@reventlessdev/reventless-aws 3.0.0-alpha.281 → 3.0.0-alpha.283

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.283 (2026-08-11)
+
+### Bug Fixes
+
+* **api:** one id contract across the read-side query doors ([c52fac2](https://github.com/ReventlessDev/reventless-core/commit/c52fac2bee87b3dd1fa33b4970a74f3cd3866280))
+### Features
+
+* **api:** infer a queryable's key field and publish its provenance ([c835a42](https://github.com/ReventlessDev/reventless-core/commit/c835a42a0da07cdc4a3f010212e1f340a4a0ca27))
+
+
+# 3.0.0-alpha.282 (2026-08-10)
+
+### Bug Fixes
+
+* **aws:** load query-interceptor extensions in init, and let it log ([c93612b](https://github.com/ReventlessDev/reventless-core/commit/c93612b3d2208cdc3f1c4b4dbef615b974c5e74a))
+
+
 # 3.0.0-alpha.281 (2026-08-10)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.281",
+  "version": "3.0.0-alpha.283",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.6",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.3",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.69",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.70",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.223",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.133",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.224",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.87",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.107"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.88",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.108",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.134"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -165,18 +165,39 @@ let dispatch = async (
     switch payload.kind {
     | "getById" =>
       let id = payload.arguments->argStr("id")->Option.getOr("")
-      switch await binding.ops.load(id) {
-      | Ok(items) =>
-        switch items->Array.get(0) {
-        | Some(item) => binding.includeIdParam ? withId(item, id) : item
-        | None => JSON.Encode.null
+      let loadKey = async key =>
+        switch await binding.ops.load(key) {
+        | Ok(items) => items->Array.get(0)
+        | Error(_) => None
         }
-      | Error(_) => JSON.Encode.null
+      // A caller holding a row's Relay global id must reach the row through this
+      // door too. Raw key first — it is what this door has always taken, and a
+      // key that merely looks like base64 must keep resolving to its own row.
+      let (resolvedKey, found) = switch (
+        await loadKey(id),
+        ReventlessCore.Api_Ids.alternateKey(id),
+      ) {
+      | (None, Some(localId)) => (localId, await loadKey(localId))
+      | (found, _) => (id, found)
+      }
+      switch found {
+      | Some(item) => binding.includeIdParam ? withId(item, resolvedKey) : item
+      | None => JSON.Encode.null
       }
 
     | "byIds" =>
       let ids = payload.arguments->argStrs("ids")
-      JSON.Encode.array(await binding.pushdowns.byIds(~readModelName=rm, ids))
+      let found = await binding.pushdowns.byIds(~readModelName=rm, ids)
+      // Only pay for the second lookup when the first came up short, and only for
+      // the ids that are global ones.
+      let missing =
+        found->Array.length < ids->Array.length
+          ? ids->Array.filterMap(ReventlessCore.Api_Ids.alternateKey)
+          : []
+      let extra = missing->Array.length > 0
+        ? await binding.pushdowns.byIds(~readModelName=rm, missing)
+        : []
+      JSON.Encode.array(Array.concat(found, extra))
 
     | "items" =>
       // Sub-id connection: {single}Items(id, filter, first/after/last/before).
@@ -243,16 +264,14 @@ let dispatch = async (
       | Some(conn) => conn
       | None =>
         // Shapes listPage declines (search/searchPrefix/ids/backward) → run the
-        // shared spec over the materialised model. No Relay global-id decoding
-        // in the Lambda, so `decodeLocalId` is a no-op (the `ids` filter still
-        // matches raw item ids).
+        // shared spec over the materialised model, which decodes Relay global
+        // ids the same way every other door now does.
         let items = await binding.pushdowns.scanAll(~readModelName=rm)
         ReventlessCore.QueryDbListQuery.run(
           ~items,
           ~argsDict,
           ~capability=binding.capability,
           ~labelField=binding.labelField,
-          ~decodeLocalId=_ => None,
         )
       }
 

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
@@ -74,19 +75,33 @@ async function dispatch(binding, lookupBindingOpt, payload) {
     switch (other) {
       case "byIds" :
         let ids = argStrs(payload.arguments, "ids");
-        return await binding.pushdowns.byIds(rm, ids);
+        let found = await binding.pushdowns.byIds(rm, ids);
+        let missing = found.length < ids.length ? Stdlib_Array.filterMap(ids, Api_Ids$ReventlessCore.alternateKey) : [];
+        let extra = missing.length !== 0 ? await binding.pushdowns.byIds(rm, missing) : [];
+        return found.concat(extra);
       case "getById" :
         let id = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
-        let items = await binding.ops.load(id);
-        if (items.TAG !== "Ok") {
-          return null;
-        }
-        let item = items._0[0];
-        if (item !== undefined) {
+        let loadKey = async key => {
+          let items = await binding.ops.load(key);
+          if (items.TAG === "Ok") {
+            return items._0[0];
+          }
+        };
+        let match$1 = await loadKey(id);
+        let match$2 = Api_Ids$ReventlessCore.alternateKey(id);
+        let match$3 = match$1 !== undefined || match$2 === undefined ? [
+            id,
+            match$1
+          ] : [
+            match$2,
+            await loadKey(match$2)
+          ];
+        let found$1 = match$3[1];
+        if (found$1 !== undefined) {
           if (binding.includeIdParam) {
-            return withId(item, id);
+            return withId(found$1, match$3[0]);
           } else {
-            return item;
+            return found$1;
           }
         } else {
           return null;
@@ -95,14 +110,14 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let indexName = Stdlib_Option.getOr(payload.index, "");
         let field = Stdlib_Option.getOr(Stdlib_Option.flatMap(binding.indexes.find(ic => ic.index === indexName), ic => ic.idField), indexName);
         let value = Stdlib_Option.getOr(argStr(payload.arguments, indexName), "");
-        let match$1 = payload.authGroup;
-        let match$2 = payload.authTable;
+        let match$4 = payload.authGroup;
+        let match$5 = payload.authTable;
         let authorized;
-        if (match$1 !== undefined && match$2 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$1)) {
-          let authBinding = lookupBinding(match$2);
+        if (match$4 !== undefined && match$5 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$4)) {
+          let authBinding = lookupBinding(match$5);
           if (authBinding !== undefined) {
-            let items$1 = await authBinding.ops.load(value);
-            authorized = items$1.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items$1._0[0], row => argStr(row, authIdField(match$1))), false, owner => owner === payload.identity.username) : false;
+            let items = await authBinding.ops.load(value);
+            authorized = items.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items._0[0], row => argStr(row, authIdField(match$4))), false, owner => owner === payload.identity.username) : false;
           } else {
             authorized = false;
           }
@@ -127,8 +142,8 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         if (conn !== undefined) {
           return conn;
         }
-        let items$2 = await binding.pushdowns.scanAll(rm);
-        return QueryDbListQuery$ReventlessCore.run(items$2, argsDict, binding.capability, binding.labelField, param => {});
+        let items$1 = await binding.pushdowns.scanAll(rm);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined);
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
@@ -139,30 +154,30 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let source$1 = Stdlib_Option.getOr(payload.source, null);
         let key = Stdlib_Option.getOr(argStr(source$1, Stdlib_Option.getOr(payload.sourceIdField, "")), "");
         let ix = payload.targetIndex;
-        let items$3;
+        let items$2;
         if (ix !== undefined) {
-          items$3 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
+          items$2 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
         } else {
-          let items$4 = await binding.ops.load(key);
-          items$3 = items$4.TAG === "Ok" ? items$4._0 : [];
+          let items$3 = await binding.ops.load(key);
+          items$2 = items$3.TAG === "Ok" ? items$3._0 : [];
         }
-        let match$3 = payload.sourceSubId;
-        let match$4 = binding.subIdField;
+        let match$6 = payload.sourceSubId;
+        let match$7 = binding.subIdField;
         let filtered;
-        if (match$3 !== undefined && match$4 !== undefined) {
-          let name = match$3.name;
-          let tmp = match$3.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
+        if (match$6 !== undefined && match$7 !== undefined) {
+          let name = match$6.name;
+          let tmp = match$6.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
           let subVal = Stdlib_Option.getOr(tmp, "");
-          filtered = items$3.filter(it => Stdlib_Option.getOr(argStr(it, match$4), "") === subVal);
+          filtered = items$2.filter(it => Stdlib_Option.getOr(argStr(it, match$7), "") === subVal);
         } else {
-          filtered = items$3;
+          filtered = items$2;
         }
         if (Stdlib_Option.getOr(payload.multi, false)) {
           return filtered;
         }
-        let item$1 = filtered[0];
-        if (item$1 !== undefined) {
-          return item$1;
+        let item = filtered[0];
+        if (item !== undefined) {
+          return item;
         } else {
           return null;
         }
@@ -172,8 +187,8 @@ async function dispatch(binding, lookupBindingOpt, payload) {
     }
   } else {
     let isMulti = Stdlib_Option.getOr(payload.multi, false);
-    let match$5 = payload.kind;
-    switch (match$5) {
+    let match$8 = payload.kind;
+    switch (match$8) {
       case "getById" :
         return null;
       case "items" :

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -205,7 +205,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // with the SDL emitted by GraphQL_FragmentGenerator at runtime.
     let stateSchemaOpt = ReventlessCore.Plugin_Helpers.stateSchemaRegistry->Dict.get(name)
     let capability = switch stateSchemaOpt {
-    | Some(s) => ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(s)
+    | Some(s) => ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(~entityName=name, s)
     | None => ReventlessCore.GraphQL_FragmentGenerator.emptyCapability
     }
     let filterFieldNames = capability.filterFields->Array.map(f => f.name)

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -91,7 +91,7 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     let resolverByIdMultiple = includeIdParam ? Stdlib_Option.map(subIdField, sortField => makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", AppSync_Resolver_Functions$PulumiAws.queryItemsWithSortConditions(sortField))) : undefined;
     let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let stateSchemaOpt = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name$1];
-    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
+    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(name$1, stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
     let filterFieldNames = capability.filterFields.map(f => f.name);
     let rangeFieldNames = Stdlib_Array.filterMap(capability.filterFields, f => {
       if (f.range) {

package/src/adapter/QueryDb/QueryInterceptor_Lambda.res

@@ -2,18 +2,24 @@
 // Query resolver — one pipeline step whose only job is to consult the hook.
 //
 // The hook is a module-level `ref`, and in a deployed runtime the only thing that
-// ever fills it is a `RuntimeExtension`'s `onColdStart`. Every other runtime
-// reaches those through a compiled entry shell that awaits `runtimeExtensionsReady`
-// before it serves anything; this handler is not built by a shell, so it awaits
-// the same promise itself. Without it the extensions the archive already carries
-// are never imported, the hook stays `None`, and interception degrades to a
-// passthrough that costs an invocation on every read and observes nothing — the
-// one failure mode this path cannot afford, because it is silent and its whole
-// price has already been paid.
+// ever fills it is a `RuntimeExtension`'s `onColdStart`. So the handler awaits
+// `runtimeExtensionsReady` before reading it. Without that the extensions the
+// archive already carries are never imported, the hook stays `None`, and
+// interception degrades to a passthrough that costs an invocation on every read
+// and observes nothing — the one failure mode this path cannot afford, because it
+// is silent and its whole price has already been paid.
+//
+// The await is kept here even though `QueryInterceptorEntryPoint.mjs` now awaits
+// the same promise at top level, because the two are answering different
+// questions. The shell's await decides WHEN the seam fires — init rather than
+// invoke, which is what keeps the load off the read path. This one is the
+// module's own contract: it does not consult a hook it has not waited for,
+// however it was entered. On the path they share, the second await is a settled
+// promise and costs a microtask.
 //
 // Awaited from the small module rather than from `HandlerFactoryHelpers`, which
 // re-exports the same binding behind the Effect runtime and the DynamoDB clients:
-// this runtime is sized for a decision, not for work.
+// there is no reason to pull that graph in to reach one promise.
 
 type payload = {
   readModelName: string,

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res

@@ -64,23 +64,56 @@ let buildInterceptor = (~api: Types.AppSync.api, ~opts) => {
     ),
   ])
   let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
-    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs",
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs",
     ~packageDirs,
   )
 
-  // Sits in front of every read, so it is sized for a decision rather than for
-  // work: small memory, short timeout. A hook that needs longer than this is
-  // doing something a read path cannot afford anyway.
+  // Framework default sizing, deliberately, and it took an outage to get here.
+  //
+  // What this runtime DECIDES is trivial — consult a hook, return a verdict — and
+  // it was once sized for exactly that: 256MB and a 10-second timeout, on the
+  // reasoning that a read path cannot afford anything more. But a runtime is not
+  // sized for what it decides, it is sized for what it LOADS, and this one loads
+  // whatever module graph the registered extensions drag behind them. An
+  // accounting extension reaching a DynamoDB client is enough to put the whole
+  // cloud SDK in that graph. Lambda CPU scales with memory, so at 256MB the load
+  // ran at a fraction of a core and did not finish inside ten seconds — and
+  // because an unfinished import neither completes nor throws, the failure was a
+  // bare timeout on EVERY read, with an empty log group to explain it.
+  //
+  // The defaults are also close to cost-neutral for the thing being paid for
+  // here. Lambda bills memory×duration, so a decision that fits in single-digit
+  // milliseconds costs about the same at either size; what changes is whether the
+  // cold start fits. The entry shell spends it in init (see its own docstring),
+  // where the timeout is headroom for the retry Lambda performs when init
+  // overruns its own budget, rather than a ceiling on the read.
   let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
     ~name,
     ~unitKind=ReventlessCore.Monitoring.Other("QueryInterceptor"),
     ~componentKind=ReventlessCore.ComponentType.Plugin,
     ~code,
     ~sourceCodeHash,
-    ~memorySize=256,
-    ~timeout=10,
     ~opts=componentOpts,
   )
+
+  // The execution role's logging grant, which `makeFromCodeAsset` does NOT give
+  // it: every runtime builder in the framework attaches this at its own call
+  // site, and this one — hand-rolled rather than grown from a builder — was the
+  // one that forgot. The result was a component sitting in front of every read on
+  // the platform whose log group never had a single stream, so the timeout above
+  // could only be found by invoking the function by hand and reading the tail of
+  // a response. Silence on the read path is not a small defect; it is the thing
+  // that decides how long the next outage lasts.
+  let _logging = IAM.RolePolicy.make(
+    ~name=name ++ "Logging",
+    ~args={
+      IAM.RolePolicy.policy: PulumiAws.Lambda.defaultLoggingPolicyDocument
+      ->PolicyDocument.toJsonString
+      ->Pulumi.Input.make,
+      role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+    },
+    ~opts,
+  )
   let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(lambda => lambda.arn)
 
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res.mjs

@@ -5,6 +5,7 @@ import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.r
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
@@ -38,11 +39,15 @@ function buildInterceptor(api, opts) {
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
-  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs", packageDirs, undefined, undefined);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs", packageDirs, undefined, undefined);
   let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, {
     TAG: "Other",
     _0: "QueryInterceptor"
-  }, "Plugin", match.code, match.sourceCodeHash, undefined, 256, 10, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  }, "Plugin", match.code, match.sourceCodeHash, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  new (Aws.iam.RolePolicy)(name + "Logging", {
+    policy: PolicyDocument$PulumiAws.toJsonString(Lambda$PulumiAws.defaultLoggingPolicyDocument),
+    role: runtime.parts.lambdaRole.id
+  }, opts);
   let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, lambda => lambda.arn);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Plugin", "Identity", "Plugin", undefined, undefined, undefined, undefined), opts);
   Pulumi.all([

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -144,6 +144,7 @@ let registerBinding = (
       indexes,
       subIdField,
       capability: ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(
+        ~entityName=entry.readModelName,
         spec.stateSchema,
       ),
       labelField: entry.labelField,

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -69,7 +69,7 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     pushdowns: pushdowns,
     indexes: indexes,
     subIdField: subIdField,
-    capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(spec.stateSchema),
+    capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(entry.readModelName, spec.stateSchema),
     labelField: entry.labelField,
     includeIdParam: entry.includeIdParam,
     authorization: spec.authorization

package/src/adapter/Runtime/QueryInterceptorEntryPoint.mjs

@@ -0,0 +1,29 @@
+// Query-interceptor Lambda entry point.
+//
+// One job, and it is a scheduling one: pull the runtime-extension cold start
+// into the INIT phase.
+//
+// `runtimeExtensionsReady` is an async IIFE started at module load and awaited
+// by nobody, so evaluating a module that merely imports it does not wait for it.
+// Awaiting it from the handler instead — which is what this runtime did before
+// there was a shell — leaves the whole extension load in the INVOKE phase, where
+// it runs without the init CPU boost and against the function timeout. An
+// extension whose module graph reaches a cloud SDK does not finish inside a
+// budget sized for a decision, and the way that fails is the worst shape
+// available: the load neither completes nor throws, so every read times out
+// having logged nothing at all.
+//
+// A top-level await is what moves it. It propagates to the generated `index.mjs`
+// re-export, so init is not finished until the seam has fired — which is also
+// the only way the handler's own await can be a formality rather than the place
+// the work happens.
+//
+// It cannot reject: the seam catches and reports each extension's load failure
+// individually, and resolves having skipped it. So a broken extension still
+// costs interception nothing more than the counting it was going to do.
+
+import { runtimeExtensionsReady } from "./RuntimeExtensionsReady.mjs";
+
+await runtimeExtensionsReady;
+
+export { handler } from "../QueryDb/QueryInterceptor_Lambda.res.mjs";

package/tests/PgQueryResolver_LambdaTest.res

@@ -365,3 +365,93 @@ describe("PgQueryResolver_Lambda.dispatch", () => {
     expect(threw)->toBe(true)
   })
 })
+
+// A client holding a row reads its `id` and passes it back. On the local platform
+// that `id` is a Relay global id; the typed doors used to take only the storage
+// key and answered null, with no error to point at. These pin the either-form
+// rule at the door, so the same client call works whichever form it holds.
+describe("id form — the typed doors take either", () => {
+  let globalIdFor = localId => ReventlessCore.Api_Ids.encode(~typeName="Thing", ~localId)
+
+  testPromise("getById resolves a Relay global id", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="getById",
+        ~args=objArgs([("id", JSON.Encode.string(globalIdFor("p-2")))]),
+        (),
+      ),
+    )
+    expect(r->str("name"))->toEqual(Some("Bravo"))
+  })
+
+  // The row's `id` must come back as the storage key it was found under — echoing
+  // the argument would hand back an id nothing else accepts.
+  testPromise("getById reports the storage key it resolved to", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="getById",
+        ~args=objArgs([("id", JSON.Encode.string(globalIdFor("p-2")))]),
+        (),
+      ),
+    )
+    expect(r->str("id"))->toEqual(Some("p-2"))
+  })
+
+  testPromise("getById still resolves a plain storage key", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="getById", ~args=objArgs([("id", JSON.Encode.string("p-2"))]), ()),
+    )
+    expect(r->str("name"))->toEqual(Some("Bravo"))
+  })
+
+  testPromise("getById on a global id for a row that does not exist is still null", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="getById",
+        ~args=objArgs([("id", JSON.Encode.string(globalIdFor("absent")))]),
+        (),
+      ),
+    )
+    expect(r)->toBe(JSON.Encode.null)
+  })
+
+  testPromise("byIds accepts the two forms mixed in one call", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="byIds",
+        ~args=objArgs([
+          (
+            "ids",
+            JSON.Encode.array([
+              JSON.Encode.string("p-1"),
+              JSON.Encode.string(globalIdFor("p-3")),
+            ]),
+          ),
+        ]),
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  // The fallback lookup must not fire when the first pass already answered — an
+  // all-raw call is the common path and pays for one round trip, not two.
+  testPromise("byIds with every id found does not double-count", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(
+        ~kind="byIds",
+        ~args=objArgs([
+          ("ids", JSON.Encode.array(["p-1", "p-3"]->Array.map(JSON.Encode.string))),
+        ]),
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+})

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs";
 
@@ -452,6 +453,63 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
 });
 
+globalThis.describe("id form — the typed doors take either", () => {
+  globalThis.test("getById resolves a Relay global id", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "p-2")
+      ]]), undefined));
+    globalThis.expect(str(r, "name")).toEqual("Bravo");
+  });
+  globalThis.test("getById reports the storage key it resolved to", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "p-2")
+      ]]), undefined));
+    globalThis.expect(str(r, "id")).toEqual("p-2");
+  });
+  globalThis.test("getById still resolves a plain storage key", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), undefined));
+    globalThis.expect(str(r, "name")).toEqual("Bravo");
+  });
+  globalThis.test("getById on a global id for a row that does not exist is still null", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "absent")
+      ]]), undefined));
+    globalThis.expect(r).toBe(null);
+  });
+  globalThis.test("byIds accepts the two forms mixed in one call", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          Api_Ids$ReventlessCore.encode("Thing", "p-3")
+        ]
+      ]]), undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("byIds with every id found does not double-count", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          "p-3"
+        ].map(prim => prim)
+      ]]), undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+});
+
 export {
   mk,
   store,