@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.76 → 2.4.0-alpha.77

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.77 (2026-08-16)
+
+### Features
+
+* **core:** exclude retired rows from reads a caller may not widen ([662f31a](https://github.com/ReventlessDev/reventless-core/commit/662f31abb717bda5154199d349da6dcf8e2d3e78))
+* **core:** let [@retired](https://github.com/retired) name a lifecycle state, not only a boolean ([6bb346b](https://github.com/ReventlessDev/reventless-core/commit/6bb346b4f6a5f33826fc24537953482a76067177))
+* **core:** mark the state that retires a row, and allow more than one ([cb1461f](https://github.com/ReventlessDev/reventless-core/commit/cb1461f024d3ca3b53fd9c8b010a054e3fcc4555))
+
+
 # 2.4.0-alpha.76 (2026-08-15)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.76",
+  "version": "2.4.0-alpha.77",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,8 +22,8 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0-alpha.4",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -447,6 +447,13 @@ let listAllItemsConnection = (
   // than a per-request one.
   ~ownerField: option<string>=?,
   ~elevatedGroups: array<string>=[],
+  // The state's `@retired` field, when it declares one. Baked in for the same
+  // reason `ownerField` is: there is no Lambda in this path to read it at
+  // request time.
+  ~retiredField: option<string>=?,
+  // The states that retire the row, for the state form of the annotation.
+  // Absent is the boolean form, where the value is always `true`.
+  ~retiredValues: option<array<string>>=?,
 ) => {
   let requireAttributeClause = switch requireAttribute {
   | Some(attr) => `
@@ -480,6 +487,70 @@ let listAllItemsConnection = (
     parts.push('#owner = :owner');
   }`
   }
+  // ── retirement narrowing (generated) ──
+  // Reuses `_exempt` when the owner clause already computed it, and computes its
+  // own when it did not — the two clauses are independently optional and either
+  // may be the only one present.
+  //
+  // `includeRetired` IS read from ctx.args, unlike the owner predicate, and the
+  // difference is deliberate: this argument does not say which rows the caller
+  // wants, it asks to lift a restriction, and it is honoured only inside the
+  // `_exempt` branch. A non-exempt caller passing it changes nothing.
+  //
+  // `attribute_not_exists OR = false` rather than `<> true`: a row written before
+  // the annotation existed carries no such attribute, and DynamoDB's `<>` does
+  // not match a missing one — the whole view would come back empty on the day
+  // the annotation lands.
+  //
+  // The state form compares `<>` against the retiring state instead, under the
+  // same `attribute_not_exists` guard and for the same reason. An equality
+  // predicate over an enum-valued attribute indexes exactly as a boolean one
+  // does, so the warning about an unindexed retirement field carries over
+  // unchanged.
+  let retiredClause = switch retiredField {
+  | None => ""
+  | Some(field) =>
+    let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+    let exemptPrelude = switch ownerField {
+    | Some(_) => ""
+    | None => `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);`
+    }
+    `${exemptPrelude}
+  // ── retirement narrowing (generated) ──
+  const _wantsRetired = _exempt && ctx.args.includeRetired === true;
+  if (!_wantsRetired) {
+    names['#retired'] = '${field}';
+${switch retiredValues {
+      | None => `    values[':retiredFalse'] = util.dynamodb.toDynamoDB(false);
+    parts.push('(attribute_not_exists(#retired) OR #retired = :retiredFalse)');`
+      // One `<>` per state, ANDed, rather than `NOT IN`: DynamoDB's `IN` needs a
+      // parenthesised operand list built from the same placeholders anyway, and
+      // the conjunction keeps `attribute_not_exists` covering the absent case
+      // once for the whole clause — a row that states no lifecycle is not
+      // retired, the same reading every other adapter takes.
+      | Some(states) =>
+        let placeholders = states->Array.mapWithIndex((state, i) => (`:retiredValue${Int.toString(i)}`, state))
+        let assignments =
+          placeholders
+          ->Array.map(((ph, state)) => `    values['${ph}'] = util.dynamodb.toDynamoDB('${state}');`)
+          ->Array.join("\n")
+        let comparisons =
+          placeholders->Array.map(((ph, _)) => `#retired <> ${ph}`)->Array.join(" AND ")
+        // A set naming nothing withdraws nothing, so it pushes no predicate down.
+        switch placeholders {
+        | [] => ""
+        | _ =>
+          `${assignments}
+    parts.push('(attribute_not_exists(#retired) OR (${comparisons}))');`
+        }
+      }}
+  }`
+  }
   let filterClauses =
     filterFields
     ->Array.map(f => `
@@ -569,7 +640,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}
+  }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}${retiredClause}
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -360,7 +360,7 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute, ownerField, elevatedGroupsOpt) {
+function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute, ownerField, elevatedGroupsOpt, retiredField, retiredValues) {
   let filterFields = filterFieldsOpt !== undefined ? filterFieldsOpt : [];
   let rangeFields = rangeFieldsOpt !== undefined ? rangeFieldsOpt : [];
   let sortFields = sortFieldsOpt !== undefined ? sortFieldsOpt : [];
@@ -391,6 +391,39 @@ function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sor
   } else {
     ownerClause = "";
   }
+  let retiredClause;
+  if (retiredField !== undefined) {
+    let elevatedLiteral$1 = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+    let exemptPrelude = ownerField !== undefined ? "" : `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral$1 + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);`;
+    let tmp;
+    if (retiredValues !== undefined) {
+      let placeholders = retiredValues.map((state, i) => [
+        `:retiredValue` + i.toString(),
+        state
+      ]);
+      let assignments = placeholders.map(param => `    values['` + param[0] + `'] = util.dynamodb.toDynamoDB('` + param[1] + `');`).join("\n");
+      let comparisons = placeholders.map(param => `#retired <> ` + param[0]).join(" AND ");
+      tmp = placeholders.length !== 0 ? assignments + `
+    parts.push('(attribute_not_exists(#retired) OR (` + comparisons + `))');` : "";
+    } else {
+      tmp = `    values[':retiredFalse'] = util.dynamodb.toDynamoDB(false);
+    parts.push('(attribute_not_exists(#retired) OR #retired = :retiredFalse)');`;
+    }
+    retiredClause = exemptPrelude + `
+  // ── retirement narrowing (generated) ──
+  const _wantsRetired = _exempt && ctx.args.includeRetired === true;
+  if (!_wantsRetired) {
+    names['#retired'] = '` + retiredField + `';
+` + tmp + `
+  }`;
+  } else {
+    retiredClause = "";
+  }
   let filterClauses = filterFields.map(f => `
   if (filter.` + f + `Eq !== undefined && filter.` + f + `Eq !== null && filter.` + f + `Eq !== '') {
     names['#` + f + `'] = '` + f + `';
@@ -460,7 +493,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }` + filterClauses + rangeClauses + requireAttributeClause + ownerClause + `
+  }` + filterClauses + rangeClauses + requireAttributeClause + ownerClause + retiredClause + `
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;