@reventlessdev/reventless-aws 3.0.0-alpha.304 → 3.0.0-alpha.306

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.306 (2026-08-16)
+
+### Bug Fixes
+
+* **aws:** attach the pre-token trigger through both fields Cognito keeps ([6d6e2e9](https://github.com/ReventlessDev/reventless-core/commit/6d6e2e90e1d6cb3defabaab8ae7f3c9d1955a5df))
+* **aws:** scope by-key reads to the owner, not only lists ([8232fd4](https://github.com/ReventlessDev/reventless-core/commit/8232fd4c09c1098c7265e4a17882ee44884f3bec))
+* **core:** stamp the owner from each DCB slice's own command schema ([6edbdf4](https://github.com/ReventlessDev/reventless-core/commit/6edbdf4680f2535597c3b560215aa514ceed27eb))
+
+
+# 3.0.0-alpha.305 (2026-08-16)
+
+### Bug Fixes
+
+* **aws:** move the EventCollector's queue-URL maps out of the environment ([31172cb](https://github.com/ReventlessDev/reventless-core/commit/31172cb793d267729f201794ff785f9f982315fa))
+
+
 # 3.0.0-alpha.304 (2026-08-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.304",
+  "version": "3.0.0-alpha.306",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.77",
     "@reventlessdev/rescript-node": "2.0.0-alpha.7",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.237",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.78",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.143",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.101",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.115"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.238",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.144",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.102",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.116",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -656,7 +656,7 @@ module MakeWithConfig = (
   }
   module InboundTranslationSlice = InboundTranslationSlice_Builder.Make(ApiConfig)
 
-  // Admin UI-fragment registry slices (docs/plans/event-sourced-fragment-registries.md): the
+  // Admin UI-fragment registry slices (docs/plans/done/event-sourced-fragment-registries.md): the
   // platform UI-fragment registry hosted as admin DCB slices sharing the admin DcbEventLog.
   // Built once at platform-module level and passed into Admin.construct below (registers the
   // slice's command handler exactly once).

package/src/adapter/Api/AppSync_Resolver_Native.res

@@ -1,7 +1,7 @@
 /** AppSync_Resolver_Native — drop-in replacement for
     `PulumiAws.AppSync.Resolver` that uses `@pulumi/aws-native` (Cloud Control
     API) so the CFN handler can internally wait out schema -> resolver
-    propagation. See docs/plans/appsync-resolver-aws-native.md. */
+    propagation. See docs/plans/done/appsync-resolver-aws-native.md. */
 
 module Native = PulumiAws.AwsNative.AppSync.Resolver
 module Functions = PulumiAws.AppSync.Resolver.Functions

package/src/adapter/Api/AppSync_Resolver_Retrying.res

@@ -16,7 +16,7 @@
     `aws-native:appsync/resolver:Resolver` type so existing resources are
     adopted in-place on first deploy (no delete+recreate).
 
-    See docs/plans/appsync-resolver-aws-native-retry.md. */
+    See docs/plans/done/appsync-resolver-aws-native-retry.md. */
 
 // ── AWS SDK bindings ─────────────────────────────────────────────────────────
 //
@@ -198,7 +198,7 @@ let jsThrow: JsExn.t => 'a = %raw(`e => { throw e }`)
 
     - `NotFoundException / No field named` — schema-propagation race after a
       successful `StartSchemaCreation`. Backstop for the per-plugin dedup
-      flow (see `docs/plans/appsync-schema-push-dedup.md`).
+      flow (see `docs/plans/done/appsync-schema-push-dedup.md`).
     - `ConcurrentModificationException / Schema is currently being altered` —
       API-level lock contention with an in-flight `StartSchemaCreation` on
       the same API (admin resolvers racing the platform schema push from

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -62,8 +62,23 @@ let readOnlyKeys = [
   "EmailConfigurationFailure",
 ]
 
-/** The pool's own configuration, sent back whole with `PreTokenGeneration` set
-    (or, when `preTokenGenerationArn` is `None`, removed).
+/** The version of the pre-token-generation contract this resource attaches at.
+
+    [Auth_ActiveRoleTrigger_Ops] implements `V1_0` — it answers with
+    `claimsOverrideDetails` — and does so deliberately, because `V2_0`/`V3_0` buy
+    access-token customisation it does not need and are gated behind the
+    Essentials and Plus feature plans.
+
+    🚨 **A pool left at a version the handler does not implement does not fail —
+    it silently does nothing.** Cognito sends a `V2_0` event, the handler answers
+    in `V1_0` shape, and the service ignores the answer. Sign-in succeeds, tokens
+    mint, and the role narrowing never happens. So the version is not the pool's
+    to keep: the trigger and the contract it speaks are one unit, and attaching
+    the trigger means attaching its version too. */
+let triggerVersion = "V1_0"
+
+/** The pool's own configuration, sent back whole with the pre-token-generation
+    trigger set (or, when `preTokenGenerationArn` is `None`, removed).
 
     Pure and total so the property that matters — a pool carrying non-default
     settings still carries them afterwards — is checkable without a pool. */
@@ -89,21 +104,64 @@ let mergedUpdateInput = (
     ->Dict.get("LambdaConfig")
     ->Option.flatMap(JSON.Decode.object)
     ->Option.mapOr(Dict.make(), existing => Dict.fromArray(existing->Dict.toArray))
+  // 🚨 Cognito carries this one trigger in TWO fields: the legacy
+  // `PreTokenGeneration` string and the `PreTokenGenerationConfig` object.
+  // `UpdateUserPool` rejects the call outright when both are present naming
+  // different functions, so both are written, together, naming the same one.
+  //
+  // Writing only one and letting the other ride through on the copy above cannot
+  // work, and not merely because a customer might have set it: **AWS
+  // materialises the field we did not write.** Attach via the legacy field alone
+  // and the next `DescribeUserPool` reports a `PreTokenGenerationConfig` the
+  // service populated, which the merge would then feed back on the following
+  // deploy — so an attachment that succeeded once fails the next time with
+  // nothing changed but AWS normalising its own record. Writing the pair in
+  // agreement is the only form stable under repeated describe → merge → update.
   switch preTokenGenerationArn {
-  | Some(arn) => lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
-  | None => lambdaConfig->Dict.delete("PreTokenGeneration")
+  | Some(arn) =>
+    let config = Dict.make()
+    config->Dict.set("LambdaArn", JSON.Encode.string(arn))
+    config->Dict.set("LambdaVersion", JSON.Encode.string(triggerVersion))
+    lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
+    lambdaConfig->Dict.set("PreTokenGenerationConfig", JSON.Encode.object(config))
+  | None =>
+    // Both, or the destroyed function stays attached through whichever field was
+    // left behind — the "every sign-in fails on a pool nothing here would fix"
+    // hazard [delete_] exists to prevent.
+    lambdaConfig->Dict.delete("PreTokenGeneration")
+    lambdaConfig->Dict.delete("PreTokenGenerationConfig")
   }
   out->Dict.set("LambdaConfig", lambdaConfig->JSON.Encode.object)
   out
 }
 
-/** The trigger currently attached to a described pool, if any. */
-let attachedTrigger = (~described: dict<JSON.t>): option<string> =>
-  described
-  ->Dict.get("LambdaConfig")
-  ->Option.flatMap(JSON.Decode.object)
-  ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
-  ->Option.flatMap(JSON.Decode.string)
+/** The trigger currently attached to a described pool, if any.
+
+    Prefers `PreTokenGenerationConfig`, since that is the field AWS populates and
+    the one that carries the version.
+
+    A pool whose `LambdaVersion` names a contract [triggerVersion] does not
+    implement reports `None` — *not attached* — even when it points at our own
+    function. That is what turns the silent-no-op case into ordinary drift:
+    refresh records nothing attached, and the next `up` rewrites the pair at the
+    right version. Reporting the ARN instead would leave a pool that mints
+    un-narrowed tokens looking correct forever. */
+let attachedTrigger = (~described: dict<JSON.t>): option<string> => {
+  let lambdaConfig = described->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+  switch lambdaConfig
+  ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+  ->Option.flatMap(JSON.Decode.object) {
+  | Some(config) =>
+    switch config->Dict.get("LambdaVersion")->Option.flatMap(JSON.Decode.string) {
+    | Some(version) if version != triggerVersion => None
+    | _ => config->Dict.get("LambdaArn")->Option.flatMap(JSON.Decode.string)
+    }
+  | None =>
+    lambdaConfig
+    ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
+    ->Option.flatMap(JSON.Decode.string)
+  }
+}
 
 // ── AWS SDK bindings (lazily imported — see AppSync_SourceApiAssociation_Retrying) ──
 

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -30,6 +30,8 @@ let readOnlyKeys = [
   "EmailConfigurationFailure"
 ];
 
+let triggerVersion = "V1_0";
+
 function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
   let out = {};
   Stdlib_Dict.forEachWithKey(described, (value, key) => {
@@ -44,16 +46,31 @@ function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
   out["UserPoolId"] = userPoolId;
   let lambdaConfig = Stdlib_Option.mapOr(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), {}, existing => Object.fromEntries(Object.entries(existing)));
   if (preTokenGenerationArn !== undefined) {
+    let config = {};
+    config["LambdaArn"] = preTokenGenerationArn;
+    config["LambdaVersion"] = triggerVersion;
     lambdaConfig["PreTokenGeneration"] = preTokenGenerationArn;
+    lambdaConfig["PreTokenGenerationConfig"] = config;
   } else {
     Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGeneration");
+    Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGenerationConfig");
   }
   out["LambdaConfig"] = lambdaConfig;
   return out;
 }
 
 function attachedTrigger(described) {
-  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+  let lambdaConfig = Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object);
+  let config = Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object);
+  if (config === undefined) {
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+  }
+  let version = Stdlib_Option.flatMap(config["LambdaVersion"], Stdlib_JSON.Decode.string);
+  if (version !== undefined && version !== triggerVersion) {
+    return;
+  } else {
+    return Stdlib_Option.flatMap(config["LambdaArn"], Stdlib_JSON.Decode.string);
+  }
 }
 
 let newOf1 = ((C, x) => new C(x));
@@ -310,6 +327,7 @@ function make(nameOpt, props, opts) {
 export {
   log,
   readOnlyKeys,
+  triggerVersion,
   mergedUpdateInput,
   attachedTrigger,
   newOf1,

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -704,7 +704,7 @@ let collectEventTags = (
 // local backends' true DCB query semantics (and fixing analysis Issue 4 — the
 // one-event-type-per-attribute deadlock). It also folds the create guard into the
 // fence (see `buildConditionalFenceUpdate`), retiring the `create#` rows.
-// Plan: docs/plans/dcb-fence-event-type-granularity.md.
+// Plan: docs/plans/done/dcb-fence-event-type-granularity.md.
 let fenceTypeAttr = (eventType: string) => `pos#${eventType}`
 
 let dedupStrings = (xs: array<string>): array<string> => {
@@ -975,7 +975,7 @@ let appendUnconditional = async (
 // fan-out sharing those prefixes turns into a hot partition → `TransactionConflict`
 // → `retries exhausted`; it also over-fenced (two DISTINCT composite entities
 // sharing a member value serialized needlessly). Plan:
-// docs/plans/Backlog/dcb-hot-tag-fence-contention.md § "Root-cause correction".
+// docs/plans/done/dcb-hot-tag-fence-contention.md § "Root-cause correction".
 let compositeFenceTagKey = "__dcb_composite__"
 
 let makeCompositeFenceTag = (

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res

@@ -11,7 +11,7 @@
 // The pool is lazy (`PgRuntime.poolFor`), so binding ops inside the deploy-time
 // `Output.apply` opens no connection during `pulumi up` — a real query only runs
 // inside the DcbCommandTopic Lambda at runtime. See
-// docs/plans/aws-postgres-change-feed-bridge.md.
+// docs/plans/done/aws-postgres-change-feed-bridge.md.
 
 let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
   ~name,

package/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res

@@ -71,7 +71,7 @@ let append = table =>
     )
     ->Effect.runPromise
 
-// ─── Aggregate snapshots (docs/plans/aggregate-snapshotting.md) ───
+// ─── Aggregate snapshots (docs/plans/done/aggregate-snapshotting.md) ───
 // A snapshot lives in the SAME table as the events, on the reserved sort key
 // `position = "SNAPSHOT"`. Event positions are 9-digit zero-padded numbers, so
 // bounding the replay query to the all-digit range excludes the snapshot row

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -5,7 +5,7 @@
 // consumes — onto that queue. The plugin EventCollector (`EventCollectorEntryPoint`)
 // then drives the full fan-out: read-model projections, aggregate command topics,
 // and the cross-plugin SNS EventTopic. See
-// docs/plans/aws-postgres-change-feed-bridge.md.
+// docs/plans/done/aws-postgres-change-feed-bridge.md.
 //
 // The transform reuses the canonical DynamoDB shape producers
 // (`derivePartitionKey` + `buildJsonEvent'`) so the emitted body is byte-identical

package/src/adapter/Postgres/PgProjectionFeed.res

@@ -1,5 +1,5 @@
 // B3.0 — projection delivery on Postgres platforms
-// (docs/plans/aws-postgres-querydb-adapter.md).
+// (docs/plans/done/aws-postgres-querydb-adapter.md).
 //
 // On DynamoDB platforms the ReadModel / StateViewSlice Lambdas consume their
 // source event logs via DynamoDB-stream event-source mappings. Postgres logs have

package/src/adapter/QueryDb/QueryDbBackend.res

@@ -1,6 +1,6 @@
 // AWS-side selection for the QueryDb (read model) storage backend — the QueryDb
 // analogue of `EventLogBackend` / `DcbBackend` (B3.1,
-// docs/plans/aws-postgres-querydb-adapter.md).
+// docs/plans/done/aws-postgres-querydb-adapter.md).
 //
 // When `Platform.MakeWithConfig` is given a `~pgConnection`, it records the
 // resolved selection here BEFORE any admin/plugin `construct` runs. Read by:

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -4,7 +4,7 @@ open PulumiAws.AppSync
 // `NotFoundException: No field named X` (the schema-propagation race) with
 // exponential backoff. Replaces AppSync_Resolver_Native (aws-native provider)
 // which exhibited the same race in production.
-// See docs/plans/appsync-resolver-aws-native-retry.md.
+// See docs/plans/done/appsync-resolver-aws-native-retry.md.
 module Resolver = AppSync_Resolver_Retrying
 open Reventless.ReadModel
 
@@ -55,7 +55,7 @@ export function response(ctx) {
     that carry no `name`. Returning `Some(attr)` makes the Connection Scan emit an
     `attribute_exists(#attr)` filter so those rows never reach the non-null GraphQL schema.
     `name` is the already-capitalized read-model name (spec name, e.g. "Plugins").
-    See docs/plans/platform-plugins-admin-connection-null-rows.md. */
+    See docs/plans/done/platform-plugins-admin-connection-null-rows.md. */
 let internalRowRequiredAttr = (name: string): option<string> =>
   name == "Plugins" ? Some("name") : None
 
@@ -69,7 +69,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   ~idResolverConfigs: array<idResolverConfig>,
   ~idsResolverConfigs: array<idsResolverConfig>,
   // AWS path enforces authorization via `@aws_cognito_user_pools(cognito_groups: …)` on the
-  // SDL fields (see Stage E in docs/plans/host-ui-login-core.md). Accepted but
+  // SDL fields (see Stage E in docs/plans/done/host-ui-login-core.md). Accepted but
   // ignored here so the in-memory and AWS resolver maker signatures stay aligned.
   ~authorization as _: Reventless.Authorization.permission,
   ~opts,
@@ -167,13 +167,30 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   // This prevents a race condition where AppSync resolvers are deployed before
   // the schema push completes and the new fields are ACTIVE in AppSync.
   let resourcesMaker: ReventlessCore.QueryDb.resolversResourcesMaker = allQueryDbs => {
+    // The state's `@owner` field, derived from the same schema `capability` is
+    // derived from, so the two cannot disagree about this read model's fields.
+    //
+    // Read HERE, at the top, rather than beside the list resolver that first
+    // needed it. The by-id resolvers are built a few lines below and the lookup
+    // used to sit well after them, so they were generated without it: a list
+    // narrowed to the caller beside a by-id read that hands over any row it is
+    // asked for. That is not a partial delivery — the row is reachable by
+    // anyone who can name one, and the list gives no sign of it, because the
+    // list is correct.
+    let stateSchemaOpt = ReventlessCore.Plugin_Helpers.stateSchemaRegistry->Dict.get(name)
+    let ownerField = switch stateSchemaOpt {
+    | Some(s) => Reventless.Owner.fieldNames(s)->Array.get(0)
+    | None => None
+    }
+    let elevatedGroups = Reventless.OwnerScope.elevatedGroups()
+
     let resolverByIdSingle = if includeIdParam {
       makeQueryResolver(
         ~resolverName=fieldNameForSingle->String.capitalize,
         ~field=fieldNameForSingle->Pulumi.Input.make,
         ~code=switch subIdField {
-        | Some(sortField) => Resolver.Functions.queryByIdSort(sortField)
-        | None => Resolver.Functions.getItemById
+        | Some(sortField) => Resolver.Functions.queryByIdSort(sortField, ~ownerField?, ~elevatedGroups)
+        | None => Resolver.Functions.getItemById(~ownerField?, ~elevatedGroups)
         },
       )
     } else {
@@ -188,7 +205,11 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         makeQueryResolver(
           ~resolverName=fieldNameForSingle->String.capitalize ++ "Items",
           ~field=(fieldNameForSingle ++ "Items")->Pulumi.Input.make,
-          ~code=Resolver.Functions.queryItemsWithSortConditions(sortField),
+          ~code=Resolver.Functions.queryItemsWithSortConditions(
+            sortField,
+            ~ownerField?,
+            ~elevatedGroups,
+          ),
         )
       )
     } else {
@@ -203,7 +224,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // registered or has no indexable fields — the resolver template emits the same
     // SDL the in-memory adapter does, so the AWS Filter / OrderBy stays in lockstep
     // with the SDL emitted by GraphQL_FragmentGenerator at runtime.
-    let stateSchemaOpt = ReventlessCore.Plugin_Helpers.stateSchemaRegistry->Dict.get(name)
     let capability = switch stateSchemaOpt {
     | Some(s) => ReventlessCore.GraphQL_FragmentGenerator.deriveServerCapability(~entityName=name, s)
     | None => ReventlessCore.GraphQL_FragmentGenerator.emptyCapability
@@ -236,14 +256,8 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // resolves `name: String!` to null → non-null violation that nulls the entire
     // Platform_PluginConnection. Exclude them with an `attribute_exists(#name)` filter
     // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
-    // See docs/plans/platform-plugins-admin-connection-null-rows.md.
+    // See docs/plans/done/platform-plugins-admin-connection-null-rows.md.
     let requireAttribute = internalRowRequiredAttr(name)
-    // Derived from the same schema `capability` came from, so the two cannot
-    // disagree about this read model's fields.
-    let ownerField = switch stateSchemaOpt {
-    | Some(s) => Reventless.Owner.fieldNames(s)->Array.get(0)
-    | None => None
-    }
     // A DynamoDB FilterExpression is applied AFTER the page is read, so a scoped
     // list over a table with no index on the owner field returns short pages —
     // correct, but pathological once a caller owns a small fraction of the rows.
@@ -310,7 +324,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~sortFields=sortFieldNames,
           ~requireAttribute?,
           ~ownerField?,
-          ~elevatedGroups=Reventless.OwnerScope.elevatedGroups(),
+          ~elevatedGroups,
           ~retiredField?,
           ~retiredValues?,
         )

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -91,10 +91,12 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   };
   let fieldNameForAll = registryEntry !== undefined ? registryEntry.listFieldName : name$1 + "s";
   let resourcesMaker = allQueryDbs => {
-    let resolverByIdSingle = includeIdParam ? makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, subIdField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIdSort(subIdField) : AppSync_Resolver_Functions$PulumiAws.getItemById) : makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, AppSync_Resolver_Functions$PulumiAws.listAllItems);
-    let resolverByIdMultiple = includeIdParam ? Stdlib_Option.map(subIdField, sortField => makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", AppSync_Resolver_Functions$PulumiAws.queryItemsWithSortConditions(sortField))) : undefined;
-    let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let stateSchemaOpt = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name$1];
+    let ownerField = stateSchemaOpt !== undefined ? Owner$Reventless.fieldNames(stateSchemaOpt)[0] : undefined;
+    let elevatedGroups = OwnerScope$Reventless.elevatedGroups();
+    let resolverByIdSingle = includeIdParam ? makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, subIdField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIdSort(subIdField, ownerField, elevatedGroups) : AppSync_Resolver_Functions$PulumiAws.getItemById(ownerField, elevatedGroups)) : makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let resolverByIdMultiple = includeIdParam ? Stdlib_Option.map(subIdField, sortField => makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", AppSync_Resolver_Functions$PulumiAws.queryItemsWithSortConditions(sortField, ownerField, elevatedGroups))) : undefined;
+    let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(name$1, stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
     let filterFieldNames = capability.filterFields.map(f => f.name);
     let rangeFieldNames = Stdlib_Array.filterMap(capability.filterFields, f => {
@@ -110,7 +112,6 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
       GraphQL_FragmentGenerator$ReventlessCore.validateScanSortAlignment(stateSchemaOpt, name$1, knownSortFields).forEach(msg => log.warn("QueryDbResolvers_AppSync", undefined, msg));
     }
     let requireAttribute = internalRowRequiredAttr(name$1);
-    let ownerField = stateSchemaOpt !== undefined ? Owner$Reventless.fieldNames(stateSchemaOpt)[0] : undefined;
     OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("QueryDbResolvers_AppSync", name$1, ownerField);
     let isIndexed = f => {
       if (indexes.some(ic => Stdlib_Option.getOr(ic.idField, ic.index) === f)) {
@@ -128,7 +129,7 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     if (retiredField !== undefined && !isIndexed(retiredField)) {
       log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is not the key of any index on this table. ` + "Reads that exclude retired rows will Scan and filter, so pages shrink as the archive's share of the rows grows. Add an @index on that field before this read model grows.");
     }
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, OwnerScope$Reventless.elevatedGroups(), retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.map(indexConfig => {
       let index = indexConfig.index;
       let stripLeadingBy = s => {

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res

@@ -147,7 +147,7 @@ let make: ReventlessCore.QueryDb_Adapter.queryEngineMaker = allQueryDbs => {
   // B3.1: Postgres-backed read models have NO DynamoDB resource — exclude them
   // instead of failing findResource at deploy time. They are not reachable via
   // this engine (getRuntimeResource raises its explicit not-found error at
-  // query time); see docs/plans/aws-postgres-querydb-adapter.md § B3.1b.
+  // query time); see docs/plans/done/aws-postgres-querydb-adapter.md § B3.1b.
   let dynamoDbQueryDbs =
     allQueryDbs
     ->Dict.toArray

package/src/adapter/Runtime/AggregateEntryPoint.mjs

@@ -22,7 +22,7 @@ import { commandOutcomeToJson, runInlineAndCollect } from "@reventlessdev/revent
 import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 // Typed cold-start core — EventLog storage-ops selection/wiring, compiler-checked
 // against the framework signatures (see the module header and
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 import { makeStorageOps } from "./AggregateEntryPoint_Ops.res.mjs";
 import { DynamoDBClient, ScanCommand } from "@aws-sdk/client-dynamodb";
 import { unmarshall } from "@aws-sdk/util-dynamodb";

package/src/adapter/Runtime/AggregateEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the Aggregate Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 // The `.mjs` shell owns the untyped seams — reading `HANDLER_CONFIG`, the dynamic
 // `import()` of user Spec/Behavior modules, and the functor wiring that consumes
 // those runtime-loaded modules (`EventLog_Operations.Make`, `Aggregate_Callback.Make`,

package/src/adapter/Runtime/AutomationSliceEntryPoint.mjs

@@ -4,7 +4,7 @@
 // by source URN.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // inherently-untyped seam — the dynamic `import()` of the spec + body modules
 // named in HANDLER_CONFIG and the curried functor applications consuming them
 // (AutomationSlice_Callback.Make(Spec)(Automation) /

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -1,7 +1,7 @@
 // Typed cold-start core for the AutomationSlice / OutboundTranslationSlice
 // Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // AutomationSliceEntryPoint.mjs keeps only the inherently-untyped seam — the
 // dynamic `import()` of the spec + body modules named in HANDLER_CONFIG and
 // the curried callback-functor applications consuming them

package/src/adapter/Runtime/CounterEntryPoint.mjs

@@ -4,7 +4,7 @@
 // Routes DynamoDB Stream events from references and counts tables.
 //
 // Thin untyped shell ("typed core, thin shell" —
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md): this file owns ONLY the
 // seams that are inherently untyped — the dynamic `import()` of the
 // target-spec/mappings modules named in HANDLER_CONFIG, the `patchSpecId`
 // fix-up, and the MakeCounterHandler functor application consuming them.

package/src/adapter/Runtime/CounterEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the Counter Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md):
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md):
 // CounterEntryPoint.mjs keeps only the untyped seam — the dynamic `import()`
 // of the target-spec/mappings modules named in HANDLER_CONFIG, the
 // `patchSpecId` fix-up, and the EventMapper_Callback.MakeCounterHandler

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -27,7 +27,7 @@ import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessde
 // Typed cold-start core — scope/partitionTag derivation, storage-ops wiring, and
 // per-slice handler building (functor + decode + handleCommands), all
 // compiler-checked against the framework signatures (see the module header and
-// docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler, buildInboundReceiver } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
 import { makeDynamoQueryDbOps } from "./QueryDbEntryPoint_Ops.res.mjs";
 
@@ -95,6 +95,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
   );
 
   const handlersByType = {};
+  const commandSchemasByType = {};
   const sharedDcbEventLogOps = dcbEventLogOperationsMake({
     name: config.pluginName,
     // Mirrors DcbEventLog_Builder.res's `name ++ "DcbEventLog"` — the
@@ -119,6 +120,19 @@ export async function buildHandlersForConfig(config, opts = {}) {
     );
     for (const typeName of commandTypeNames(patchedSpec)) {
       handlersByType[typeName] = jsonHandler;
+      // The schema this command's owner fields are read from. Kept beside the
+      // handler because the two answer the same question — "which slice is this
+      // command?" — and a command routed to a handler but not to a schema is
+      // exactly the state that stamps nothing while looking like it worked.
+      if (commandSchemasByType[typeName] !== undefined) {
+        log.error(
+          "two DCB slices declare the command \"" + typeName + "\"; owner stamping " +
+            "resolves a command by that name alone and cannot tell them apart",
+          { comp: "DcbCommandTopicRuntime" },
+        );
+      } else {
+        commandSchemasByType[typeName] = patchedSpec.commandSchema;
+      }
     }
   });
 
@@ -191,9 +205,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // Sync (default): inline-dispatch the command via the same composite handler
   // that Route 2 uses, so the AppSync resolver gets a typed Accepted/Rejected
   // outcome. Async: undefined → makeCommandGenerator falls back to publishJsons
-  // and returns Pending. The schema is permissive (S.json) because AppSync has
-  // already validated input against the SDL — per-slice schemas reapply inside
-  // the typed core's buildSliceHandler decode.
+  // and returns Pending.
   const publishJsonsAndWait = DISPATCH_MODE === "async"
     ? undefined
     : (jsons) => runInlineAndCollect(jsons, compositeJsonCommandsHandler);
@@ -202,14 +214,31 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // the framework signature. stripIdFromParams=false: DCB slices may declare a
   // literal `id` field as part of the command schema (composite partition keys
   // etc.) — don't strip it.
-  const generateCommand = makeCommandGenerator(
+  //
+  // One generator per command, differing only in the schema. This used to be a
+  // single generator built on the permissive `jsonSchema`, on the still-true
+  // grounds that AppSync has already validated input against the SDL and that
+  // per-slice schemas reapply inside `buildSliceHandler`'s decode. What that
+  // reasoning did not cover is that the schema is also where `makeGenerateCommand`
+  // reads a command's `@owner` fields from: given `S.json` it finds none, for every
+  // command, and the write keeps whatever owner the CLIENT sent. Validation was
+  // never the only job.
+  const makeGeneratorFor = (commandSchema) => makeCommandGenerator(
     publishJsons,
     publishJsonsAndWait,
     config.pluginName,
-    jsonSchema,
+    commandSchema,
     "StateChangeSlice",
     false,
   );
+  const generatorsByType = {};
+  for (const typeName of Object.keys(commandSchemasByType)) {
+    generatorsByType[typeName] = makeGeneratorFor(commandSchemasByType[typeName]);
+  }
+  // A command no loaded slice claims keeps the permissive generator — what every
+  // command got before this change — so anything reaching this handler by another
+  // route behaves as it did. It also cannot stamp, hence the warning.
+  const generateFallback = makeGeneratorFor(jsonSchema);
 
   const cmdGenHandler = (event) => {
     // CommandGenerator.meta declares ip as array<string> (X-Forwarded-For chain).
@@ -225,6 +254,15 @@ export async function buildHandlersForConfig(config, opts = {}) {
           groups: [],
           provider: { TAG: "Custom", _0: "aws" },
         };
+    let generateCommand = generatorsByType[event.command];
+    if (generateCommand === undefined) {
+      log.warn(
+        "no DCB slice declares the command \"" + event.command + "\"; dispatching " +
+          "without an owner stamp, so any @owner field keeps the value the caller sent",
+        { comp: "DcbCommandTopicRuntime" },
+      );
+      generateCommand = generateFallback;
+    }
     return generateCommand({ ...event, meta, identity });
   };
 

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -1,6 +1,6 @@
 // Typed cold-start core for the DCB CommandTopic Lambda entry point.
 //
-// The "typed core, thin shell" split (docs/plans/minimize-lambda-entrypoint-mjs-shell.md).
+// The "typed core, thin shell" split (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
 // The `.mjs` shell owns the one boundary that is inherently untyped: reading
 // `HANDLER_CONFIG` and dynamically `import()`-ing user Spec/Behavior modules at
 // cold start, whose types are unknowable here. Everything below is compiler-