@reventlessdev/reventless-aws 3.0.0-alpha.263 → 3.0.0-alpha.264

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.264 (2026-08-03)
+
+### Bug Fixes
+
+* **aws:** give slice command publishes a queue they can actually reach ([42fdb55](https://github.com/ReventlessDev/reventless-core/commit/42fdb55b751a197d586c49e3615ce12ffea42046))
+
+
 # 3.0.0-alpha.263 (2026-08-03)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.263",
+  "version": "3.0.0-alpha.264",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -16,13 +16,13 @@
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.65",
     "@reventlessdev/rescript-node": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.209",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.124",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.208",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.99",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.72"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.73",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -794,12 +794,17 @@ module MakeWithConfig = (
         let tableResource = outputs.resources->Array.getUnsafe(0)
         PluginRuntime_Builder.registerDcbTableName(tableResource.name)
       },
-    // DCB CommandTopic created hook — extracts SQS queue URL for slice builders.
+    // DCB CommandTopic created hook — extracts SQS queue URL for slice builders,
+    // and the queue resource so the slice Lambda's role is granted
+    // `sqs:SendMessage` on it.
     onDcbCommandTopicCreated: dcbCommandTopicUnknown => {
       let commandTopic = dcbCommandTopicUnknown->asDcbCommandTopicComponent
       let channel = commandTopic->ReventlessCore.CommandTopic_Adapter.channel
       let channelParts = channel.parts->asSqsChannelParts
-      AutomationSliceRuntime_Builder_Single.setDcbQueueUrl(channelParts.queue.id)
+      AutomationSliceRuntime_Builder_Single.setDcbQueueUrl(
+        ~resource=?channel.resources->Array.get(0),
+        channelParts.queue.id,
+      )
     },
     // DCB slices created hook — finalize slice Lambdas.
     onDcbSlicesCreated: dcbEventLogUnknown => {

package/src/Platform.res.mjs

@@ -542,7 +542,7 @@ function MakeWithConfig(Config) {
   let hooks_onDcbCommandTopicCreated = dcbCommandTopicUnknown => {
     let channel = dcbCommandTopicUnknown.channel;
     let channelParts = channel.parts;
-    AutomationSliceRuntime_Builder_Single$ReventlessAws.setDcbQueueUrl(channelParts.queue.id);
+    AutomationSliceRuntime_Builder_Single$ReventlessAws.setDcbQueueUrl(undefined, channel.resources[0], channelParts.queue.id);
   };
   let hooks_onDcbSlicesCreated = dcbEventLogUnknown => {
     StateViewSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);
@@ -1796,7 +1796,7 @@ function Make($star) {
   let hooks_onDcbCommandTopicCreated = dcbCommandTopicUnknown => {
     let channel = dcbCommandTopicUnknown.channel;
     let channelParts = channel.parts;
-    AutomationSliceRuntime_Builder_Single$ReventlessAws.setDcbQueueUrl(channelParts.queue.id);
+    AutomationSliceRuntime_Builder_Single$ReventlessAws.setDcbQueueUrl(undefined, channel.resources[0], channelParts.queue.id);
   };
   let hooks_onDcbSlicesCreated = dcbEventLogUnknown => {
     StateViewSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);

package/src/adapter/CommandTopic/CommandTopicChannel_SQS.res

@@ -65,10 +65,15 @@ let make: ReventlessCore.CommandTopic_Adapter.channelMaker<
   )
 
   let resolvedQueueOutput = queue->Util_SQS.toResolvedQueueOutput
+  let queueResource = queue->Util_SQS.toResource(~tags=tags->Pulumi.Output.fromInput)
+
+  // Recorded while the queue is still concrete, so a component publishing to
+  // this owner from a Lambda can be given the URL and flavor as configuration.
+  CommandTopicRegistry.register(~owner, ~queueUrl=queue.id, ~resource=queueResource, ~isFifo=false)
 
   {
     ReventlessCore.CommandTopic_Adapter.parts: {queue: queue},
-    resources: [queue->Util_SQS.toResource(~tags=tags->Pulumi.Output.fromInput)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput->Pulumi.Output.apply(resolvedQueue =>
       resolvedQueue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS, ...)
     ),

package/src/adapter/CommandTopic/CommandTopicChannel_SQS.res.mjs

@@ -12,6 +12,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
+import * as CommandTopicRegistry$ReventlessAws from "./CommandTopicRegistry.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as CommandTopicChannel_Helpers$ReventlessAws from "./CommandTopicChannel_Helpers.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "./CommandTopicChannel_SQS_Runtime.res.mjs";
@@ -48,11 +49,13 @@ function make(name, owner, opts) {
     sqsManagedSseEnabled: false
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   let resolvedQueueOutput = Util_SQS$ReventlessAws.toResolvedQueueOutput(queue);
+  let queueResource = Util_SQS$ReventlessAws.toResource(tags, queue);
+  CommandTopicRegistry$ReventlessAws.register(owner, queue.id, queueResource, false);
   return {
     parts: {
       queue: queue
     },
-    resources: [Util_SQS$ReventlessAws.toResource(tags, queue)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput.apply(resolvedQueue => CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS")),
     publishJsonsStream: resolvedQueueOutput.apply(resolvedQueue => {
       let publishJsons = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS");

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_Async.res

@@ -44,6 +44,11 @@ let make: ReventlessCore.CommandTopic_Adapter.channelMaker<
   )
 
   let resolvedQueueOutput = queue->Util_SQS.toResolvedQueueOutput
+  let queueResource = queue->Util_SQS.toResource(~tags=tags->Pulumi.Output.fromInput)
+
+  // Async aggregates and StateChangeSlices land here; same capture so a slice
+  // targeting one is routed to it rather than to the plugin's DCB topic.
+  CommandTopicRegistry.register(~owner, ~queueUrl=queue.id, ~resource=queueResource, ~isFifo=false)
 
   {
     parts: {queue: queue},

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_Async.res.mjs

@@ -13,6 +13,7 @@ import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Util_SQS_FIFO$ReventlessAws from "../../util/Util_SQS_FIFO.res.mjs";
+import * as CommandTopicRegistry$ReventlessAws from "./CommandTopicRegistry.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "./CommandTopicChannel_SQS.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "./CommandTopicChannel_SQS_Runtime.res.mjs";
@@ -31,6 +32,8 @@ function make(name, owner, opts) {
     sqsManagedSseEnabled: false
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   let resolvedQueueOutput = Util_SQS$ReventlessAws.toResolvedQueueOutput(queue);
+  let queueResource = Util_SQS$ReventlessAws.toResource(tags, queue);
+  CommandTopicRegistry$ReventlessAws.register(owner, queue.id, queueResource, false);
   return {
     parts: {
       queue: queue

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_FIFO.res

@@ -33,10 +33,15 @@ let make: ReventlessCore.CommandTopic_Adapter.channelMaker<
   )
 
   let resolvedQueueOutput = queue->Util_SQS.toResolvedQueueOutput
+  let queueResource = queue->Util_SQS_FIFO.toResource(~tags=tags->Pulumi.Output.fromInput)
+
+  // Same capture as the standard variant, and the reason the flag exists: only
+  // the creating module knows this queue needs a MessageGroupId.
+  CommandTopicRegistry.register(~owner, ~queueUrl=queue.id, ~resource=queueResource, ~isFifo=true)
 
   {
     parts: {queue: queue},
-    resources: [queue->Util_SQS_FIFO.toResource(~tags=tags->Pulumi.Output.fromInput)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput->Pulumi.Output.apply(resolvedQueue =>
       resolvedQueue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO, ...)
     ),

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_FIFO.res.mjs

@@ -13,6 +13,7 @@ import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Util_SQS_FIFO$ReventlessAws from "../../util/Util_SQS_FIFO.res.mjs";
+import * as CommandTopicRegistry$ReventlessAws from "./CommandTopicRegistry.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "./CommandTopicChannel_SQS.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "./CommandTopicChannel_SQS_Runtime.res.mjs";
@@ -31,11 +32,13 @@ function make(name, owner, opts) {
     sqsManagedSseEnabled: false
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   let resolvedQueueOutput = Util_SQS$ReventlessAws.toResolvedQueueOutput(queue);
+  let queueResource = Util_SQS_FIFO$ReventlessAws.toResource(tags, queue);
+  CommandTopicRegistry$ReventlessAws.register(owner, queue.id, queueResource, true);
   return {
     parts: {
       queue: queue
     },
-    resources: [Util_SQS_FIFO$ReventlessAws.toResource(tags, queue)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput.apply(resolvedQueue => CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS_FIFO")),
     publishJsonsStream: resolvedQueueOutput.apply(resolvedQueue => {
       let publishJsons = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS_FIFO");

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_Sync.res

@@ -45,10 +45,15 @@ let make: ReventlessCore.CommandTopic_Adapter.channelMaker<
   )
 
   let resolvedQueueOutput = queue->Util_SQS.toResolvedQueueOutput
+  let queueResource = queue->Util_SQS.toResource(~tags=tags->Pulumi.Output.fromInput)
+
+  // This is the maker Aggregates use, so it is the one an OutboundTranslationSlice
+  // naming an Aggregate in `targetName` needs to find.
+  CommandTopicRegistry.register(~owner, ~queueUrl=queue.id, ~resource=queueResource, ~isFifo=false)
 
   {
     ReventlessCore.CommandTopic_Adapter.parts: {queue: queue},
-    resources: [queue->Util_SQS.toResource(~tags=tags->Pulumi.Output.fromInput)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput->Pulumi.Output.apply(resolvedQueue =>
       resolvedQueue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS, ...)
     ),

package/src/adapter/CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
+import * as CommandTopicRegistry$ReventlessAws from "./CommandTopicRegistry.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "./CommandTopicChannel_SQS.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "./CommandTopicChannel_SQS_Runtime.res.mjs";
@@ -28,11 +29,13 @@ function make(name, owner, opts) {
     sqsManagedSseEnabled: false
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
   let resolvedQueueOutput = Util_SQS$ReventlessAws.toResolvedQueueOutput(queue);
+  let queueResource = Util_SQS$ReventlessAws.toResource(tags, queue);
+  CommandTopicRegistry$ReventlessAws.register(owner, queue.id, queueResource, false);
   return {
     parts: {
       queue: queue
     },
-    resources: [Util_SQS$ReventlessAws.toResource(tags, queue)],
+    resources: [queueResource],
     publishJsons: resolvedQueueOutput.apply(resolvedQueue => CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS")),
     publishJsonsStream: resolvedQueueOutput.apply(resolvedQueue => {
       let publishJsons = CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(resolvedQueue, "SQS");

package/src/adapter/CommandTopic/CommandTopicRegistry.res

@@ -0,0 +1,50 @@
+// Where each component's CommandTopic queue lives, recorded as the queue is
+// created.
+//
+// Runtime code cannot be handed a publisher. A slice Lambda is a compiled
+// EntryPoint configured through `HANDLER_CONFIG`, not a serialized closure —
+// that separation is what fixed the cold-start crashes from closures mixing
+// layer and runtime SDK versions — so a `publishJsons` function cannot cross
+// into it. The same choice has to travel as *data*: which queue, and whether it
+// is FIFO.
+//
+// Captured here rather than recovered later, because recovering it does not
+// work. A component's `resources` array reaches callers inside a
+// `Pulumi.Output.t`, and although every `resource` field is typed
+// `Pulumi.Output.t<string>`, Pulumi flattens nested Outputs at resolution — so
+// within the enclosing apply those fields are already plain strings and calling
+// `.apply` on one throws. At creation the queue is still concrete: `.id` is a
+// flat Output, and the creating module's identity already settles the flavor.
+//
+// Keyed by owner *name* — an Aggregate's `Spec.name` — which is the same key an
+// OutboundTranslationSlice names in `targetName`.
+
+type entry = {
+  /** The queue URL, for a runtime publisher rebuilt from configuration. */
+  queueUrl: Pulumi.Output.t<string>,
+  /** The queue as a deploy-time resource, so a caller can add it to a channel
+      spec and pick up `connectLambda`'s existing `sqs:SendMessage` grant. */
+  resource: ReventlessInfra.Adapter.resource,
+  /** FIFO queues need a `MessageGroupId` and standard queues reject one, so this
+      cannot be assumed by the caller — it is a property of the queue that only
+      the module which created it knows. */
+  isFifo: bool,
+}
+
+let byOwner: dict<entry> = Dict.make()
+
+let register = (
+  ~owner: option<ReventlessCore.ResourceAttribution.owner>,
+  ~queueUrl: Pulumi.Output.t<string>,
+  ~resource: ReventlessInfra.Adapter.resource,
+  ~isFifo: bool,
+) =>
+  owner->Option.forEach(({name}) =>
+    byOwner->Dict.set(name, {queueUrl, resource, isFifo})
+  )
+
+/** The CommandTopic of the component with this name, if one has been created.
+    `None` for a target that is not an Aggregate in this plugin — a DCB
+    StateChangeSlice, or a name that matches nothing — where the caller keeps
+    the plugin-wide DCB command topic. */
+let get = (name: string) => byOwner->Dict.get(name)

package/src/adapter/CommandTopic/CommandTopicRegistry.res.mjs

@@ -0,0 +1,26 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+
+let byOwner = {};
+
+function register(owner, queueUrl, resource, isFifo) {
+  Stdlib_Option.forEach(owner, param => {
+    byOwner[param.name] = {
+      queueUrl: queueUrl,
+      resource: resource,
+      isFifo: isFifo
+    };
+  });
+}
+
+function get(name) {
+  return byOwner[name];
+}
+
+export {
+  byOwner,
+  register,
+  get,
+}
+/* No side effect */

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -27,6 +27,10 @@ type handlerEntry = {
   callbackType: string,
   queryDbTableName: string,
   dcbQueueUrl: string,
+  /** Whether `dcbQueueUrl` is a FIFO queue. Absent in a config written before
+      the flavor travelled with the URL, where `false` — a standard queue — is
+      what these command topics actually are. */
+  commandQueueIsFifo: option<bool>,
   sourceUrn: string,
   context: option<Reventless.AutomationSlice.context>,
 }
@@ -53,6 +57,7 @@ let decodeEntry = (json: JSON.t): option<handlerEntry> =>
     callbackType: h->strOf("callbackType")->Option.getOr("automation"),
     queryDbTableName: h->strOf("queryDbTableName")->Option.getOr(""),
     dcbQueueUrl: h->strOf("dcbQueueUrl")->Option.getOr(""),
+    commandQueueIsFifo: h->Dict.get("commandQueueIsFifo")->Option.flatMap(JSON.Decode.bool),
     sourceUrn: h->strOf("sourceUrn")->Option.getOr(""),
     context: h->Dict.get("context")->Option.flatMap(decodeContext),
   })
@@ -88,9 +93,13 @@ let defaultContext = (sliceName: string): Reventless.AutomationSlice.context =>
 
 // ── Shared plumbing ─────────────────────────────────────────────────────────
 
-let makePublishJsons = (queueUrl: string): ReventlessCore.CommandTopic.publishJsons => {
+// The flavor comes from the handler config rather than being assumed. It used to
+// be hardcoded FIFO while the command topics are standard queues, and SQS rejects
+// the MessageGroupId a FIFO publisher attaches — a failure nothing had reached,
+// because the role had no sqs:SendMessage to get that far.
+let makePublishJsons = (queueUrl: string, ~isFifo: bool): ReventlessCore.CommandTopic.publishJsons => {
   let queue: Util_SQS_Runtime.resolvedQueue = {id: queueUrl, name: queueUrl, arn: ""}
-  queue->CommandTopicChannel_SQS_Runtime.publishJsons(AWS.SQS_FIFO)
+  queue->CommandTopicChannel_SQS_Runtime.publishJsons(isFifo ? AWS.SQS_FIFO : AWS.SQS)
 }
 
 // Overwrite-sync the in-memory TODO list into the slice's view table. Rows are
@@ -223,7 +232,7 @@ let makeAutomationRegisteredHandler = (
     makeAutomationJsonEventsHandler(
       ~context=entry.context->Option.getOr(defaultContext(sliceName)),
       ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl),
+      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
       ~syncTodoItems=makeSyncTodoItems(
         ~queryDbTableName=entry.queryDbTableName,
         ~todoItems=callback.todoItems,
@@ -244,7 +253,7 @@ let makeOutboundRegisteredHandler = (
     makeOutboundJsonEventsHandler(
       ~consumedEventSchema,
       ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl),
+      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
       ~syncTodoItems=makeSyncTodoItems(
         ~queryDbTableName=entry.queryDbTableName,
         ~todoItems=callback.todoItems,

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -36,6 +36,7 @@ function decodeEntry(json) {
     callbackType: Stdlib_Option.getOr(strOf(h, "callbackType"), "automation"),
     queryDbTableName: Stdlib_Option.getOr(strOf(h, "queryDbTableName"), ""),
     dcbQueueUrl: Stdlib_Option.getOr(strOf(h, "dcbQueueUrl"), ""),
+    commandQueueIsFifo: Stdlib_Option.flatMap(h["commandQueueIsFifo"], Stdlib_JSON.Decode.bool),
     sourceUrn: Stdlib_Option.getOr(strOf(h, "sourceUrn"), ""),
     context: Stdlib_Option.flatMap(h["context"], decodeContext)
   }));
@@ -64,13 +65,13 @@ function defaultContext(sliceName) {
   };
 }
 
-function makePublishJsons(queueUrl) {
+function makePublishJsons(queueUrl, isFifo) {
   let queue = {
     id: queueUrl,
     name: queueUrl,
     arn: ""
   };
-  return CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, "SQS_FIFO");
+  return CommandTopicChannel_SQS_Runtime$ReventlessAws.publishJsons(queue, isFifo ? "SQS_FIFO" : "SQS");
 }
 
 function makeSyncTodoItems(queryDbTableName, todoItems, rowSchema) {
@@ -121,14 +122,14 @@ function makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJso
 
 function makeAutomationRegisteredHandler(entry, sliceName, callback) {
   return {
-    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeAutomationJsonEventsHandler(Stdlib_Option.getOr(entry.context, defaultContext(sliceName)), callback, makePublishJsons(entry.dcbQueueUrl), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, AutomationSlice_Callback$ReventlessCore.todoRowSchema))),
+    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeAutomationJsonEventsHandler(Stdlib_Option.getOr(entry.context, defaultContext(sliceName)), callback, makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false)), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, AutomationSlice_Callback$ReventlessCore.todoRowSchema))),
     comp: `AutomationSlice(` + sliceName + `)`
   };
 }
 
 function makeOutboundRegisteredHandler(entry, sliceName, consumedEventSchema, callback) {
   return {
-    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeOutboundJsonEventsHandler(consumedEventSchema, callback, makePublishJsons(entry.dcbQueueUrl), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema))),
+    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeOutboundJsonEventsHandler(consumedEventSchema, callback, makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false)), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema))),
     comp: `OutboundTranslationSlice(` + sliceName + `)`
   };
 }

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -38,12 +38,44 @@ type sliceInfo = {
   // slice that declares no sources (the default) and for any that names the log
   // explicitly, which is why it is not derivable from `sourceTopics` being empty.
   consumesDcbLog: bool,
+  // Which component's CommandTopic this slice publishes its inbound command to.
+  // `None` keeps the plugin's DCB queue — right for a slice targeting a DCB
+  // StateChangeSlice, and what the shared Lambda used unconditionally before an
+  // outbound slice could target an Aggregate, whose commands a different Lambda
+  // consumes.
+  //
+  // Resolved in the finalizer rather than here: an Aggregate's CommandTopic is
+  // created *after* the slices that target it, so a lookup at registration time
+  // finds nothing. Only the name is knowable this early.
+  commandTargetName: option<string>,
 }
 
 let bundledInfos: dict<sliceInfo> = Dict.make()
 
 let dcbQueueUrlRef: ref<option<Pulumi.Output.t<string>>> = ref(None)
-let setDcbQueueUrl = url => dcbQueueUrlRef := Some(url)
+// The DCB command topic's own flavor, for the slices that publish to it. Set
+// beside the URL rather than assumed: the runtime publisher used to hardcode
+// FIFO, and these queues are standard, which SQS rejects.
+let dcbQueueIsFifo = ref(false)
+// The DCB command topic queues as deploy-time resources, so the finalizer can
+// put them on the channel spec and `connectLambda`'s `sqs:SendMessage` grant
+// covers the slices that publish to the DCB fallback. Accumulated rather than
+// kept singular: the hook fires once per DCB command topic (sync, and async
+// when async StateChangeSlices exist), and granting on both is correct.
+let dcbQueueResources: array<ReventlessInfra.Adapter.resource> = []
+// First call wins for the URL and flavor. The hook fires once per DCB command
+// topic and a plugin with async StateChangeSlices fires it twice; the sync topic
+// is created first and is the one a slice's command belongs on, so letting the
+// async FIFO topic overwrite would send slice commands to a FIFO queue with no
+// MessageGroupId — which SQS rejects. The resources keep accumulating: the grant
+// is wanted on every DCB command topic.
+let setDcbQueueUrl = (~isFifo=false, ~resource=?, url) => {
+  if dcbQueueUrlRef.contents->Option.isNone {
+    dcbQueueUrlRef := Some(url)
+    dcbQueueIsFifo := isFifo
+  }
+  resource->Option.forEach(r => dcbQueueResources->Array.push(r)->ignore)
+}
 // The admin/plugin DCB command-topic FIFO URL captured by the
 // onDcbCommandTopicCreated hook. Read by the admin EventCollector's reactive
 // ApiFragmentRegistry push (2e) to dispatch RecordApiFragmentPush.
@@ -62,6 +94,7 @@ let registerAutomationSlice = (
   ~context=?,
   ~sourceTopics=Dict.make(),
   ~consumesDcbLog=true,
+  ~commandTargetName=?,
 ) =>
   bundledInfos->Dict.set(
     name,
@@ -74,6 +107,7 @@ let registerAutomationSlice = (
       context,
       sourceTopics,
       consumesDcbLog,
+      commandTargetName,
     },
   )
 
@@ -358,9 +392,25 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
         let handlerOutputs: array<Pulumi.Output.t<string>> = []
         let packageDirs: dict<string> = Dict.make()
         let allQueryDbResources: array<ReventlessInfra.Adapter.resource> = []
+        // Whether any slice publishes to the DCB fallback rather than a target
+        // aggregate's own topic — if so, that queue needs the SendMessage grant
+        // too, once, below the loop.
+        let anyDcbFallback = ref(false)
 
         bundledInfos->Dict.forEachWithKey((info, _name) => {
           info.queryDbResources->Array.forEach(r => allQueryDbResources->Array.push(r)->ignore)
+          // The queue this slice publishes its command to. An Aggregate registers
+          // its CommandTopic while plugin construction is still synchronous —
+          // before DCB construction registers the slices targeting it — so a
+          // named target resolves here; anything else keeps the DCB fallback.
+          let target = info.commandTargetName->Option.flatMap(CommandTopicRegistry.get)
+          switch target {
+          | Some({resource}) =>
+            // The target CommandTopic joins the channel's resources so
+            // `connectLambda`'s existing `sqs:SendMessage` grant covers it.
+            allQueryDbResources->Array.push(resource)->ignore
+          | None => anyDcbFallback := true
+          }
           let pkg = Util_Bundle.extractPackageName(info.specModulePath)
           packageDirs->Dict.set(pkg, Util_Bundle.resolvePackageRoot(pkg))
           // Usually the same package as the spec, but bundle it explicitly —
@@ -380,8 +430,16 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
           | None => ""
           }
 
+          // Per slice, not plugin-wide: an outbound slice targeting an Aggregate
+          // publishes to that aggregate's CommandTopic. Everything else keeps the
+          // DCB topic, which is what the field has always meant — and with it the
+          // DCB queue's own flavor.
+          let (commandQueueUrl, commandQueueIsFifo) = switch target {
+          | Some({queueUrl, isFifo}) => (queueUrl, isFifo)
+          | None => (dcbQueueUrl, dcbQueueIsFifo.contents)
+          }
           let handlerJson =
-            Pulumi.Output.all3((info.queryDbTableName, dcbQueueUrl, sourceUrnsFor(info)))
+            Pulumi.Output.all3((info.queryDbTableName, commandQueueUrl, sourceUrnsFor(info)))
             ->Pulumi.Output.apply(((tableName, queueUrl, urns)) => {
               let urnsJson =
                 urns->Array.map(JSON.Encode.string)->JSON.Encode.array->JSON.stringify
@@ -389,11 +447,20 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
               // an entry point that predates multi-source still routes its first
               // stream rather than none.
               let firstUrn = urns->Array.get(0)->Option.getOr("")
-              `{"specModule":${specModule},"bodyModule":${bodyModule},"callbackType":${callbackType},"queryDbTableName":"${tableName}","dcbQueueUrl":"${queueUrl}","sourceUrn":"${firstUrn}","sourceUrns":${urnsJson}${contextFragment}}`
+              let fifoJson = commandQueueIsFifo ? "true" : "false"
+              `{"specModule":${specModule},"bodyModule":${bodyModule},"callbackType":${callbackType},"queryDbTableName":"${tableName}","dcbQueueUrl":"${queueUrl}","commandQueueIsFifo":${fifoJson},"sourceUrn":"${firstUrn}","sourceUrns":${urnsJson}${contextFragment}}`
             })
           let _ = handlerOutputs->Array.push(handlerJson)
         })
 
+        // The fallback publishers' grant. Every slice that resolved no target
+        // publishes to the plugin's DCB command topic, whose queue was captured
+        // by `setDcbQueueUrl` — without this the role has no `sqs:SendMessage`
+        // there and every such publish is rejected.
+        if anyDcbFallback.contents {
+          dcbQueueResources->Array.forEach(r => allQueryDbResources->Array.push(r)->ignore)
+        }
+
         let handlerConfigOutput =
           Pulumi.Output.all(handlerOutputs)
           ->Pulumi.Output.apply(handlers => `{"handlers":[${handlers->Array.join(",")}]}`)

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -8,6 +8,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as CommandTopicRegistry$ReventlessAws from "../CommandTopic/CommandTopicRegistry.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "../../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorChannel_DynamoDbStream$ReventlessAws from "../EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs";
@@ -20,15 +21,28 @@ let dcbQueueUrlRef = {
   contents: undefined
 };
 
-function setDcbQueueUrl(url) {
-  dcbQueueUrlRef.contents = url;
+let dcbQueueIsFifo = {
+  contents: false
+};
+
+let dcbQueueResources = [];
+
+function setDcbQueueUrl(isFifoOpt, resource, url) {
+  let isFifo = isFifoOpt !== undefined ? isFifoOpt : false;
+  if (Stdlib_Option.isNone(dcbQueueUrlRef.contents)) {
+    dcbQueueUrlRef.contents = url;
+    dcbQueueIsFifo.contents = isFifo;
+  }
+  Stdlib_Option.forEach(resource, r => {
+    dcbQueueResources.push(r);
+  });
 }
 
 function getDcbQueueUrl() {
   return dcbQueueUrlRef.contents;
 }
 
-function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt) {
+function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName) {
   let callbackType = callbackTypeOpt !== undefined ? callbackTypeOpt : "automation";
   let queryDbResources = queryDbResourcesOpt !== undefined ? queryDbResourcesOpt : [];
   let sourceTopics = sourceTopicsOpt !== undefined ? sourceTopicsOpt : ({});
@@ -41,7 +55,8 @@ function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackT
     queryDbResources: queryDbResources,
     context: context,
     sourceTopics: sourceTopics,
-    consumesDcbLog: consumesDcbLog
+    consumesDcbLog: consumesDcbLog,
+    commandTargetName: commandTargetName
   };
 }
 
@@ -195,10 +210,19 @@ function finishWithDcbEventLog(dcbEventLog) {
       let handlerOutputs = [];
       let packageDirs = {};
       let allQueryDbResources = [];
+      let anyDcbFallback = {
+        contents: false
+      };
       Stdlib_Dict.forEachWithKey(bundledInfos, (info, _name) => {
         info.queryDbResources.forEach(r => {
           allQueryDbResources.push(r);
         });
+        let target = Stdlib_Option.flatMap(info.commandTargetName, CommandTopicRegistry$ReventlessAws.get);
+        if (target !== undefined) {
+          allQueryDbResources.push(target.resource);
+        } else {
+          anyDcbFallback.contents = true;
+        }
         let pkg = Util_Bundle$ReventlessAws.extractPackageName(info.specModulePath);
         packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, pkg);
         let bodyPkg = Util_Bundle$ReventlessAws.extractPackageName(info.bodyModulePath);
@@ -208,18 +232,32 @@ function finishWithDcbEventLog(dcbEventLog) {
         let callbackType = Stdlib_Option.getOr(JSON.stringify(info.callbackType), `""`);
         let context = info.context;
         let contextFragment = context !== undefined ? Stdlib_Option.getOr(Stdlib_Option.map(JSON.stringify(context), json => `,"context":` + json), "") : "";
+        let match = target !== undefined ? [
+            target.queueUrl,
+            target.isFifo
+          ] : [
+            dcbQueueUrl,
+            dcbQueueIsFifo.contents
+          ];
+        let commandQueueIsFifo = match[1];
         let handlerJson = Pulumi.all([
           info.queryDbTableName,
-          dcbQueueUrl,
+          match[0],
           sourceUrnsFor(info)
         ]).apply(param => {
           let urns = param[2];
           let urnsJson = JSON.stringify(urns.map(prim => prim));
           let firstUrn = Stdlib_Option.getOr(urns[0], "");
-          return `{"specModule":` + specModule + `,"bodyModule":` + bodyModule + `,"callbackType":` + callbackType + `,"queryDbTableName":"` + param[0] + `","dcbQueueUrl":"` + param[1] + `","sourceUrn":"` + firstUrn + `","sourceUrns":` + urnsJson + contextFragment + `}`;
+          let fifoJson = commandQueueIsFifo ? "true" : "false";
+          return `{"specModule":` + specModule + `,"bodyModule":` + bodyModule + `,"callbackType":` + callbackType + `,"queryDbTableName":"` + param[0] + `","dcbQueueUrl":"` + param[1] + `","commandQueueIsFifo":` + fifoJson + `,"sourceUrn":"` + firstUrn + `","sourceUrns":` + urnsJson + contextFragment + `}`;
         });
         handlerOutputs.push(handlerJson);
       });
+      if (anyDcbFallback.contents) {
+        dcbQueueResources.forEach(r => {
+          allQueryDbResources.push(r);
+        });
+      }
       let handlerConfigOutput = Pulumi.all(handlerOutputs).apply(handlers => `{"handlers":[` + handlers.join(",") + `]}`);
       let envVars = {};
       envVars["HANDLER_CONFIG"] = handlerConfigOutput;
@@ -250,6 +288,8 @@ export {
   log,
   bundledInfos,
   dcbQueueUrlRef,
+  dcbQueueIsFifo,
+  dcbQueueResources,
   setDcbQueueUrl,
   getDcbQueueUrl,
   registerAutomationSlice,

package/src/components/AutomationSlice_Builder.res.mjs

@@ -46,7 +46,7 @@ function Make(Api) {
       let queryDbTableName = tableResource.name;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(sourceNames));
       let consumesDcbLog = sourceNames.length === 0 || sourceNames.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog, undefined);
       return as_;
     };
     return {

package/src/components/OutboundTranslationSlice_Builder.res

@@ -65,9 +65,14 @@ module Make = (Api: {
         ~bodyModulePath=Util_Bundle.getModuleSpecifier(Translation.moduleUrl),
         ~callbackType="outbound",
         ~queryDbTableName,
+        // The target queue rides along so `connectLambda`'s existing
+        // `sqs:SendMessage` grant covers it. Without it the role can publish
+        // nowhere, and the command is lost after the geocoder has been paid for.
         ~queryDbResources=queryDbOutputs.resources,
         ~sourceTopics,
         ~consumesDcbLog,
+        // Only the name: the target Aggregate's CommandTopic does not exist yet.
+        ~commandTargetName=?Spec.targetName,
       )
 
       ots

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -54,7 +54,7 @@ function Make(Api) {
       let declaredSources = Spec.sourceNames;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(declaredSources));
       let consumesDcbLog = declaredSources.length === 0 || declaredSources.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog, Spec.targetName);
       return ots;
     };
     return {