,
+  pathSegment,
+}
+/* node:crypto Not a pure module */

package/src/adapter/Api/Platform_AdminScan_Ops.res

@@ -0,0 +1,136 @@
+// Shared runtime helpers for the two admin-query resolver Lambdas
+// (Platform_UIFragments, Platform_ComponentDefinitions). Both scan a read-model
+// table and collapse the rows to the highest version per bare plugin name.
+//
+// Runtime-pure and self-contained: bare `@aws-sdk/*` specifiers (resolved from
+// the managed runtime via the ESM resolve-hook), no `PulumiAws` — so it ships
+// inside an EntryPoint code archive with no serialized closure and no Pulumi in
+// the cold-start graph. Extracted from the former inline JS handler strings,
+// which duplicated the version comparator verbatim across both files.
+
+// ── @aws-sdk DynamoDB DocumentClient (bare specifiers) ──────────────────────
+
+type ddbClient
+type docClient
+@module("@aws-sdk/client-dynamodb") @new external makeDdbClient: unit => ddbClient = "DynamoDBClient"
+@module("@aws-sdk/lib-dynamodb") @scope("DynamoDBDocumentClient")
+external docFrom: ddbClient => docClient = "from"
+
+type scanInput = {
+  @as("TableName") tableName: string,
+  @as("Limit") limit?: int,
+  @as("ExclusiveStartKey") exclusiveStartKey?: JSON.t,
+  @as("FilterExpression") filterExpression?: string,
+  @as("ExpressionAttributeNames") expressionAttributeNames?: dict<string>,
+  @as("ExpressionAttributeValues") expressionAttributeValues?: dict<JSON.t>,
+}
+type scanCommand
+@module("@aws-sdk/lib-dynamodb") @new external makeScanCommand: scanInput => scanCommand = "ScanCommand"
+type scanOutput = {
+  @as("Items") items?: array<dict<JSON.t>>,
+  @as("LastEvaluatedKey") lastEvaluatedKey?: JSON.t,
+}
+@send external send: (docClient, scanCommand) => promise<scanOutput> = "send"
+
+// One document client per container (cold start).
+let doc = makeDdbClient()->docFrom
+
+// Drain every page of a table scan (1000/page), following LastEvaluatedKey.
+let scanAll = async (
+  ~tableName: string,
+  ~filterExpression: option<string>=?,
+  ~expressionAttributeNames: option<dict<string>>=?,
+  ~expressionAttributeValues: option<dict<JSON.t>>=?,
+): array<dict<JSON.t>> => {
+  let items = []
+  let startKey = ref(None)
+  let more = ref(true)
+  while more.contents {
+    let out =
+      await doc->send(
+        makeScanCommand({
+          tableName,
+          limit: 1000,
+          exclusiveStartKey: ?startKey.contents,
+          filterExpression: ?filterExpression,
+          expressionAttributeNames: ?expressionAttributeNames,
+          expressionAttributeValues: ?expressionAttributeValues,
+        }),
+      )
+    out.items->Option.forEach(is => is->Array.forEach(i => items->Array.push(i)))
+    switch out.lastEvaluatedKey {
+    | Some(k) => startKey := Some(k)
+    | None => more := false
+    }
+  }
+  items
+}
+
+// ── Version comparison ──────────────────────────────────────────────────────
+
+// `Number(...)` binding so the numeric-segment comparison is byte-identical to
+// the former JS `cmpVer` (empty string is guarded separately, exactly as before).
+@val external jsNumber: string => float = "Number"
+
+// Compare two version strings (`-`/`+` normalised to `.`, then segment-wise:
+// numeric segments compared as numbers, others lexically). Mirrors the platform
+// invariant "one version per plugin at a time" ordering. Returns 1/-1/0.
+let compareVersions = (a: string, b: string): int => {
+  let norm = s => s->String.replaceRegExp(%re("/[-+]/g"), ".")->String.split(".")
+  let pa = norm(a)
+  let pb = norm(b)
+  let len = Math.Int.max(pa->Array.length, pb->Array.length)
+  let res = ref(0)
+  let i = ref(0)
+  while res.contents == 0 && i.contents < len {
+    let sa = pa->Array.get(i.contents)->Option.getOr("")
+    let sb = pb->Array.get(i.contents)->Option.getOr("")
+    let na = jsNumber(sa)
+    let nb = jsNumber(sb)
+    let bothNum = sa != "" && sb != "" && !Float.isNaN(na) && !Float.isNaN(nb)
+    if bothNum {
+      if na > nb {
+        res := 1
+      } else if na < nb {
+        res := -1
+      }
+    } else if sa > sb {
+      res := 1
+    } else if sa < sb {
+      res := -1
+    }
+    i := i.contents + 1
+  }
+  res.contents
+}
+
+// Collapse scanned rows to the highest-version entry per bare plugin name.
+// `nameVersionOf` reads the row's `name@version` string; `toEntry` builds the
+// output entry for a surviving row (returning None drops a malformed row). The
+// name/version split mirrors ReventlessCore.Plugin.name / compareVersions.
+let latestByName = (
+  items: array<dict<JSON.t>>,
+  ~nameVersionOf: dict<JSON.t> => option<string>,
+  ~toEntry: (dict<JSON.t>, ~name: string) => option<JSON.t>,
+): array<JSON.t> => {
+  // bare plugin name -> (version, entry); highest version wins.
+  let latest: dict<(string, JSON.t)> = Dict.make()
+  items->Array.forEach(item =>
+    switch item->nameVersionOf {
+    | None => ()
+    | Some(nameVersion) =>
+      let segments = nameVersion->String.split("@")
+      let name = segments->Array.get(0)->Option.getOr("")
+      let version = segments->Array.get(1)->Option.getOr("")
+      switch item->toEntry(~name) {
+      | None => ()
+      | Some(entry) =>
+        switch latest->Dict.get(name) {
+        | Some((prevVersion, _)) if compareVersions(version, prevVersion) <= 0 => ()
+        | _ => latest->Dict.set(name, (version, entry))
+        }
+      }
+    }
+  )
+  latest->Dict.valuesToArray->Array.map(((_, entry)) => entry)
+}

package/src/adapter/Api/Platform_AdminScan_Ops.res.mjs

@@ -0,0 +1,98 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
+
+let doc = LibDynamodb.DynamoDBDocumentClient.from(new ClientDynamodb.DynamoDBClient());
+
+async function scanAll(tableName, filterExpression, expressionAttributeNames, expressionAttributeValues) {
+  let items = [];
+  let startKey;
+  let more = true;
+  while (more) {
+    let out = await doc.send(new LibDynamodb.ScanCommand({
+      TableName: tableName,
+      Limit: 1000,
+      ExclusiveStartKey: startKey,
+      FilterExpression: filterExpression,
+      ExpressionAttributeNames: expressionAttributeNames,
+      ExpressionAttributeValues: expressionAttributeValues
+    }));
+    Stdlib_Option.forEach(out.Items, is => {
+      is.forEach(i => {
+        items.push(i);
+      });
+    });
+    let k = out.LastEvaluatedKey;
+    if (k !== undefined) {
+      startKey = k;
+    } else {
+      more = false;
+    }
+  };
+  return items;
+}
+
+function compareVersions(a, b) {
+  let norm = s => s.replace(/[-+]/g, ".").split(".");
+  let pa = norm(a);
+  let pb = norm(b);
+  let len = Math.max(pa.length, pb.length);
+  let res = 0;
+  let i = 0;
+  while (res === 0 && i < len) {
+    let sa = Stdlib_Option.getOr(pa[i], "");
+    let sb = Stdlib_Option.getOr(pb[i], "");
+    let na = Number(sa);
+    let nb = Number(sb);
+    let bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+    if (bothNum) {
+      if (na > nb) {
+        res = 1;
+      } else if (na < nb) {
+        res = -1;
+      }
+    } else if (sa > sb) {
+      res = 1;
+    } else if (sa < sb) {
+      res = -1;
+    }
+    i = i + 1 | 0;
+  };
+  return res;
+}
+
+function latestByName(items, nameVersionOf, toEntry) {
+  let latest = {};
+  items.forEach(item => {
+    let nameVersion = nameVersionOf(item);
+    if (nameVersion === undefined) {
+      return;
+    }
+    let segments = nameVersion.split("@");
+    let name = Stdlib_Option.getOr(segments[0], "");
+    let version = Stdlib_Option.getOr(segments[1], "");
+    let entry = toEntry(item, name);
+    if (entry === undefined) {
+      return;
+    }
+    let match = latest[name];
+    if (match !== undefined && compareVersions(version, match[0]) <= 0) {
+      return;
+    }
+    latest[name] = [
+      version,
+      entry
+    ];
+  });
+  return Object.values(latest).map(param => param[1]);
+}
+
+export {
+  doc,
+  scanAll,
+  compareVersions,
+  latestByName,
+}
+/* doc Not a pure module */

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -13,85 +13,6 @@
 
 open PulumiAws
 
-// `adminEntryJson` is the JSON-stringified entry for the built-in Platform_Admin
-// plugin (Plugin aggregate with Activate/Deactivate, Plugin read model).
-// The admin never `Connect`s to itself, so its structure never
-// enters the Plugin read model — we inject it at deploy time so the host shell
-// renders Auto UI for it alongside user plugins.
-let makeHandlerCode = (~tableName as _: string, ~adminEntryJson: string): string =>
-  `
-import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
-
-const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
-const TABLE = process.env.PLUGIN_RM_TABLE;
-const ADMIN_ENTRY = ${adminEntryJson};
-
-export async function handler() {
-  if (!TABLE) {
-    console.error("Platform_ComponentDefinitions: PLUGIN_RM_TABLE env var not set");
-    return [ADMIN_ENTRY];
-  }
-  const items = [];
-  let exclusiveStartKey;
-  do {
-    const out = await client.send(new ScanCommand({
-      TableName: TABLE,
-      FilterExpression: "contains(#status, :connected)",
-      ExpressionAttributeNames: { "#status": "status" },
-      ExpressionAttributeValues: { ":connected": "Connected" },
-      Limit: 1000,
-      ExclusiveStartKey: exclusiveStartKey,
-    }));
-    if (out.Items) items.push(...out.Items);
-    exclusiveStartKey = out.LastEvaluatedKey;
-  } while (exclusiveStartKey);
-
-  // Platform invariant: one version per plugin at a time, so the UI sees just
-  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The Connected
-  // filter above does not enforce single-version: during a rolling deploy or a
-  // missed retire, several versions of the same plugin sit in Connected at once
-  // and each would otherwise emit a full duplicate set of AutoUI menu entries.
-  // Collapse to the highest version per plugin name (mirrors
-  // ReventlessCore.Plugin.compareVersions).
-  const cmpVer = (a, b) => {
-    const pa = String(a).replace(/[-+]/g, ".").split(".");
-    const pb = String(b).replace(/[-+]/g, ".").split(".");
-    const len = Math.max(pa.length, pb.length);
-    for (let i = 0; i < len; i++) {
-      const sa = pa[i] ?? "", sb = pb[i] ?? "";
-      const na = Number(sa), nb = Number(sb);
-      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
-      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
-      else if (sa !== sb) return sa > sb ? 1 : -1;
-    }
-    return 0;
-  };
-  // The persisted structure carries Internal ReadModels / StateViewSlices for
-  // developer tooling; they must stay out of the deployed AutoUI. Mirror
-  // ReventlessCore.Platform_ComponentDefinitionsApi.isPublicQueryable here on the
-  // read path (the persisted structure is pre-filter — it is NOT re-encoded).
-  const isPublicQueryable = (q) => q?.visibility !== "Internal";
-  const filterStructure = (s) => ({
-    ...s,
-    readModels: (s.readModels ?? []).filter(isPublicQueryable),
-    stateViewSlices: (s.stateViewSlices ?? []).filter(isPublicQueryable),
-  });
-  const latestByName = new Map();
-  for (const item of items) {
-    if (!item || !item.structure) continue;
-    const name = String(item.name).split("@")[0];
-    const version = String(item.name).split("@")[1] ?? "";
-    const prev = latestByName.get(name);
-    if (!prev || cmpVer(version, prev.version) > 0) {
-      latestByName.set(name, { version, entry: { pluginId: name, ...filterStructure(item.structure) } });
-    }
-  }
-  const userEntries = [...latestByName.values()].map(v => v.entry);
-  return [ADMIN_ENTRY, ...userEntries];
-}
-`
-
 let resolverCode = `
 import { util } from '@aws-appsync/utils';
 export function request(ctx) {
@@ -160,18 +81,18 @@ let make = (
       ReventlessCore.Platform_Admin_Structure.structure,
     )->JSON.stringify
 
-  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
-  let handlerCodeStub = makeHandlerCode(~tableName="", ~adminEntryJson)
-  archiveContents->Dict.set(
-    "index.mjs",
-    Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
+  // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
+  // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook so
+  // the handler's bare @aws-sdk/* specifiers resolve from the managed runtime.
+  // The admin entry is passed as an env var (ADMIN_ENTRY_JSON) rather than
+  // interpolated into the source, so the archive hash is stable across deploys.
+  let packageDirs = Dict.fromArray([
+    ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs",
+    ~packageDirs,
   )
-  // ESM self-containment: the handler imports @aws-sdk/* bare specifiers the
-  // nodejs22.x runtime provides only under /var/runtime — unreachable from
-  // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
-  let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
-  let code = Pulumi.Archive.assetArchive(archiveContents)
-  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub ++ "\n---\n" ++ loaderHash)
 
   let layers =
     Lambda.reventlessLayerArn
@@ -196,6 +117,7 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("PLUGIN_RM_TABLE", pluginReadModelTableName->Pulumi.Output.asInput),
+            ("ADMIN_ENTRY_JSON", adminEntryJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
           ]),