@reventlessdev/reventless-aws 3.0.0-alpha.232 → 3.0.0-alpha.233

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res

@@ -0,0 +1,198 @@
+// Typed cold-start core for the TaskBucket Lambda entry point.
+//
+// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// TaskBucketEntryPoint.mjs keeps only the inherently-untyped seam — the
+// dynamic `import()` of the task callback module named in HANDLER_CONFIG and
+// the read of its `callback` export. HANDLER_CONFIG parsing, the S3-event →
+// task-action dispatch (an exhaustive match over Reventless.Task.taskAction —
+// the former JS `switch (action.TAG)` with its unreachable "unknown TAG" arm), the
+// per-aggregate command publishing, and the CloudWatch Events scheduler ops
+// live here, fully type-checked.
+//
+// The former `.mjs` carried a hand-maintained mirror of
+// `toScheduleExpression` ("kept in sync manually"); typed code calls
+// ScheduledPublisher_CloudWatchEvents_Runtime directly — the layer ships it —
+// so the mirror is gone.
+
+@val @scope("process") external processEnv: dict<string> = "env"
+@module("./HandlerFactoryHelpers.mjs") @scope("log")
+external logWarn: (string, StreamRoutedEntryPoint_Ops.dispatchOpts) => unit = "warn"
+
+// ── HANDLER_CONFIG ──────────────────────────────────────────────────────────
+// Written by TaskRuntime_Builder_PerBucket.
+
+type schedulerEnvConfig = {
+  roleArnEnv: string,
+  targetArnEnv: string,
+  targetNameEnv: string,
+}
+type handlerConfig = {
+  callbackModule: string,
+  // aggregateName → env-var name holding the aggregate's cmd-topic SQS URL.
+  publishToAggregates: dict<string>,
+  scheduler: option<schedulerEnvConfig>,
+}
+
+let strOf = (obj: dict<JSON.t>, key: string): option<string> =>
+  obj->Dict.get(key)->Option.flatMap(JSON.Decode.string)
+
+let parseHandlerConfig = (rawJson: string): handlerConfig => {
+  let obj =
+    (rawJson == "" ? "{}" : rawJson)
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+    ->Option.getOr(Dict.make())
+  {
+    callbackModule: obj->strOf("callbackModule")->Option.getOr(""),
+    publishToAggregates: obj
+    ->Dict.get("publishToAggregates")
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.getOr(Dict.make())
+    ->Dict.toArray
+    ->Array.filterMap(((k, v)) => v->JSON.Decode.string->Option.map(s => (k, s)))
+    ->Dict.fromArray,
+    scheduler: obj
+    ->Dict.get("scheduler")
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.map(s => {
+      roleArnEnv: s->strOf("roleArnEnv")->Option.getOr(""),
+      targetArnEnv: s->strOf("targetArnEnv")->Option.getOr(""),
+      targetNameEnv: s->strOf("targetNameEnv")->Option.getOr(""),
+    }),
+  }
+}
+
+// ── Command publishing ──────────────────────────────────────────────────────
+// aggregateName → publishJsons, resolving each queue URL via the env-var name
+// carried in HANDLER_CONFIG; entries with an unset or empty URL are skipped
+// (same as the former JS `if (queueUrl !== "")`).
+
+let buildPublishCommands = (map: dict<string>): dict<ReventlessCore.CommandTopic.publishJsons> =>
+  map
+  ->Dict.toArray
+  ->Array.filterMap(((aggName, envVarName)) =>
+    processEnv
+    ->Dict.get(envVarName)
+    ->Option.filter(queueUrl => queueUrl != "")
+    ->Option.map(queueUrl => {
+      let queue: Util_SQS_Runtime.resolvedQueue = {id: queueUrl, name: queueUrl, arn: ""}
+      (aggName, queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO))
+    })
+  )
+  ->Dict.fromArray
+
+// ── Scheduler ops (CloudWatch Events) ───────────────────────────────────────
+// Resolved lazily on the first schedule action (tasks without schedules never
+// touch the CloudWatch client) and cached for the container lifetime.
+
+type schedulerOps = {
+  createSchedule: Reventless.Schedule.schedule => promise<unit>,
+  deleteSchedule: string => promise<unit>,
+}
+
+let schedulerOpsCache: ref<option<schedulerOps>> = ref(None)
+
+let makeSchedulerOps = (config: option<schedulerEnvConfig>): option<schedulerOps> =>
+  switch (schedulerOpsCache.contents, config) {
+  | (Some(ops), _) => Some(ops)
+  | (None, None) => None
+  | (None, Some(cfg)) =>
+    switch (
+      processEnv->Dict.get(cfg.roleArnEnv),
+      processEnv->Dict.get(cfg.targetArnEnv),
+      processEnv->Dict.get(cfg.targetNameEnv),
+    ) {
+    | (Some(roleArn), Some(targetArn), Some(targetName))
+      if roleArn != "" && targetArn != "" && targetName != "" =>
+      // The single resolved resource the shared CloudWatch Events runtime
+      // targets: `urn` is the PutTargets ARN, `name` the target id.
+      let resources: array<ReventlessInfra.Adapter.resolvedResource> = [
+        {
+          name: targetName,
+          id: targetName,
+          urn: targetArn,
+          service: "unknown",
+          resourceInfo: ReventlessInfra.Adapter.NoInfo,
+          role: "",
+          region: "",
+          resourceType: "",
+          configuration: Dict.make(),
+          tags: Dict.make(),
+        },
+      ]
+      let ops = {
+        createSchedule: schedule =>
+          ScheduledPublisher_CloudWatchEvents_Runtime.createSchedule(~roleArn)(resources, schedule),
+        deleteSchedule: name =>
+          ScheduledPublisher_CloudWatchEvents_Runtime.deleteSchedule(resources, name),
+      }
+      schedulerOpsCache := Some(ops)
+      Some(ops)
+    | _ =>
+      logWarn("scheduler env vars missing — schedules will no-op", {comp: "TaskBucketRuntime"})
+      None
+    }
+  }
+
+// ── Task-action dispatch ────────────────────────────────────────────────────
+
+let dispatchTaskActions = async (
+  ~actions: array<Reventless.Task.taskAction>,
+  ~publishCommands: dict<ReventlessCore.CommandTopic.publishJsons>,
+  ~schedulerOps: unit => option<schedulerOps>,
+): unit => {
+  let _ =
+    await actions
+    ->Array.map(async action =>
+      switch action {
+      | Reventless.Task.PublishCommands(aggregateName, cmdJsons) =>
+        switch publishCommands->Dict.get(aggregateName) {
+        | Some(publish) => await publish(cmdJsons)
+        | None =>
+          logWarn(
+            `no publish function for aggregate "${aggregateName}"`,
+            {comp: "TaskBucketRuntime"},
+          )
+        }
+      | CreateSchedule(schedule) =>
+        switch schedulerOps() {
+        | Some(ops) => await ops.createSchedule(schedule)
+        | None =>
+          logWarn(
+            "CreateSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
+            {comp: "TaskBucketRuntime"},
+          )
+        }
+      | DeleteSchedule(name) =>
+        switch schedulerOps() {
+        | Some(ops) => await ops.deleteSchedule(name)
+        | None =>
+          logWarn(
+            "DeleteSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)",
+            {comp: "TaskBucketRuntime"},
+          )
+        }
+      }
+    )
+    ->Promise.all
+}
+
+// ── Exported Lambda handler ─────────────────────────────────────────────────
+// The shell reads `callback` off the dynamically imported task module and
+// hands it here; from this point everything is typed
+// (TaskBucket_S3_Runtime.handleBucketEvent decodes the S3 records and invokes
+// the callback per object).
+
+let makeHandler = (~callback: ReventlessCore.Task.bucketCallback, ~config: handlerConfig) => {
+  let handleEvents = TaskBucket_S3_Runtime.handleBucketEvent(callback)
+  let publishCommands = buildPublishCommands(config.publishToAggregates)
+  async (event: PulumiAws.S3.Bucket.event, context: PulumiAws.Lambda.context) => {
+    let actions = await handleEvents(event, context)
+    await dispatchTaskActions(
+      ~actions,
+      ~publishCommands,
+      ~schedulerOps=() => makeSchedulerOps(config.scheduler),
+    )
+    ""
+  }
+}

package/src/adapter/Runtime/TaskBucketEntryPoint_Ops.res.mjs

@@ -0,0 +1,155 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
+import * as TaskBucket_S3_Runtime$ReventlessAws from "../Task/TaskBucket_S3_Runtime.res.mjs";
+import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
+import * as ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_CloudWatchEvents_Runtime.res.mjs";
+
+function logWarn(prim0, prim1) {
+  HandlerFactoryHelpersMjs.log.warn(prim0, prim1);
+}
+
+function strOf(obj, key) {
+  return Stdlib_Option.flatMap(obj[key], Stdlib_JSON.Decode.string);
+}
+
+function parseHandlerConfig(rawJson) {
+  let obj = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(rawJson === "" ? "{}" : rawJson)), {});
+  return {
+    callbackModule: Stdlib_Option.getOr(strOf(obj, "callbackModule"), ""),
+    publishToAggregates: Object.fromEntries(Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(obj["publishToAggregates"], Stdlib_JSON.Decode.object), {})), param => {
+      let k = param[0];
+      return Stdlib_Option.map(Stdlib_JSON.Decode.string(param[1]), s => [
+        k,
+        s
+      ]);
+    })),
+    scheduler: Stdlib_Option.map(Stdlib_Option.flatMap(obj["scheduler"], Stdlib_JSON.Decode.object), s => ({
+      roleArnEnv: Stdlib_Option.getOr(strOf(s, "roleArnEnv"), ""),
+      targetArnEnv: Stdlib_Option.getOr(strOf(s, "targetArnEnv"), ""),
+      targetNameEnv: Stdlib_Option.getOr(strOf(s, "targetNameEnv"), "")
+    }))
+  };
+}
+
+function buildPublishCommands(map) {
+  return Object.fromEntries(Stdlib_Array.filterMap(Object.entries(map), param => {
+    let aggName = param[0];
+    return Stdlib_Option.map(Stdlib_Option.filter(process.env[param[1]], queueUrl => queueUrl !== ""), queueUrl => {
+      let queue = {
+        id: queueUrl,
+        name: queueUrl,
+        arn: ""
+      };
+      return [
+        aggName,
+        CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO")
+      ];
+    });
+  }));
+}
+
+let schedulerOpsCache = {
+  contents: undefined
+};
+
+function makeSchedulerOps(config) {
+  let match = schedulerOpsCache.contents;
+  if (match !== undefined) {
+    return match;
+  }
+  if (config === undefined) {
+    return;
+  }
+  let match$1 = process.env[config.roleArnEnv];
+  let match$2 = process.env[config.targetArnEnv];
+  let match$3 = process.env[config.targetNameEnv];
+  if (match$1 !== undefined && match$2 !== undefined && match$3 !== undefined && match$1 !== "" && match$2 !== "" && match$3 !== "") {
+    let resources = [{
+        name: match$3,
+        id: match$3,
+        urn: match$2,
+        resourceInfo: "NoInfo",
+        service: "unknown",
+        role: "",
+        region: "",
+        resourceType: "",
+        configuration: {},
+        tags: {}
+      }];
+    let ops_createSchedule = schedule => ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.createSchedule(match$1)(resources, schedule);
+    let ops_deleteSchedule = name => ScheduledPublisher_CloudWatchEvents_Runtime$ReventlessAws.deleteSchedule(resources, name);
+    let ops = {
+      createSchedule: ops_createSchedule,
+      deleteSchedule: ops_deleteSchedule
+    };
+    schedulerOpsCache.contents = ops;
+    return ops;
+  }
+  HandlerFactoryHelpersMjs.log.warn("scheduler env vars missing — schedules will no-op", {
+    comp: "TaskBucketRuntime"
+  });
+}
+
+async function dispatchTaskActions(actions, publishCommands, schedulerOps) {
+  await Promise.all(actions.map(async action => {
+    switch (action.TAG) {
+      case "PublishCommands" :
+        let aggregateName = action._0;
+        let publish = publishCommands[aggregateName];
+        if (publish !== undefined) {
+          return await publish(action._1);
+        } else {
+          HandlerFactoryHelpersMjs.log.warn(`no publish function for aggregate "` + aggregateName + `"`, {
+            comp: "TaskBucketRuntime"
+          });
+          return;
+        }
+      case "CreateSchedule" :
+        let ops = schedulerOps();
+        if (ops !== undefined) {
+          return await ops.createSchedule(action._0);
+        } else {
+          HandlerFactoryHelpersMjs.log.warn("CreateSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)", {
+            comp: "TaskBucketRuntime"
+          });
+          return;
+        }
+      case "DeleteSchedule" :
+        let ops$1 = schedulerOps();
+        if (ops$1 !== undefined) {
+          return await ops$1.deleteSchedule(action._0);
+        } else {
+          HandlerFactoryHelpersMjs.log.warn("DeleteSchedule skipped — no scheduler configured for this Task (add sideEffects to setup)", {
+            comp: "TaskBucketRuntime"
+          });
+          return;
+        }
+    }
+  }));
+}
+
+function makeHandler(callback, config) {
+  let handleEvents = TaskBucket_S3_Runtime$ReventlessAws.handleBucketEvent(callback);
+  let publishCommands = buildPublishCommands(config.publishToAggregates);
+  return async (event, context) => {
+    let actions = await handleEvents(event, context);
+    await dispatchTaskActions(actions, publishCommands, () => makeSchedulerOps(config.scheduler));
+    return "";
+  };
+}
+
+export {
+  logWarn,
+  strOf,
+  parseHandlerConfig,
+  buildPublishCommands,
+  schedulerOpsCache,
+  makeSchedulerOps,
+  dispatchTaskActions,
+  makeHandler,
+}
+/* ./HandlerFactoryHelpers.mjs Not a pure module */

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -81,164 +81,6 @@ let registry: dict<array<streamEntry>> = Dict.make()
 // Uses native Node.js crypto + fetch with SigV4 — no extra SDK packages needed.
 // Credentials come from the Lambda execution role via the process.env AWS_* variables.
 
-let handlerCode: string = `
-import { createHmac, createHash } from "node:crypto";
-import { unmarshall } from "@aws-sdk/util-dynamodb";
-
-const TOPIC_MAP = JSON.parse(process.env.STATE_TOPIC_MAP || "{}");
-const APPSYNC_ENDPOINT = process.env.APPSYNC_ENDPOINT; // "https://{eventsApi.dns.http}"
-const AWS_REGION = process.env.AWS_REGION ?? "eu-west-1";
-
-function sha256hex(data) {
-  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
-}
-function hmacBuf(key, data) {
-  return createHmac("sha256", key).update(data).digest();
-}
-
-async function signedHeaders(host, path, body) {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
-  const sessionToken = process.env.AWS_SESSION_TOKEN;
-  const now = new Date();
-  const amzDate = now.toISOString().replace(/[:\\-]|\\..../g, "").slice(0, 15) + "Z";
-  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
-  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
-  const canonH = Object.entries(headers).sort(([a],[b]) => a.localeCompare(b)).map(([k,v]) => \`\${k}:\${v}\\n\`).join("");
-  const signH = Object.keys(headers).sort().join(";");
-  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\\n");
-  const scope = \`\${dateStamp}/\${AWS_REGION}/appsync/aws4_request\`;
-  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\\n");
-  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
-  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, AWS_REGION), "appsync"), "aws4_request");
-  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
-  return { ...headers, Authorization: \`AWS4-HMAC-SHA256 Credential=\${accessKeyId}/\${scope}, SignedHeaders=\${signH}, Signature=\${sig}\` };
-}
-
-// AppSync Events channel segments allow only [A-Za-z0-9-]. Anything else
-// (\`@\`, \`.\`, \`:\`, \`_\`, \`/\`, …) collapses to \`-\` so the segment is a
-// legal channel-path token. The UI's AutoLive.normalizeSegment uses the same
-// rule for Entity-scoped subscribes.
-function pathSegment(value) {
-  return String(value).replace(/[^A-Za-z0-9-]/g, "-");
-}
-
-// Map record.eventSourceARN → topicRoot via STATE_TOPIC_MAP.
-// Stream ARNs look like: arn:aws:dynamodb:<region>:<acct>:table/<TableName>/stream/<ts>
-function topicRootFromEventSourceArn(arn) {
-  const m = arn && arn.match(/:table\\/([^/]+)\\/stream\\//);
-  if (!m) return undefined;
-  const topicName = TOPIC_MAP[m[1]];
-  if (topicName === undefined) return undefined;
-  return pathSegment(topicName);
-}
-
-// Build entityKey from record.dynamodb.Keys. Framework convention:
-// partition-key attr is named "id"; composite tables have one extra attr (the
-// sort key) whose name comes from the projection's subIdConfig.subIdField.
-// Returns the ORIGINAL key string — the descriptor body uses this verbatim so
-// AutoListView can match it against the GraphQL row.id. The channel path
-// segment is derived later via pathSegment().
-function entityKeyFromRecord(record) {
-  const keys = unmarshall(record.dynamodb.Keys ?? {});
-  const id = keys.id;
-  if (id === undefined) {
-    // Defensive: framework always names the partition key "id". If a future
-    // table breaks the convention, fall back to a stable sort-join.
-    const names = Object.keys(keys).sort();
-    return names.map((n) => String(keys[n])).join("-");
-  }
-  const subIdName = Object.keys(keys).find((k) => k !== "id");
-  return subIdName === undefined
-    ? String(id)
-    : String(id) + "-" + String(keys[subIdName]);
-}
-
-// Map DDB stream eventName → descriptor changeKind.
-function changeKindFor(eventName) {
-  switch (eventName) {
-    case "INSERT": return "Added";
-    case "MODIFY": return "Updated";
-    case "REMOVE": return "Removed";
-    default:       return "Updated";  // defensive default — shouldn't fire
-  }
-}
-
-// Pick the "natural" sort timestamp from an unmarshalled image. Conventions
-// in this codebase prefer updatedAt; createdAt is the fallback for views that
-// never mutate after insert. Returns undefined if neither is present.
-function pickSortKeyValue(image) {
-  if (image && typeof image.updatedAt === "string") return image.updatedAt;
-  if (image && typeof image.createdAt === "string") return image.createdAt;
-  return undefined;
-}
-
-export async function handler(event) {
-  const url = new URL(APPSYNC_ENDPOINT);
-  let transientErr;
-  for (const record of event.Records) {
-    const topicRoot = topicRootFromEventSourceArn(record.eventSourceARN);
-    if (topicRoot === undefined) {
-      console.warn("StateTopic: unknown table for ARN", record.eventSourceARN);
-      continue;
-    }
-    const channelRoot = "/default/" + topicRoot;
-    const image =
-      record.eventName === "REMOVE"
-        ? record.dynamodb.OldImage
-        : record.dynamodb.NewImage;
-    if (image === undefined) continue;
-    const entityKey = entityKeyFromRecord(record);
-    const channel = channelRoot + "/" + pathSegment(entityKey);
-    const unmarshalled = unmarshall(image);
-    const descriptor = {
-      changeKind: changeKindFor(record.eventName),
-      id: entityKey,
-    };
-    const sortKeyValue = pickSortKeyValue(unmarshalled);
-    if (sortKeyValue !== undefined) descriptor.sortKeyValue = sortKeyValue;
-    const body = JSON.stringify({ id: record.eventID, channel, events: [JSON.stringify(descriptor)] });
-    const auth = await signedHeaders(url.hostname, "/event", body);
-    try {
-      const res = await fetch(APPSYNC_ENDPOINT + "/event", {
-        method: "POST",
-        headers: { accept: "application/json, text/javascript", "content-encoding": "amz-1.0", "content-type": "application/json; charset=UTF-8", ...auth },
-        body,
-      });
-      if (!res.ok) {
-        const txt = await res.text();
-        // 4xx: permanent (bad request, auth, channel format) — retrying won't
-        // help. Log structurally so a CloudWatch metric filter on
-        // "STATE_TOPIC_PUBLISH_FAILED type=permanent" surfaces it; continue
-        // processing so one bad record doesn't block the rest of the batch.
-        // 5xx / network: transient — record it and throw at the end so the
-        // ESM retries (bounded by maximumRetryAttempts + bisectBatch).
-        const isTransient = res.status >= 500;
-        const tag = isTransient ? "transient" : "permanent";
-        console.error(
-          "STATE_TOPIC_PUBLISH_FAILED type=" + tag +
-          " status=" + res.status +
-          " channel=" + channel +
-          " body=" + txt.slice(0, 500)
-        );
-        if (isTransient) transientErr = new Error("StateTopic publish failed: " + res.status);
-      }
-    } catch (e) {
-      // Network-level error (DNS, connection refused, timeout) — always transient.
-      console.error(
-        "STATE_TOPIC_PUBLISH_FAILED type=transient status=network" +
-        " channel=" + channel +
-        " err=" + (e && e.message)
-      );
-      transientErr = e;
-    }
-  }
-  // Throw after the loop so a single transient error doesn't stop us from
-  // emitting other records' descriptors first. The ESM will retry the batch;
-  // bisectBatchOnFunctionError isolates the bad record across retries.
-  if (transientErr) throw transientErr;
-}
-`
 
 // ── Registration ──────────────────────────────────────────────────────────────
 
@@ -353,19 +195,19 @@ let finish = (
         dict->JSON.Encode.object->JSON.stringify
       })
 
-    // Shared Lambda — handler code is identical for every stream-enabled RM;
-    // routing is per-record via STATE_TOPIC_MAP env var.
-    let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
-    archiveContents->Dict.set(
-      "index.mjs",
-      Pulumi.Asset.stringAsset(handlerCode)->Pulumi.Archive.assetToAssetOrArchive,
+    // Shared Lambda — the compiled `_Ops` handler is identical for every
+    // stream-enabled RM; routing is per-record via STATE_TOPIC_MAP env var.
+    // Bundle reventless-aws (the handler + its node:crypto signer + the
+    // util-dynamodb unmarshaller live inside it) and re-export its `handler`;
+    // buildCodeArchive ships the ESM resolve-hook so `@rescript/runtime` and the
+    // handler's bare @aws-sdk/util-dynamodb resolve from layer / managed runtime.
+    let packageDirs = Dict.fromArray([
+      ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+    ])
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs",
+      ~packageDirs,
     )
-    // ESM self-containment: the handler imports @aws-sdk/util-dynamodb, provided
-    // by the nodejs22.x runtime only under /var/runtime — unreachable from
-    // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
-    let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
-    let code = Pulumi.Archive.assetArchive(archiveContents)
-    let sourceCodeHash = Util_Bundle.hashString(handlerCode ++ "\n---\n" ++ loaderHash)
 
     let layers =
       Lambda.reventlessLayerArn