@reventlessdev/reventless-aws 3.0.0-alpha.232 → 3.0.0-alpha.234

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -81,164 +81,6 @@ let registry: dict<array<streamEntry>> = Dict.make()
 // Uses native Node.js crypto + fetch with SigV4 — no extra SDK packages needed.
 // Credentials come from the Lambda execution role via the process.env AWS_* variables.
 
-let handlerCode: string = `
-import { createHmac, createHash } from "node:crypto";
-import { unmarshall } from "@aws-sdk/util-dynamodb";
-
-const TOPIC_MAP = JSON.parse(process.env.STATE_TOPIC_MAP || "{}");
-const APPSYNC_ENDPOINT = process.env.APPSYNC_ENDPOINT; // "https://{eventsApi.dns.http}"
-const AWS_REGION = process.env.AWS_REGION ?? "eu-west-1";
-
-function sha256hex(data) {
-  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
-}
-function hmacBuf(key, data) {
-  return createHmac("sha256", key).update(data).digest();
-}
-
-async function signedHeaders(host, path, body) {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
-  const sessionToken = process.env.AWS_SESSION_TOKEN;
-  const now = new Date();
-  const amzDate = now.toISOString().replace(/[:\\-]|\\..../g, "").slice(0, 15) + "Z";
-  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
-  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
-  const canonH = Object.entries(headers).sort(([a],[b]) => a.localeCompare(b)).map(([k,v]) => \`\${k}:\${v}\\n\`).join("");
-  const signH = Object.keys(headers).sort().join(";");
-  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\\n");
-  const scope = \`\${dateStamp}/\${AWS_REGION}/appsync/aws4_request\`;
-  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\\n");
-  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
-  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, AWS_REGION), "appsync"), "aws4_request");
-  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
-  return { ...headers, Authorization: \`AWS4-HMAC-SHA256 Credential=\${accessKeyId}/\${scope}, SignedHeaders=\${signH}, Signature=\${sig}\` };
-}
-
-// AppSync Events channel segments allow only [A-Za-z0-9-]. Anything else
-// (\`@\`, \`.\`, \`:\`, \`_\`, \`/\`, …) collapses to \`-\` so the segment is a
-// legal channel-path token. The UI's AutoLive.normalizeSegment uses the same
-// rule for Entity-scoped subscribes.
-function pathSegment(value) {
-  return String(value).replace(/[^A-Za-z0-9-]/g, "-");
-}
-
-// Map record.eventSourceARN → topicRoot via STATE_TOPIC_MAP.
-// Stream ARNs look like: arn:aws:dynamodb:<region>:<acct>:table/<TableName>/stream/<ts>
-function topicRootFromEventSourceArn(arn) {
-  const m = arn && arn.match(/:table\\/([^/]+)\\/stream\\//);
-  if (!m) return undefined;
-  const topicName = TOPIC_MAP[m[1]];
-  if (topicName === undefined) return undefined;
-  return pathSegment(topicName);
-}
-
-// Build entityKey from record.dynamodb.Keys. Framework convention:
-// partition-key attr is named "id"; composite tables have one extra attr (the
-// sort key) whose name comes from the projection's subIdConfig.subIdField.
-// Returns the ORIGINAL key string — the descriptor body uses this verbatim so
-// AutoListView can match it against the GraphQL row.id. The channel path
-// segment is derived later via pathSegment().
-function entityKeyFromRecord(record) {
-  const keys = unmarshall(record.dynamodb.Keys ?? {});
-  const id = keys.id;
-  if (id === undefined) {
-    // Defensive: framework always names the partition key "id". If a future
-    // table breaks the convention, fall back to a stable sort-join.
-    const names = Object.keys(keys).sort();
-    return names.map((n) => String(keys[n])).join("-");
-  }
-  const subIdName = Object.keys(keys).find((k) => k !== "id");
-  return subIdName === undefined
-    ? String(id)
-    : String(id) + "-" + String(keys[subIdName]);
-}
-
-// Map DDB stream eventName → descriptor changeKind.
-function changeKindFor(eventName) {
-  switch (eventName) {
-    case "INSERT": return "Added";
-    case "MODIFY": return "Updated";
-    case "REMOVE": return "Removed";
-    default:       return "Updated";  // defensive default — shouldn't fire
-  }
-}
-
-// Pick the "natural" sort timestamp from an unmarshalled image. Conventions
-// in this codebase prefer updatedAt; createdAt is the fallback for views that
-// never mutate after insert. Returns undefined if neither is present.
-function pickSortKeyValue(image) {
-  if (image && typeof image.updatedAt === "string") return image.updatedAt;
-  if (image && typeof image.createdAt === "string") return image.createdAt;
-  return undefined;
-}
-
-export async function handler(event) {
-  const url = new URL(APPSYNC_ENDPOINT);
-  let transientErr;
-  for (const record of event.Records) {
-    const topicRoot = topicRootFromEventSourceArn(record.eventSourceARN);
-    if (topicRoot === undefined) {
-      console.warn("StateTopic: unknown table for ARN", record.eventSourceARN);
-      continue;
-    }
-    const channelRoot = "/default/" + topicRoot;
-    const image =
-      record.eventName === "REMOVE"
-        ? record.dynamodb.OldImage
-        : record.dynamodb.NewImage;
-    if (image === undefined) continue;
-    const entityKey = entityKeyFromRecord(record);
-    const channel = channelRoot + "/" + pathSegment(entityKey);
-    const unmarshalled = unmarshall(image);
-    const descriptor = {
-      changeKind: changeKindFor(record.eventName),
-      id: entityKey,
-    };
-    const sortKeyValue = pickSortKeyValue(unmarshalled);
-    if (sortKeyValue !== undefined) descriptor.sortKeyValue = sortKeyValue;
-    const body = JSON.stringify({ id: record.eventID, channel, events: [JSON.stringify(descriptor)] });
-    const auth = await signedHeaders(url.hostname, "/event", body);
-    try {
-      const res = await fetch(APPSYNC_ENDPOINT + "/event", {
-        method: "POST",
-        headers: { accept: "application/json, text/javascript", "content-encoding": "amz-1.0", "content-type": "application/json; charset=UTF-8", ...auth },
-        body,
-      });
-      if (!res.ok) {
-        const txt = await res.text();
-        // 4xx: permanent (bad request, auth, channel format) — retrying won't
-        // help. Log structurally so a CloudWatch metric filter on
-        // "STATE_TOPIC_PUBLISH_FAILED type=permanent" surfaces it; continue
-        // processing so one bad record doesn't block the rest of the batch.
-        // 5xx / network: transient — record it and throw at the end so the
-        // ESM retries (bounded by maximumRetryAttempts + bisectBatch).
-        const isTransient = res.status >= 500;
-        const tag = isTransient ? "transient" : "permanent";
-        console.error(
-          "STATE_TOPIC_PUBLISH_FAILED type=" + tag +
-          " status=" + res.status +
-          " channel=" + channel +
-          " body=" + txt.slice(0, 500)
-        );
-        if (isTransient) transientErr = new Error("StateTopic publish failed: " + res.status);
-      }
-    } catch (e) {
-      // Network-level error (DNS, connection refused, timeout) — always transient.
-      console.error(
-        "STATE_TOPIC_PUBLISH_FAILED type=transient status=network" +
-        " channel=" + channel +
-        " err=" + (e && e.message)
-      );
-      transientErr = e;
-    }
-  }
-  // Throw after the loop so a single transient error doesn't stop us from
-  // emitting other records' descriptors first. The ESM will retry the batch;
-  // bisectBatchOnFunctionError isolates the bad record across retries.
-  if (transientErr) throw transientErr;
-}
-`
 
 // ── Registration ──────────────────────────────────────────────────────────────
 
@@ -353,19 +195,19 @@ let finish = (
         dict->JSON.Encode.object->JSON.stringify
       })
 
-    // Shared Lambda — handler code is identical for every stream-enabled RM;
-    // routing is per-record via STATE_TOPIC_MAP env var.
-    let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
-    archiveContents->Dict.set(
-      "index.mjs",
-      Pulumi.Asset.stringAsset(handlerCode)->Pulumi.Archive.assetToAssetOrArchive,
+    // Shared Lambda — the compiled `_Ops` handler is identical for every
+    // stream-enabled RM; routing is per-record via STATE_TOPIC_MAP env var.
+    // Bundle reventless-aws (the handler + its node:crypto signer + the
+    // util-dynamodb unmarshaller live inside it) and re-export its `handler`;
+    // buildCodeArchive ships the ESM resolve-hook so `@rescript/runtime` and the
+    // handler's bare @aws-sdk/util-dynamodb resolve from layer / managed runtime.
+    let packageDirs = Dict.fromArray([
+      ("@reventlessdev/reventless-aws", Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws")),
+    ])
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs",
+      ~packageDirs,
     )
-    // ESM self-containment: the handler imports @aws-sdk/util-dynamodb, provided
-    // by the nodejs22.x runtime only under /var/runtime — unreachable from
-    // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
-    let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
-    let code = Pulumi.Archive.assetArchive(archiveContents)
-    let sourceCodeHash = Util_Bundle.hashString(handlerCode ++ "\n---\n" ++ loaderHash)
 
     let layers =
       Lambda.reventlessLayerArn

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -16,165 +16,6 @@ import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStre
 
 let registry = {};
 
-let handlerCode = `
-import { createHmac, createHash } from "node:crypto";
-import { unmarshall } from "@aws-sdk/util-dynamodb";
-
-const TOPIC_MAP = JSON.parse(process.env.STATE_TOPIC_MAP || "{}");
-const APPSYNC_ENDPOINT = process.env.APPSYNC_ENDPOINT; // "https://{eventsApi.dns.http}"
-const AWS_REGION = process.env.AWS_REGION ?? "eu-west-1";
-
-function sha256hex(data) {
-  return createHash("sha256").update(typeof data === "string" ? data : JSON.stringify(data)).digest("hex");
-}
-function hmacBuf(key, data) {
-  return createHmac("sha256", key).update(data).digest();
-}
-
-async function signedHeaders(host, path, body) {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
-  const sessionToken = process.env.AWS_SESSION_TOKEN;
-  const now = new Date();
-  const amzDate = now.toISOString().replace(/[:\\-]|\\..../g, "").slice(0, 15) + "Z";
-  const dateStamp = now.toISOString().slice(0, 10).replace(/-/g, "");
-  const headers = { host, "x-amz-date": amzDate, ...(sessionToken ? { "x-amz-security-token": sessionToken } : {}) };
-  const canonH = Object.entries(headers).sort(([a],[b]) => a.localeCompare(b)).map(([k,v]) => \`\${k}:\${v}\\n\`).join("");
-  const signH = Object.keys(headers).sort().join(";");
-  const cr = ["POST", path, "", canonH, signH, sha256hex(body)].join("\\n");
-  const scope = \`\${dateStamp}/\${AWS_REGION}/appsync/aws4_request\`;
-  const sts = ["AWS4-HMAC-SHA256", amzDate, scope, sha256hex(cr)].join("\\n");
-  const kDate = hmacBuf("AWS4" + secretAccessKey, dateStamp);
-  const kSigning = hmacBuf(hmacBuf(hmacBuf(kDate, AWS_REGION), "appsync"), "aws4_request");
-  const sig = createHmac("sha256", kSigning).update(sts).digest("hex");
-  return { ...headers, Authorization: \`AWS4-HMAC-SHA256 Credential=\${accessKeyId}/\${scope}, SignedHeaders=\${signH}, Signature=\${sig}\` };
-}
-
-// AppSync Events channel segments allow only [A-Za-z0-9-]. Anything else
-// (\`@\`, \`.\`, \`:\`, \`_\`, \`/\`, …) collapses to \`-\` so the segment is a
-// legal channel-path token. The UI's AutoLive.normalizeSegment uses the same
-// rule for Entity-scoped subscribes.
-function pathSegment(value) {
-  return String(value).replace(/[^A-Za-z0-9-]/g, "-");
-}
-
-// Map record.eventSourceARN → topicRoot via STATE_TOPIC_MAP.
-// Stream ARNs look like: arn:aws:dynamodb:<region>:<acct>:table/<TableName>/stream/<ts>
-function topicRootFromEventSourceArn(arn) {
-  const m = arn && arn.match(/:table\\/([^/]+)\\/stream\\//);
-  if (!m) return undefined;
-  const topicName = TOPIC_MAP[m[1]];
-  if (topicName === undefined) return undefined;
-  return pathSegment(topicName);
-}
-
-// Build entityKey from record.dynamodb.Keys. Framework convention:
-// partition-key attr is named "id"; composite tables have one extra attr (the
-// sort key) whose name comes from the projection's subIdConfig.subIdField.
-// Returns the ORIGINAL key string — the descriptor body uses this verbatim so
-// AutoListView can match it against the GraphQL row.id. The channel path
-// segment is derived later via pathSegment().
-function entityKeyFromRecord(record) {
-  const keys = unmarshall(record.dynamodb.Keys ?? {});
-  const id = keys.id;
-  if (id === undefined) {
-    // Defensive: framework always names the partition key "id". If a future
-    // table breaks the convention, fall back to a stable sort-join.
-    const names = Object.keys(keys).sort();
-    return names.map((n) => String(keys[n])).join("-");
-  }
-  const subIdName = Object.keys(keys).find((k) => k !== "id");
-  return subIdName === undefined
-    ? String(id)
-    : String(id) + "-" + String(keys[subIdName]);
-}
-
-// Map DDB stream eventName → descriptor changeKind.
-function changeKindFor(eventName) {
-  switch (eventName) {
-    case "INSERT": return "Added";
-    case "MODIFY": return "Updated";
-    case "REMOVE": return "Removed";
-    default:       return "Updated";  // defensive default — shouldn't fire
-  }
-}
-
-// Pick the "natural" sort timestamp from an unmarshalled image. Conventions
-// in this codebase prefer updatedAt; createdAt is the fallback for views that
-// never mutate after insert. Returns undefined if neither is present.
-function pickSortKeyValue(image) {
-  if (image && typeof image.updatedAt === "string") return image.updatedAt;
-  if (image && typeof image.createdAt === "string") return image.createdAt;
-  return undefined;
-}
-
-export async function handler(event) {
-  const url = new URL(APPSYNC_ENDPOINT);
-  let transientErr;
-  for (const record of event.Records) {
-    const topicRoot = topicRootFromEventSourceArn(record.eventSourceARN);
-    if (topicRoot === undefined) {
-      console.warn("StateTopic: unknown table for ARN", record.eventSourceARN);
-      continue;
-    }
-    const channelRoot = "/default/" + topicRoot;
-    const image =
-      record.eventName === "REMOVE"
-        ? record.dynamodb.OldImage
-        : record.dynamodb.NewImage;
-    if (image === undefined) continue;
-    const entityKey = entityKeyFromRecord(record);
-    const channel = channelRoot + "/" + pathSegment(entityKey);
-    const unmarshalled = unmarshall(image);
-    const descriptor = {
-      changeKind: changeKindFor(record.eventName),
-      id: entityKey,
-    };
-    const sortKeyValue = pickSortKeyValue(unmarshalled);
-    if (sortKeyValue !== undefined) descriptor.sortKeyValue = sortKeyValue;
-    const body = JSON.stringify({ id: record.eventID, channel, events: [JSON.stringify(descriptor)] });
-    const auth = await signedHeaders(url.hostname, "/event", body);
-    try {
-      const res = await fetch(APPSYNC_ENDPOINT + "/event", {
-        method: "POST",
-        headers: { accept: "application/json, text/javascript", "content-encoding": "amz-1.0", "content-type": "application/json; charset=UTF-8", ...auth },
-        body,
-      });
-      if (!res.ok) {
-        const txt = await res.text();
-        // 4xx: permanent (bad request, auth, channel format) — retrying won't
-        // help. Log structurally so a CloudWatch metric filter on
-        // "STATE_TOPIC_PUBLISH_FAILED type=permanent" surfaces it; continue
-        // processing so one bad record doesn't block the rest of the batch.
-        // 5xx / network: transient — record it and throw at the end so the
-        // ESM retries (bounded by maximumRetryAttempts + bisectBatch).
-        const isTransient = res.status >= 500;
-        const tag = isTransient ? "transient" : "permanent";
-        console.error(
-          "STATE_TOPIC_PUBLISH_FAILED type=" + tag +
-          " status=" + res.status +
-          " channel=" + channel +
-          " body=" + txt.slice(0, 500)
-        );
-        if (isTransient) transientErr = new Error("StateTopic publish failed: " + res.status);
-      }
-    } catch (e) {
-      // Network-level error (DNS, connection refused, timeout) — always transient.
-      console.error(
-        "STATE_TOPIC_PUBLISH_FAILED type=transient status=network" +
-        " channel=" + channel +
-        " err=" + (e && e.message)
-      );
-      transientErr = e;
-    }
-  }
-  // Throw after the loop so a single transient error doesn't stop us from
-  // emitting other records' descriptors first. The ESM will retry the batch;
-  // bisectBatchOnFunctionError isolates the bad record across retries.
-  if (transientErr) throw transientErr;
-}
-`;
-
 function make(readModelName, topicName, allQueryDbs, eventsApi, param) {
   let streamResource = Util_DynamoDbStream$ReventlessAws.findResource(Util_ReadModel$ReventlessCore.queryDbStorageResources(allQueryDbs, readModelName));
   let streamArn = Util_DynamoDbStream$ReventlessAws.streamArnFromDynamoDbTableResource(streamResource);
@@ -241,17 +82,17 @@ function finish(eventsApi, opts) {
     });
     return JSON.stringify(dict);
   });
-  let archiveContents = {};
-  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCode);
-  let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(archiveContents);
-  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
-  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCode + "\n---\n" + loaderHash);
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs", packageDirs, undefined);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let appsyncEndpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(eventsApi);
   let lambda = new (Aws.lambda.Function)(name + "StateTopicPublisher", {
     handler: "index.handler",
     runtime: "nodejs22.x",
-    code: code,
+    code: match.code,
     role: lambdaRole.arn,
     memorySize: 256,
     timeout: 30,
@@ -281,7 +122,7 @@ function finish(eventsApi, opts) {
         ]
       ])
     },
-    sourceCodeHash: sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash
   }, opts);
   entries.forEach(entry => {
     let esmName = entry.topicName + "Stream2" + name + "StateTopic";
@@ -299,7 +140,6 @@ function finish(eventsApi, opts) {
 
 export {
   registry,
-  handlerCode,
   make,
   finish,
 }

package/src/adapter/StateTopic/StateTopic_AppSync_Ops.res

@@ -0,0 +1,208 @@
+// Runtime handler for the read-model → AppSync Events state-topic relay —
+// compiled, type-checked ReScript (replaces the inline JS `handlerCode` string
+// in StateTopic_AppSync.res). Runtime-pure and SDK-free for signing (node:crypto
+// via AppSyncEventsSigner_Ops; see the parity test); it uses the rescript-aws-sdk
+// util-dynamodb unmarshaller (also Pulumi-free).
+//
+// Triggered by DynamoDB streams (one shared Lambda; routing is per-record via
+// STATE_TOPIC_MAP). For each changed row it derives the entity channel and a
+// `{changeKind, id, sortKeyValue?}` descriptor and publishes it. 4xx failures
+// are logged and skipped; 5xx / network failures are recorded and rethrown after
+// the batch so the EventSourceMapping retries (bisectBatchOnFunctionError).
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+let endpoint = processEnv->Dict.get("APPSYNC_ENDPOINT")->Option.getOr("")
+
+// STATE_TOPIC_MAP: `{ <tableName>: <topicName> }`, injected at deploy time.
+let topicMap: dict<string> =
+  switch processEnv->Dict.get("STATE_TOPIC_MAP")->Option.getOr("{}")->JSON.parseOrThrow->JSON.Decode.object {
+  | Some(obj) =>
+    obj
+    ->Dict.toArray
+    ->Array.filterMap(((k, v)) => v->JSON.Decode.string->Option.map(s => (k, s)))
+    ->Dict.fromArray
+  | None => Dict.make()
+  }
+
+// ── DynamoDB stream event (only the fields this handler reads) ───────────────
+
+type attributeValue = AwsSdk.DynamoDb.Util.attributeValue
+type streamRecord = {
+  @as("Keys") keys: dict<attributeValue>,
+  @as("NewImage") newImage?: dict<attributeValue>,
+  @as("OldImage") oldImage?: dict<attributeValue>,
+}
+type record = {
+  eventID: string,
+  eventName: string, // "INSERT" | "MODIFY" | "REMOVE"
+  eventSourceARN: string,
+  dynamodb?: streamRecord,
+}
+type event = {@as("Records") records: array<record>}
+
+// ── Per-record derivations (ports of the former inline JS helpers) ───────────
+
+// Map record.eventSourceARN → topicRoot via STATE_TOPIC_MAP. Stream ARNs look
+// like arn:aws:dynamodb:<region>:<acct>:table/<TableName>/stream/<ts>; split on
+// "/" gives [ "...:table", "<TableName>", "stream", "<ts>" ].
+let topicRootFromEventSourceArn = (arn: string): option<string> => {
+  let parts = arn->String.split("/")
+  switch (parts->Array.get(0), parts->Array.get(1), parts->Array.get(2)) {
+  | (Some(prefix), Some(tableName), Some("stream")) if prefix->String.endsWith(":table") =>
+    topicMap->Dict.get(tableName)->Option.map(AppSyncEventsSigner_Ops.pathSegment)
+  | _ => None
+  }
+}
+
+// `String(value)` parity for scalar key attributes.
+let jsonToString = (j: JSON.t): string =>
+  switch j {
+  | String(s) => s
+  | Number(n) => n->Float.toString
+  | Boolean(b) => b ? "true" : "false"
+  | Null => "null"
+  | _ => j->JSON.stringify
+  }
+
+// Build entityKey from the record's Keys. Framework convention: the partition
+// key attribute is "id"; a composite table adds one sort-key attribute. Returns
+// the ORIGINAL key string (channel-segmentised later via pathSegment).
+let entityKeyFromRecord = (dynamodb: streamRecord): string => {
+  let keys: dict<JSON.t> = AwsSdk.DynamoDb_Util_Helpers.unmarshallDict(dynamodb.keys)
+  switch keys->Dict.get("id") {
+  | None =>
+    // Defensive: framework always names the partition key "id"; fall back to a
+    // stable sort-join if a future table breaks the convention.
+    keys
+    ->Dict.keysToArray
+    ->Array.toSorted(String.compare)
+    ->Array.map(n => keys->Dict.get(n)->Option.mapOr("", jsonToString))
+    ->Array.join("-")
+  | Some(id) =>
+    switch keys->Dict.keysToArray->Array.find(k => k != "id") {
+    | None => id->jsonToString
+    | Some(subIdName) =>
+      id->jsonToString ++ "-" ++ keys->Dict.get(subIdName)->Option.mapOr("", jsonToString)
+    }
+  }
+}
+
+// Map DDB stream eventName → descriptor changeKind.
+let changeKindFor = (eventName: string): string =>
+  switch eventName {
+  | "INSERT" => "Added"
+  | "MODIFY" => "Updated"
+  | "REMOVE" => "Removed"
+  | _ => "Updated" // defensive default — shouldn't fire
+  }
+
+// Prefer updatedAt, then createdAt; None if neither is a string.
+let pickSortKeyValue = (image: dict<JSON.t>): option<string> =>
+  switch image->Dict.get("updatedAt")->Option.flatMap(JSON.Decode.string) {
+  | Some(v) => Some(v)
+  | None => image->Dict.get("createdAt")->Option.flatMap(JSON.Decode.string)
+  }
+
+// Publish one record; returns Some(errorMessage) on a transient (5xx / network)
+// failure so the caller can rethrow after the batch, None otherwise.
+let processRecord = async (
+  ~record: record,
+  ~region: string,
+  ~creds: AppSyncEventsSigner_Ops.creds,
+): option<string> =>
+  switch topicRootFromEventSourceArn(record.eventSourceARN) {
+  | None =>
+    Console.warn2("StateTopic: unknown table for ARN", record.eventSourceARN)
+    None
+  | Some(topicRoot) =>
+    switch record.dynamodb {
+    | None => None
+    | Some(dynamodb) =>
+      let image = if record.eventName == "REMOVE" {
+        dynamodb.oldImage
+      } else {
+        dynamodb.newImage
+      }
+      switch image {
+      | None => None
+      | Some(image) =>
+        let entityKey = entityKeyFromRecord(dynamodb)
+        let channel = `/default/${topicRoot}/${AppSyncEventsSigner_Ops.pathSegment(entityKey)}`
+        let unmarshalled: dict<JSON.t> = AwsSdk.DynamoDb_Util_Helpers.unmarshallDict(image)
+        let descriptor = Dict.make()
+        descriptor->Dict.set("changeKind", JSON.Encode.string(changeKindFor(record.eventName)))
+        descriptor->Dict.set("id", JSON.Encode.string(entityKey))
+        pickSortKeyValue(unmarshalled)->Option.forEach(v =>
+          descriptor->Dict.set("sortKeyValue", JSON.Encode.string(v))
+        )
+        let body =
+          Dict.fromArray([
+            ("id", JSON.Encode.string(record.eventID)),
+            ("channel", JSON.Encode.string(channel)),
+            (
+              "events",
+              JSON.Encode.array([JSON.Encode.string(descriptor->JSON.Encode.object->JSON.stringify)]),
+            ),
+          ])
+          ->JSON.Encode.object
+          ->JSON.stringify
+        try {
+          let res = await AppSyncEventsSigner_Ops.postEvent(
+            ~endpoint,
+            ~region,
+            ~isoNow=Date.make()->Date.toISOString,
+            ~creds,
+            ~body,
+          )
+          if res->AppSyncEventsSigner_Ops.responseOk {
+            None
+          } else {
+            let status = res->AppSyncEventsSigner_Ops.responseStatus
+            let txt = await res->AppSyncEventsSigner_Ops.responseText
+            let isTransient = status >= 500
+            let tag = isTransient ? "transient" : "permanent"
+            // 4xx: permanent (bad request, auth, channel format) — retrying won't
+            // help. 5xx: transient — recorded and rethrown so the ESM retries.
+            // Structured so a CloudWatch metric filter can surface each type.
+            Console.error(
+              `STATE_TOPIC_PUBLISH_FAILED type=${tag} status=${status->Int.toString} channel=${channel} body=${txt->String.slice(
+                  ~start=0,
+                  ~end=500,
+                )}`,
+            )
+            isTransient ? Some(`StateTopic publish failed: ${status->Int.toString}`) : None
+          }
+        } catch {
+        | exn =>
+          // Network-level error (DNS, connection refused, timeout) — always transient.
+          let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("")
+          Console.error(
+            `STATE_TOPIC_PUBLISH_FAILED type=transient status=network channel=${channel} err=${msg}`,
+          )
+          Some(msg == "" ? "StateTopic network error" : msg)
+        }
+      }
+    }
+  }
+
+let handler = async (event: event): unit => {
+  let region = AppSyncEventsSigner_Ops.region()
+  let creds = AppSyncEventsSigner_Ops.envCreds()
+  let transientErr = ref(None)
+  // Sequential, mirroring the former for-await loop.
+  await event.records->Array.reduce(Promise.resolve(), (acc, record) =>
+    acc->Promise.then(async _ =>
+      switch await processRecord(~record, ~region, ~creds) {
+      | Some(msg) => transientErr := Some(msg)
+      | None => ()
+      }
+    )
+  )
+  // Throw after the loop so one transient failure doesn't stop the other records'
+  // descriptors from being emitted first; the ESM retries the batch.
+  switch transientErr.contents {
+  | Some(msg) => JsError.throwWithMessage(msg)
+  | None => ()
+  }
+}