@reventlessdev/reventless-aws 3.0.0-alpha.264 → 3.0.0-alpha.265

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.265 (2026-08-04)
+
+### Bug Fixes
+
+* **aws:** make a slice's TODO backlog survive, and actually sweep it ([f35dcbd](https://github.com/ReventlessDev/reventless-core/commit/f35dcbd86374124106c2d1e48d29c6f41fdbec2c))
+### Features
+
+* **outbound:** hand translate its geocoder instead of making it fetch one ([fb18312](https://github.com/ReventlessDev/reventless-core/commit/fb1831216b37c9562868c46e1a09054e69418c67))
+
+
 # 3.0.0-alpha.264 (2026-08-03)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.264",
+  "version": "3.0.0-alpha.265",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -18,10 +18,10 @@
     "@reventlessdev/rescript-node": "2.0.0-alpha.1",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.209",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.124",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.99",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.73",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.210",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.125",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.74",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.100",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {

package/src/Platform.res

@@ -96,6 +96,12 @@ let getObjectStoreEndpoints = () => objectStoreEndpointsRef.contents
     the same sentinel, as `PluginRuntime_Builder.inboundSliceReg.auditTableName`. */
 let geocoderEndpointRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** The geocoding place index, for the monolithic case — the SDK-side half of the
+    same capability, carried for exactly the reasons above and with the same `""`
+    sentinel. Slice Lambdas call Amazon Location directly with this; only the
+    browser needs the Function URL. */
+let geocoderPlaceIndexRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -2083,6 +2089,19 @@ module MakeWithConfig = (
       Pulumi.Pulumi.export("geocoderEndpoint", geocoderEndpointFlat)
       geocoderEndpointRef := geocoderEndpointFlat
 
+      // The place index itself, exported beside the Function URL because the two
+      // callers need different things from the same capability. A browser cannot
+      // sign an SDK call and gets the URL; a slice's Lambda can, and gets the
+      // index name — no proxy hop, and no dependence on a public unauthenticated
+      // endpoint for an unattended path. `""` when unset, for the same
+      // one-shape-to-handle reason as the endpoint above.
+      let geocoderPlaceIndexFlat = switch cfg.geocoderPlaceIndex {
+      | Some(index) => index.indexName->Pulumi.Output.fromInput
+      | None => Pulumi.Output.make("")
+      }
+      Pulumi.Pulumi.export("geocoderPlaceIndex", geocoderPlaceIndexFlat)
+      geocoderPlaceIndexRef := geocoderPlaceIndexFlat
+
       // Presign endpoints are no longer written to config.json: under route B the
       // client calls the platform API's `Upload_Presign` mutation (reachable from
       // `platformApiEndpoint`, already present) with the store it declares, so there
@@ -2251,15 +2270,22 @@ module MakeWithConfig = (
     // is a modelled outcome, which is the point of the empty string: a plugin
     // deployed against a platform without the capability degrades rather than
     // failing to deploy.
-    let geocoderEndpoint: Pulumi.Output.t<string> = switch platformStackRef {
+    // The place index, not the Function URL. A slice's Lambda reaches Amazon
+    // Location through the SDK now, so what it needs is the index's name — and
+    // the grant that goes with it, which is why this is also handed to
+    // `registerGeocoderPlaceIndex` rather than only to the environment. The
+    // browser keeps using the Function URL until the platform API carries a
+    // geocode field; the two doors are independent.
+    let geocoderPlaceIndex: Pulumi.Output.t<string> = switch platformStackRef {
     | Some(stackRef) =>
       (
-        stackRef->Pulumi.StackReference.getOutput("geocoderEndpoint"):
+        stackRef->Pulumi.StackReference.getOutput("geocoderPlaceIndex"):
           Pulumi.Output.t<option<string>>
       )->Pulumi.Output.apply(o => o->Option.getOr(""))
-    | None => geocoderEndpointRef.contents
+    | None => geocoderPlaceIndexRef.contents
     }
-    PluginRuntime_Builder.registerCapabilityEnv("GEOCODER_ENDPOINT", geocoderEndpoint)
+    PluginRuntime_Builder.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex)
+    PluginRuntime_Builder.registerGeocoderPlaceIndex(geocoderPlaceIndex)
 
     module P = unpack(plugin)
     let pluginComponent = P.make()

package/src/Platform.res.mjs

@@ -134,6 +134,10 @@ let geocoderEndpointRef = {
   contents: Pulumi.output("")
 };
 
+let geocoderPlaceIndexRef = {
+  contents: Pulumi.output("")
+};
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -1131,6 +1135,10 @@ function MakeWithConfig(Config) {
       let geocoderEndpointFlat = geocoderEndpointOutput.apply(o => Stdlib_Option.getOr(o, ""));
       Pulumi$Pulumi.$$export("geocoderEndpoint", geocoderEndpointFlat);
       geocoderEndpointRef.contents = geocoderEndpointFlat;
+      let index$1 = hostUiBundle.geocoderPlaceIndex;
+      let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
+      Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
+      geocoderPlaceIndexRef.contents = geocoderPlaceIndexFlat;
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -1247,8 +1255,9 @@ function MakeWithConfig(Config) {
         bytes: bytes.length
       };
     });
-    let geocoderEndpoint = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderEndpoint").apply(o => Stdlib_Option.getOr(o, "")) : geocoderEndpointRef.contents;
-    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("GEOCODER_ENDPOINT", geocoderEndpoint);
+    let geocoderPlaceIndex = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderPlaceIndex").apply(o => Stdlib_Option.getOr(o, "")) : geocoderPlaceIndexRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex);
+    PluginRuntime_Builder$ReventlessAws.registerGeocoderPlaceIndex(geocoderPlaceIndex);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2362,6 +2371,10 @@ function Make($star) {
       let geocoderEndpointFlat = geocoderEndpointOutput.apply(o => Stdlib_Option.getOr(o, ""));
       Pulumi$Pulumi.$$export("geocoderEndpoint", geocoderEndpointFlat);
       geocoderEndpointRef.contents = geocoderEndpointFlat;
+      let index$1 = hostUiBundle.geocoderPlaceIndex;
+      let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
+      Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
+      geocoderPlaceIndexRef.contents = geocoderPlaceIndexFlat;
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -2478,8 +2491,9 @@ function Make($star) {
         bytes: bytes.length
       };
     });
-    let geocoderEndpoint = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderEndpoint").apply(o => Stdlib_Option.getOr(o, "")) : geocoderEndpointRef.contents;
-    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("GEOCODER_ENDPOINT", geocoderEndpoint);
+    let geocoderPlaceIndex = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderPlaceIndex").apply(o => Stdlib_Option.getOr(o, "")) : geocoderPlaceIndexRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex);
+    PluginRuntime_Builder$ReventlessAws.registerGeocoderPlaceIndex(geocoderPlaceIndex);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2632,6 +2646,7 @@ export {
   objectStoreEndpointsRef,
   getObjectStoreEndpoints,
   geocoderEndpointRef,
+  geocoderPlaceIndexRef,
   MakeWithConfig,
   Make,
 }

package/src/adapter/Runtime/AutomationSliceEntryPoint.mjs

@@ -22,6 +22,7 @@ const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifie
 
 async function buildAllHandlers() {
   const handlers = {};
+  const sweeps = [];
   const entries = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
 
   await Promise.all(entries.map(async (entry) => {
@@ -56,11 +57,28 @@ async function buildAllHandlers() {
         ? [entry.sourceUrn]
         : [];
     for (const sourceUrn of sourceUrns) {
-      StreamOps.addToRegistry(handlers, sourceUrn, registered);
+      StreamOps.addToRegistry(handlers, sourceUrn, registered.registered);
     }
+    // Every slice can also be swept without an event — see the scheduled branch
+    // below. Collected regardless of how many streams it listens on, so a
+    // multi-source slice is swept once rather than once per stream.
+    sweeps.push(registered);
   }));
 
-  return handlers;
+  return { handlers, sweeps };
 }
 
-export const handler = StreamOps.makeRoutedHandler("AutomationSliceRuntime", buildAllHandlers());
+const builtPromise = buildAllHandlers();
+const routed = StreamOps.makeRoutedHandler(
+  "AutomationSliceRuntime",
+  builtPromise.then((b) => b.handlers),
+);
+
+// The scheduled sweep arrives as the EventBridge rule's constant Input, which
+// has no `records` — so this branch is the one place that must probe an untyped
+// Lambda payload, which is what this shell exists for. Everything it dispatches
+// to is type-checked in AutomationSliceEntryPoint_Ops.
+export const handler = async (event, context) =>
+  event?.reventlessSweep
+    ? Ops.runSweeps((await builtPromise).sweeps)
+    : routed(event, context);

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -128,6 +128,111 @@ let makeSyncTodoItems = (
   }
 }
 
+// Rehydrate the in-memory TODO list from the slice's view table, once per
+// container.
+//
+// `todoItems` is a module-level dict populated only by phase 1, so before this
+// existed a cold start began with an empty list and every row already persisted
+// was unreachable: `phase2` admits `Failed && retryCount < maxRetries`, but only
+// for rows it can see. A transient failure whose container then recycled was
+// stranded permanently, in a row reading `Failed` that nothing would ever pick
+// up again — while `makeSyncTodoItems` kept faithfully writing it back out.
+//
+// Once per container rather than per invocation: within a container the dict is
+// authoritative and `phase2` already re-attempts every actionable row on each
+// batch, so re-reading would buy nothing and cost a scan each time. The backlog
+// is therefore retried on the first event a new container handles.
+//
+// Memory wins on conflict. A row already in the dict may be mid-flight
+// (`Processing`) or a status this invocation just advanced; the stored copy is
+// by definition no fresher.
+//
+// Only `Pending` and `Failed` are read. `Completed` rows are the bulk of a
+// mature table and are never actionable. Retry-exhausted rows are not excluded —
+// `maxRetries` is Spec-level and not known here — but `phase2` filters them, so
+// they are inert rather than wrong.
+let makeLoadTodoItems = (
+  ~queryDbTableName: string,
+  ~todoItems: dict<'row>,
+  ~rowSchema: S.t<'row>,
+  ~comp: string,
+): (unit => promise<unit>) => {
+  let loaded = ref(false)
+  async () =>
+    if loaded.contents {
+      ()
+    } else {
+      loaded := true
+      let params: AwsSdk.DynamoDb.DocumentClient.ScanCommand.input = {
+        tableName: queryDbTableName,
+        consistentRead: true,
+        filterExpression: "#s = :pending OR #s = :failed",
+        expressionAttributeNames: [("#s", "status")]->Dict.fromArray,
+        expressionAttributeValues: [
+          (":pending", "Pending"->JSON.Encode.string),
+          (":failed", "Failed"->JSON.Encode.string),
+        ]->Dict.fromArray,
+      }
+      let restored = await Util_DynamoDb_Runtime.scanStream(params)
+      ->Stream.runCollect
+      ->Effect.map(items =>
+        items->Array.reduce(0, (count, item) => {
+          let json = item->JSON.stringifyAny->Option.getOr("")->JSON.parseOrThrow
+          let id = json->JSON.Decode.object->Option.flatMap(d => d->Dict.get("id"))->Option.flatMap(JSON.Decode.string)
+          switch id {
+          | Some(id) if todoItems->Dict.get(id)->Option.isNone =>
+            switch json->S.parseJsonOrThrow(rowSchema) {
+            | row =>
+              todoItems->Dict.set(id, row)
+              count + 1
+            | exception _ => count
+            }
+          | _ => count
+          }
+        })
+      )
+      ->Effect.catchAll(err =>
+        ReventlessCore.EffectLogger.logError(
+          ~comp,
+          `restore: couldn't read pending TODO rows from ${queryDbTableName}: ${DynamoDb_Error.message(
+              err,
+            )}`,
+        )->Effect.map(_ => 0)
+      )
+      ->Effect.runPromise
+      if restored > 0 {
+        ReventlessCore.EffectLogger.logInfo(
+          ~comp,
+          `restore: reloaded ${restored->Int.toString} unfinished TODO row(s) from ${queryDbTableName}`,
+        )->Effect.runSync
+      }
+    }
+}
+
+// ── Platform capabilities ───────────────────────────────────────────────────
+
+/**
+What this Lambda hands a slice's `translate`.
+
+Built here rather than reached for inside the plugin, because a plugin depends on
+`reventless-spec` and cannot name Amazon Location — the whole point of the
+injected record. This module is the AWS side of that seam and calls the SDK
+directly: no proxy hop through the browser's Function URL, and no dependence on a
+public unauthenticated endpoint for an unattended path.
+
+Resolved per call rather than captured once, so a Lambda whose configuration is
+updated does not need a cold start to see it. An unset `PLACE_INDEX_NAME` reaches
+`Geocoder_AwsLocation_Backend` as `""`, which answers `Unavailable` — a retryable
+outcome, not a verdict on the address.
+*/
+let capabilities = (): Reventless.Capabilities.t => {
+  geocode: (~text) =>
+    Geocoder_AwsLocation_Backend.search(
+      ~indexName=NodeProcess.env->Dict.get("PLACE_INDEX_NAME")->Option.getOr(""),
+      ~text,
+    ),
+}
+
 // ── Phase-1/phase-2 pipelines ───────────────────────────────────────────────
 // Both run: collect the batch → phase 1 → sync (so consumers observe Pending
 // rows even if phase 2 fails) → phase 2 → sync. Unlike the in-process builders
@@ -161,12 +266,14 @@ let makeAutomationJsonEventsHandler = (
   ~callback: automationCallback,
   ~publishJsons: ReventlessCore.CommandTopic.publishJsons,
   ~syncTodoItems: unit => promise<unit>,
+  ~loadTodoItems: unit => promise<unit>,
 ): ReventlessCore.EventCollector.jsonEventsHandler =>
   stream =>
     stream
     ->Stream.runCollect
     ->Effect.flatMap(jsons =>
       Effect.promise(async () => {
+        await loadTodoItems()
         callback.phase1(jsons, context)
         await syncTodoItems()
         await callback.phase2(publishJsons)
@@ -183,6 +290,7 @@ let makeOutboundJsonEventsHandler = (
   ~callback: outboundCallback<'event>,
   ~publishJsons: ReventlessCore.CommandTopic.publishJsons,
   ~syncTodoItems: unit => promise<unit>,
+  ~loadTodoItems: unit => promise<unit>,
 ): ReventlessCore.EventCollector.jsonEventsHandler => {
   let decoder = Reventless.DcbDecode.makeDecoder(consumedEventSchema)
   stream =>
@@ -211,9 +319,10 @@ let makeOutboundJsonEventsHandler = (
     ->Stream.runCollect
     ->Effect.flatMap(events =>
       Effect.promise(async () => {
+        await loadTodoItems()
         callback.phase1(events)
         await syncTodoItems()
-        await callback.phase2(publishJsons)
+        await callback.phase2(publishJsons, ~capabilities=capabilities())
         await syncTodoItems()
       })
     )
@@ -223,24 +332,62 @@ let makeOutboundJsonEventsHandler = (
 // Comp matches what the slice's own callback logs under, so a filter catches
 // both the framework's lines and the application handler's.
 
+/**
+A built slice, in the two ways the Lambda drives it.
+
+`registered` handles a stream batch. `sweep` runs the TODO backlog with no event
+to trigger it — the scheduled path, and the reason `translatePending` exists on
+the in-process builder. Both close over the *same* publish/sync/load closures, so
+a sweep landing on a container that has already served a batch reuses the load it
+did then, and one landing cold does the reload itself.
+*/
+type builtSlice = {
+  registered: StreamRoutedEntryPoint_Ops.registeredHandler,
+  sweep: unit => promise<unit>,
+  comp: string,
+}
+
 let makeAutomationRegisteredHandler = (
   entry: handlerEntry,
   ~sliceName: string,
   ~callback: automationCallback,
-): StreamRoutedEntryPoint_Ops.registeredHandler => {
-  handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
-    makeAutomationJsonEventsHandler(
-      ~context=entry.context->Option.getOr(defaultContext(sliceName)),
-      ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
-      ~syncTodoItems=makeSyncTodoItems(
-        ~queryDbTableName=entry.queryDbTableName,
-        ~todoItems=callback.todoItems,
-        ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+): builtSlice => {
+  let comp = `AutomationSlice(${sliceName})`
+  let publishJsons = makePublishJsons(
+    entry.dcbQueueUrl,
+    ~isFifo=entry.commandQueueIsFifo->Option.getOr(false),
+  )
+  let syncTodoItems = makeSyncTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+  )
+  let loadTodoItems = makeLoadTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+    ~comp,
+  )
+  {
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
+        makeAutomationJsonEventsHandler(
+          ~context=entry.context->Option.getOr(defaultContext(sliceName)),
+          ~callback,
+          ~publishJsons,
+          ~syncTodoItems,
+          ~loadTodoItems,
+        ),
       ),
-    ),
-  ),
-  comp: `AutomationSlice(${sliceName})`,
+      comp,
+    },
+    sweep: async () => {
+      await loadTodoItems()
+      await callback.phase2(publishJsons)
+      await syncTodoItems()
+    },
+    comp,
+  }
 }
 
 let makeOutboundRegisteredHandler = (
@@ -248,18 +395,63 @@ let makeOutboundRegisteredHandler = (
   ~sliceName: string,
   ~consumedEventSchema: S.t<'event>,
   ~callback: outboundCallback<'event>,
-): StreamRoutedEntryPoint_Ops.registeredHandler => {
-  handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
-    makeOutboundJsonEventsHandler(
-      ~consumedEventSchema,
-      ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
-      ~syncTodoItems=makeSyncTodoItems(
-        ~queryDbTableName=entry.queryDbTableName,
-        ~todoItems=callback.todoItems,
-        ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+): builtSlice => {
+  let comp = `OutboundTranslationSlice(${sliceName})`
+  let publishJsons = makePublishJsons(
+    entry.dcbQueueUrl,
+    ~isFifo=entry.commandQueueIsFifo->Option.getOr(false),
+  )
+  let syncTodoItems = makeSyncTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+  )
+  let loadTodoItems = makeLoadTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+    ~comp,
+  )
+  {
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
+        makeOutboundJsonEventsHandler(
+          ~consumedEventSchema,
+          ~callback,
+          ~publishJsons,
+          ~syncTodoItems,
+          ~loadTodoItems,
+        ),
       ),
-    ),
-  ),
-  comp: `OutboundTranslationSlice(${sliceName})`,
+      comp,
+    },
+    sweep: async () => {
+      await loadTodoItems()
+      await callback.phase2(publishJsons, ~capabilities=capabilities())
+      await syncTodoItems()
+    },
+    comp,
+  }
+}
+
+/**
+Run every slice's TODO backlog, for a scheduled invocation carrying no records.
+
+Sequential rather than concurrent: the slices in one Lambda share its memory and
+its downstream quotas, and a sweep is never latency-critical. A slice that throws
+is logged and does not stop the rest — a sweep that abandoned the remaining
+slices because one geocoder was down would be a worse version of the problem it
+exists to fix.
+*/
+let runSweeps = async (slices: array<builtSlice>) => {
+  for i in 0 to slices->Array.length - 1 {
+    let slice = slices->Array.getUnsafe(i)
+    try {
+      await slice.sweep()
+    } catch {
+    | exn =>
+      let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
+      ReventlessCore.EffectLogger.logError(~comp=slice.comp, `sweep failed: ${msg}`)->Effect.runSync
+    }
+  }
 }

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -4,14 +4,20 @@ import * as S from "sury/src/S.res.mjs";
 import * as Stream from "@reventlessdev/rescript-effect/src/Stream.res.mjs";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stream$1 from "effect/Stream";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/components/DcbDecode.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
+import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
+import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
 import * as AutomationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/AutomationSlice/AutomationSlice_Callback.res.mjs";
 import * as StreamRoutedEntryPoint_Ops$ReventlessAws from "./StreamRoutedEntryPoint_Ops.res.mjs";
+import * as Geocoder_AwsLocation_Backend$ReventlessAws from "../Geocoder/Geocoder_AwsLocation_Backend.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import * as QueryDbStorage_DynamoDb_Runtime$ReventlessAws from "../QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
 import * as OutboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Callback.res.mjs";
@@ -87,8 +93,71 @@ function makeSyncTodoItems(queryDbTableName, todoItems, rowSchema) {
   };
 }
 
-function makeAutomationJsonEventsHandler(context, callback, publishJsons, syncTodoItems) {
+function makeLoadTodoItems(queryDbTableName, todoItems, rowSchema, comp) {
+  let loaded = {
+    contents: false
+  };
+  return async () => {
+    if (loaded.contents) {
+      return;
+    }
+    loaded.contents = true;
+    let params_ConsistentRead = true;
+    let params_ExpressionAttributeNames = Object.fromEntries([[
+        "#s",
+        "status"
+      ]]);
+    let params_ExpressionAttributeValues = Object.fromEntries([
+      [
+        ":pending",
+        "Pending"
+      ],
+      [
+        ":failed",
+        "Failed"
+      ]
+    ]);
+    let params_FilterExpression = "#s = :pending OR #s = :failed";
+    let params = {
+      TableName: queryDbTableName,
+      ConsistentRead: params_ConsistentRead,
+      ExpressionAttributeNames: params_ExpressionAttributeNames,
+      ExpressionAttributeValues: params_ExpressionAttributeValues,
+      FilterExpression: params_FilterExpression
+    };
+    let restored = await Effect.runPromise(Effect.catchAll(Effect.map(Stream.runCollect(Util_DynamoDb_Runtime$ReventlessAws.scanStream(params)), items => Stdlib_Array.reduce(items, 0, (count, item) => {
+      let json = JSON.parse(Stdlib_Option.getOr(JSON.stringify(item), ""));
+      let id = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), d => d["id"]), Stdlib_JSON.Decode.string);
+      if (id === undefined) {
+        return count;
+      }
+      if (!Stdlib_Option.isNone(todoItems[id])) {
+        return count;
+      }
+      let row;
+      try {
+        row = S.parseJsonOrThrow(json, rowSchema);
+      } catch (exn) {
+        return count;
+      }
+      todoItems[id] = row;
+      return count + 1 | 0;
+    })), err => Effect.map(EffectLogger$ReventlessCore.logError(comp, undefined, `restore: couldn't read pending TODO rows from ` + queryDbTableName + `: ` + DynamoDb_Error$ReventlessAws.message(err)), () => 0)));
+    if (restored > 0) {
+      return Effect.runSync(EffectLogger$ReventlessCore.logInfo(comp, undefined, `restore: reloaded ` + restored.toString() + ` unfinished TODO row(s) from ` + queryDbTableName));
+    }
+  };
+}
+
+function capabilities() {
+  return {
+    geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
+  };
+}
+
+function makeAutomationJsonEventsHandler(context, callback, publishJsons, syncTodoItems, loadTodoItems) {
   return stream => Effect.flatMap(Stream.runCollect(stream), jsons => Effect.promise(async () => {
+    await loadTodoItems();
     callback.phase1(jsons, context);
     await syncTodoItems();
     await callback.phase2(publishJsons);
@@ -96,7 +165,7 @@ function makeAutomationJsonEventsHandler(context, callback, publishJsons, syncTo
   }));
 }
 
-function makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJsons, syncTodoItems) {
+function makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJsons, syncTodoItems, loadTodoItems) {
   let decoder = DcbDecode$Reventless.makeDecoder(consumedEventSchema);
   return stream => Effect.flatMap(Stream.runCollect(Stream$1.flatMap(Stream$1.mapEffect(stream, json => Effect.sync(() => {
     let envelope = Stdlib_JSON.Decode.object(json);
@@ -113,27 +182,69 @@ function makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJso
       return [];
     }
   })), events => Stream$1.fromIterable(events))), events => Effect.promise(async () => {
+    await loadTodoItems();
     callback.phase1(events);
     await syncTodoItems();
-    await callback.phase2(publishJsons);
+    await callback.phase2(publishJsons, {
+      geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
+    });
     return await syncTodoItems();
   }));
 }
 
 function makeAutomationRegisteredHandler(entry, sliceName, callback) {
+  let comp = `AutomationSlice(` + sliceName + `)`;
+  let publishJsons = makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false));
+  let syncTodoItems = makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, AutomationSlice_Callback$ReventlessCore.todoRowSchema);
+  let loadTodoItems = makeLoadTodoItems(entry.queryDbTableName, callback.todoItems, AutomationSlice_Callback$ReventlessCore.todoRowSchema, comp);
   return {
-    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeAutomationJsonEventsHandler(Stdlib_Option.getOr(entry.context, defaultContext(sliceName)), callback, makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false)), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, AutomationSlice_Callback$ReventlessCore.todoRowSchema))),
-    comp: `AutomationSlice(` + sliceName + `)`
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeAutomationJsonEventsHandler(Stdlib_Option.getOr(entry.context, defaultContext(sliceName)), callback, publishJsons, syncTodoItems, loadTodoItems)),
+      comp: comp
+    },
+    sweep: async () => {
+      await loadTodoItems();
+      await callback.phase2(publishJsons);
+      return await syncTodoItems();
+    },
+    comp: comp
   };
 }
 
 function makeOutboundRegisteredHandler(entry, sliceName, consumedEventSchema, callback) {
+  let comp = `OutboundTranslationSlice(` + sliceName + `)`;
+  let publishJsons = makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false));
+  let syncTodoItems = makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema);
+  let loadTodoItems = makeLoadTodoItems(entry.queryDbTableName, callback.todoItems, OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema, comp);
   return {
-    handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeOutboundJsonEventsHandler(consumedEventSchema, callback, makePublishJsons(entry.dcbQueueUrl, Stdlib_Option.getOr(entry.commandQueueIsFifo, false)), makeSyncTodoItems(entry.queryDbTableName, callback.todoItems, OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema))),
-    comp: `OutboundTranslationSlice(` + sliceName + `)`
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops$ReventlessAws.toStreamHandler(makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJsons, syncTodoItems, loadTodoItems)),
+      comp: comp
+    },
+    sweep: async () => {
+      await loadTodoItems();
+      await callback.phase2(publishJsons, {
+        geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
+      });
+      return await syncTodoItems();
+    },
+    comp: comp
   };
 }
 
+async function runSweeps(slices) {
+  for (let i = 0, i_finish = slices.length; i < i_finish; ++i) {
+    let slice = slices[i];
+    try {
+      await slice.sweep();
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
+      Effect.runSync(EffectLogger$ReventlessCore.logError(slice.comp, undefined, `sweep failed: ` + msg));
+    }
+  }
+}
+
 export {
   strOf,
   decodeContext,
@@ -143,9 +254,12 @@ export {
   defaultContext,
   makePublishJsons,
   makeSyncTodoItems,
+  makeLoadTodoItems,
+  capabilities,
   makeAutomationJsonEventsHandler,
   makeOutboundJsonEventsHandler,
   makeAutomationRegisteredHandler,
   makeOutboundRegisteredHandler,
+  runSweeps,
 }
 /* S Not a pure module */

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -181,6 +181,121 @@ let forEventCollector: ReventlessCore.Runtime.forEventCollector<
   }
 }
 
+// How often the shared automation Lambda is invoked with no records, to work
+// its slices' TODO backlogs.
+//
+// Without it a backlog only moves when the *next event* arrives, so a slice
+// whose traffic stops holds its failed items indefinitely — and D4's "retried to
+// maxRetries, then swept" is what an outbound slice is chosen for over a
+// hand-rolled Task. Five minutes is short enough that a transient outage clears
+// on its own without anyone watching, and long enough that the invocations are
+// noise against the event traffic (~288/day per deployment, most of them finding
+// an empty backlog and exiting).
+let sweepIntervalMinutes = 5
+
+// The scheduled trigger: a rule, permission for EventBridge to invoke, and a
+// target carrying the constant payload the entry point's shell branches on. The
+// payload is the whole event — a scheduled invocation has no `records`, which is
+// exactly how the shell tells the two apart.
+let makeSweepSchedule = (~runtime: ReventlessCore.Runtime.environment<runtimeParts>, ~opts) => {
+  let name = "AllAutomationSlicesSweep"
+  let customOpts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let rule = {
+    open PulumiAws.Cloudwatch
+    EventRule.make(
+      ~name=Pulumi.Pulumi.getStackName() ++ ("-" ++ name),
+      ~args={
+        description: "Work the automation/outbound slices' TODO backlogs"->Pulumi.Input.make,
+        scheduleExpression: EventRule.ScheduleExpression.every(sweepIntervalMinutes->Minutes),
+        tags: AWS.Tags.make(
+          ~name=Pulumi.Pulumi.getStackName() ++ ("-" ++ name),
+          ~kind=ReventlessCore.ComponentType.AutomationSlice,
+          ~role=Scheduler,
+          ~component=name,
+        ),
+      },
+      ~opts=customOpts,
+    )
+  }
+
+  // The permission and target need the Lambda's resolved arn/name, so they stay
+  // inside an apply — the same shape the plugin heartbeat's runner uses.
+  let _permissionAndTarget =
+    (
+      runtime.parts.lambda->Pulumi.Output.flatMap(l => l.arn),
+      runtime.parts.lambda->Pulumi.Output.flatMap(l => l.name),
+    )
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
+      let _permission = PulumiAws.Lambda.Permission.make(
+        ~name,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: lambdaName->Pulumi.Input.make,
+          principal: AWS.CloudwatchEventRule.principal,
+        },
+        ~opts=customOpts,
+      )
+      let _target = {
+        open PulumiAws.Cloudwatch
+        EventTarget.make(
+          ~name,
+          ~args={
+            rule: EventTarget.Rule.ofEventRule(rule),
+            arn: lambdaArn->Pulumi.Input.make,
+            input: `{"reventlessSweep":true}`->Pulumi.Input.make,
+          },
+          ~opts=customOpts,
+        )
+      }
+    })
+}
+
+// Least-privilege `geo:SearchPlaceIndexForText` on the platform's place index,
+// for the slices that call the geocoder through the injected capability.
+//
+// Only attached when the platform actually provisioned an index — that bit is a
+// plain bool and therefore known synchronously, while the index *name* is an
+// Output. Without the split this would either grant on a nonsense ARN or need
+// `option<Pulumi.Output.t<_>>`, which corrupts the Output proxy.
+//
+// The RolePolicy is created at top level with an Output-valued document, not
+// inside an `apply`. A resource created in an apply callback does not reliably
+// register with the engine — the same defect that intermittently left the
+// heartbeat Lambda without its SQS grant.
+let makeGeocoderGrant = (~runtime: ReventlessCore.Runtime.environment<runtimeParts>, ~opts) =>
+  if PluginRuntime_Builder.geocoderProvisioned() {
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let policyJson =
+      PluginRuntime_Builder.geocoderPlaceIndex()->Pulumi.Output.apply(idx => {
+        open PulumiAws.PolicyDocument
+        PulumiAws.PolicyDocument.make(
+          ~id="AllAutomationSlicesGeocode",
+          ~statements=[
+            {
+              sid: "AllowGeocode",
+              effect: Allow,
+              actions: Action("geo:SearchPlaceIndexForText"),
+              // Account/region wildcarded, matching the Function URL handler's
+              // own policy: the index name is what identifies it, and the stack
+              // has no other account to reach.
+              resources: Resource(`arn:aws:geo:*:*:place-index/${idx}`),
+            },
+          ],
+        )->PulumiAws.PolicyDocument.toJsonString
+      })
+    let _ = PulumiAws.IAM.RolePolicy.make(
+      ~name="AllAutomationSlicesGeocode",
+      ~args={
+        policy: policyJson->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
 let finished = ref(false)
 
 // Legacy finalizer, kept only to satisfy `EventCollectorRuntime_Builder.T`.
@@ -501,6 +616,9 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
           ~runtime,
           ~opts,
         )
+
+        makeSweepSchedule(~runtime, ~opts)
+        makeGeocoderGrant(~runtime, ~opts)
       | None =>
         log.warn(
           ~comp="AutomationSliceRuntime_Builder_Single",

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -1,13 +1,22 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Cloudwatch_EventRule$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventRule.res.mjs";
+import * as Cloudwatch_EventTarget$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Cloudwatch/Cloudwatch_EventTarget.res.mjs";
 import * as CommandTopicRegistry$ReventlessAws from "../CommandTopic/CommandTopicRegistry.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "../../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
@@ -96,6 +105,51 @@ function forEventCollector(param, eventTopics, resources, memorySizeOpt, timeout
   log.info("AutomationSliceRuntime_Builder_Single", undefined, `registered ` + eventCollectorName + ` for ` + parentName);
 }
 
+function makeSweepSchedule(runtime, opts) {
+  let name = "AllAutomationSlicesSweep";
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let rule = new (Aws.cloudwatch.EventRule)(Pulumi.getStack() + ("-" + name), {
+    description: "Work the automation/outbound slices' TODO backlogs",
+    scheduleExpression: Primitive_option.some(Cloudwatch_EventRule$PulumiAws.ScheduleExpression.every({
+      TAG: "Minutes",
+      _0: 5
+    })),
+    tags: AWS_Tags$ReventlessAws.make(Pulumi.getStack() + ("-" + name), "AutomationSlice", "Scheduler", undefined, name, undefined, undefined, undefined)
+  }, customOpts);
+  Pulumi.all([
+    Output$Pulumi.flatMap(runtime.parts.lambda, l => l.arn),
+    Output$Pulumi.flatMap(runtime.parts.lambda, l => l.name)
+  ]).apply(param => {
+    new (Aws.lambda.Permission)(name, {
+      action: "lambda:InvokeFunction",
+      function: param[1],
+      principal: AWS$ReventlessAws.CloudwatchEventRule.principal
+    }, customOpts);
+    new (Aws.cloudwatch.EventTarget)(name, {
+      rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(rule),
+      arn: param[0],
+      input: `{"reventlessSweep":true}`
+    }, customOpts);
+  });
+}
+
+function makeGeocoderGrant(runtime, opts) {
+  if (!PluginRuntime_Builder$ReventlessAws.geocoderProvisioned()) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let policyJson = PluginRuntime_Builder$ReventlessAws.geocoderPlaceIndex().apply(idx => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAutomationSlicesGeocode", [{
+      Sid: "AllowGeocode",
+      Effect: "Allow",
+      Action: "geo:SearchPlaceIndexForText",
+      Resource: `arn:aws:geo:*:*:place-index/` + idx
+    }])));
+  new (Aws.iam.RolePolicy)("AllAutomationSlicesGeocode", {
+    policy: policyJson,
+    role: runtime.parts.lambdaRole.id
+  }, customOpts);
+}
+
 let finished = {
   contents: false
 };
@@ -271,6 +325,8 @@ function finishWithDcbEventLog(dcbEventLog) {
           eventTopics: eventTopics,
           resources: allQueryDbResources
         }], runtime, opts);
+      makeSweepSchedule(runtime, opts);
+      makeGeocoderGrant(runtime, opts);
     } else {
       log.warn("AutomationSliceRuntime_Builder_Single", undefined, "finishWithDcbEventLog: DCB EventLog has no parent");
     }
@@ -282,6 +338,8 @@ let EventCollectorChannel;
 
 let RuntimeEnvironment;
 
+let sweepIntervalMinutes = 5;
+
 export {
   EventCollectorChannel,
   RuntimeEnvironment,
@@ -296,6 +354,9 @@ export {
   storedSpecs,
   grandParent,
   forEventCollector,
+  sweepIntervalMinutes,
+  makeSweepSchedule,
+  makeGeocoderGrant,
   finished,
   finish,
   finishWithDcbEventLog,

package/src/components/OutboundTranslationSlice_Builder.res

@@ -14,6 +14,20 @@ module EventCollectorRuntimeBuilder = {
   let finish = Inner.finish
 }
 
+// On AWS the core builder's in-process handler is never the thing that runs a
+// translation: `forEventCollector` registers module paths, and the shared
+// `AllAutomationSlices` Lambda rebuilds the callback from them and drives phase 2
+// itself. So the capabilities that matter are the ones
+// `AutomationSliceEntryPoint_Ops.capabilities` builds at runtime, from the
+// Lambda's environment — where the place index name actually is.
+//
+// This deploy-time value therefore has no caller. `none` rather than a real
+// geocoder because inventing one here would suggest a path that does not exist,
+// and because a deploy-time module has no environment to read anyway.
+module DeployTimeCapabilities = {
+  let capabilities = () => Reventless.Capabilities.none
+}
+
 module Make = (Api: {
   let api: unit => Types.AppSync.api
   let apiRole: unit => Types.AppSync.role
@@ -25,6 +39,7 @@ module Make = (Api: {
     EventCollectorChannel,
     EventCollectorRuntimeBuilder,
     Api,
+    DeployTimeCapabilities,
   )
 
   module Make = (

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
+import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as EventTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventTopic/EventTopic.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../util/Util_Bundle.res.mjs";
@@ -18,6 +19,14 @@ let EventCollectorRuntimeBuilder = {
   finish: AutomationSliceRuntime_Builder_Single$ReventlessAws.finish
 };
 
+function capabilities() {
+  return Capabilities$Reventless.none;
+}
+
+let DeployTimeCapabilities = {
+  capabilities: capabilities
+};
+
 function Make(Api) {
   let Inner = OutboundTranslationSlice_Builder$ReventlessCore.Make({
     make: RuntimeEnvironment_Lambda$ReventlessAws.make,
@@ -42,7 +51,7 @@ function Make(Api) {
     },
     forEventCollector: AutomationSliceRuntime_Builder_Single$ReventlessAws.forEventCollector,
     finish: AutomationSliceRuntime_Builder_Single$ReventlessAws.finish
-  })(Api);
+  })(Api)(DeployTimeCapabilities);
   let Make$1 = Spec => (Translation => {
     let InnerMake = Inner.Make(Spec)(Translation);
     let make = (dcbEventLog, allEventTopicsOpt, publishJsons, runtime, opts) => {
@@ -80,6 +89,7 @@ export {
   EventCollectorChannel,
   RuntimeEnvironment,
   EventCollectorRuntimeBuilder,
+  DeployTimeCapabilities,
   Make,
 }
 /* Component-ReventlessCore Not a pure module */

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -51,6 +51,32 @@ let registerCapabilityEnv = (name: string, value: Pulumi.Output.t<string>) =>
     capability, so this returns `[]` rather than throwing. */
 let capabilityEnv = () => capabilityEnvRef->Dict.toArray
 
+/**
+The geocoding place index, when the platform provisioned one.
+
+Separate from `capabilityEnv` because an env dict cannot express a *grant*: a
+slice Lambda calling Amazon Location needs `geo:SearchPlaceIndexForText` on this
+index, and its role is created later, in the slice runtime's finalizer. So the
+name travels twice — once as a variable the runtime reads, once as the resource
+its role must be allowed to touch.
+
+A plain Output with `""` for "not provisioned", plus a separate bool for "was it
+registered at all", rather than `ref<option<Pulumi.Output.t<_>>>`: that shape
+compiles to `Option.getOr`, whose nested-option probe corrupts the Output proxy.
+The bool is an ordinary value and is known synchronously, which is what the
+finalizer needs in order to decide whether to attach a policy at all.
+*/
+let geocoderPlaceIndexRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+let geocoderProvisionedRef = ref(false)
+
+let registerGeocoderPlaceIndex = (indexName: Pulumi.Output.t<string>) => {
+  geocoderPlaceIndexRef := indexName
+  geocoderProvisionedRef := true
+}
+
+let geocoderPlaceIndex = () => geocoderPlaceIndexRef.contents
+let geocoderProvisioned = () => geocoderProvisionedRef.contents
+
 type sliceModulePaths = {
   specPath: string,
   behaviorPath: string,

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -44,6 +44,27 @@ function capabilityEnv() {
   return Object.entries(capabilityEnvRef);
 }
 
+let geocoderPlaceIndexRef = {
+  contents: Pulumi.output("")
+};
+
+let geocoderProvisionedRef = {
+  contents: false
+};
+
+function registerGeocoderPlaceIndex(indexName) {
+  geocoderPlaceIndexRef.contents = indexName;
+  geocoderProvisionedRef.contents = true;
+}
+
+function geocoderPlaceIndex() {
+  return geocoderPlaceIndexRef.contents;
+}
+
+function geocoderProvisioned() {
+  return geocoderProvisionedRef.contents;
+}
+
 let dcbConfigRef = {
   contents: {
     pluginName: "",
@@ -506,6 +527,11 @@ export {
   capabilityEnvRef,
   registerCapabilityEnv,
   capabilityEnv,
+  geocoderPlaceIndexRef,
+  geocoderProvisionedRef,
+  registerGeocoderPlaceIndex,
+  geocoderPlaceIndex,
+  geocoderProvisioned,
   dcbConfigRef,
   registeredSliceModulePaths,
   registerStateChangeSliceSpec,

package/tests/AutomationSliceEntryPoint_OpsTest.res

@@ -112,6 +112,7 @@ describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandler", () =>
       ~callback,
       ~publishJsons=noopPublish,
       ~syncTodoItems=async () => steps->Array.push("sync"),
+      ~loadTodoItems=async () => steps->Array.push("restore"),
     )
     let envelope = obj([("meta", obj([("service", str("Order"))])), ("event", str("Placed"))])
     await Stream.fromIterable([envelope, str("bare")])->handler->Effect.runPromise
@@ -120,7 +121,43 @@ describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandler", () =>
     expect(receivedCtx.contents->Option.map(c => c.Reventless.AutomationSlice.sliceName))->toEqual(
       Some("S"),
     )
-    expect(steps)->toEqual(["phase1", "sync", "phase2", "sync"])
+    // `restore` first: rehydrating the TODO list after phase 1 would let a stored
+    // row overwrite one this batch just collected, and after phase 2 would leave
+    // the reloaded backlog unprocessed until another invocation.
+    expect(steps)->toEqual(["restore", "phase1", "sync", "phase2", "sync"])
+  })
+})
+
+describe("AutomationSliceEntryPoint_Ops.runSweeps", () => {
+  let dummyRegistered: StreamRoutedEntryPoint_Ops.registeredHandler = {
+    handler: (_event, _context) => Effect.succeed(),
+  }
+  let sliceThat = (~comp, ~run): AutomationSliceEntryPoint_Ops.builtSlice => {
+    registered: dummyRegistered,
+    sweep: run,
+    comp,
+  }
+
+  test("sweeps every slice", async () => {
+    let swept = []
+    await AutomationSliceEntryPoint_Ops.runSweeps([
+      sliceThat(~comp="A", ~run=async () => swept->Array.push("a")),
+      sliceThat(~comp="B", ~run=async () => swept->Array.push("b")),
+    ])
+    expect(swept)->toEqual(["a", "b"])
+  })
+
+  // A sweep exists to recover from a failing external call, so one slice whose
+  // geocoder is still down must not cost every other slice on the Lambda its
+  // turn — that would be a worse version of the problem being fixed.
+  test("a throwing slice does not stop the others", async () => {
+    let swept = []
+    await AutomationSliceEntryPoint_Ops.runSweeps([
+      sliceThat(~comp="A", ~run=async () => swept->Array.push("a")),
+      sliceThat(~comp="Boom", ~run=async () => JsError.throwWithMessage("gateway down")),
+      sliceThat(~comp="C", ~run=async () => swept->Array.push("c")),
+    ])
+    expect(swept)->toEqual(["a", "c"])
   })
 })
 
@@ -142,13 +179,14 @@ describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler", () => {
         received := events
         steps->Array.push("phase1")
       },
-      phase2: async _publish => steps->Array.push("phase2"),
+      phase2: async (_publish, ~capabilities as _) => steps->Array.push("phase2"),
     }
     let handler = AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler(
       ~consumedEventSchema=outboundEventSchema,
       ~callback,
       ~publishJsons=noopPublish,
       ~syncTodoItems=async () => steps->Array.push("sync"),
+      ~loadTodoItems=async () => steps->Array.push("restore"),
     )
     // `id` is the envelope's subject — the entity the event was published for.
     // An Aggregate's event payload does not repeat it, so this is the only place
@@ -170,6 +208,9 @@ describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler", () => {
       ("ord-1", OrderPlaced({orderId: "ord-1"})),
       ("", OrderArchived),
     ])
-    expect(steps)->toEqual(["phase1", "sync", "phase2", "sync"])
+    // `restore` first: rehydrating the TODO list after phase 1 would let a stored
+    // row overwrite one this batch just collected, and after phase 2 would leave
+    // the reloaded backlog unprocessed until another invocation.
+    expect(steps)->toEqual(["restore", "phase1", "sync", "phase2", "sync"])
   })
 })

package/tests/AutomationSliceEntryPoint_OpsTest.res.mjs

@@ -153,6 +153,8 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandl
       sliceName: "S"
     }, callback, noopPublish, async () => {
       steps.push("sync");
+    }, async () => {
+      steps.push("restore");
     });
     let envelope = Object.fromEntries([
       [
@@ -177,6 +179,7 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandl
     ]);
     globalThis.expect(Stdlib_Option.map(receivedCtx.contents, c => c.sliceName)).toEqual("S");
     globalThis.expect(steps).toEqual([
+      "restore",
       "phase1",
       "sync",
       "phase2",
@@ -185,6 +188,64 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeAutomationJsonEventsHandl
   });
 });
 
+globalThis.describe("AutomationSliceEntryPoint_Ops.runSweeps", () => {
+  let dummyRegistered_handler = (_event, _context) => Effect.succeed();
+  let dummyRegistered = {
+    handler: dummyRegistered_handler
+  };
+  globalThis.test("sweeps every slice", async () => {
+    let swept = [];
+    await AutomationSliceEntryPoint_Ops$ReventlessAws.runSweeps([
+      {
+        registered: dummyRegistered,
+        sweep: async () => {
+          swept.push("a");
+        },
+        comp: "A"
+      },
+      {
+        registered: dummyRegistered,
+        sweep: async () => {
+          swept.push("b");
+        },
+        comp: "B"
+      }
+    ]);
+    globalThis.expect(swept).toEqual([
+      "a",
+      "b"
+    ]);
+  });
+  globalThis.test("a throwing slice does not stop the others", async () => {
+    let swept = [];
+    await AutomationSliceEntryPoint_Ops$ReventlessAws.runSweeps([
+      {
+        registered: dummyRegistered,
+        sweep: async () => {
+          swept.push("a");
+        },
+        comp: "A"
+      },
+      {
+        registered: dummyRegistered,
+        sweep: async () => Stdlib_JsError.throwWithMessage("gateway down"),
+        comp: "Boom"
+      },
+      {
+        registered: dummyRegistered,
+        sweep: async () => {
+          swept.push("c");
+        },
+        comp: "C"
+      }
+    ]);
+    globalThis.expect(swept).toEqual([
+      "a",
+      "c"
+    ]);
+  });
+});
+
 let outboundEventSchema = S.union([
   S.schema(s => ({
     TAG: "OrderPlaced",
@@ -204,7 +265,7 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler
       received.contents = events;
       steps.push("phase1");
     };
-    let callback_phase2 = async _publish => {
+    let callback_phase2 = async (_publish, param) => {
       steps.push("phase2");
     };
     let callback = {
@@ -214,6 +275,8 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler
     };
     let handler = AutomationSliceEntryPoint_Ops$ReventlessAws.makeOutboundJsonEventsHandler(outboundEventSchema, callback, noopPublish, async () => {
       steps.push("sync");
+    }, async () => {
+      steps.push("restore");
     });
     let placed = Object.fromEntries([
       [
@@ -273,6 +336,7 @@ globalThis.describe("AutomationSliceEntryPoint_Ops.makeOutboundJsonEventsHandler
       ]
     ]);
     globalThis.expect(steps).toEqual([
+      "restore",
       "phase1",
       "sync",
       "phase2",