@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.173

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res.mjs

@@ -66,7 +66,7 @@ function forCommandTopic(param, connect, memorySizeOpt, timeoutOpt, param$1, par
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs", {}, undefined);
-  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts));
+  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
 }
 
 function finish() {

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -300,7 +300,7 @@ function Make(EventCollectorChannel) {
     });
     let codeOutput = bundleOutput.apply(b => b.code);
     let sourceCodeHashOutput = bundleOutput.apply(b => b.sourceCodeHash);
-    let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, codeOutput, sourceCodeHashOutput, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts);
+    let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, codeOutput, sourceCodeHashOutput, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts);
     EventCollectorChannel.connect(name, [{
         channel: eventCollector.channel,
         eventTopics: eventTopics,
@@ -422,7 +422,7 @@ function Make(EventCollectorChannel) {
     envVars["PLUGIN_ID"] = Pulumi.output(hbConfig.pluginId);
     envVars["HEARTBEAT_TIMEOUT"] = Pulumi.output(hbConfig.heartbeatTimeout.toString());
     let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.mjs", {}, undefined);
-    connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts));
+    connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
   };
   let forDcbCommandTopic = (param, connect, $staropt$star, $staropt$star$1, dcbCommandTopic) => {
     $staropt$star !== undefined;

package/tests/AppSync_AdapterTest.res

@@ -347,6 +347,146 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
   })
 })
 
+// ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
+//
+// A field flagged `iamCallable` must be reachable by BOTH the console UI
+// (Cognito) and the deploy-time SigV4 system caller (AWS_IAM). It switches from
+// the single-mode `@aws_auth(...)` form to the multi-auth
+// `@aws_cognito_user_pools(...) @aws_iam` form.
+
+describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: mutationFields,
+      queries: queryFields,
+      subscriptions: [],
+    })
+
+  testSync("iamCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+    expect(m)->toContain("@aws_iam")
+    // Must NOT emit the single-mode form, which does not admit IAM.
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("iamCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowAuthenticated)]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    // Bare @aws_cognito_user_pools (any authenticated Cognito user) + IAM.
+    expect(m)->toContain("@aws_cognito_user_pools @aws_iam")
+    expect(m)->not_->toContain("cognito_groups")
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("a non-iamCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync", "p_Other"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([
+        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
+      ]),
+      // iamCallable applies to every field in the entry; split the fields so only
+      // p_Sync opts in.
+      iamCallable: false,
+    }
+    let iamEntry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String", "p_Other(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry, iamEntry], ~queryEntries=[])
+    let parts = decodeFragment(aug)
+    switch parts.mutations->Array.find(f => f->String.includes("p_Other")) {
+    | Some(other) =>
+      expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(other)->not_->toContain("@aws_iam")
+    | None => JsError.throwWithMessage("missing p_Other field")
+    }
+  })
+
+  testSync("iamCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry: ReventlessInfra.Api.querySchemaEntry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      iamCallable: true,
+    }
+    let frag = makeFragment(
+      [],
+      ["p_Item(id: ID!): Item", "p_Items(first: Int, after: String): ItemConnection!"],
+    )
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[entry])
+    let parts = decodeFragment(aug)
+    switch (
+      parts.queries->Array.find(f => f->String.includes("p_Item(")),
+      parts.queries->Array.find(f => f->String.includes("p_Items(")),
+    ) {
+    | (Some(single), Some(list)) =>
+      expect(single)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(single)->toContain("@aws_iam")
+      expect(list)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(list)->toContain("@aws_iam")
+    | _ => JsError.throwWithMessage("missing query fields")
+    }
+  })
+})
+
+describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=true)
+
+  testSync("marks only the named field dual-auth, leaving others single-mode", () => {
+    // Pick a real mutation field name from the admin base fragment.
+    let firstMutationName =
+      decodeFragment(baseFragment).mutations
+      ->Array.getUnsafe(0)
+      ->ReventlessCore.GraphQL_Stitcher.extractLeadingName
+    let augmented =
+      AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin", ~iamFieldNames=[firstMutationName])
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => {
+      let name = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
+      if name == firstMutationName {
+        expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+        expect(field)->toContain("@aws_iam")
+        expect(field)->not_->toContain("@aws_auth")
+      } else {
+        expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+        expect(field)->not_->toContain("@aws_iam")
+      }
+    })
+  })
+
+  testSync("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+    parts.queries->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+  })
+})
+
 describe("Split mode — empty base fragment", () => {
   testSync("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = ReventlessCore.GraphQL_Stitcher.encode({

package/tests/AppSync_AdapterTest.res.mjs

@@ -27,14 +27,14 @@ let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
   globalThis.test("adds @aws_auth directive to all mutation fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("adds @aws_auth directive to all query fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.queries.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
@@ -42,12 +42,12 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves type definitions unchanged", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.types).toEqual(original.types);
   });
   globalThis.test("uses specified group name", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
@@ -55,7 +55,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves subscription fields with @aws_auth directive", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
     globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
@@ -64,7 +64,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
     });
   });
   globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     let joined = parts.subscriptions.join("\n");
     globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
@@ -282,6 +282,182 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
   });
 });
 
+globalThis.describe("AppSync_Adapter.injectAwsAuth — iamCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: mutationFields,
+    queries: queryFields,
+    subscriptions: []
+  });
+  globalThis.test("iamCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let entry_iamCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+    globalThis.expect(m).toContain("@aws_iam");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("iamCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        "AllowAuthenticated"
+      ]]);
+    let entry_iamCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools @aws_iam");
+    globalThis.expect(m).not.toContain("cognito_groups");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("a non-iamCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry_fieldNames = [
+      "p_Sync",
+      "p_Other"
+    ];
+    let entry_fieldPermissions = Object.fromEntries([
+      [
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ],
+      [
+        "p_Other",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]
+    ]);
+    let entry_iamCallable = false;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      iamCallable: entry_iamCallable
+    };
+    let iamEntry_fieldNames = ["p_Sync"];
+    let iamEntry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let iamEntry_iamCallable = true;
+    let iamEntry = {
+      fieldNames: iamEntry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: iamEntry_fieldPermissions,
+      iamCallable: iamEntry_iamCallable
+    };
+    let frag = makeFragment([
+      "p_Sync(id: ID!): String",
+      "p_Other(id: ID!): String"
+    ], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [
+      entry,
+      iamEntry
+    ], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let other = parts.mutations.find(f => f.includes("p_Other"));
+    if (other !== undefined) {
+      globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(other).not.toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing p_Other field");
+    }
+  });
+  globalThis.test("iamCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry_permission = {
+      TAG: "AllowGroups",
+      _0: ["Admin"]
+    };
+    let entry_iamCallable = true;
+    let entry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: undefined,
+      permission: entry_permission,
+      iamCallable: entry_iamCallable
+    };
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let match = parts.queries.find(f => f.includes("p_Item("));
+    let match$1 = parts.queries.find(f => f.includes("p_Items("));
+    if (match !== undefined && match$1 !== undefined) {
+      globalThis.expect(match).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match).toContain("@aws_iam");
+      globalThis.expect(match$1).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match$1).toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing query fields");
+    }
+  });
+});
+
+globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  globalThis.test("marks only the named field dual-auth, leaving others single-mode", () => {
+    let firstMutationName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(GraphQL_Stitcher$ReventlessCore.decode(baseFragment).mutations[0]);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", [firstMutationName]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      let name = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
+      if (name === firstMutationName) {
+        globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).toContain("@aws_iam");
+        globalThis.expect(field).not.toContain("@aws_auth");
+      } else {
+        globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).not.toContain("@aws_iam");
+      }
+    });
+  });
+  globalThis.test("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+    parts.queries.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+  });
+});
+
 globalThis.describe("Split mode — empty base fragment", () => {
   globalThis.test("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = GraphQL_Stitcher$ReventlessCore.encode({

package/tests/PgChangeFeedRelay_RuntimeTest.res

@@ -0,0 +1,44 @@
+open JestGlobals
+
+// A realistic DCB feed event as PgChangeFeed.readBatch would surface it.
+let sampleEvent: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: [("customerId", JSON.Encode.string("c-1"))]->Dict.fromArray->JSON.Encode.object,
+  tags: [{key: "orderId", value: "o-1"}],
+  meta: {
+    service: "Orders",
+    time: "2026-07-05T10:00:00.000Z",
+    msgId: "m-1",
+    correlationId: "m-1",
+  },
+  recordedAt: "2026-07-05T10:00:00.000Z",
+}
+
+describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  testSync("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(sampleEvent)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+
+    // id = derivePartitionKey with no partitionTag → "<firstTag.key>:<value>"
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("orderId:o-1")))
+
+    // event carries the event type + payload (combineMessage encodes a
+    // payload-bearing variant as an object, e.g. {"OrderCreated": {...}})
+    let eventJson = obj->Dict.get("event")->Option.getOrThrow
+    expect(eventJson->JSON.stringify->String.includes("OrderCreated"))->toBe(true)
+    expect(eventJson->JSON.stringify->String.includes("c-1"))->toBe(true)
+
+    // meta round-trips the producing service
+    let metaObj =
+      obj->Dict.get("meta")->Option.flatMap(JSON.Decode.object)->Option.getOrThrow
+    expect(metaObj->Dict.get("service"))->toEqual(Some(JSON.Encode.string("Orders")))
+  })
+
+  testSync("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags = {...sampleEvent, tags: []}
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(noTags)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("dcb")))
+  })
+})

package/tests/PgChangeFeedRelay_RuntimeTest.res.mjs

@@ -0,0 +1,70 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as PgChangeFeedRelay_Runtime$ReventlessAws from "../src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+
+let sampleEvent_data = Object.fromEntries([[
+    "customerId",
+    "c-1"
+  ]]);
+
+let sampleEvent_tags = [{
+    key: "orderId",
+    value: "o-1"
+  }];
+
+let sampleEvent_meta = {
+  service: "Orders",
+  time: "2026-07-05T10:00:00.000Z",
+  msgId: "m-1",
+  correlationId: "m-1"
+};
+
+let sampleEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: sampleEvent_data,
+  tags: sampleEvent_tags,
+  meta: sampleEvent_meta,
+  recordedAt: "2026-07-05T10:00:00.000Z"
+};
+
+globalThis.describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  globalThis.test("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(sampleEvent, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("orderId:o-1");
+    let eventJson = Stdlib_Option.getOrThrow(obj["event"], undefined);
+    globalThis.expect(JSON.stringify(eventJson).includes("OrderCreated")).toBe(true);
+    globalThis.expect(JSON.stringify(eventJson).includes("c-1")).toBe(true);
+    let metaObj = Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(obj["meta"], Stdlib_JSON.Decode.object), undefined);
+    globalThis.expect(metaObj["service"]).toEqual("Orders");
+  });
+  globalThis.test("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags_data = sampleEvent_data;
+    let noTags_tags = [];
+    let noTags_meta = {
+      service: "Orders",
+      time: "2026-07-05T10:00:00.000Z",
+      msgId: "m-1",
+      correlationId: "m-1"
+    };
+    let noTags = {
+      position: "00000000000000000042:00000000000000000007",
+      eventType: "OrderCreated",
+      data: noTags_data,
+      tags: noTags_tags,
+      meta: noTags_meta,
+      recordedAt: "2026-07-05T10:00:00.000Z"
+    };
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(noTags, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("dcb");
+  });
+});
+
+export {
+  sampleEvent,
+}
+/* sampleEvent Not a pure module */