@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -0,0 +1,170 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "../Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let resolveDataSourceName = {
+  contents: param => {}
+};
+
+let dataSourceNamePromise = new Promise((resolve, _reject) => {
+  resolveDataSourceName.contents = resolve;
+});
+
+let entries = {};
+
+function register(entry) {
+  entries[entry.readModelName] = entry;
+}
+
+let nodeTypes = {};
+
+function registerNodeType(typeName, readModelName) {
+  nodeTypes[typeName] = readModelName;
+}
+
+function bool(b) {
+  if (b) {
+    return "true";
+  } else {
+    return "false";
+  }
+}
+
+let nodeResolverCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function pgConnectionJson(cc) {
+  return JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc));
+}
+
+function provision(api, selection, opts, createNodeResolverOpt) {
+  let createNodeResolver = createNodeResolverOpt !== undefined ? createNodeResolverOpt : true;
+  let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
+    let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
+    if (info !== undefined && info.pgBacked) {
+      return [
+        entry,
+        info.specModulePath
+      ];
+    }
+  });
+  if (handlers.length === 0) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PgQueryResolver";
+  let packageDirs = {};
+  handlers.forEach(param => {
+    let pkg = Util_Bundle$ReventlessAws.extractPackageName(param[1]);
+    packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(pkg);
+  });
+  let handlerJsons = handlers.toSorted((param, param$1) => Primitive_string.compare(param[0].readModelName, param$1[0].readModelName)).map(param => {
+    let entry = param[0];
+    let specModule = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
+    return `{"readModelName":"` + entry.readModelName + `","specModule":` + specModule + `,"labelField":"` + entry.labelField + `","includeIdParam":` + (
+      entry.includeIdParam ? "true" : "false"
+    ) + `}`;
+  });
+  let nodeTypesJson = Object.entries(nodeTypes).toSorted((param, param$1) => Primitive_string.compare(param[0], param$1[0])).map(param => `"` + param[0] + `":"` + param[1] + `"`).join(",");
+  let queryResolverConfig = selection.connectionConfig.apply(cc => `{"pgConnection":` + pgConnectionJson(cc) + `,"handlers":[` + handlerJsons.join(",") + `],"nodeTypes":{` + nodeTypesJson + `}}`);
+  let envVars = {};
+  envVars["QUERY_RESOLVER_CONFIG"] = queryResolverConfig;
+  envVars["Environment"] = Pulumi.getStack();
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs", packageDirs, undefined);
+  let vpcConfig = selection.securityGroupId.apply(sgId => ({
+    subnetIds: selection.subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, 512, 30, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  selection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)(name + "-pgSecret", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "-pgSecretPolicy", [{
+        Sid: "AllowGetPgSecret",
+        Effect: "Allow",
+        Action: "secretsmanager:GetSecretValue",
+        Resource: cc.secretArn
+      }])),
+    role: runtime.parts.lambdaRole.id
+  }));
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), customOpts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, l => l.arn);
+  Pulumi.all([
+    lambdaArn,
+    dataSourceRole.id
+  ]).apply(param => new (Aws.iam.RolePolicy)(name + "DataSourceInvoke", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourceInvokePolicy", [{
+        Sid: "AllowDataSourceInvokeLambda",
+        Effect: "Allow",
+        Action: "lambda:InvokeFunction",
+        Resource: param[0]
+      }])),
+    role: param[1]
+  }));
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, a => a.id),
+    lambdaConfig: {
+      functionArn: lambdaArn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, customOpts);
+  if (createNodeResolver && Object.entries(nodeTypes).length !== 0) {
+    AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
+  }
+  dataSource.name.apply(n => resolveDataSourceName.contents(n));
+  log.info("PgQueryResolver_Builder", undefined, `provisioned for ` + handlers.length.toString() + ` read model(s)`);
+}
+
+let dataSourceName = dataSourceNamePromise;
+
+export {
+  log,
+  resolveDataSourceName,
+  dataSourceNamePromise,
+  dataSourceName,
+  entries,
+  register,
+  nodeTypes,
+  registerNodeType,
+  bool,
+  nodeResolverCode,
+  pgConnectionJson,
+  provision,
+}
+/* log Not a pure module */

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -19,16 +19,44 @@
 
 let log = ReventlessCore.Logger.fromEnv()
 
+@val external atob: string => string = "atob"
+
+// Where a cross-table resolver reads the target's sort-key value from.
+// `kind`: "field" (the parent object) | "arg" (the GraphQL arguments).
+type subIdSource = {kind: string, name: string}
+
 // Wire payload from the resolver template. `arguments` mirrors the field name the
 // other Invoke templates use (QueryInterceptor_Lambda, invokeCommandGenerator).
+// The cross-table fields (B3.2c) are present only for resolveOne/resolveMany:
 type payload = {
   readModelName: string,
   kind: string,
   index?: string,
+  // Cross-table (@resolves/@resolvesMany) — see B3.2c dispatch below.
+  target?: string,
+  source?: JSON.t,
+  sourceIdField?: string,
+  sourceIdsField?: string,
+  sourceSubId?: subIdSource,
+  targetIndex?: string,
+  targetIndexIdField?: string,
+  multi?: bool,
+  // Auth-table pipeline (B3.2c): a group-restricted index. Group members must
+  // own the resource (the auth table maps index value → {<group>Id: username});
+  // non-members pass through (mirrors the DynamoDB pipeline's earlyReturn).
+  authTable?: string,
+  authGroup?: string,
   arguments: JSON.t,
   identity: Reventless.Identity.t,
 }
 
+// "Owner" → "ownerId" (auth-table owner field name, matching authorizeIndexedAccess).
+let authIdField = (group: string): string =>
+  switch group->String.get(0) {
+  | Some(c) => c->String.toLowerCase ++ group->String.slice(~start=1, ~end=group->String.length) ++ "Id"
+  | None => "Id"
+  }
+
 // The Postgres query push-downs a binding needs (QueryEnginePostgres.Make
 // provides these; the mock in tests provides in-memory equivalents).
 type pushdowns = {
@@ -40,6 +68,13 @@ type pushdowns = {
     ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
     ~labelField: string,
   ) => promise<option<JSON.t>>,
+  // Sub-id connection ({single}Items) — keyset over sub_key within a partition.
+  itemsPage: (
+    ~readModelName: string,
+    ~subIdField: string,
+    ~id: string,
+    ~argsDict: dict<JSON.t>,
+  ) => promise<JSON.t>,
   // Full materialisation for the list fallback (shapes listPage declines).
   scanAll: (~readModelName: string) => promise<array<JSON.t>>,
 }
@@ -107,14 +142,23 @@ let runInterceptor = async (~binding, ~payload): ReventlessCore.QueryDb_Callback
   }
 }
 
-let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
+// `lookupBinding` resolves another read model's binding by key — needed only for
+// the auth-table pipeline (the auth table is another read model, loaded by the
+// index value). The handler passes the module-level registry; tests pass a mock.
+let dispatch = async (
+  ~binding: binding,
+  ~lookupBinding: string => option<binding>=_ => None,
+  ~payload: payload,
+): JSON.t => {
   let rm = payload.readModelName
   switch await runInterceptor(~binding, ~payload) {
   | Deny(_) =>
-    // Empty shape per kind (null for single, [] for lists, empty connection).
+    // Empty shape per kind (null for single, connection for list/items, [] else).
+    let isMulti = payload.multi->Option.getOr(false)
     switch payload.kind {
     | "getById" => JSON.Encode.null
-    | "list" => emptyConnection()
+    | "resolveOne" if !isMulti => JSON.Encode.null
+    | "list" | "items" => emptyConnection()
     | _ => JSON.Encode.array([])
     }
   | Allow =>
@@ -134,6 +178,21 @@ let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
       let ids = payload.arguments->argStrs("ids")
       JSON.Encode.array(await binding.pushdowns.byIds(~readModelName=rm, ids))
 
+    | "items" =>
+      // Sub-id connection: {single}Items(id, filter, first/after/last/before).
+      // Requires a subIdField; without one it's an empty connection.
+      switch binding.subIdField {
+      | Some(subIdField) =>
+        let id = payload.arguments->argStr("id")->Option.getOr("")
+        await binding.pushdowns.itemsPage(
+          ~readModelName=rm,
+          ~subIdField,
+          ~id,
+          ~argsDict=payload.arguments->argObj,
+        )
+      | None => emptyConnection()
+      }
+
     | "index" =>
       // The index arg name is the index; its stored field is idField ?? index.
       let indexName = payload.index->Option.getOr("")
@@ -143,7 +202,35 @@ let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
         ->Option.flatMap(ic => ic.idField)
         ->Option.getOr(indexName)
       let value = payload.arguments->argStr(indexName)->Option.getOr("")
-      JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+      // Auth-table pipeline: a group-restricted index. Non-members pass through;
+      // members must own the resource (auth table maps index value →
+      // {<group>Id: username}). Auth table is another read model, loaded via the
+      // registry (unsupported → deny if it isn't Postgres-registered).
+      let authorized = switch (payload.authGroup, payload.authTable) {
+      | (Some(group), Some(authTable)) =>
+        if !Reventless.Identity.hasGroup(payload.identity, group) {
+          true
+        } else {
+          switch lookupBinding(authTable) {
+          | Some(authBinding) =>
+            switch await authBinding.ops.load(value) {
+            | Ok(items) =>
+              items
+              ->Array.get(0)
+              ->Option.flatMap(row => row->argStr(authIdField(group)))
+              ->Option.mapOr(false, owner => owner == payload.identity.username)
+            | Error(_) => false
+            }
+          | None => false
+          }
+        }
+      | _ => true
+      }
+      if authorized {
+        JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+      } else {
+        JSON.Encode.array([])
+      }
 
     | "list" =>
       let argsDict = payload.arguments->argObj
@@ -169,6 +256,55 @@ let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
         )
       }
 
+    // Cross-table single-ID field resolver (@resolves). `binding` is the TARGET
+    // binding (the handler looks it up by payload.target); the key comes from the
+    // parent object (payload.source[sourceIdField]).
+    | "resolveOne" =>
+      let target = payload.target->Option.getOr(rm)
+      let source = payload.source->Option.getOr(JSON.Encode.null)
+      let key = source->argStr(payload.sourceIdField->Option.getOr(""))->Option.getOr("")
+      let items = switch payload.targetIndex {
+      | Some(ix) =>
+        await binding.pushdowns.indexLookup(
+          ~readModelName=target,
+          payload.targetIndexIdField->Option.getOr(ix),
+          key,
+        )
+      | None =>
+        switch await binding.ops.load(key) {
+        | Ok(items) => items
+        | Error(_) => []
+        }
+      }
+      // Optional target sort-key filter (source field or GraphQL arg).
+      let filtered = switch (payload.sourceSubId, binding.subIdField) {
+      | (Some({kind, name}), Some(subField)) =>
+        let subVal =
+          switch kind {
+          | "arg" => payload.arguments->argStr(name)
+          | _ => source->argStr(name)
+          }->Option.getOr("")
+        items->Array.filter(it => it->argStr(subField)->Option.getOr("") == subVal)
+      | _ => items
+      }
+      if payload.multi->Option.getOr(false) {
+        JSON.Encode.array(filtered)
+      } else {
+        switch filtered->Array.get(0) {
+        | Some(item) => item
+        | None => JSON.Encode.null
+        }
+      }
+
+    // Cross-table batch field resolver (@resolvesMany). ids come from the parent
+    // object (payload.source[sourceIdsField]); BatchGet the target by partition
+    // key (missing ids drop out).
+    | "resolveMany" =>
+      let target = payload.target->Option.getOr(rm)
+      let source = payload.source->Option.getOr(JSON.Encode.null)
+      let ids = source->argStrs(payload.sourceIdsField->Option.getOr(""))
+      JSON.Encode.array(await binding.pushdowns.byIds(~readModelName=target, ids))
+
     | other =>
       // Fail loudly on unmapped kinds (feature-parity guard, per the B3.2 plan).
       log.error(~comp="PgQueryResolver_Lambda", `unmapped resolver kind '${other}' for ${rm}`)
@@ -182,11 +318,66 @@ let bindings: dict<binding> = Dict.make()
 let register = (~readModelName: string, binding: binding): unit =>
   bindings->Dict.set(readModelName, binding)
 
-let handler = async (payload: payload, _context) =>
-  switch bindings->Dict.get(payload.readModelName) {
-  | Some(binding) => await dispatch(~binding, ~payload)
-  | None =>
-    JsError.throwWithMessage(
-      "PgQueryResolver: no binding registered for read model " ++ payload.readModelName,
-    )
+// Relay node type → read-model-name map (B3.2c), populated at Lambda init from
+// the deploy-time registerNodeType calls.
+let nodeTypeMap: dict<string> = Dict.make()
+let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
+  nodeTypeMap->Dict.set(typeName, readModelName)
+
+// node(id: ID!) — decode the global id (base64 of `typeName:localId`, matching
+// AppSync's nodeDecodeGlobalId), map typeName → read model, load by localId,
+// return the item tagged with __typename and the original global id. Runs the
+// target's authorization/interceptor. Self-contained (getById returns raw ids,
+// so no encoding elsewhere is affected).
+let handleNode = async (~payload: payload): JSON.t => {
+  let globalId = payload.arguments->argStr("id")->Option.getOr("")
+  let decoded = try atob(globalId) catch {
+  | _ => ""
   }
+  let colonIdx = decoded->String.indexOf(":")
+  if colonIdx <= 0 {
+    JSON.Encode.null
+  } else {
+    let typeName = decoded->String.slice(~start=0, ~end=colonIdx)
+    let localId = decoded->String.slice(~start=colonIdx + 1, ~end=decoded->String.length)
+    switch nodeTypeMap->Dict.get(typeName)->Option.flatMap(rm => bindings->Dict.get(rm)) {
+    | Some(binding) =>
+      switch await runInterceptor(~binding, ~payload) {
+      | Deny(_) => JSON.Encode.null
+      | Allow =>
+        switch await binding.ops.load(localId) {
+        | Ok(items) =>
+          switch items->Array.get(0) {
+          | Some(item) =>
+            let obj = item->JSON.Decode.object->Option.getOr(Dict.make())->Dict.copy
+            obj->Dict.set("__typename", JSON.Encode.string(typeName))
+            obj->Dict.set("id", JSON.Encode.string(globalId))
+            JSON.Encode.object(obj)
+          | None => JSON.Encode.null
+          }
+        | Error(_) => JSON.Encode.null
+        }
+      }
+    | None => JSON.Encode.null
+    }
+  }
+}
+
+let handler = async (payload: payload, _context) => {
+  // node decodes its own target; the cross-table field resolvers dispatch against
+  // the TARGET binding; everything else against the payload's own read model.
+  let bindingKey = switch payload.kind {
+  | "resolveOne" | "resolveMany" => payload.target->Option.getOr(payload.readModelName)
+  | _ => payload.readModelName
+  }
+  switch payload.kind {
+  | "node" => await handleNode(~payload)
+  | _ =>
+    switch bindings->Dict.get(bindingKey) {
+    | Some(binding) =>
+      await dispatch(~binding, ~lookupBinding=name => bindings->Dict.get(name), ~payload)
+    | None =>
+      JsError.throwWithMessage("PgQueryResolver: no binding registered for read model " ++ bindingKey)
+    }
+  }
+}

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
@@ -11,6 +12,15 @@ import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core
 
 let log = Logger$ReventlessCore.fromEnv();
 
+function authIdField(group) {
+  let c = group[0];
+  if (c !== undefined) {
+    return c.toLowerCase() + group.slice(1, group.length) + "Id";
+  } else {
+    return "Id";
+  }
+}
+
 function argObj(args) {
   return Stdlib_Option.getOr(Stdlib_JSON.Decode.object(args), {});
 }
@@ -55,7 +65,8 @@ async function runInterceptor(binding, payload) {
   }
 }
 
-async function dispatch(binding, payload) {
+async function dispatch(binding, lookupBindingOpt, payload) {
+  let lookupBinding = lookupBindingOpt !== undefined ? lookupBindingOpt : param => {};
   let rm = payload.readModelName;
   let match = await runInterceptor(binding, payload);
   if (typeof match !== "object") {
@@ -84,26 +95,96 @@ async function dispatch(binding, payload) {
         let indexName = Stdlib_Option.getOr(payload.index, "");
         let field = Stdlib_Option.getOr(Stdlib_Option.flatMap(binding.indexes.find(ic => ic.index === indexName), ic => ic.idField), indexName);
         let value = Stdlib_Option.getOr(argStr(payload.arguments, indexName), "");
-        return await binding.pushdowns.indexLookup(rm, field, value);
+        let match$1 = payload.authGroup;
+        let match$2 = payload.authTable;
+        let authorized;
+        if (match$1 !== undefined && match$2 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$1)) {
+          let authBinding = lookupBinding(match$2);
+          if (authBinding !== undefined) {
+            let items$1 = await authBinding.ops.load(value);
+            authorized = items$1.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items$1._0[0], row => argStr(row, authIdField(match$1))), false, owner => owner === payload.identity.username) : false;
+          } else {
+            authorized = false;
+          }
+        } else {
+          authorized = true;
+        }
+        if (authorized) {
+          return await binding.pushdowns.indexLookup(rm, field, value);
+        } else {
+          return [];
+        }
+      case "items" :
+        let subIdField = binding.subIdField;
+        if (subIdField === undefined) {
+          return emptyConnection();
+        }
+        let id$1 = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
+        return await binding.pushdowns.itemsPage(rm, subIdField, id$1, argObj(payload.arguments));
       case "list" :
         let argsDict = argObj(payload.arguments);
         let conn = await binding.pushdowns.listPage(rm, argsDict, binding.capability, binding.labelField);
         if (conn !== undefined) {
           return conn;
         }
-        let items$1 = await binding.pushdowns.scanAll(rm);
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, param => {});
+        let items$2 = await binding.pushdowns.scanAll(rm);
+        return QueryDbListQuery$ReventlessCore.run(items$2, argsDict, binding.capability, binding.labelField, param => {});
+      case "resolveMany" :
+        let target = Stdlib_Option.getOr(payload.target, rm);
+        let source = Stdlib_Option.getOr(payload.source, null);
+        let ids$1 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
+        return await binding.pushdowns.byIds(target, ids$1);
+      case "resolveOne" :
+        let target$1 = Stdlib_Option.getOr(payload.target, rm);
+        let source$1 = Stdlib_Option.getOr(payload.source, null);
+        let key = Stdlib_Option.getOr(argStr(source$1, Stdlib_Option.getOr(payload.sourceIdField, "")), "");
+        let ix = payload.targetIndex;
+        let items$3;
+        if (ix !== undefined) {
+          items$3 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
+        } else {
+          let items$4 = await binding.ops.load(key);
+          items$3 = items$4.TAG === "Ok" ? items$4._0 : [];
+        }
+        let match$3 = payload.sourceSubId;
+        let match$4 = binding.subIdField;
+        let filtered;
+        if (match$3 !== undefined && match$4 !== undefined) {
+          let name = match$3.name;
+          let tmp = match$3.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
+          let subVal = Stdlib_Option.getOr(tmp, "");
+          filtered = items$3.filter(it => Stdlib_Option.getOr(argStr(it, match$4), "") === subVal);
+        } else {
+          filtered = items$3;
+        }
+        if (Stdlib_Option.getOr(payload.multi, false)) {
+          return filtered;
+        }
+        let item$1 = filtered[0];
+        if (item$1 !== undefined) {
+          return item$1;
+        } else {
+          return null;
+        }
       default:
         log.error("PgQueryResolver_Lambda", undefined, `unmapped resolver kind '` + other + `' for ` + rm);
         return Stdlib_JsError.throwWithMessage(`PgQueryResolver: unmapped resolver kind '` + other + `' for ` + rm);
     }
   } else {
-    let match$1 = payload.kind;
-    switch (match$1) {
+    let isMulti = Stdlib_Option.getOr(payload.multi, false);
+    let match$5 = payload.kind;
+    switch (match$5) {
       case "getById" :
         return null;
+      case "items" :
       case "list" :
         return emptyConnection();
+      case "resolveOne" :
+        if (isMulti) {
+          return [];
+        } else {
+          return null;
+        }
       default:
         return [];
     }
@@ -116,17 +197,74 @@ function register(readModelName, binding) {
   bindings[readModelName] = binding;
 }
 
+let nodeTypeMap = {};
+
+function registerNodeType(typeName, readModelName) {
+  nodeTypeMap[typeName] = readModelName;
+}
+
+async function handleNode(payload) {
+  let globalId = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
+  let decoded;
+  try {
+    decoded = atob(globalId);
+  } catch (exn) {
+    decoded = "";
+  }
+  let colonIdx = decoded.indexOf(":");
+  if (colonIdx <= 0) {
+    return null;
+  }
+  let typeName = decoded.slice(0, colonIdx);
+  let localId = decoded.slice(colonIdx + 1 | 0, decoded.length);
+  let binding = Stdlib_Option.flatMap(nodeTypeMap[typeName], rm => bindings[rm]);
+  if (binding === undefined) {
+    return null;
+  }
+  let match = await runInterceptor(binding, payload);
+  if (typeof match === "object") {
+    return null;
+  }
+  let items = await binding.ops.load(localId);
+  if (items.TAG !== "Ok") {
+    return null;
+  }
+  let item = items._0[0];
+  if (item === undefined) {
+    return null;
+  }
+  let obj = Object.assign({}, Stdlib_Option.getOr(Stdlib_JSON.Decode.object(item), {}));
+  obj["__typename"] = typeName;
+  obj["id"] = globalId;
+  return obj;
+}
+
 async function handler(payload, _context) {
-  let binding = bindings[payload.readModelName];
+  let match = payload.kind;
+  let bindingKey;
+  switch (match) {
+    case "resolveMany" :
+    case "resolveOne" :
+      bindingKey = Stdlib_Option.getOr(payload.target, payload.readModelName);
+      break;
+    default:
+      bindingKey = payload.readModelName;
+  }
+  let match$1 = payload.kind;
+  if (match$1 === "node") {
+    return await handleNode(payload);
+  }
+  let binding = bindings[bindingKey];
   if (binding !== undefined) {
-    return await dispatch(binding, payload);
+    return await dispatch(binding, name => bindings[name], payload);
   } else {
-    return Stdlib_JsError.throwWithMessage("PgQueryResolver: no binding registered for read model " + payload.readModelName);
+    return Stdlib_JsError.throwWithMessage("PgQueryResolver: no binding registered for read model " + bindingKey);
   }
 }
 
 export {
   log,
+  authIdField,
   argObj,
   argStr,
   argStrs,
@@ -136,6 +274,9 @@ export {
   dispatch,
   bindings,
   register,
+  nodeTypeMap,
+  registerNodeType,
+  handleNode,
   handler,
 }
 /* log Not a pure module */

package/src/adapter/QueryDb/QueryDbBackend.res

@@ -50,3 +50,11 @@ let isPostgresFor = (name: string): bool =>
 /** Whether ANY read model on this platform is Postgres-backed (used to decide
     whether the projection Lambdas need VPC/secret access). */
 let isPostgres = (): bool => selectionRef.contents->Option.isSome
+
+// B3.3: Postgres read models routed through `QueryDbStorage.SelectableStream`
+// (i.e. subscription-enabled). Lives here — a leaf both the storage selector and
+// the projection-Lambda runtime builders already import — so the runtime builder
+// can consult it without pulling in QueryDbStorage (which would close a build
+// cycle via QueryDbStorage_Postgres → PgQueryResolver_Builder). Membership means
+// "publish live updates from the projection Lambda after save/delete".
+let postgresStreamRegistry: Set.t<string> = Set.make()