@reventlessdev/reventless-aws 3.0.0-alpha.174 → 3.0.0-alpha.176

package/tests/PgPipeline_IntegrationTest.res

@@ -0,0 +1,208 @@
+// End-to-end Postgres projection pipeline (B1 + B3.0 + B3.1 composed), minus AWS.
+//
+// Skipped unless PG_URL is set. Exercises the full deployed classic path against
+// a real database:
+//   classic append (`event_log`) → change-feed relay (`relayClassicWithPool`,
+//   emitting the EventCollector `{id, meta, event}` bodies) → feed-queue SQS
+//   records → `handleStreamEvent` decode → a real `ReadModel_Callback` projection
+//   (meta.service dispatch) → `QueryDbStorage_Postgres` write → `qdb_` row.
+//
+// This is the composition the first live deploy will exercise; the only pieces
+// it can't cover are the AWS boundary itself (SQS delivery, ESMs, VPC).
+
+open JestGlobals
+open ReventlessCore
+
+@val external processEnv: dict<string> = "process.env"
+
+// --- Fixtures: one classic source, one read model, one projection mapping ---
+
+module OrderSource = {
+  module Id = Reventless.Id.StringPure
+  let name = "Order"
+
+  @schema
+  type event = OrderPlaced({product: string})
+}
+
+module OrdersSpec = {
+  module Id = Reventless.Id.StringPure
+  let name = "PipelineOrders"
+  let moduleUrl = ""
+
+  @schema
+  type state = {id: string, product: string}
+
+  let config = Reventless.ReadModel.config()
+  let subIdConfig = None
+  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  let visibility: Reventless.Visibility.t = Public
+}
+
+module OrderMapping = Reventless.Projection.Mapping.Make(
+  OrderSource,
+  OrdersSpec,
+  {
+    let project = ({id, event, _}: Reventless.Message.event'<string, OrderSource.event>) =>
+      switch event {
+      | OrderPlaced({product}) => Reventless.Projection.Set(id, ({id, product}: OrdersSpec.state))
+      }
+  },
+)
+
+module OrdersMappings = {
+  module Target = OrdersSpec
+  module M = Reventless.Projection.Mappings.Make(OrdersSpec)
+  module type Mapping = M.Mapping
+  let moduleUrl = ""
+  let mappings: array<module(Mapping)> = [module(OrderMapping)]
+}
+
+// --- Helpers ---
+
+// The flat on-disk item the classic append stores verbatim — same shape the
+// DynamoDB path puts (id, position, event, data, decomposed meta). `service`
+// must be the SOURCE name: ReadModel_Callback dispatches mappings by
+// meta.service (the repeatedly-bitten projection dispatch key).
+let flatItem = (~id, ~seq, ~service, ~event: OrderSource.event) => {
+  let (eventType, data) =
+    event
+    ->S.reverseConvertToJsonOrThrow(OrderSource.eventSchema)
+    ->Message.splitMessage
+  [
+    ("id", JSON.Encode.string(id)),
+    ("position", JSON.Encode.string(seq->Int.toString->String.padStart(9, "0"))),
+    ("event", JSON.Encode.string(eventType)),
+    ("data", JSON.Encode.object(data)),
+  ]
+  ->Array.concat(Message.generateMeta(~service)->Message.decomposeMeta)
+  ->Dict.fromArray
+  ->JSON.Encode.object
+}
+
+// Wrap relay bodies the way the deployed feed queue delivers them.
+let asSqsEvent = (bodies: array<JSON.t>): PulumiAws.Lambda.CallbackFunction.event =>
+  Obj.magic({
+    "Records": bodies->Array.map(body =>
+      {
+        "eventSource": "aws:sqs",
+        "eventSourceARN": "arn:aws:sqs:eu-west-1:1:AllReadModelsFeed",
+        "body": JSON.stringify(body),
+      }
+    ),
+  })
+
+switch processEnv->Dict.get("PG_URL") {
+| None =>
+  testSync("Postgres pipeline integration (skipped — set PG_URL to run)", () =>
+    expect(true)->toBe(true)
+  )
+| Some(url) =>
+  let pool = ReventlessPostgres.PgDriver.makePool({connectionString: url})
+
+  let qdbOps = ReventlessPostgres.QueryDbStorage_Postgres.makeOperations(
+    ~pool,
+    ~name=OrdersSpec.name,
+    ~indexes=[],
+    ~subIdField=None,
+  )
+
+  module Callback = ReadModel_Callback.Make(
+    OrdersSpec,
+    OrdersMappings,
+    {
+      module ReadModelSpec = OrdersSpec
+      // Production passes the raw JSON op set (ReadModelEntryPoint) — actions are
+      // rewritten to JSON via stateSchema before handleAction, so the JSON-level
+      // ops satisfy the typed slot exactly as deployed.
+      let operations: QueryDb.operations<string, OrdersSpec.state> = Obj.magic(qdbOps)
+    },
+  )
+
+  beforeAllAsync(async () => {
+    await ReventlessPostgres.PgSchema.ensureSchema(pool)
+    await ReventlessPostgres.PgSchema.truncateAll(pool)
+    let _ = await pool->ReventlessPostgres.PgDriver.query(
+      `DROP TABLE IF EXISTS qdb_${OrdersSpec.name}`,
+      [],
+    )
+  })
+  afterAll(() => {
+    let _ = pool->ReventlessPostgres.PgDriver.endPool
+  })
+
+  describe("Postgres pipeline (append → relay → feed decode → projection → qdb row)", () => {
+    testPromise("projects a classic event end-to-end into the Postgres QueryDb", async () => {
+      let (_n, elOps, _s) =
+        ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+          ~pool,
+          ~name="PipelineOrderEventLog",
+          ~opts=(),
+        )
+      let _ = await elOps.append(
+        0,
+        "o-1",
+        [flatItem(~id="o-1", ~seq=0, ~service=OrderSource.name, ~event=OrderPlaced({product: "boat"}))],
+      )
+
+      // Relay drains event_log and emits the EventCollector bodies.
+      let sink = ref([])
+      let relayed = await PgChangeFeedRelay_Runtime.relayClassicWithPool(
+        ~pool,
+        ~logName="PipelineOrderEventLog",
+        ~subscriber="aws-rm-feed:PipelineOrderEventLog",
+        ~sendBatch=async jsons => sink := sink.contents->Array.concat(jsons),
+      )
+      expect(relayed)->toBe(1)
+
+      // Feed-queue delivery → entry-point decode → real projection callback.
+      let _ = await EventCollectorChannel_DynamoDbStream_Runtime.handleStreamEvent(
+        Callback.handleJsonEvents,
+        asSqsEvent(sink.contents),
+        (),
+      )->Effect.runPromise
+
+      // The projected row is in the Postgres QueryDb.
+      switch await qdbOps.load("o-1") {
+      | Ok(rows) =>
+        expect(rows->Array.length)->toBe(1)
+        let row = rows->Array.getUnsafe(0)->JSON.Decode.object->Option.getOrThrow
+        expect(row->Dict.get("product"))->toEqual(Some(JSON.Encode.string("boat")))
+        expect(row->Dict.get("id"))->toEqual(Some(JSON.Encode.string("o-1")))
+      | Error(_) => expect("load failed")->toBe("Ok")
+      }
+    })
+
+    testPromise("meta.service mismatch is a silent no-op (dispatch filter)", async () => {
+      let (_n, elOps, _s) =
+        ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+          ~pool,
+          ~name="PipelineWrongServiceEventLog",
+          ~opts=(),
+        )
+      let _ = await elOps.append(
+        0,
+        "o-2",
+        [flatItem(~id="o-2", ~seq=0, ~service="NotTheSource", ~event=OrderPlaced({product: "x"}))],
+      )
+
+      let sink = ref([])
+      let _ = await PgChangeFeedRelay_Runtime.relayClassicWithPool(
+        ~pool,
+        ~logName="PipelineWrongServiceEventLog",
+        ~subscriber="aws-rm-feed:PipelineWrongServiceEventLog",
+        ~sendBatch=async jsons => sink := sink.contents->Array.concat(jsons),
+      )
+      let _ = await EventCollectorChannel_DynamoDbStream_Runtime.handleStreamEvent(
+        Callback.handleJsonEvents,
+        asSqsEvent(sink.contents),
+        (),
+      )->Effect.runPromise
+
+      switch await qdbOps.load("o-2") {
+      | Ok(rows) => expect(rows->Array.length)->toBe(0)
+      | Error(_) => expect("load failed")->toBe("Ok")
+      }
+    })
+  })
+}

package/tests/PgPipeline_IntegrationTest.res.mjs

@@ -0,0 +1,260 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Effect from "effect/Effect";
+import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as Projection$Reventless from "@reventlessdev/reventless-spec/src/types/Projection.res.mjs";
+import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as PgDriver$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgDriver.res.mjs";
+import * as PgSchema$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgSchema.res.mjs";
+import * as ReadModel_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel_Callback.res.mjs";
+import * as PgChangeFeedRelay_Runtime$ReventlessAws from "../src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+import * as QueryDbStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/QueryDbStorage_Postgres.res.mjs";
+import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+import * as EventCollectorChannel_DynamoDbStream_Runtime$ReventlessAws from "../src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs";
+
+let name = "Order";
+
+let eventSchema = S.schema(s => ({
+  TAG: "OrderPlaced",
+  product: s.m(S.string)
+}));
+
+let OrderSource = {
+  Id: undefined,
+  name: name,
+  eventSchema: eventSchema
+};
+
+let name$1 = "PipelineOrders";
+
+let moduleUrl = "";
+
+let stateSchema = S.schema(s => ({
+  id: s.m(S.string),
+  product: s.m(S.string)
+}));
+
+let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+
+let OrdersSpec = {
+  Id: undefined,
+  name: name$1,
+  moduleUrl: moduleUrl,
+  stateSchema: stateSchema,
+  config: config,
+  subIdConfig: undefined,
+  authorization: "AllowAuthenticated",
+  visibility: "Public"
+};
+
+function project(param) {
+  let id = param.id;
+  return {
+    TAG: "Set",
+    _0: id,
+    _1: {
+      id: id,
+      product: param.event.product
+    }
+  };
+}
+
+let OrderMapping = Projection$Reventless.Mapping.Make({
+  Id: {
+    schema: Id$Reventless.StringPure.schema,
+    make: prim => prim,
+    makeFromString: prim => prim,
+    toString: prim => prim,
+    cmp: Id$Reventless.StringPure.cmp
+  },
+  name: name,
+  eventSchema: eventSchema
+})({
+  Id: {
+    schema: Id$Reventless.StringPure.schema,
+    make: prim => prim,
+    makeFromString: prim => prim,
+    toString: prim => prim,
+    cmp: Id$Reventless.StringPure.cmp
+  },
+  name: name$1,
+  stateSchema: stateSchema,
+  subIdConfig: undefined
+})({
+  project: project
+});
+
+let M = Projection$Reventless.Mappings.Make({
+  Id: {
+    schema: Id$Reventless.StringPure.schema,
+    make: prim => prim,
+    makeFromString: prim => prim,
+    toString: prim => prim,
+    cmp: Id$Reventless.StringPure.cmp
+  },
+  name: name$1,
+  stateSchema: stateSchema,
+  subIdConfig: undefined
+});
+
+let moduleUrl$1 = "";
+
+let mappings = [OrderMapping];
+
+let OrdersMappings = {
+  Target: undefined,
+  M: M,
+  moduleUrl: moduleUrl$1,
+  mappings: mappings
+};
+
+function flatItem(id, seq, service, event) {
+  let match = Message$ReventlessCore.splitMessage(S.reverseConvertToJsonOrThrow(event, eventSchema));
+  return Object.fromEntries([
+    [
+      "id",
+      id
+    ],
+    [
+      "position",
+      seq.toString().padStart(9, "0")
+    ],
+    [
+      "event",
+      match[0]
+    ],
+    [
+      "data",
+      match[1]
+    ]
+  ].concat(Message$ReventlessCore.decomposeMeta(Message$ReventlessCore.generateMeta(service, undefined, undefined, undefined, undefined, undefined, undefined, undefined))));
+}
+
+function asSqsEvent(bodies) {
+  return {
+    Records: bodies.map(body => ({
+      eventSource: "aws:sqs",
+      eventSourceARN: "arn:aws:sqs:eu-west-1:1:AllReadModelsFeed",
+      body: JSON.stringify(body)
+    }))
+  };
+}
+
+let url = process.env["PG_URL"];
+
+if (url !== undefined) {
+  let pool = PgDriver$ReventlessPostgres.makePool({
+    connectionString: url
+  });
+  let qdbOps = QueryDbStorage_Postgres$ReventlessPostgres.makeOperations(pool, name$1, [], undefined);
+  let Callback = ReadModel_Callback$ReventlessCore.Make({
+    Id: {
+      schema: Id$Reventless.StringPure.schema,
+      make: prim => prim,
+      makeFromString: prim => prim,
+      toString: prim => prim,
+      cmp: Id$Reventless.StringPure.cmp
+    },
+    name: name$1,
+    moduleUrl: moduleUrl,
+    stateSchema: stateSchema,
+    config: config,
+    subIdConfig: undefined,
+    authorization: "AllowAuthenticated",
+    visibility: "Public"
+  })({
+    moduleUrl: moduleUrl$1,
+    mappings: mappings
+  })({
+    ReadModelSpec: {
+      Id: {
+        schema: Id$Reventless.StringPure.schema,
+        make: prim => prim,
+        makeFromString: prim => prim,
+        toString: prim => prim,
+        cmp: Id$Reventless.StringPure.cmp
+      },
+      name: name$1,
+      moduleUrl: moduleUrl,
+      stateSchema: stateSchema,
+      config: config,
+      subIdConfig: undefined,
+      authorization: "AllowAuthenticated",
+      visibility: "Public"
+    },
+    operations: qdbOps
+  });
+  globalThis.beforeAll(async () => {
+    await PgSchema$ReventlessPostgres.ensureSchema(pool);
+    await PgSchema$ReventlessPostgres.truncateAll(pool);
+    await PgDriver$ReventlessPostgres.query(pool, `DROP TABLE IF EXISTS qdb_` + name$1, []);
+  });
+  globalThis.afterAll(() => {
+    PgDriver$ReventlessPostgres.endPool(pool);
+  });
+  globalThis.describe("Postgres pipeline (append → relay → feed decode → projection → qdb row)", () => {
+    globalThis.test("projects a classic event end-to-end into the Postgres QueryDb", async () => {
+      let match = EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, "PipelineOrderEventLog", undefined, undefined);
+      await match[1].append(0, "o-1", [flatItem("o-1", 0, name, {
+          TAG: "OrderPlaced",
+          product: "boat"
+        })]);
+      let sink = {
+        contents: []
+      };
+      let relayed = await PgChangeFeedRelay_Runtime$ReventlessAws.relayClassicWithPool(pool, "PipelineOrderEventLog", "aws-rm-feed:PipelineOrderEventLog", async jsons => {
+        sink.contents = sink.contents.concat(jsons);
+      });
+      globalThis.expect(relayed).toBe(1);
+      await Effect.runPromise(EventCollectorChannel_DynamoDbStream_Runtime$ReventlessAws.handleStreamEvent(Callback.handleJsonEvents, asSqsEvent(sink.contents), undefined));
+      let rows = await qdbOps.load("o-1");
+      if (rows.TAG === "Ok") {
+        let rows$1 = rows._0;
+        globalThis.expect(rows$1.length).toBe(1);
+        let row = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(rows$1[0]), undefined);
+        globalThis.expect(row["product"]).toEqual("boat");
+        globalThis.expect(row["id"]).toEqual("o-1");
+        return;
+      }
+      globalThis.expect("load failed").toBe("Ok");
+    });
+    globalThis.test("meta.service mismatch is a silent no-op (dispatch filter)", async () => {
+      let match = EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, "PipelineWrongServiceEventLog", undefined, undefined);
+      await match[1].append(0, "o-2", [flatItem("o-2", 0, "NotTheSource", {
+          TAG: "OrderPlaced",
+          product: "x"
+        })]);
+      let sink = {
+        contents: []
+      };
+      await PgChangeFeedRelay_Runtime$ReventlessAws.relayClassicWithPool(pool, "PipelineWrongServiceEventLog", "aws-rm-feed:PipelineWrongServiceEventLog", async jsons => {
+        sink.contents = sink.contents.concat(jsons);
+      });
+      await Effect.runPromise(EventCollectorChannel_DynamoDbStream_Runtime$ReventlessAws.handleStreamEvent(Callback.handleJsonEvents, asSqsEvent(sink.contents), undefined));
+      let rows = await qdbOps.load("o-2");
+      if (rows.TAG === "Ok") {
+        globalThis.expect(rows._0.length).toBe(0);
+        return;
+      }
+      globalThis.expect("load failed").toBe("Ok");
+    });
+  });
+} else {
+  globalThis.test("Postgres pipeline integration (skipped — set PG_URL to run)", () => {
+    globalThis.expect(true).toBe(true);
+  });
+}
+
+export {
+  OrderSource,
+  OrdersSpec,
+  OrderMapping,
+  OrdersMappings,
+  flatItem,
+  asSqsEvent,
+}
+/* eventSchema Not a pure module */

package/tests/PgQueryResolver_LambdaTest.res

@@ -0,0 +1,206 @@
+// Unit tests for the Postgres GraphQL-read Lambda dispatcher (B3.2a-2).
+//
+// `PgQueryResolver_Lambda.dispatch` is pure over a `binding`, so this exercises
+// kind routing, arg extraction, spec-level authorization, the queryInterceptor
+// hook, and the list push-down/fallback split with an IN-MEMORY mock binding —
+// no Postgres. SQL correctness lives in QueryEnginePostgres and is covered by
+// its PG_URL-gated parity test.
+
+open JestGlobals
+open ReventlessCore
+
+let mk = (id, status, name) => {
+  let o = Dict.make()
+  o->Dict.set("id", JSON.Encode.string(id))
+  o->Dict.set("status", JSON.Encode.string(status))
+  o->Dict.set("name", JSON.Encode.string(name))
+  JSON.Encode.object(o)
+}
+
+let store = Dict.fromArray([
+  ("p-1", mk("p-1", "active", "Alpha")),
+  ("p-2", mk("p-2", "inactive", "Bravo")),
+  ("p-3", mk("p-3", "active", "Charlie")),
+])
+let allItems = () => store->Dict.valuesToArray
+
+let fieldEq = (item, field, value) =>
+  item
+  ->JSON.Decode.object
+  ->Option.flatMap(d => d->Dict.get(field))
+  ->Option.flatMap(JSON.Decode.string)
+  ->Option.mapOr(false, v => v == value)
+
+// Records whether listPage was consulted, and what it returns (sentinel or None).
+let listPageReturn: ref<option<JSON.t>> = ref(None)
+
+let ops: QueryDb_Adapter.operations = {
+  load: async id => Ok(store->Dict.get(id)->Option.mapOr([], i => [i])),
+  loadStream: Obj.magic(0), // never called by dispatch
+  save: Obj.magic(0),
+  saveBatch: Obj.magic(0),
+  count: Obj.magic(0),
+  delete: Obj.magic(0),
+  deleteBatch: Obj.magic(0),
+}
+
+let pushdowns: PgQueryResolver_Lambda.pushdowns = {
+  indexLookup: async (~readModelName as _, field, value) =>
+    allItems()->Array.filter(i => fieldEq(i, field, value)),
+  byIds: async (~readModelName as _, ids) =>
+    ids->Array.filterMap(id => store->Dict.get(id)),
+  listPage: async (~readModelName as _, ~argsDict as _, ~capability as _, ~labelField as _) =>
+    listPageReturn.contents,
+  scanAll: async (~readModelName as _) => allItems(),
+}
+
+let capability: GraphQL_FragmentGenerator.serverCapability = {
+  filterFields: [{name: "status", gqlType: "String", range: false}],
+  sortFields: ["name", "status"],
+}
+
+let makeBinding = (~authorization=Reventless.Authorization.AllowAnonymous, ()): PgQueryResolver_Lambda.binding => {
+  ops,
+  pushdowns,
+  // "byStatus" index stored on the `status` field.
+  indexes: [
+    {index: "byStatus", type_: "S", idField: "status", projectionType: Reventless.ReadModel.ALL},
+  ],
+  subIdField: None,
+  capability,
+  labelField: "name",
+  includeIdParam: true,
+  authorization,
+}
+
+let mkPayload = (~kind, ~index=?, ~args=JSON.Encode.object(Dict.make()), ()): PgQueryResolver_Lambda.payload => {
+  readModelName: "Things",
+  kind,
+  ?index,
+  arguments: args,
+  identity: Reventless.Identity.anonymous,
+}
+
+let objArgs = pairs => JSON.Encode.object(Dict.fromArray(pairs))
+let field = (j, k) => j->JSON.Decode.object->Option.flatMap(d => d->Dict.get(k))
+let str = (j, k) => j->field(k)->Option.flatMap(JSON.Decode.string)
+let ids = (arr: JSON.t) =>
+  arr
+  ->JSON.Decode.array
+  ->Option.getOr([])
+  ->Array.filterMap(i => i->str("id"))
+  ->Array.toSorted(String.compare)
+
+describe("PgQueryResolver_Lambda.dispatch", () => {
+  testPromise("getById returns the item (id-carrying)", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="getById", ~args=objArgs([("id", JSON.Encode.string("p-2"))]), ()),
+    )
+    expect(r->str("id"))->toEqual(Some("p-2"))
+    expect(r->str("name"))->toEqual(Some("Bravo"))
+  })
+
+  testPromise("getById miss → null", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="getById", ~args=objArgs([("id", JSON.Encode.string("absent"))]), ()),
+    )
+    expect(r)->toBe(JSON.Encode.null)
+  })
+
+  testPromise("byIds returns matches, drops missing", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="byIds",
+        ~args=objArgs([
+          ("ids", JSON.Encode.array(["p-1", "absent", "p-3"]->Array.map(JSON.Encode.string))),
+        ]),
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("index routes to indexLookup on the idField", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="index",
+        ~index="byStatus",
+        // arg name is the index name; value looked up against idField `status`
+        ~args=objArgs([("byStatus", JSON.Encode.string("active"))]),
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("list with push-down → returns the connection listPage gives", async () => {
+    listPageReturn := Some(JSON.Encode.string("PUSHED"))
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="list", ()),
+    )
+    listPageReturn := None
+    expect(r)->toEqual(JSON.Encode.string("PUSHED"))
+  })
+
+  testPromise("list without push-down → falls back to the shared spec", async () => {
+    listPageReturn := None
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="list", ()),
+    )
+    // A connection object: edges present, all 3 items, sorted by id.
+    let edgeIds =
+      r
+      ->field("edges")
+      ->Option.flatMap(JSON.Decode.array)
+      ->Option.getOr([])
+      ->Array.filterMap(e => e->field("node")->Option.flatMap(n => n->str("id")))
+    expect(edgeIds)->toEqual(["p-1", "p-2", "p-3"])
+  })
+
+  testPromise("authorization DenyAll → empty shape per kind", async () => {
+    let b = makeBinding(~authorization=DenyAll, ())
+    let single = await PgQueryResolver_Lambda.dispatch(
+      ~binding=b,
+      ~payload=mkPayload(~kind="getById", ~args=objArgs([("id", JSON.Encode.string("p-1"))]), ()),
+    )
+    expect(single)->toBe(JSON.Encode.null)
+    let list = await PgQueryResolver_Lambda.dispatch(~binding=b, ~payload=mkPayload(~kind="list", ()))
+    expect(list->field("edges")->Option.flatMap(JSON.Decode.array)->Option.getOr([])->Array.length)->toBe(0)
+    let byIds = await PgQueryResolver_Lambda.dispatch(
+      ~binding=b,
+      ~payload=mkPayload(~kind="byIds", ~args=objArgs([("ids", JSON.Encode.array([]))]), ()),
+    )
+    expect(byIds->JSON.Decode.array->Option.getOr([])->Array.length)->toBe(0)
+  })
+
+  testPromise("queryInterceptor hook Deny → empty shape (auth allowed)", async () => {
+    QueryDb_Callback.registerQueryInterceptor(async (~identity as _, ~readModelName as _, ~args as _) =>
+      Deny("nope")
+    )
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="getById", ~args=objArgs([("id", JSON.Encode.string("p-1"))]), ()),
+    )
+    QueryDb_Callback.clearQueryInterceptor()
+    expect(r)->toBe(JSON.Encode.null)
+  })
+
+  testPromise("unmapped kind throws", async () => {
+    let threw = try {
+      let _ = await PgQueryResolver_Lambda.dispatch(
+        ~binding=makeBinding(),
+        ~payload=mkPayload(~kind="frobnicate", ()),
+      )
+      false
+    } catch {
+    | _ => true
+    }
+    expect(threw)->toBe(true)
+  })
+})