@reventlessdev/reventless-aws 3.0.0-alpha.282 → 3.0.0-alpha.284

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.284 (2026-08-12)
+
+### Features
+
+* **platform:** bake a curated component manifest as a static asset ([4f30265](https://github.com/ReventlessDev/reventless-core/commit/4f30265a51fc2c59e69afd8074cf1b2534c06378))
+* **queries:** narrow owner-bearing reads to the caller ([ba9cc3d](https://github.com/ReventlessDev/reventless-core/commit/ba9cc3d58d7914a9e4827bda90a704a74b1b82dd))
+* **spec:** let the environment name the groups exempt from owner scoping ([2de5c51](https://github.com/ReventlessDev/reventless-core/commit/2de5c5118347a46998f9ab603308fca09addf00b))
+
+
+# 3.0.0-alpha.283 (2026-08-11)
+
+### Bug Fixes
+
+* **api:** one id contract across the read-side query doors ([c52fac2](https://github.com/ReventlessDev/reventless-core/commit/c52fac2bee87b3dd1fa33b4970a74f3cd3866280))
+### Features
+
+* **api:** infer a queryable's key field and publish its provenance ([c835a42](https://github.com/ReventlessDev/reventless-core/commit/c835a42a0da07cdc4a3f010212e1f340a4a0ca27))
+
+
 # 3.0.0-alpha.282 (2026-08-10)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.282",
+  "version": "3.0.0-alpha.284",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.6",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.3",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.69",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.71",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.133",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.87",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.107",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.223"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.225",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.135",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.89",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.109",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1124,18 +1124,6 @@ module MakeWithConfig = (
 
   // In split mode, create a dedicated platform AppSync API and push the platform schema.
   // In unified mode, makePlatform is a no-op (schema stitching handled by events).
-  let makePlatform = (~version, ~plugins: array<module(PluginMaker)>) => {
-    log.info(~comp="Platform", `v${version}`)
-    let _ = plugins
-    // Retired with the merged-API cutover: on AWS the platform deploys with
-    // deployPlatform (staged) and each plugin with deployPlugin — makePlatform
-    // predates the merge path and never gained merged wiring.
-    failwith(
-      "makePlatform is not supported on AWS — deploy the platform with deployPlatform and " ++
-      "each plugin with deployPlugin (merged-API composition).",
-    )
-  }
-
   // Optional host UI shell bundle: a static SPA (e.g. reventless-ui's host-shell)
   // hosted on the platform's CloudFront-fronted S3 bucket. The platform writes a
   // `config.json` next to `index.html` so the shell discovers `apiEndpoint` and
@@ -1154,6 +1142,10 @@ module MakeWithConfig = (
     // written; the shell treats the resulting 404 as "no hints" and boots
     // unchanged. Single-mode shape: one origin-relative file per deployment.
     uiHintsFile?: string,
+    // Optional baked component manifest. Declared here so a deployment can state
+    // it once; the emission that writes the file is not wired on this platform
+    // yet, and a declaration without it writes nothing.
+    bakedManifest?: ReventlessInfra.Platform.bakedManifest,
     // Optional geocoding place index, as returned by
     // `Capability_Geocoding_AwsLocation.make`. When set, the deploy provisions the
     // capability's client door — a Cognito-authenticated `Query.geocode` resolver
@@ -1198,6 +1190,23 @@ module MakeWithConfig = (
     shellConfig?: dict<JSON.t>,
   }
 
+  let makePlatform = (
+    ~version,
+    ~plugins: array<module(PluginMaker)>,
+    ~hostUiBundle as _: option<hostUiBundleConfig>=?,
+  ) => {
+    log.info(~comp="Platform", `v${version}`)
+    let _ = plugins
+    // Retired with the merged-API cutover: on AWS the platform deploys with
+    // deployPlatform (staged) and each plugin with deployPlugin — makePlatform
+    // predates the merge path and never gained merged wiring.
+    failwith(
+      "makePlatform is not supported on AWS — deploy the platform with deployPlatform and " ++
+      "each plugin with deployPlugin (merged-API composition).",
+    )
+  }
+
+
   // Merged-mode outputs of deployPlatform — the merged API(s), plus the
   // deploy-time merge gates (Outputs that resolve on MERGE_SUCCESS and fail
   // the deploy on MERGE_FAILED; folded into the ARN exports so they are

package/src/Platform.res.mjs

@@ -753,7 +753,7 @@ function MakeWithConfig(Config) {
       return;
     }
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, param) => {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };
@@ -2009,7 +2009,7 @@ function Make($star) {
       return;
     }
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, param) => {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -67,6 +67,7 @@ type pushdowns = {
     ~argsDict: dict<JSON.t>,
     ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
     ~labelField: string,
+    ~ownerScope: (string, string)=?,
   ) => promise<option<JSON.t>>,
   // Sub-id connection ({single}Items) — keyset over sub_key within a partition.
   itemsPage: (
@@ -74,6 +75,7 @@ type pushdowns = {
     ~subIdField: string,
     ~id: string,
     ~argsDict: dict<JSON.t>,
+    ~ownerScope: (string, string)=?,
   ) => promise<JSON.t>,
   // Full materialisation for the list fallback (shapes listPage declines).
   scanAll: (~readModelName: string) => promise<array<JSON.t>>,
@@ -89,6 +91,10 @@ type binding = {
   labelField: string,
   includeIdParam: bool,
   authorization: Reventless.Authorization.permission,
+  /** The state's `@owner` field, when it declares one. Derived at Lambda init
+      from the same schema `capability` comes from, so the two cannot disagree
+      about which fields this read model has. */
+  ownerField: option<string>,
 }
 
 // -- arg helpers -------------------------------------------------------------
@@ -162,21 +168,55 @@ let dispatch = async (
     | _ => JSON.Encode.array([])
     }
   | Allow =>
+    // Post-read narrowing for the doors that hand back rows rather than a page.
+    // Same decision as the list door takes; applied per row because there is no
+    // query to push it into.
+    let ownerAllows = (item: JSON.t) =>
+      switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+      | Unscoped => true
+      | RefuseOwned => false
+      | ScopeTo(field, required) =>
+        item->argStr(field)->Option.mapOr(false, v => v == required)
+      }
     switch payload.kind {
     | "getById" =>
       let id = payload.arguments->argStr("id")->Option.getOr("")
-      switch await binding.ops.load(id) {
-      | Ok(items) =>
-        switch items->Array.get(0) {
-        | Some(item) => binding.includeIdParam ? withId(item, id) : item
-        | None => JSON.Encode.null
+      let loadKey = async key =>
+        switch await binding.ops.load(key) {
+        | Ok(items) => items->Array.get(0)
+        | Error(_) => None
         }
-      | Error(_) => JSON.Encode.null
+      // A caller holding a row's Relay global id must reach the row through this
+      // door too. Raw key first — it is what this door has always taken, and a
+      // key that merely looks like base64 must keep resolving to its own row.
+      let (resolvedKey, found) = switch (
+        await loadKey(id),
+        ReventlessCore.Api_Ids.alternateKey(id),
+      ) {
+      | (None, Some(localId)) => (localId, await loadKey(localId))
+      | (found, _) => (id, found)
+      }
+      switch found {
+      // A row the caller does not own answers as "not found". Saying "not yours"
+      // instead would make this door an oracle for which ids exist.
+      | Some(item) if !ownerAllows(item) => JSON.Encode.null
+      | Some(item) => binding.includeIdParam ? withId(item, resolvedKey) : item
+      | None => JSON.Encode.null
       }
 
     | "byIds" =>
       let ids = payload.arguments->argStrs("ids")
-      JSON.Encode.array(await binding.pushdowns.byIds(~readModelName=rm, ids))
+      let found = await binding.pushdowns.byIds(~readModelName=rm, ids)
+      // Only pay for the second lookup when the first came up short, and only for
+      // the ids that are global ones.
+      let missing =
+        found->Array.length < ids->Array.length
+          ? ids->Array.filterMap(ReventlessCore.Api_Ids.alternateKey)
+          : []
+      let extra = missing->Array.length > 0
+        ? await binding.pushdowns.byIds(~readModelName=rm, missing)
+        : []
+      JSON.Encode.array(Array.concat(found, extra)->Array.filter(ownerAllows))
 
     | "items" =>
       // Sub-id connection: {single}Items(id, filter, first/after/last/before).
@@ -184,12 +224,17 @@ let dispatch = async (
       switch binding.subIdField {
       | Some(subIdField) =>
         let id = payload.arguments->argStr("id")->Option.getOr("")
-        await binding.pushdowns.itemsPage(
-          ~readModelName=rm,
-          ~subIdField,
-          ~id,
-          ~argsDict=payload.arguments->argObj,
-        )
+        switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+        | RefuseOwned => emptyConnection()
+        | decision =>
+          await binding.pushdowns.itemsPage(
+            ~readModelName=rm,
+            ~subIdField,
+            ~id,
+            ~argsDict=payload.arguments->argObj,
+            ~ownerScope=?Reventless.OwnerScope.scopeOf(decision),
+          )
+        }
       | None => emptyConnection()
       }
 
@@ -227,33 +272,42 @@ let dispatch = async (
       | _ => true
       }
       if authorized {
-        JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+        JSON.Encode.array(
+          (await binding.pushdowns.indexLookup(~readModelName=rm, field, value))->Array.filter(
+            ownerAllows,
+          ),
+        )
       } else {
         JSON.Encode.array([])
       }
 
     | "list" =>
       let argsDict = payload.arguments->argObj
-      switch await binding.pushdowns.listPage(
-        ~readModelName=rm,
-        ~argsDict,
-        ~capability=binding.capability,
-        ~labelField=binding.labelField,
-      ) {
-      | Some(conn) => conn
-      | None =>
-        // Shapes listPage declines (search/searchPrefix/ids/backward) → run the
-        // shared spec over the materialised model. No Relay global-id decoding
-        // in the Lambda, so `decodeLocalId` is a no-op (the `ids` filter still
-        // matches raw item ids).
-        let items = await binding.pushdowns.scanAll(~readModelName=rm)
-        ReventlessCore.QueryDbListQuery.run(
-          ~items,
+      switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+      | RefuseOwned => emptyConnection()
+      | decision =>
+        let ownerScope = Reventless.OwnerScope.scopeOf(decision)
+        switch await binding.pushdowns.listPage(
+          ~readModelName=rm,
           ~argsDict,
           ~capability=binding.capability,
           ~labelField=binding.labelField,
-          ~decodeLocalId=_ => None,
-        )
+          ~ownerScope?,
+        ) {
+        | Some(conn) => conn
+        | None =>
+          // Shapes listPage declines (search/searchPrefix/ids/backward) → run the
+          // shared spec over the materialised model, which decodes Relay global
+          // ids the same way every other door now does.
+          let items = await binding.pushdowns.scanAll(~readModelName=rm)
+          ReventlessCore.QueryDbListQuery.run(
+            ~items,
+            ~argsDict,
+            ~capability=binding.capability,
+            ~labelField=binding.labelField,
+            ~ownerScope?,
+          )
+        }
       }
 
     // Cross-table single-ID field resolver (@resolves). `binding` is the TARGET

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -6,6 +6,8 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
@@ -70,23 +72,45 @@ async function dispatch(binding, lookupBindingOpt, payload) {
   let rm = payload.readModelName;
   let match = await runInterceptor(binding, payload);
   if (typeof match !== "object") {
+    let ownerAllows = item => {
+      let match = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+      if (typeof match !== "object") {
+        return match === "Unscoped";
+      }
+      let required = match._1;
+      return Stdlib_Option.mapOr(argStr(item, match._0), false, v => v === required);
+    };
     let other = payload.kind;
     switch (other) {
       case "byIds" :
         let ids = argStrs(payload.arguments, "ids");
-        return await binding.pushdowns.byIds(rm, ids);
+        let found = await binding.pushdowns.byIds(rm, ids);
+        let missing = found.length < ids.length ? Stdlib_Array.filterMap(ids, Api_Ids$ReventlessCore.alternateKey) : [];
+        let extra = missing.length !== 0 ? await binding.pushdowns.byIds(rm, missing) : [];
+        return found.concat(extra).filter(ownerAllows);
       case "getById" :
         let id = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
-        let items = await binding.ops.load(id);
-        if (items.TAG !== "Ok") {
-          return null;
-        }
-        let item = items._0[0];
-        if (item !== undefined) {
+        let loadKey = async key => {
+          let items = await binding.ops.load(key);
+          if (items.TAG === "Ok") {
+            return items._0[0];
+          }
+        };
+        let match$1 = await loadKey(id);
+        let match$2 = Api_Ids$ReventlessCore.alternateKey(id);
+        let match$3 = match$1 !== undefined || match$2 === undefined ? [
+            id,
+            match$1
+          ] : [
+            match$2,
+            await loadKey(match$2)
+          ];
+        let found$1 = match$3[1];
+        if (found$1 !== undefined && ownerAllows(found$1)) {
           if (binding.includeIdParam) {
-            return withId(item, id);
+            return withId(found$1, match$3[0]);
           } else {
-            return item;
+            return found$1;
           }
         } else {
           return null;
@@ -95,14 +119,14 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let indexName = Stdlib_Option.getOr(payload.index, "");
         let field = Stdlib_Option.getOr(Stdlib_Option.flatMap(binding.indexes.find(ic => ic.index === indexName), ic => ic.idField), indexName);
         let value = Stdlib_Option.getOr(argStr(payload.arguments, indexName), "");
-        let match$1 = payload.authGroup;
-        let match$2 = payload.authTable;
+        let match$4 = payload.authGroup;
+        let match$5 = payload.authTable;
         let authorized;
-        if (match$1 !== undefined && match$2 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$1)) {
-          let authBinding = lookupBinding(match$2);
+        if (match$4 !== undefined && match$5 !== undefined && Identity$Reventless.hasGroup(payload.identity, match$4)) {
+          let authBinding = lookupBinding(match$5);
           if (authBinding !== undefined) {
-            let items$1 = await authBinding.ops.load(value);
-            authorized = items$1.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items$1._0[0], row => argStr(row, authIdField(match$1))), false, owner => owner === payload.identity.username) : false;
+            let items = await authBinding.ops.load(value);
+            authorized = items.TAG === "Ok" ? Stdlib_Option.mapOr(Stdlib_Option.flatMap(items._0[0], row => argStr(row, authIdField(match$4))), false, owner => owner === payload.identity.username) : false;
           } else {
             authorized = false;
           }
@@ -110,7 +134,7 @@ async function dispatch(binding, lookupBindingOpt, payload) {
           authorized = true;
         }
         if (authorized) {
-          return await binding.pushdowns.indexLookup(rm, field, value);
+          return (await binding.pushdowns.indexLookup(rm, field, value)).filter(ownerAllows);
         } else {
           return [];
         }
@@ -120,15 +144,26 @@ async function dispatch(binding, lookupBindingOpt, payload) {
           return emptyConnection();
         }
         let id$1 = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
-        return await binding.pushdowns.itemsPage(rm, subIdField, id$1, argObj(payload.arguments));
+        let decision = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+        if (typeof decision !== "object" && decision !== "Unscoped") {
+          return emptyConnection();
+        }
+        return await binding.pushdowns.itemsPage(rm, subIdField, id$1, argObj(payload.arguments), OwnerScope$Reventless.scopeOf(decision));
+        break;
       case "list" :
         let argsDict = argObj(payload.arguments);
-        let conn = await binding.pushdowns.listPage(rm, argsDict, binding.capability, binding.labelField);
+        let decision$1 = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+        if (typeof decision$1 !== "object" && decision$1 !== "Unscoped") {
+          return emptyConnection();
+        }
+        let ownerScope = OwnerScope$Reventless.scopeOf(decision$1);
+        let conn = await binding.pushdowns.listPage(rm, argsDict, binding.capability, binding.labelField, ownerScope);
         if (conn !== undefined) {
           return conn;
         }
-        let items$2 = await binding.pushdowns.scanAll(rm);
-        return QueryDbListQuery$ReventlessCore.run(items$2, argsDict, binding.capability, binding.labelField, param => {});
+        let items$1 = await binding.pushdowns.scanAll(rm);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined, ownerScope);
+        break;
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
@@ -139,30 +174,30 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let source$1 = Stdlib_Option.getOr(payload.source, null);
         let key = Stdlib_Option.getOr(argStr(source$1, Stdlib_Option.getOr(payload.sourceIdField, "")), "");
         let ix = payload.targetIndex;
-        let items$3;
+        let items$2;
         if (ix !== undefined) {
-          items$3 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
+          items$2 = await binding.pushdowns.indexLookup(target$1, Stdlib_Option.getOr(payload.targetIndexIdField, ix), key);
         } else {
-          let items$4 = await binding.ops.load(key);
-          items$3 = items$4.TAG === "Ok" ? items$4._0 : [];
+          let items$3 = await binding.ops.load(key);
+          items$2 = items$3.TAG === "Ok" ? items$3._0 : [];
         }
-        let match$3 = payload.sourceSubId;
-        let match$4 = binding.subIdField;
+        let match$6 = payload.sourceSubId;
+        let match$7 = binding.subIdField;
         let filtered;
-        if (match$3 !== undefined && match$4 !== undefined) {
-          let name = match$3.name;
-          let tmp = match$3.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
+        if (match$6 !== undefined && match$7 !== undefined) {
+          let name = match$6.name;
+          let tmp = match$6.kind === "arg" ? argStr(payload.arguments, name) : argStr(source$1, name);
           let subVal = Stdlib_Option.getOr(tmp, "");
-          filtered = items$3.filter(it => Stdlib_Option.getOr(argStr(it, match$4), "") === subVal);
+          filtered = items$2.filter(it => Stdlib_Option.getOr(argStr(it, match$7), "") === subVal);
         } else {
-          filtered = items$3;
+          filtered = items$2;
         }
         if (Stdlib_Option.getOr(payload.multi, false)) {
           return filtered;
         }
-        let item$1 = filtered[0];
-        if (item$1 !== undefined) {
-          return item$1;
+        let item = filtered[0];
+        if (item !== undefined) {
+          return item;
         } else {
           return null;
         }
@@ -172,8 +207,8 @@ async function dispatch(binding, lookupBindingOpt, payload) {
     }
   } else {
     let isMulti = Stdlib_Option.getOr(payload.multi, false);
-    let match$5 = payload.kind;
-    switch (match$5) {
+    let match$8 = payload.kind;
+    switch (match$8) {
       case "getById" :
         return null;
       case "items" :

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -205,7 +205,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // with the SDL emitted by GraphQL_FragmentGenerator at runtime.
     let stateSchemaOpt = ReventlessCore.Plugin_Helpers.stateSchemaRegistry->Dict.get(name)
     let capability = switch stateSchemaOpt {
-    | Some(s) => ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(s)
+    | Some(s) => ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(~entityName=name, s)
     | None => ReventlessCore.GraphQL_FragmentGenerator.emptyCapability
     }
     let filterFieldNames = capability.filterFields->Array.map(f => f.name)
@@ -238,6 +238,39 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
     // See docs/plans/platform-plugins-admin-connection-null-rows.md.
     let requireAttribute = internalRowRequiredAttr(name)
+    // Derived from the same schema `capability` came from, so the two cannot
+    // disagree about this read model's fields.
+    let ownerField = switch stateSchemaOpt {
+    | Some(s) => Reventless.Owner.fieldNames(s)->Array.get(0)
+    | None => None
+    }
+    // A DynamoDB FilterExpression is applied AFTER the page is read, so a scoped
+    // list over a table with no index on the owner field returns short pages —
+    // correct, but pathological once a caller owns a small fraction of the rows.
+    // Warned rather than refused: the resolver does serve the query, and a
+    // deployment may legitimately accept the cost on a small table. Mirrors the
+    // `@scanSort` alignment warning above, which exists for the same class of
+    // "works, but scans" mistake.
+    ReventlessCore.OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+      ~comp="QueryDbResolvers_AppSync",
+      ~view=name,
+      ~ownerField,
+    )
+    switch ownerField {
+    | Some(f) =>
+      let indexed =
+        indexes->Array.some(ic => ic.idField->Option.getOr(ic.index) == f) ||
+          subIdField->Option.getOr("") == f
+      if !indexed {
+        log.warn(
+          ~comp="QueryDbResolvers_AppSync",
+          `${name}: @owner field "${f}" is not the key of any index on this table. ` ++
+          "Owner-scoped reads will Scan and filter, so pages shrink as the caller's " ++
+          "share of the rows falls. Add an @index on that field before this read model grows.",
+        )
+      }
+    | None => ()
+    }
     let resolverAll = makeQueryResolver(
       ~resolverName=fieldNameForAll->String.capitalize,
       ~field=fieldNameForAll->Pulumi.Input.make,
@@ -248,6 +281,8 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~rangeFields=rangeFieldNames,
           ~sortFields=sortFieldNames,
           ~requireAttribute?,
+          ~ownerField?,
+          ~elevatedGroups=Reventless.OwnerScope.elevatedGroups(),
         )
       } else {
         Resolver.Functions.listAllItems

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -3,7 +3,9 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as AppSync_Function$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Function.res.mjs";
 import * as Util_AppSync$ReventlessAws from "../../util/Util_AppSync.res.mjs";
@@ -12,6 +14,7 @@ import * as Util_QueryDb$ReventlessCore from "@reventlessdev/reventless-core/src
 import * as AppSync_DataSource$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_DataSource.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+import * as OwnerScopeDiagnostics$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/OwnerScopeDiagnostics.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 import * as QueryInterceptor_Provisioning$ReventlessAws from "./QueryInterceptor_Provisioning.res.mjs";
@@ -91,7 +94,7 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     let resolverByIdMultiple = includeIdParam ? Stdlib_Option.map(subIdField, sortField => makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", AppSync_Resolver_Functions$PulumiAws.queryItemsWithSortConditions(sortField))) : undefined;
     let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let stateSchemaOpt = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name$1];
-    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
+    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(name$1, stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
     let filterFieldNames = capability.filterFields.map(f => f.name);
     let rangeFieldNames = Stdlib_Array.filterMap(capability.filterFields, f => {
       if (f.range) {
@@ -106,7 +109,15 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
       GraphQL_FragmentGenerator$ReventlessCore.validateScanSortAlignment(stateSchemaOpt, name$1, knownSortFields).forEach(msg => log.warn("QueryDbResolvers_AppSync", undefined, msg));
     }
     let requireAttribute = internalRowRequiredAttr(name$1);
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let ownerField = stateSchemaOpt !== undefined ? Owner$Reventless.fieldNames(stateSchemaOpt)[0] : undefined;
+    OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("QueryDbResolvers_AppSync", name$1, ownerField);
+    if (ownerField !== undefined) {
+      let indexed = indexes.some(ic => Stdlib_Option.getOr(ic.idField, ic.index) === ownerField) || Stdlib_Option.getOr(subIdField, "") === ownerField;
+      if (!indexed) {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" is not the key of any index on this table. ` + "Owner-scoped reads will Scan and filter, so pages shrink as the caller's share of the rows falls. Add an @index on that field before this read model grows.");
+      }
+    }
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, OwnerScope$Reventless.elevatedGroups()) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.map(indexConfig => {
       let index = indexConfig.index;
       let stripLeadingBy = s => {

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -144,11 +144,15 @@ let registerBinding = (
       indexes,
       subIdField,
       capability: ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(
+        ~entityName=entry.readModelName,
         spec.stateSchema,
       ),
       labelField: entry.labelField,
       includeIdParam: entry.includeIdParam,
       authorization: spec.authorization,
+      // From the same schema `capability` is derived from, one line above, so the
+      // two cannot end up disagreeing about this read model's fields.
+      ownerField: Reventless.Owner.fieldNames(spec.stateSchema)->Array.get(0),
     },
   )
   logDebug("registered resolver binding for " ++ entry.readModelName, {comp: "PgQueryResolver"})

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
 import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../QueryDb/PgQueryResolver_Lambda.res.mjs";
@@ -69,10 +70,11 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     pushdowns: pushdowns,
     indexes: indexes,
     subIdField: subIdField,
-    capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(spec.stateSchema),
+    capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(entry.readModelName, spec.stateSchema),
     labelField: entry.labelField,
     includeIdParam: entry.includeIdParam,
-    authorization: spec.authorization
+    authorization: spec.authorization,
+    ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0]
   });
   HandlerFactoryHelpersMjs.log.debug("registered resolver binding for " + entry.readModelName, {
     comp: "PgQueryResolver"
@@ -91,4 +93,4 @@ export {
   makePushdowns,
   registerBinding,
 }
-/* PgRuntime-ReventlessAws Not a pure module */
+/* Owner-Reventless Not a pure module */