@reventlessdev/reventless-aws 3.0.0-alpha.264 → 3.0.0-alpha.266

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver.res.mjs

@@ -0,0 +1,127 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
+
+let invokeCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: { arguments: ctx.args } };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function make(api, placeIndexName, nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "GeocodeService";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  placeIndexName.apply(idx => {
+    let arn = `arn:aws:geo:*:*:place-index/` + idx;
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowGeocode",
+          Effect: "Allow",
+          Action: "geo:SearchPlaceIndexForText",
+          Resource: arn
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver_Ops.res.mjs", packageDirs, undefined);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: match.code,
+    role: lambdaRole.arn,
+    memorySize: 256,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "PLACE_INDEX_NAME",
+          placeIndexName
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
+      ])
+    },
+    sourceCodeHash: match.sourceCodeHash
+  }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Geocode", api, dataSource.name, "Query", "geocode", invokeCode, opts$1);
+  return {
+    resources: [lambda.arn]
+  };
+}
+
+export {
+  invokeCode,
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver_Ops.res

@@ -0,0 +1,55 @@
+// Runtime handler for the geocoder's client door — compiled, type-checked, and
+// Pulumi-free so it can be shipped as an EntryPoint module
+// (`Geocoder_AwsLocation_Resolver` bundles it and attaches it as the platform API's
+// `Query.geocode` Lambda data source). Keeping it out of the deploy-time module
+// avoids both the serialized-closure SDK skew and a deploy-time Pulumi import
+// leaking into the Lambda's cold-start graph.
+//
+// Invoked by an AppSync resolver, not a Function URL: the platform API's Cognito
+// authorizer has already authenticated the caller, so there is no token to decode
+// and no anonymous surface. The SDK call, the `[lng, lat]` order and the relevance
+// handling all live in `Geocoder_AwsLocation_Backend`, shared with the unattended
+// slice path so one module owns the AWS Location call.
+//
+// Returns the ranked candidates as `[{label, lat, lng, relevance?}]`. A no-match is
+// an empty array — a browser search box degrades to "no results". A service failure
+// throws, which the resolver's response mapper turns into a GraphQL error rather
+// than an empty answer: the client half of D2's status contract, so a browser can
+// tell "no such address" from "the geocoder is down" the way the Function URL's
+// `200`/`502` split did.
+
+let candidateJson = (c: Reventless.Geocoding.candidate): JSON.t =>
+  Dict.fromArray(
+    Array.concat(
+      [
+        ("label", JSON.Encode.string(c.label)),
+        ("lat", JSON.Encode.float(c.point.lat)),
+        ("lng", JSON.Encode.float(c.point.lng)),
+      ],
+      switch c.relevance {
+      | Some(rel) => [("relevance", JSON.Encode.float(rel))]
+      | None => []
+      },
+    ),
+  )->JSON.Encode.object
+
+// Only `text` is read; `ctx.identity` is forwarded by the resolver but the geocoder
+// does not scope by caller, so the handler ignores it.
+type geocodeArgs = {text?: string}
+type appSyncEvent = {arguments?: geocodeArgs}
+
+let handler = async (event: appSyncEvent): array<JSON.t> => {
+  let indexName = switch NodeProcess.env->Dict.get("PLACE_INDEX_NAME") {
+  | Some("") | None => ""
+  | Some(v) => v
+  }
+  let text = event.arguments->Option.flatMap(a => a.text)->Option.getOr("")
+  switch await Geocoder_AwsLocation_Backend.search(~indexName, ~text) {
+  | Ok(candidates) => candidates->Array.map(candidateJson)
+  // The provider answered and had nothing — a true, final empty answer.
+  | Error(NoMatch) => []
+  // Misconfigured (no index) or the service failed: throw so `ctx.error` is set and
+  // the caller sees an error, never a silent empty list it would read as "no match".
+  | Error(Unavailable(msg)) => JsError.throwWithMessage(`geocoder unavailable: ${msg}`)
+  }
+}

package/src/adapter/Geocoder/Geocoder_AwsLocation_Resolver_Ops.res.mjs

@@ -0,0 +1,48 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Geocoder_AwsLocation_Backend$ReventlessAws from "./Geocoder_AwsLocation_Backend.res.mjs";
+
+function candidateJson(c) {
+  let rel = c.relevance;
+  return Object.fromEntries([
+    [
+      "label",
+      c.label
+    ],
+    [
+      "lat",
+      c.point.lat
+    ],
+    [
+      "lng",
+      c.point.lng
+    ]
+  ].concat(rel !== undefined ? [[
+        "relevance",
+        rel
+      ]] : []));
+}
+
+async function handler(event) {
+  let v = process.env["PLACE_INDEX_NAME"];
+  let indexName = v !== undefined && v !== "" ? v : "";
+  let text = Stdlib_Option.getOr(Stdlib_Option.flatMap(event.arguments, a => a.text), "");
+  let candidates = await Geocoder_AwsLocation_Backend$ReventlessAws.search(indexName, text, undefined);
+  if (candidates.TAG === "Ok") {
+    return candidates._0.map(candidateJson);
+  }
+  let msg = candidates._0;
+  if (typeof msg !== "object") {
+    return [];
+  } else {
+    return Stdlib_JsError.throwWithMessage(`geocoder unavailable: ` + msg._0);
+  }
+}
+
+export {
+  candidateJson,
+  handler,
+}
+/* Geocoder_AwsLocation_Backend-ReventlessAws Not a pure module */

package/src/adapter/Runtime/AutomationSliceEntryPoint.mjs

@@ -22,6 +22,7 @@ const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifie
 
 async function buildAllHandlers() {
   const handlers = {};
+  const sweeps = [];
   const entries = Ops.parseHandlerConfig(process.env["HANDLER_CONFIG"] || "");
 
   await Promise.all(entries.map(async (entry) => {
@@ -56,11 +57,28 @@ async function buildAllHandlers() {
         ? [entry.sourceUrn]
         : [];
     for (const sourceUrn of sourceUrns) {
-      StreamOps.addToRegistry(handlers, sourceUrn, registered);
+      StreamOps.addToRegistry(handlers, sourceUrn, registered.registered);
     }
+    // Every slice can also be swept without an event — see the scheduled branch
+    // below. Collected regardless of how many streams it listens on, so a
+    // multi-source slice is swept once rather than once per stream.
+    sweeps.push(registered);
   }));
 
-  return handlers;
+  return { handlers, sweeps };
 }
 
-export const handler = StreamOps.makeRoutedHandler("AutomationSliceRuntime", buildAllHandlers());
+const builtPromise = buildAllHandlers();
+const routed = StreamOps.makeRoutedHandler(
+  "AutomationSliceRuntime",
+  builtPromise.then((b) => b.handlers),
+);
+
+// The scheduled sweep arrives as the EventBridge rule's constant Input, which
+// has no `records` — so this branch is the one place that must probe an untyped
+// Lambda payload, which is what this shell exists for. Everything it dispatches
+// to is type-checked in AutomationSliceEntryPoint_Ops.
+export const handler = async (event, context) =>
+  event?.reventlessSweep
+    ? Ops.runSweeps((await builtPromise).sweeps)
+    : routed(event, context);

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -128,6 +128,111 @@ let makeSyncTodoItems = (
   }
 }
 
+// Rehydrate the in-memory TODO list from the slice's view table, once per
+// container.
+//
+// `todoItems` is a module-level dict populated only by phase 1, so before this
+// existed a cold start began with an empty list and every row already persisted
+// was unreachable: `phase2` admits `Failed && retryCount < maxRetries`, but only
+// for rows it can see. A transient failure whose container then recycled was
+// stranded permanently, in a row reading `Failed` that nothing would ever pick
+// up again — while `makeSyncTodoItems` kept faithfully writing it back out.
+//
+// Once per container rather than per invocation: within a container the dict is
+// authoritative and `phase2` already re-attempts every actionable row on each
+// batch, so re-reading would buy nothing and cost a scan each time. The backlog
+// is therefore retried on the first event a new container handles.
+//
+// Memory wins on conflict. A row already in the dict may be mid-flight
+// (`Processing`) or a status this invocation just advanced; the stored copy is
+// by definition no fresher.
+//
+// Only `Pending` and `Failed` are read. `Completed` rows are the bulk of a
+// mature table and are never actionable. Retry-exhausted rows are not excluded —
+// `maxRetries` is Spec-level and not known here — but `phase2` filters them, so
+// they are inert rather than wrong.
+let makeLoadTodoItems = (
+  ~queryDbTableName: string,
+  ~todoItems: dict<'row>,
+  ~rowSchema: S.t<'row>,
+  ~comp: string,
+): (unit => promise<unit>) => {
+  let loaded = ref(false)
+  async () =>
+    if loaded.contents {
+      ()
+    } else {
+      loaded := true
+      let params: AwsSdk.DynamoDb.DocumentClient.ScanCommand.input = {
+        tableName: queryDbTableName,
+        consistentRead: true,
+        filterExpression: "#s = :pending OR #s = :failed",
+        expressionAttributeNames: [("#s", "status")]->Dict.fromArray,
+        expressionAttributeValues: [
+          (":pending", "Pending"->JSON.Encode.string),
+          (":failed", "Failed"->JSON.Encode.string),
+        ]->Dict.fromArray,
+      }
+      let restored = await Util_DynamoDb_Runtime.scanStream(params)
+      ->Stream.runCollect
+      ->Effect.map(items =>
+        items->Array.reduce(0, (count, item) => {
+          let json = item->JSON.stringifyAny->Option.getOr("")->JSON.parseOrThrow
+          let id = json->JSON.Decode.object->Option.flatMap(d => d->Dict.get("id"))->Option.flatMap(JSON.Decode.string)
+          switch id {
+          | Some(id) if todoItems->Dict.get(id)->Option.isNone =>
+            switch json->S.parseJsonOrThrow(rowSchema) {
+            | row =>
+              todoItems->Dict.set(id, row)
+              count + 1
+            | exception _ => count
+            }
+          | _ => count
+          }
+        })
+      )
+      ->Effect.catchAll(err =>
+        ReventlessCore.EffectLogger.logError(
+          ~comp,
+          `restore: couldn't read pending TODO rows from ${queryDbTableName}: ${DynamoDb_Error.message(
+              err,
+            )}`,
+        )->Effect.map(_ => 0)
+      )
+      ->Effect.runPromise
+      if restored > 0 {
+        ReventlessCore.EffectLogger.logInfo(
+          ~comp,
+          `restore: reloaded ${restored->Int.toString} unfinished TODO row(s) from ${queryDbTableName}`,
+        )->Effect.runSync
+      }
+    }
+}
+
+// ── Platform capabilities ───────────────────────────────────────────────────
+
+/**
+What this Lambda hands a slice's `translate`.
+
+Built here rather than reached for inside the plugin, because a plugin depends on
+`reventless-spec` and cannot name Amazon Location — the whole point of the
+injected record. This module is the AWS side of that seam and calls the SDK
+directly: no proxy hop through the browser's Function URL, and no dependence on a
+public unauthenticated endpoint for an unattended path.
+
+Resolved per call rather than captured once, so a Lambda whose configuration is
+updated does not need a cold start to see it. An unset `PLACE_INDEX_NAME` reaches
+`Geocoder_AwsLocation_Backend` as `""`, which answers `Unavailable` — a retryable
+outcome, not a verdict on the address.
+*/
+let capabilities = (): Reventless.Capabilities.t => {
+  geocode: (~text) =>
+    Geocoder_AwsLocation_Backend.search(
+      ~indexName=NodeProcess.env->Dict.get("PLACE_INDEX_NAME")->Option.getOr(""),
+      ~text,
+    ),
+}
+
 // ── Phase-1/phase-2 pipelines ───────────────────────────────────────────────
 // Both run: collect the batch → phase 1 → sync (so consumers observe Pending
 // rows even if phase 2 fails) → phase 2 → sync. Unlike the in-process builders
@@ -161,12 +266,14 @@ let makeAutomationJsonEventsHandler = (
   ~callback: automationCallback,
   ~publishJsons: ReventlessCore.CommandTopic.publishJsons,
   ~syncTodoItems: unit => promise<unit>,
+  ~loadTodoItems: unit => promise<unit>,
 ): ReventlessCore.EventCollector.jsonEventsHandler =>
   stream =>
     stream
     ->Stream.runCollect
     ->Effect.flatMap(jsons =>
       Effect.promise(async () => {
+        await loadTodoItems()
         callback.phase1(jsons, context)
         await syncTodoItems()
         await callback.phase2(publishJsons)
@@ -183,6 +290,7 @@ let makeOutboundJsonEventsHandler = (
   ~callback: outboundCallback<'event>,
   ~publishJsons: ReventlessCore.CommandTopic.publishJsons,
   ~syncTodoItems: unit => promise<unit>,
+  ~loadTodoItems: unit => promise<unit>,
 ): ReventlessCore.EventCollector.jsonEventsHandler => {
   let decoder = Reventless.DcbDecode.makeDecoder(consumedEventSchema)
   stream =>
@@ -211,9 +319,10 @@ let makeOutboundJsonEventsHandler = (
     ->Stream.runCollect
     ->Effect.flatMap(events =>
       Effect.promise(async () => {
+        await loadTodoItems()
         callback.phase1(events)
         await syncTodoItems()
-        await callback.phase2(publishJsons)
+        await callback.phase2(publishJsons, ~capabilities=capabilities())
         await syncTodoItems()
       })
     )
@@ -223,24 +332,62 @@ let makeOutboundJsonEventsHandler = (
 // Comp matches what the slice's own callback logs under, so a filter catches
 // both the framework's lines and the application handler's.
 
+/**
+A built slice, in the two ways the Lambda drives it.
+
+`registered` handles a stream batch. `sweep` runs the TODO backlog with no event
+to trigger it — the scheduled path, and the reason `translatePending` exists on
+the in-process builder. Both close over the *same* publish/sync/load closures, so
+a sweep landing on a container that has already served a batch reuses the load it
+did then, and one landing cold does the reload itself.
+*/
+type builtSlice = {
+  registered: StreamRoutedEntryPoint_Ops.registeredHandler,
+  sweep: unit => promise<unit>,
+  comp: string,
+}
+
 let makeAutomationRegisteredHandler = (
   entry: handlerEntry,
   ~sliceName: string,
   ~callback: automationCallback,
-): StreamRoutedEntryPoint_Ops.registeredHandler => {
-  handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
-    makeAutomationJsonEventsHandler(
-      ~context=entry.context->Option.getOr(defaultContext(sliceName)),
-      ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
-      ~syncTodoItems=makeSyncTodoItems(
-        ~queryDbTableName=entry.queryDbTableName,
-        ~todoItems=callback.todoItems,
-        ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+): builtSlice => {
+  let comp = `AutomationSlice(${sliceName})`
+  let publishJsons = makePublishJsons(
+    entry.dcbQueueUrl,
+    ~isFifo=entry.commandQueueIsFifo->Option.getOr(false),
+  )
+  let syncTodoItems = makeSyncTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+  )
+  let loadTodoItems = makeLoadTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
+    ~comp,
+  )
+  {
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
+        makeAutomationJsonEventsHandler(
+          ~context=entry.context->Option.getOr(defaultContext(sliceName)),
+          ~callback,
+          ~publishJsons,
+          ~syncTodoItems,
+          ~loadTodoItems,
+        ),
       ),
-    ),
-  ),
-  comp: `AutomationSlice(${sliceName})`,
+      comp,
+    },
+    sweep: async () => {
+      await loadTodoItems()
+      await callback.phase2(publishJsons)
+      await syncTodoItems()
+    },
+    comp,
+  }
 }
 
 let makeOutboundRegisteredHandler = (
@@ -248,18 +395,63 @@ let makeOutboundRegisteredHandler = (
   ~sliceName: string,
   ~consumedEventSchema: S.t<'event>,
   ~callback: outboundCallback<'event>,
-): StreamRoutedEntryPoint_Ops.registeredHandler => {
-  handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
-    makeOutboundJsonEventsHandler(
-      ~consumedEventSchema,
-      ~callback,
-      ~publishJsons=makePublishJsons(entry.dcbQueueUrl, ~isFifo=entry.commandQueueIsFifo->Option.getOr(false)),
-      ~syncTodoItems=makeSyncTodoItems(
-        ~queryDbTableName=entry.queryDbTableName,
-        ~todoItems=callback.todoItems,
-        ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+): builtSlice => {
+  let comp = `OutboundTranslationSlice(${sliceName})`
+  let publishJsons = makePublishJsons(
+    entry.dcbQueueUrl,
+    ~isFifo=entry.commandQueueIsFifo->Option.getOr(false),
+  )
+  let syncTodoItems = makeSyncTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+  )
+  let loadTodoItems = makeLoadTodoItems(
+    ~queryDbTableName=entry.queryDbTableName,
+    ~todoItems=callback.todoItems,
+    ~rowSchema=ReventlessCore.OutboundTranslationSlice_Callback.todoRowSchema,
+    ~comp,
+  )
+  {
+    registered: {
+      handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
+        makeOutboundJsonEventsHandler(
+          ~consumedEventSchema,
+          ~callback,
+          ~publishJsons,
+          ~syncTodoItems,
+          ~loadTodoItems,
+        ),
       ),
-    ),
-  ),
-  comp: `OutboundTranslationSlice(${sliceName})`,
+      comp,
+    },
+    sweep: async () => {
+      await loadTodoItems()
+      await callback.phase2(publishJsons, ~capabilities=capabilities())
+      await syncTodoItems()
+    },
+    comp,
+  }
+}
+
+/**
+Run every slice's TODO backlog, for a scheduled invocation carrying no records.
+
+Sequential rather than concurrent: the slices in one Lambda share its memory and
+its downstream quotas, and a sweep is never latency-critical. A slice that throws
+is logged and does not stop the rest — a sweep that abandoned the remaining
+slices because one geocoder was down would be a worse version of the problem it
+exists to fix.
+*/
+let runSweeps = async (slices: array<builtSlice>) => {
+  for i in 0 to slices->Array.length - 1 {
+    let slice = slices->Array.getUnsafe(i)
+    try {
+      await slice.sweep()
+    } catch {
+    | exn =>
+      let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
+      ReventlessCore.EffectLogger.logError(~comp=slice.comp, `sweep failed: ${msg}`)->Effect.runSync
+    }
+  }
 }