@reventlessdev/reventless-core 3.0.0-alpha.183 → 3.0.0-alpha.184

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.184 (2026-07-27)
+
+### Bug Fixes
+
+* **aws:** grant DCB command Lambda write access to InboundTranslationSlice audit tables ([2c445fa](https://github.com/ReventlessDev/reventless-core/commit/2c445faf9692573d0eab2f0d4a456e8c5d723b41))
+
+
 # 3.0.0-alpha.183 (2026-07-27)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.183",
+  "version": "3.0.0-alpha.184",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -30,14 +30,14 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
     "@reventlessdev/rescript-fast-csv": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-node-streams": "1.1.0-alpha.13",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.13",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/rescript-ssh2": "1.1.0-alpha.14",
+    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.105",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.81"
   },
   "devDependencies": {

package/src/components/Dcb/Dcb_Builder.res

@@ -739,12 +739,19 @@ module Make = (
             composite->Obj.magic
           })
 
-        // Resources the sync Lambda needs access to
+        // Resources the sync Lambda needs access to. An InboundTranslationSlice
+        // exposes its audit table under `queryDb.resources` — its top-level
+        // `resources` is empty — and the sync DCB command Lambda is the Route 0
+        // target that writes those audit rows. Granting only `outputs.resources`
+        // left the Lambda role without `PutItem` on the audit table, so every
+        // audit write failed with AccessDenied (swallowed at the write site,
+        // surfacing only as a permanently empty audit view). Include the audit
+        // table's resources so the role can write it.
         let dcbResources = Array.concat(
           stateChangeSlicesOutputs->Dict.valuesToArray->Array.flatMap(outputs => outputs.resources),
           inboundTranslationSlicesOutputs
           ->Dict.valuesToArray
-          ->Array.flatMap(outputs => outputs.resources),
+          ->Array.flatMap(outputs => Array.concat(outputs.resources, outputs.queryDb.resources)),
         )
 
         // Resources the async Lambda needs access to

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -398,7 +398,7 @@ function Make(DcbEventLogStorage) {
           }
         };
       });
-      let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources));
+      let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));
       let asyncDcbResources = Object.values(asyncStateChangeSlicesOutputs).flatMap(outputs => outputs.resources);
       let inboundFieldNames = inboundTranslationSliceData.map(param => param[1]);
       let inboundSchemas = inboundTranslationSliceData.map(param => param[3]);