@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.4 → 3.0.0-alpha.40

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -4,12 +4,11 @@
     exported `request` and `response` functions, ready to be passed as the `code`
     field of AppSync_Resolver.makeUnitJsResolver / makePipelineJsResolver.
 */
-
-// ---------------------------------------------------------------------------
+let // ---------------------------------------------------------------------------
 // Shared response snippets (inlined into each resolver's template literal)
 // ---------------------------------------------------------------------------
 
-let resultResponseCode = `
+resultResponseCode = `
 export function response(ctx) {
   if (ctx.error) util.error(ctx.error.message, ctx.error.type);
   return ctx.result;
@@ -62,6 +61,21 @@ let exemptPreamble = (~elevatedGroups: array<string>) => {
   const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);`
 }
 
+/**
+A view row's `_change` field: the stored value for an exempt caller, null for anyone else.
+Answered from the request step, so the view's data source is never called.
+*/
+let rowChangeField = (~field: string, ~elevatedGroups: array<string>): Pulumi.Input.t<string> =>
+  `import { util, runtime } from '@aws-appsync/utils';
+export function request(ctx) {${exemptPreamble(~elevatedGroups)}
+  const _row = ctx.source;
+  return runtime.earlyReturn(_exempt && _row != null && _row['${field}'] != null ? _row['${field}'] : null);
+}
+export function response(ctx) {
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
 /**
 A by-key read's retirement guard: `_live(row)`, true when the caller may see it.
 The post-read half of what `listAllItemsConnection` pushes into a
@@ -191,15 +205,18 @@ let ownerScopedResultResponse = (
   | _ =>
     let ownerPart = switch ownerField {
     // Takes the row it ignores: APPSYNC_JS type-checks the resolver, so a
-  // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
-  // arguments, but got 1") and AppSync rejects the whole resolver at create
-  // time with "The code contains one or more errors". Only a door that emits
-  // the call conditionally is safe with a bare `() => true`, and that is not a
-  // property worth relying on across three templates.
-  | None => "\n  const _owns = (row) => true;"
+    // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
+    // arguments, but got 1") and AppSync rejects the whole resolver at create
+    // time with "The code contains one or more errors". Only a door that emits
+    // the call conditionally is safe with a bare `() => true`, and that is not a
+    // property worth relying on across three templates.
+    | None => "\n  const _owns = (row) => true;"
     | Some(field) =>
       `
-  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}`
+  // ── owner scoping (generated) ──${ownerGuardPreamble(
+          ~ownerField=field,
+          ~elevatedGroups,
+        )}`
     }
     let retiredPart = retiredGuardPreamble(
       ~retiredField,
@@ -210,7 +227,9 @@ let ownerScopedResultResponse = (
     `
 export function response(ctx) {
   if (ctx.error) util.error(ctx.error.message, ctx.error.type);${ownerPart}${retiredPart}
-  return _owns(ctx.result)${retiredField->Option.isSome ? " && _live(ctx.result)" : ""} ? ctx.result : null;
+  return _owns(ctx.result)${retiredField->Option.isSome
+        ? " && _live(ctx.result)"
+        : ""} ? ctx.result : null;
 }`
   }
 
@@ -226,15 +245,18 @@ let ownerScopedFirstResultResponse = (
   | _ =>
     let ownerPart = switch ownerField {
     // Takes the row it ignores: APPSYNC_JS type-checks the resolver, so a
-  // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
-  // arguments, but got 1") and AppSync rejects the whole resolver at create
-  // time with "The code contains one or more errors". Only a door that emits
-  // the call conditionally is safe with a bare `() => true`, and that is not a
-  // property worth relying on across three templates.
-  | None => "\n  const _owns = (row) => true;"
+    // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
+    // arguments, but got 1") and AppSync rejects the whole resolver at create
+    // time with "The code contains one or more errors". Only a door that emits
+    // the call conditionally is safe with a bare `() => true`, and that is not a
+    // property worth relying on across three templates.
+    | None => "\n  const _owns = (row) => true;"
     | Some(field) =>
       `
-  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}`
+  // ── owner scoping (generated) ──${ownerGuardPreamble(
+          ~ownerField=field,
+          ~elevatedGroups,
+        )}`
     }
     let retiredPart = retiredGuardPreamble(
       ~retiredField,
@@ -255,8 +277,7 @@ export function response(ctx) {
 // ---------------------------------------------------------------------------
 
 /** Pipeline resolver code with no pre-processing and a standard error-check response. */
-let pipelinePassThrough =
-  `${importUtil}
+let pipelinePassThrough = `${importUtil}
 export function request(ctx) { return {}; }
 ${resultResponseCode}
 `->Pulumi.Input.make
@@ -329,8 +350,7 @@ export function request(ctx) {
 ${ownerScopedResultResponse(~ownerField, ~elevatedGroups, ~retiredField?, ~retiredValues?)}
 `->Pulumi.Input.make
 
-let queryById =
-  `${importUtil}
+let queryById = `${importUtil}
 export function request(ctx) {
   return {
     operation: 'Query',
@@ -348,11 +368,11 @@ ${resultResponseCode}
     Relay pagination: `first`/`after` (forward) or `last`/`before` (backward).
     Cursor is base64 of the sort key value.
     Returns a Relay `{ edges, pageInfo }` shape reusing the entity's `Connection` type. */
-// A list in everything but its name, so it scopes the way `listAllItemsConnection`
+let // A list in everything but its name, so it scopes the way `listAllItemsConnection`
 // does — a FilterExpression on the request, not a guard on the response. The
 // response is where the page is cut, and narrowing after that cut would report
 // `hasNextPage` from a count the caller was never allowed to see.
-let queryItemsWithSortConditions = (
+queryItemsWithSortConditions = (
   sortField: string,
   ~ownerField: option<string>=?,
   ~elevatedGroups: array<string>=[],
@@ -559,9 +579,26 @@ the survivors serves short — usually empty — pages under a selective filter.
 no loops in APPSYNC_JS the door reads wider instead and addresses the surplus by
 position. 1 MB caps a page anyway, hence 1000; `filtered` is the JS expression
 saying whether a filter was pushed down.
+
+An unfiltered read takes one row past the page. DynamoDB hands back a token
+whenever it stops AT the limit, end of data or not, so a read of exactly the page
+reports a next page that comes back blank; the extra row is what says one exists.
 */
 let pageWindowBudget = (~filtered: string) =>
-  `(${filtered} ? (_first > 1000 ? _first : 1000) : _first + _from)`
+  `(${filtered} ? (_first > 1000 ? _first : 1000) : _first + _from + 1)`
+
+/**
+The same budget for the full-list door, which may also read backward.
+
+A backward page is the slice `[_from, _upTo)` of the window, so the read has to
+reach `_upTo` rows into it — `_first + _from` would stop short and hand back a
+page with its tail missing. Forward reads one row past the page, for the reason
+`pageWindowBudget` gives; a backward page needs none, as one provably follows it.
+*/
+let listPageWindowBudget = {
+  let need = "(_backward ? _upTo : _first + _from + 1)"
+  `(parts.length > 0 ? (${need} > 1000 ? ${need} : 1000) : ${need})`
+}
 
 /**
 Decodes `after` into the window it names (`t`, the token opening it) and the row's
@@ -573,7 +610,8 @@ index among that window's matches (`n`). Pre-window cursors carried
 tag existed came off a Scan. Only a door with more than one read tests it — see
 `cursorPathGuard`.
 */
-let cursorDecode = (~args: string) => `
+let cursorDecode = (~args: string) =>
+  `
   let _window = null;
   let _from = 0;
   let _cursorPath = null;
@@ -597,21 +635,74 @@ let cursorPathGuard = `
     util.error('This cursor belongs to a different read of this list; restart from the first page.', 'CursorPathMismatch');
   }`
 
+/**
+The full-list door's cursor decode, which unlike `cursorDecode` may run backward.
+
+A `{t, n}` cursor names a position INSIDE a read window, and a window is re-read
+from its own token — which forward paging already relies on to resume mid-window.
+Backward is the same move in the other direction: re-read the window `before`
+names and cut the page that ends at `n`, `[n - first, n)`. No new cursor shape, no
+index, and no assumption forward paging does not already make.
+
+What it cannot do is cross into an EARLIER window: DynamoDB's continuation chain
+walks one way, so a window cannot name the one before it. `_upTo <= 0` with a
+non-null window is that case, and it is the only one still refused.
+
+Declares `_first` (the response's slicing needs it before `connectionPageResponse`
+would have declared it, so that one omits it here).
+*/
+let listCursorPreamble = `
+  const _first = ctx.args.first ?? 50;
+  let _window = null;
+  let _from = 0;
+  let _cursorPath = null;
+  let _backward = false;
+  let _upTo = -1;
+  if (ctx.args.before != null && ctx.args.before !== '') {
+    const _c = JSON.parse(util.base64Decode(ctx.args.before));
+    _window = (_c.t !== undefined ? _c.t : _c.token) ?? null;
+    _cursorPath = _c.p ?? 's';
+    _backward = true;
+    _upTo = _c.n !== undefined ? _c.n : 0;
+    _from = (_upTo - _first) > 0 ? (_upTo - _first) : 0;
+  } else if (ctx.args.after != null && ctx.args.after !== '') {
+    const _c = JSON.parse(util.base64Decode(ctx.args.after));
+    _window = (_c.t !== undefined ? _c.t : _c.token) ?? null;
+    _from = _c.n !== undefined ? _c.n + 1 : 0;
+    _cursorPath = _c.p ?? 's';
+  }`
+
 /**
 Cuts the requested page out of the returned window. Expects `items` (sorted, if the
 door sorts) plus `_window` / `_from` from `cursorDecode`. `pathExpr` is the JS
 expression naming which read minted these cursors, for a door that has two.
+
+`bidirectional` is the full-list door, whose page may have been cut backward: it
+reads `_backward` / `_upTo` from `listCursorPreamble` and takes `_first` from
+there rather than declaring its own.
 */
-let connectionPageResponse = (~pathExpr: option<string>=?) => {
+let connectionPageResponse = (~pathExpr: option<string>=?, ~bidirectional: bool=false) => {
   let tag = switch pathExpr {
   | None => ""
   | Some(e) => `, p: ${e}`
   }
-  `
-  const _first = ctx.args.first ?? 50;
+  let firstDecl = bidirectional ? "" : "\n  const _first = ctx.args.first ?? 50;"
+  let slice = bidirectional
+    ? `
+  const _rest = _backward ? items.slice(_from, _upTo) : items.slice(_from);
+  const _page = _backward ? _rest : _rest.slice(0, _first);
+  // A backward page was cut from ahead, so a next page provably exists — the one
+  // the caller came from — whatever this window's tail looks like.
+  const _more = _backward ? true : _rest.length > _first;`
+    : `
   const _rest = items.slice(_from);
   const _page = _rest.slice(0, _first);
-  const _more = _rest.length > _first;
+  const _more = _rest.length > _first;`
+  // Only what the door can actually serve. `!!ctx.args.after` said "a page
+  // precedes this one", which is a different claim: at a window boundary one does
+  // and this door cannot reach it, so the client drew a Prev that always errored.
+  let hasPrevious = bidirectional ? "_from > 0" : "!!ctx.args.after"
+  `${firstDecl}${slice}
   const _next = ctx.result?.nextToken ?? null;
   const _lastIndex = _page.length - 1;
   // A row's cursor names its own position. The last row of a page that closes its
@@ -632,7 +723,7 @@ let connectionPageResponse = (~pathExpr: option<string>=?) => {
     edges,
     pageInfo: {
       hasNextPage: _more || !!_next,
-      hasPreviousPage: !!ctx.args.after,
+      hasPreviousPage: ${hasPrevious},
       startCursor: edges.length > 0 ? edges[0].cursor : _boundary,
       endCursor: edges.length > 0 ? edges[edges.length - 1].cursor : _boundary,
     },
@@ -652,7 +743,7 @@ export function response(ctx) {
 
 /** Refuses backward paging, for the reason `listAllItemsConnection` gives: the
 cursor is DynamoDB's own continuation token, which only walks forward, so
-`last`/`before` cannot be honoured, and handing back the forward page would answer
+`last`/`before` cannot be honored, and handing back the forward page would answer
 a different question without saying so. The arguments stay declared — one that
 came and went with the index's shape would make every client feature-detect — and
 the local backend refuses them with the same message. */
@@ -714,7 +805,11 @@ export function request(ctx) {
       values[':' + key] = '' + value;
     }
   });
-${ownerFilterClause(~ownerField, ~elevatedGroups)}${retiredFilterClause(~retiredField, ~retiredValues, ~elevatedGroups)}${indexCursorPreamble}
+${ownerFilterClause(~ownerField, ~elevatedGroups)}${retiredFilterClause(
+      ~retiredField,
+      ~retiredValues,
+      ~elevatedGroups,
+    )}${indexCursorPreamble}
   const result = {
     operation: 'Query',
     query,
@@ -777,7 +872,11 @@ export function request(ctx) {
       values[':' + key] = '' + value;
     }
   });
-${ownerFilterClause(~ownerField, ~elevatedGroups)}${retiredFilterClause(~retiredField, ~retiredValues, ~elevatedGroups)}${indexCursorPreamble}
+${ownerFilterClause(~ownerField, ~elevatedGroups)}${retiredFilterClause(
+      ~retiredField,
+      ~retiredValues,
+      ~elevatedGroups,
+    )}${indexCursorPreamble}
   const result = {
     operation: 'Query',
     query,
@@ -798,8 +897,7 @@ ${indexConnectionResponseCode}
 // DynamoDB read — list all
 // ---------------------------------------------------------------------------
 
-let listAllItems =
-  `${importUtil}
+let listAllItems = `${importUtil}
 export function request(ctx) {
   return {
     operation: 'Scan',
@@ -863,7 +961,8 @@ let listAllItemsConnection = (
   // have nothing to name in the key condition.
   let ownerIndex = ownerField->Option.isSome ? ownerIndex : None
   let requireAttributeClause = switch requireAttribute {
-  | Some(attr) => `
+  | Some(attr) =>
+    `
   names['#${attr}'] = '${attr}';
   parts.push('attribute_exists(#${attr})');`
   | None => ""
@@ -909,7 +1008,7 @@ let listAllItemsConnection = (
   // Reuses `_exempt` when the owner clause computed it; either clause may be the
   // only one present. `includeRetired` IS read from ctx.args, unlike the owner
   // predicate — it asks to lift a restriction rather than naming rows, and is
-  // honoured only inside `_exempt`.
+  // honored only inside `_exempt`.
   //
   // `attribute_not_exists OR = false` rather than `<> true`, because `<>` does not
   // match a missing attribute and the view would empty out the day the annotation
@@ -921,7 +1020,8 @@ let listAllItemsConnection = (
     let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
     let exemptPrelude = switch ownerField {
     | Some(_) => ""
-    | None => `
+    | None =>
+      `
   const _id = ctx.identity;
   const _sub = _id == null ? null : _id.sub;
   const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
@@ -942,10 +1042,13 @@ ${switch retiredValues {
       // once for the whole clause — a row that states no lifecycle is not
       // retired, the same reading every other adapter takes.
       | Some(states) =>
-        let placeholders = states->Array.mapWithIndex((state, i) => (`:retiredValue${Int.toString(i)}`, state))
+        let placeholders =
+          states->Array.mapWithIndex((state, i) => (`:retiredValue${Int.toString(i)}`, state))
         let assignments =
           placeholders
-          ->Array.map(((ph, state)) => `    values['${ph}'] = util.dynamodb.toDynamoDB('${state}');`)
+          ->Array.map(((ph, state)) =>
+            `    values['${ph}'] = util.dynamodb.toDynamoDB('${state}');`
+          )
           ->Array.join("\n")
         let comparisons =
           placeholders->Array.map(((ph, _)) => `#retired <> ${ph}`)->Array.join(" AND ")
@@ -961,16 +1064,19 @@ ${switch retiredValues {
   }
   let filterClauses =
     filterFields
-    ->Array.map(f => `
+    ->Array.map(f =>
+      `
   if (filter.${f}Eq !== undefined && filter.${f}Eq !== null && filter.${f}Eq !== '') {
     names['#${f}'] = '${f}';
     values[':${f}Eq'] = util.dynamodb.toDynamoDB(filter.${f}Eq);
     parts.push('#${f} = :${f}Eq');
-  }`)
+  }`
+    )
     ->Array.join("")
   let rangeClauses =
     rangeFields
-    ->Array.map(f => `
+    ->Array.map(f =>
+      `
   if (filter.${f}From !== undefined && filter.${f}From !== null && filter.${f}From !== '') {
     names['#${f}'] = '${f}';
     values[':${f}From'] = util.dynamodb.toDynamoDB(filter.${f}From);
@@ -980,10 +1086,10 @@ ${switch retiredValues {
     names['#${f}'] = '${f}';
     values[':${f}To'] = util.dynamodb.toDynamoDB(filter.${f}To);
     parts.push('#${f} <= :${f}To');
-  }`)
+  }`
+    )
     ->Array.join("")
-  let sortFieldsLiteral =
-    sortFields->Array.map(f => `'${f}'`)->Array.join(", ")
+  let sortFieldsLiteral = sortFields->Array.map(f => `'${f}'`)->Array.join(", ")
   // When the Query branch already ordered on the index's own sort key, the page
   // arrives globally ordered and re-sorting it here is the one way to break that
   // order — a sort over a page is not a sort over the caller's rows.
@@ -1025,8 +1131,7 @@ ${switch retiredValues {
   // halves, because both need it: the request to set `scanIndexForward`, the
   // response to leave an already-ordered page alone.
   let indexOrderedExpr = switch (ownerIndex, ownerIndexSortField) {
-  | (Some(_), Some(sf)) =>
-    `!_exempt && !!(ctx.args.orderBy && ctx.args.orderBy.field === '${sf}')`
+  | (Some(_), Some(sf)) => `!_exempt && !!(ctx.args.orderBy && ctx.args.orderBy.field === '${sf}')`
   | _ => "false"
   }
   // The two reads, chosen by the same test that used to choose a predicate.
@@ -1034,12 +1139,13 @@ ${switch retiredValues {
   // branch inside one resolver — no second field, no second data source, no
   // client change.
   let requestOperation = switch (ownerField, ownerIndex) {
-  | (Some(field), Some(index)) => `
+  | (Some(field), Some(index)) =>
+    `
   const _indexOrdered = ${indexOrderedExpr};
   const req = _exempt
     ? {
         operation: 'Scan',
-        limit: ${pageWindowBudget(~filtered="parts.length > 0")},
+        limit: ${listPageWindowBudget},
         nextToken: _window,
       }
     : {
@@ -1050,14 +1156,15 @@ ${switch retiredValues {
           expressionNames: { '#owner': '${field}' },
           expressionValues: { ':owner': util.dynamodb.toDynamoDB(_sub) },
         },
-        limit: ${pageWindowBudget(~filtered="parts.length > 0")},
+        limit: ${listPageWindowBudget},
         nextToken: _window,
         scanIndexForward: !(_indexOrdered && ctx.args.orderBy.direction === 'DESC'),
       };`
-  | _ => `
+  | _ =>
+    `
   const req = {
     operation: 'Scan',
-    limit: ${pageWindowBudget(~filtered="parts.length > 0")},
+    limit: ${listPageWindowBudget},
     nextToken: _window,
   };`
   }
@@ -1065,21 +1172,24 @@ ${switch retiredValues {
   let requestPathGuard = ownerIndex->Option.isSome ? cursorPathGuard : ""
   let responsePathPreamble = switch ownerIndex {
   | None => ""
-  | Some(_) => `${ownerIdentityPreamble}
+  | Some(_) =>
+    `${ownerIdentityPreamble}
   const _path = _exempt ? 's' : 'q';
   const _indexOrdered = ${indexOrderedExpr};`
   }
   let pageResponse = switch ownerIndex {
-  | None => connectionPageResponse()
-  | Some(_) => connectionPageResponse(~pathExpr="_path")
+  | None => connectionPageResponse(~bidirectional=true)
+  | Some(_) => connectionPageResponse(~pathExpr="_path", ~bidirectional=true)
   }
   `${importUtil}
 export function request(ctx) {
-  // Scan cannot page backward (ScanIndexForward is Query-only). Fail loud rather than
-  // silently returning the forward page. The ordered {single}Items connection
-  // (queryItemsWithSortConditions) supports last/before — direct backward callers there.
-  if (ctx.args.before != null || ctx.args.last != null) {
-    util.error('Backward pagination (last/before) is not supported on full-list connections; use first/after.', 'UnsupportedPagination');
+  // 'before' IS served — the page is cut backward out of the window the cursor
+  // names. 'last' is not: "the last N rows of the list" needs the end of the
+  // list, which a forward-only Scan cursor cannot reach. The ordered
+  // {single}Items connection (queryItemsWithSortConditions) has a real keyset
+  // cursor and honours both — direct callers who need 'last' there.
+  if (ctx.args.last != null) {
+    util.error('last is not supported on full-list connections; page backward with first and before.', 'UnsupportedPagination');
   }
   const filter = ctx.args.filter ?? {};
   const names = {};
@@ -1104,8 +1214,14 @@ export function request(ctx) {
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
   }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}${retiredClause}
-${cursorDecode(~args="ctx.args")}${requestPathGuard}
-  const _first = ctx.args.first ?? 50;${requestOperation}
+${listCursorPreamble}${requestPathGuard}
+  // The one page a cursor cannot reach: it begins in an earlier window, and a
+  // continuation token cannot name the one before it. Refused by itself rather
+  // than folded into the 'last' guard, because the two are different limits and a
+  // caller can act on this one (page forward from the start).
+  if (_backward && _upTo <= 0 && _window !== null) {
+    util.error('The previous page begins in an earlier read window, which this cursor cannot name; page forward from the start.', 'UnsupportedPagination');
+  }${requestOperation}
   if (parts.length > 0) {
     req.filter = {
       expression: parts.join(' AND '),
@@ -1117,9 +1233,7 @@ ${cursorDecode(~args="ctx.args")}${requestPathGuard}
 }
 export function response(ctx) {
   if (ctx.error) util.error(ctx.error.message, ctx.error.type);
-  let items = ctx.result?.items ?? [];${responsePathPreamble}${sortBlock}${cursorDecode(
-      ~args="ctx.args",
-    )}${pageResponse}
+  let items = ctx.result?.items ?? [];${responsePathPreamble}${sortBlock}${listCursorPreamble}${pageResponse}
 }
 `->Pulumi.Input.make
 }
@@ -1153,7 +1267,10 @@ let resolvedFieldResponse = (
     | None => "\n  const _owns = (row) => true;"
     | Some(field) =>
       `
-  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}`
+  // ── owner scoping (generated) ──${ownerGuardPreamble(
+          ~ownerField=field,
+          ~elevatedGroups,
+        )}`
     }
     let retiredPart = retiredGuardPreamble(
       ~retiredField,
@@ -1356,13 +1473,14 @@ let resolveIds = (
   ~retiredField: option<string>=?,
   ~retiredValues: option<array<string>>=?,
   ~elevatedGroups: array<string>=[],
-) => (tableName: string) => {
-  let keysCode = switch sortField {
-  | Some(sf) =>
-    `id => ({ id: util.dynamodb.toString(id.id), ${sf}: util.dynamodb.toString(id.${sf}) })`
-  | None => `id => ({ id: util.dynamodb.toString(id) })`
-  }
-  `${importUtil}
+) =>
+  (tableName: string) => {
+    let keysCode = switch sortField {
+    | Some(sf) =>
+      `id => ({ id: util.dynamodb.toString(id.id), ${sf}: util.dynamodb.toString(id.${sf}) })`
+    | None => `id => ({ id: util.dynamodb.toString(id) })`
+    }
+    `${importUtil}
 import { runtime } from '@aws-appsync/utils';
 export function request(ctx) {
   const idList = ctx.source.${idsField} ?? [];
@@ -1379,21 +1497,21 @@ export function request(ctx) {
 }
 export function response(ctx) {
   if (ctx.error) util.error(ctx.error.message, ctx.error.type);${switch ownerField {
-    | None => ""
-    | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
-    }}${retiredGuardPreamble(
-      ~retiredField,
-      ~retiredValues,
-      ~elevatedGroups,
-      ~ownerScoped=ownerField->Option.isSome,
-    )}
+      | None => ""
+      | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
+      }}${retiredGuardPreamble(
+        ~retiredField,
+        ~retiredValues,
+        ~elevatedGroups,
+        ~ownerScoped=ownerField->Option.isSome,
+      )}
   return (ctx.result?.data?.['${tableName}'] ?? []).filter(item =>
     item !== null${ownerField->Option.isSome ? " && _owns(item)" : ""}${retiredField->Option.isSome
-      ? " && _live(item)"
-      : ""});
+        ? " && _live(item)"
+        : ""});
 }
 `
-}
+  }
 
 /** Batched-by-ids — reads `ctx.args.ids: [String!]!` through one BatchGetItem.
     Missing ids drop out; empty input short-circuits without hitting DDB. The
@@ -1404,8 +1522,9 @@ let batchGetItemsByIds = (
   ~retiredField: option<string>=?,
   ~retiredValues: option<array<string>>=?,
   ~elevatedGroups: array<string>=[],
-) => (tableName: string) =>
-  `${importUtil}
+) =>
+  (tableName: string) =>
+    `${importUtil}
 import { runtime } from '@aws-appsync/utils';
 export function request(ctx) {
   const ids = ctx.args.ids ?? [];
@@ -1430,18 +1549,18 @@ export function response(ctx) {
   // caller does not own is dropped rather than refused, for the reason the
   // single-key door answers null: distinguishing "not yours" from "not there"
   // would make this door an oracle for which ids exist.${switch ownerField {
-    | None => ""
-    | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
-    }}${retiredGuardPreamble(
-      ~retiredField,
-      ~retiredValues,
-      ~elevatedGroups,
-      ~ownerScoped=ownerField->Option.isSome,
-    )}
+      | None => ""
+      | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
+      }}${retiredGuardPreamble(
+        ~retiredField,
+        ~retiredValues,
+        ~elevatedGroups,
+        ~ownerScoped=ownerField->Option.isSome,
+      )}
   return (ctx.result?.data?.['${tableName}'] ?? []).filter(item =>
     item !== null${ownerField->Option.isSome ? " && _owns(item)" : ""}${retiredField->Option.isSome
-      ? " && _live(item)"
-      : ""});
+        ? " && _live(item)"
+        : ""});
 }
 `
 
@@ -1458,37 +1577,43 @@ let refsByIds = (
   ~retiredField: option<string>,
   ~retiredValues: option<array<string>>,
   ~namedWhenRetired: bool,
+  // The picture a reference shows this row by, already read off the state schema
+  // by `Reventless.RowImage` — this template only bakes in the expression it
+  // hands over. `None` for a view that declares none, which emits a literal
+  // `null`, exactly what the nullable field promises.
+  ~imageExpr: option<string>=?,
   ~ownerField: option<string>=?,
   ~elevatedGroups: array<string>=[],
-) => (tableName: string) => {
-  let ownerGuard = switch ownerField {
-  // Takes the row it ignores: APPSYNC_JS type-checks the resolver, so a
-  // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
-  // arguments, but got 1") and AppSync rejects the whole resolver at create
-  // time with "The code contains one or more errors". Only a door that emits
-  // the call conditionally is safe with a bare `() => true`, and that is not a
-  // property worth relying on across three templates.
-  | None => "\n  const _owns = (row) => true;"
-  | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
-  }
-  // Retirement, in the vocabulary the row itself uses: a member test for the
-  // state form, truthiness for the boolean one. Absent keeps the row live, which
-  // is what a row written before the annotation is.
-  let retiredExpr = switch (retiredField, retiredValues) {
-  | (None, _) => "false"
-  | (Some(f), Some(values)) =>
-    let literal = values->Array.map(v => `'${v}'`)->Array.join(", ")
-    `[${literal}].indexOf(row['${f}']) >= 0`
-  | (Some(f), None) => `row['${f}'] === true`
-  }
-  // Only the state form has a state to name, and only a retired row reports one:
-  // this door names rows, it does not publish a lifecycle column to callers the
-  // list withholds.
-  let stateExpr = switch (retiredField, retiredValues) {
-  | (Some(f), Some(_)) => `_retired(row) ? (row['${f}'] ?? null) : null`
-  | _ => "null"
-  }
-  `${importUtil}
+) =>
+  (tableName: string) => {
+    let ownerGuard = switch ownerField {
+    // Takes the row it ignores: APPSYNC_JS type-checks the resolver, so a
+    // zero-parameter stub called as `_owns(row)` is TS2554 ("Expected 0
+    // arguments, but got 1") and AppSync rejects the whole resolver at create
+    // time with "The code contains one or more errors". Only a door that emits
+    // the call conditionally is safe with a bare `() => true`, and that is not a
+    // property worth relying on across three templates.
+    | None => "\n  const _owns = (row) => true;"
+    | Some(field) => ownerGuardPreamble(~ownerField=field, ~elevatedGroups)
+    }
+    // Retirement, in the vocabulary the row itself uses: a member test for the
+    // state form, truthiness for the boolean one. Absent keeps the row live, which
+    // is what a row written before the annotation is.
+    let retiredExpr = switch (retiredField, retiredValues) {
+    | (None, _) => "false"
+    | (Some(f), Some(values)) =>
+      let literal = values->Array.map(v => `'${v}'`)->Array.join(", ")
+      `[${literal}].indexOf(row['${f}']) >= 0`
+    | (Some(f), None) => `row['${f}'] === true`
+    }
+    // Only the state form has a state to name, and only a retired row reports one:
+    // this door names rows, it does not publish a lifecycle column to callers the
+    // list withholds.
+    let stateExpr = switch (retiredField, retiredValues) {
+    | (Some(f), Some(_)) => `_retired(row) ? (row['${f}'] ?? null) : null`
+    | _ => "null"
+    }
+    `${importUtil}
 import { runtime } from '@aws-appsync/utils';
 export function request(ctx) {
   const ids = ctx.args.ids ?? [];
@@ -1513,19 +1638,19 @@ export function response(ctx) {
     .map(row => ({
       id: row.id,
       label: row['${labelField}'] ?? row.id,
+      image: ${imageExpr->Option.getOr("null")},
       retired: _retired(row),
       retiredState: ${stateExpr},
     }));
 }
 `
-}
+  }
 
 // ---------------------------------------------------------------------------
 // DynamoDB write
 // ---------------------------------------------------------------------------
 
-let putItem =
-  `${importUtil}
+let putItem = `${importUtil}
 export function request(ctx) {
   return {
     operation: 'PutItem',
@@ -1552,8 +1677,7 @@ export function request(ctx) {
 ${resultResponseCode}
 `->Pulumi.Input.make
 
-let deleteItem =
-  `${importUtil}
+let deleteItem = `${importUtil}
 export function request(ctx) {
   return {
     operation: 'DeleteItem',
@@ -1567,6 +1691,24 @@ ${resultResponseCode}
 // Lambda invocations
 // ---------------------------------------------------------------------------
 
+// The caller as a command Lambda reads it: a Cognito user, an IAM principal, or null.
+let callerIdentity = `identity: isCognito
+        ? {
+            userId: id.sub,
+            username: id.username,
+            groups: id.claims?.['cognito:groups'] ?? [],
+            claims: id.claims,
+            provider: 'Cognito'
+          }
+        : id != null
+          ? {
+              userArn: id.userArn ?? null,
+              accountId: id.accountId ?? null,
+              username: id.username ?? null,
+              provider: 'IAM'
+            }
+          : null`
+
 /** Invoke a CommandGenerator Lambda. `command` is the Aggregate command name. */
 let invokeCommandGenerator = (command: string) =>
   `${importUtil}
@@ -1579,26 +1721,10 @@ export function request(ctx) {
       command: '${command}',
       arguments: ctx.args,
       meta: {
-        ip: id?.sourceIp ?? null,
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1617,26 +1743,10 @@ export function request(ctx) {
       command: '${tag}',
       arguments: ctx.args,
       meta: {
-        ip: id?.sourceIp ?? null,
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1647,12 +1757,15 @@ ${resultResponseCode}
 let invokeInboundTranslation = (fieldName: string) =>
   `${importUtil}
 export function request(ctx) {
+  const id = ctx.identity;
+  const isCognito = id != null && id.sub != null;
   return {
     operation: 'Invoke',
     payload: {
       __inboundTranslation: true,
       fieldName: '${fieldName}',
-      arguments: ctx.args
+      arguments: ctx.args,
+      ${callerIdentity}
     }
   };
 }
@@ -1696,8 +1809,7 @@ export function response(ctx) {
 let authorizeIndexedAccessRequest = authorizeIndexedAccess
 
 /** @deprecated The response check is now part of authorizeIndexedAccess. */
-let authorizeIndexedAccessResponse = (~group as _: string) =>
-  resultResponseCode->Pulumi.Input.make
+let authorizeIndexedAccessResponse = (~group as _: string) => resultResponseCode->Pulumi.Input.make
 
 // ---------------------------------------------------------------------------
 // Response-only helpers