@reventlessdev/reventless-aws 3.0.0-alpha.171 → 3.0.0-alpha.173

package/src/util/Util_AppSync_Caller.res.mjs

@@ -47,9 +47,11 @@ function jsonToLiteral(value) {
   }
 }
 
-function buildQuery(mutation, variablesDict) {
+function buildQuery(mutation, selectionOpt, variablesDict) {
+  let selection = selectionOpt !== undefined ? selectionOpt : "{ __typename }";
   let args = Object.entries(variablesDict).map(param => param[0] + `: ` + jsonToLiteral(param[1])).join(", ");
-  return `mutation { ` + mutation + `(` + args + `) }`;
+  let sel = selection === "" ? "" : ` ` + selection;
+  return `mutation { ` + mutation + `(` + args + `)` + sel + ` }`;
 }
 
 async function sendQuery(endpoint, region, queryString) {
@@ -104,7 +106,8 @@ async function sendQuery(endpoint, region, queryString) {
   }
 }
 
-async function sendMutation(endpoint, region, mutation, variables) {
+async function sendMutation(endpoint, region, mutation, selectionOpt, variables) {
+  let selection = selectionOpt !== undefined ? selectionOpt : "{ __typename }";
   let url = new URL(endpoint);
   let hostname = url.hostname;
   let path = url.pathname;
@@ -116,7 +119,7 @@ async function sendMutation(endpoint, region, mutation, variables) {
   } else {
     variablesDict = {};
   }
-  let query = buildQuery(mutation, variablesDict);
+  let query = buildQuery(mutation, selection, variablesDict);
   let body = JSON.stringify(Object.fromEntries([[
       "query",
       query

package/tests/AppSync_AdapterTest.res

@@ -347,6 +347,146 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
   })
 })
 
+// ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
+//
+// A field flagged `iamCallable` must be reachable by BOTH the console UI
+// (Cognito) and the deploy-time SigV4 system caller (AWS_IAM). It switches from
+// the single-mode `@aws_auth(...)` form to the multi-auth
+// `@aws_cognito_user_pools(...) @aws_iam` form.
+
+describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: mutationFields,
+      queries: queryFields,
+      subscriptions: [],
+    })
+
+  testSync("iamCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+    expect(m)->toContain("@aws_iam")
+    // Must NOT emit the single-mode form, which does not admit IAM.
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("iamCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowAuthenticated)]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    // Bare @aws_cognito_user_pools (any authenticated Cognito user) + IAM.
+    expect(m)->toContain("@aws_cognito_user_pools @aws_iam")
+    expect(m)->not_->toContain("cognito_groups")
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("a non-iamCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync", "p_Other"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([
+        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
+      ]),
+      // iamCallable applies to every field in the entry; split the fields so only
+      // p_Sync opts in.
+      iamCallable: false,
+    }
+    let iamEntry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String", "p_Other(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry, iamEntry], ~queryEntries=[])
+    let parts = decodeFragment(aug)
+    switch parts.mutations->Array.find(f => f->String.includes("p_Other")) {
+    | Some(other) =>
+      expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(other)->not_->toContain("@aws_iam")
+    | None => JsError.throwWithMessage("missing p_Other field")
+    }
+  })
+
+  testSync("iamCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry: ReventlessInfra.Api.querySchemaEntry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(
+      [],
+      ["p_Item(id: ID!): Item", "p_Items(first: Int, after: String): ItemConnection!"],
+    )
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[entry])
+    let parts = decodeFragment(aug)
+    switch (
+      parts.queries->Array.find(f => f->String.includes("p_Item(")),
+      parts.queries->Array.find(f => f->String.includes("p_Items(")),
+    ) {
+    | (Some(single), Some(list)) =>
+      expect(single)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(single)->toContain("@aws_iam")
+      expect(list)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(list)->toContain("@aws_iam")
+    | _ => JsError.throwWithMessage("missing query fields")
+    }
+  })
+})
+
+describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=true)
+
+  testSync("marks only the named field dual-auth, leaving others single-mode", () => {
+    // Pick a real mutation field name from the admin base fragment.
+    let firstMutationName =
+      decodeFragment(baseFragment).mutations
+      ->Array.getUnsafe(0)
+      ->ReventlessCore.GraphQL_Stitcher.extractLeadingName
+    let augmented =
+      AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin", ~iamFieldNames=[firstMutationName])
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => {
+      let name = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
+      if name == firstMutationName {
+        expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+        expect(field)->toContain("@aws_iam")
+        expect(field)->not_->toContain("@aws_auth")
+      } else {
+        expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+        expect(field)->not_->toContain("@aws_iam")
+      }
+    })
+  })
+
+  testSync("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+    parts.queries->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+  })
+})
+
 describe("Split mode — empty base fragment", () => {
   testSync("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = ReventlessCore.GraphQL_Stitcher.encode({

package/tests/AppSync_AdapterTest.res.mjs

@@ -27,14 +27,14 @@ let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
   globalThis.test("adds @aws_auth directive to all mutation fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("adds @aws_auth directive to all query fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.queries.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
@@ -42,12 +42,12 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves type definitions unchanged", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.types).toEqual(original.types);
   });
   globalThis.test("uses specified group name", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
@@ -55,7 +55,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves subscription fields with @aws_auth directive", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
     globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
@@ -64,7 +64,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
     });
   });
   globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     let joined = parts.subscriptions.join("\n");
     globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
@@ -282,6 +282,182 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
   });
 });
 
+globalThis.describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: mutationFields,
+    queries: queryFields,
+    subscriptions: []
+  });
+  globalThis.test("iamCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let entry_iamCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+    globalThis.expect(m).toContain("@aws_iam");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("iamCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        "AllowAuthenticated"
+      ]]);
+    let entry_iamCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools @aws_iam");
+    globalThis.expect(m).not.toContain("cognito_groups");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("a non-iamCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry_fieldNames = [
+      "p_Sync",
+      "p_Other"
+    ];
+    let entry_fieldPermissions = Object.fromEntries([
+      [
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ],
+      [
+        "p_Other",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]
+    ]);
+    let entry_iamCallable = false;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let iamEntry_fieldNames = ["p_Sync"];
+    let iamEntry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let iamEntry_iamCallable = true;
+    let iamEntry = {
+      fieldNames: iamEntry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: iamEntry_fieldPermissions,
+      iamCallable: iamEntry_iamCallable
+    };
+    let frag = makeFragment([
+      "p_Sync(id: ID!): String",
+      "p_Other(id: ID!): String"
+    ], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [
+      entry,
+      iamEntry
+    ], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let other = parts.mutations.find(f => f.includes("p_Other"));
+    if (other !== undefined) {
+      globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(other).not.toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing p_Other field");
+    }
+  });
+  globalThis.test("iamCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry_permission = {
+      TAG: "AllowGroups",
+      _0: ["Admin"]
+    };
+    let entry_iamCallable = true;
+    let entry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: undefined,
+      permission: entry_permission,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let match = parts.queries.find(f => f.includes("p_Item("));
+    let match$1 = parts.queries.find(f => f.includes("p_Items("));
+    if (match !== undefined && match$1 !== undefined) {
+      globalThis.expect(match).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match).toContain("@aws_iam");
+      globalThis.expect(match$1).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match$1).toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing query fields");
+    }
+  });
+});
+
+globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  globalThis.test("marks only the named field dual-auth, leaving others single-mode", () => {
+    let firstMutationName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(GraphQL_Stitcher$ReventlessCore.decode(baseFragment).mutations[0]);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", [firstMutationName]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      let name = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
+      if (name === firstMutationName) {
+        globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).toContain("@aws_iam");
+        globalThis.expect(field).not.toContain("@aws_auth");
+      } else {
+        globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).not.toContain("@aws_iam");
+      }
+    });
+  });
+  globalThis.test("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+    parts.queries.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+  });
+});
+
 globalThis.describe("Split mode — empty base fragment", () => {
   globalThis.test("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = GraphQL_Stitcher$ReventlessCore.encode({

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -316,7 +316,9 @@ describe("Runtime.appendUnconditional", () => {
     let events = manyTags->Array.map(t => event("Foo", [t]))
     let result = await Runtime.appendUnconditional(table, events)
     switch result {
-    | Error(msg) => expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
+      expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })
@@ -555,8 +557,9 @@ describe("Runtime.appendConditional", () => {
     }
     let result = await Runtime.appendConditional(table, [], cond)
     switch result {
-    | Error(msg) =>
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
       expect(msg->String.includes("tagless"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })
@@ -579,8 +582,9 @@ describe("Runtime.appendConditional", () => {
     }
     let result = await Runtime.appendConditional(table, [event], cond)
     switch result {
-    | Error(msg) =>
+    | Error(ReventlessInfra.DcbEventLog.StorageFailure(msg)) =>
       expect(msg->String.includes("limit exceeded"))->toBe(true)
+    | Error(Conflict) => expect("expected StorageFailure, got Conflict")->toBe("")
     | Ok(_) => expect("expected Error, got Ok")->toBe("")
     }
   })

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -363,7 +363,12 @@ globalThis.describe("Runtime.appendUnconditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("limit exceeded")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("limit exceeded")).toBe(true);
   });
 });
 
@@ -683,7 +688,12 @@ globalThis.describe("Runtime.appendConditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("tagless")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("tagless")).toBe(true);
   });
   globalThis.test("rejects appends exceeding 100 items with a clear error", async () => {
     let manyTags = Stdlib_Array.fromInitializer(100, i => ({
@@ -716,7 +726,12 @@ globalThis.describe("Runtime.appendConditional", () => {
       globalThis.expect("expected Error, got Ok").toBe("");
       return;
     }
-    globalThis.expect(result._0.includes("limit exceeded")).toBe(true);
+    let msg = result._0;
+    if (typeof msg !== "object") {
+      globalThis.expect("expected StorageFailure, got Conflict").toBe("");
+      return;
+    }
+    globalThis.expect(msg._0.includes("limit exceeded")).toBe(true);
   });
 });
 

package/tests/PgChangeFeedRelay_RuntimeTest.res

@@ -0,0 +1,44 @@
+open JestGlobals
+
+// A realistic DCB feed event as PgChangeFeed.readBatch would surface it.
+let sampleEvent: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: [("customerId", JSON.Encode.string("c-1"))]->Dict.fromArray->JSON.Encode.object,
+  tags: [{key: "orderId", value: "o-1"}],
+  meta: {
+    service: "Orders",
+    time: "2026-07-05T10:00:00.000Z",
+    msgId: "m-1",
+    correlationId: "m-1",
+  },
+  recordedAt: "2026-07-05T10:00:00.000Z",
+}
+
+describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  testSync("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(sampleEvent)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+
+    // id = derivePartitionKey with no partitionTag → "<firstTag.key>:<value>"
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("orderId:o-1")))
+
+    // event carries the event type + payload (combineMessage encodes a
+    // payload-bearing variant as an object, e.g. {"OrderCreated": {...}})
+    let eventJson = obj->Dict.get("event")->Option.getOrThrow
+    expect(eventJson->JSON.stringify->String.includes("OrderCreated"))->toBe(true)
+    expect(eventJson->JSON.stringify->String.includes("c-1"))->toBe(true)
+
+    // meta round-trips the producing service
+    let metaObj =
+      obj->Dict.get("meta")->Option.flatMap(JSON.Decode.object)->Option.getOrThrow
+    expect(metaObj->Dict.get("service"))->toEqual(Some(JSON.Encode.string("Orders")))
+  })
+
+  testSync("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags = {...sampleEvent, tags: []}
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(noTags)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("dcb")))
+  })
+})

package/tests/PgChangeFeedRelay_RuntimeTest.res.mjs

@@ -0,0 +1,70 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as PgChangeFeedRelay_Runtime$ReventlessAws from "../src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+
+let sampleEvent_data = Object.fromEntries([[
+    "customerId",
+    "c-1"
+  ]]);
+
+let sampleEvent_tags = [{
+    key: "orderId",
+    value: "o-1"
+  }];
+
+let sampleEvent_meta = {
+  service: "Orders",
+  time: "2026-07-05T10:00:00.000Z",
+  msgId: "m-1",
+  correlationId: "m-1"
+};
+
+let sampleEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: sampleEvent_data,
+  tags: sampleEvent_tags,
+  meta: sampleEvent_meta,
+  recordedAt: "2026-07-05T10:00:00.000Z"
+};
+
+globalThis.describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  globalThis.test("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(sampleEvent, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("orderId:o-1");
+    let eventJson = Stdlib_Option.getOrThrow(obj["event"], undefined);
+    globalThis.expect(JSON.stringify(eventJson).includes("OrderCreated")).toBe(true);
+    globalThis.expect(JSON.stringify(eventJson).includes("c-1")).toBe(true);
+    let metaObj = Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(obj["meta"], Stdlib_JSON.Decode.object), undefined);
+    globalThis.expect(metaObj["service"]).toEqual("Orders");
+  });
+  globalThis.test("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags_data = sampleEvent_data;
+    let noTags_tags = [];
+    let noTags_meta = {
+      service: "Orders",
+      time: "2026-07-05T10:00:00.000Z",
+      msgId: "m-1",
+      correlationId: "m-1"
+    };
+    let noTags = {
+      position: "00000000000000000042:00000000000000000007",
+      eventType: "OrderCreated",
+      data: noTags_data,
+      tags: noTags_tags,
+      meta: noTags_meta,
+      recordedAt: "2026-07-05T10:00:00.000Z"
+    };
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(noTags, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("dcb");
+  });
+});
+
+export {
+  sampleEvent,
+}
+/* sampleEvent Not a pure module */

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -44,7 +44,8 @@ let isOk = r =>
 
 let isConflict = r =>
   switch r {
-  | Error(msg) => msg->String.includes("Conflict")
+  | Error(ReventlessInfra.DcbEventLog.Conflict) => true
+  | Error(StorageFailure(_)) => false
   | Ok(_) => false
   }
 

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res.mjs

@@ -41,9 +41,9 @@ function isOk(r) {
 function isConflict(r) {
   if (r.TAG === "Ok") {
     return false;
-  } else {
-    return r._0.includes("Conflict");
   }
+  let tmp = r._0;
+  return typeof tmp !== "object";
 }
 
 async function readAfter(table, query) {