@reventlessdev/reventless-aws 3.0.0-alpha.305 → 3.0.0-alpha.307

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -119,6 +119,19 @@ function lambdaConfigOf(input) {
   return Stdlib_Option.flatMap(input["LambdaConfig"], Stdlib_JSON.Decode.object);
 }
 
+function v1Config(arn) {
+  return Object.fromEntries([
+    [
+      "LambdaArn",
+      arn
+    ],
+    [
+      "LambdaVersion",
+      "V1_0"
+    ]
+  ]);
+}
+
 globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(triggerArn);
   globalThis.test("MFA stays on rather than defaulting off", () => {
@@ -200,10 +213,84 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool
         "Name",
         "Bare"
       ]]), "eu-west-1_bare", triggerArn);
-    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([[
+    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([
+      [
         "PreTokenGeneration",
         triggerArn
-      ]]));
+      ],
+      [
+        "PreTokenGenerationConfig",
+        v1Config(triggerArn)
+      ]
+    ]));
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken";
+  let describedWithConfig = version => Object.fromEntries([
+    [
+      "Name",
+      "CustomerPool"
+    ],
+    [
+      "LambdaConfig",
+      Object.fromEntries([
+        [
+          "PreSignUp",
+          "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp"
+        ],
+        [
+          "PreTokenGeneration",
+          theirArn
+        ],
+        [
+          "PreTokenGenerationConfig",
+          Object.fromEntries([
+            [
+              "LambdaArn",
+              theirArn
+            ],
+            [
+              "LambdaVersion",
+              version
+            ]
+          ])
+        ]
+      ])
+    ]
+  ]);
+  let attachOnto = version => Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig(version), "eu-west-1_abc123", triggerArn);
+  globalThis.test("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto("V1_0"));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaArn"])
+    ]).toEqual([
+      triggerArn,
+      triggerArn
+    ]);
+  });
+  globalThis.test("a pool that arrived on V2_0 is pinned back to the version we implement", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V2_0")), c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), c => c["LambdaVersion"])).toEqual("V1_0");
+  });
+  globalThis.test("the customer's other triggers still survive", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(attachOnto("V1_0")), c => c["PreSignUp"])).toEqual("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp");
+  });
+  globalThis.test("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedWithConfig("V1_0"), "eu-west-1_abc123", undefined));
+    globalThis.expect([
+      Stdlib_Option.flatMap(config, c => c["PreTokenGeneration"]),
+      Stdlib_Option.flatMap(config, c => c["PreTokenGenerationConfig"])
+    ]).toEqual([
+      undefined,
+      undefined
+    ]);
+  });
+  globalThis.test("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto("V1_0");
+    let twice = Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(once, "eu-west-1_abc123", triggerArn);
+    globalThis.expect(lambdaConfigOf(twice)).toEqual(lambdaConfigOf(once));
   });
 });
 
@@ -217,6 +304,33 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
         "Bare"
       ]]))).toEqual(undefined);
   });
+  globalThis.test("reads the V2 field on a pool that only carries that one", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            v1Config(triggerArn)
+          ]])
+      ]]))).toEqual(triggerArn);
+  });
+  globalThis.test("reports none for our trigger held at a version we do not implement", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGenerationConfig",
+            Object.fromEntries([
+              [
+                "LambdaArn",
+                triggerArn
+              ],
+              [
+                "LambdaVersion",
+                "V2_0"
+              ]
+            ])
+          ]])
+      ]]))).toEqual(undefined);
+  });
 });
 
 globalThis.describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
@@ -259,5 +373,6 @@ export {
   merged,
   triggerArn,
   lambdaConfigOf,
+  v1Config,
 }
 /*  Not a pure module */

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -440,7 +440,7 @@ describe("Runtime.buildConditionalTransactItems — composite partition fences o
   // pluginName}. The read is one exact `tag_composite` match, so the fence must be
   // a SINGLE composite-key fence — not one per member. Per-member fencing made the
   // low-cardinality prefix (`environment`, `platformName`) hot under a deploy
-  // fan-out. Plan: docs/plans/Backlog/dcb-hot-tag-fence-contention.md.
+  // fan-out. Plan: docs/plans/done/dcb-hot-tag-fence-contention.md.
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,
     data: JSON.Object(Dict.make()),
@@ -563,7 +563,7 @@ describe("Runtime.toItem — an empty tag value skips its GSI attribute", () =>
   // `tag_<key>` is a GSI hash key, and DynamoDB rejects an empty string for a key
   // attribute — writing one fails the whole append. An empty value is legitimate
   // (an absent composite-partition member), so the attribute is skipped and that
-  // index goes sparse. See docs/plans/dcb-empty-tag-values-break-append.md.
+  // index goes sparse. See docs/plans/done/dcb-empty-tag-values-break-append.md.
   let tagOf = (key, value): Reventless.DcbTag.tag => {key, value}
   let tags = [tagOf("environment", "prod"), tagOf("componentName", "")]
   let storedEvent: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {

package/tests/EventLogStorage_DynamoDb_RuntimeTest.res

@@ -57,7 +57,7 @@ describe("Runtime.buildTransactItems", () => {
   })
 })
 
-// ─── Aggregate snapshots (docs/plans/aggregate-snapshotting.md) ───
+// ─── Aggregate snapshots (docs/plans/done/aggregate-snapshotting.md) ───
 
 describe("Runtime.replayQueryInput", () => {
   testSync("default bounds cover exactly the zero-padded event range", () => {

package/tests/PgQueryResolver_LambdaTest.res

@@ -95,6 +95,7 @@ let makeBinding = (
   ~ownerField=None,
   ~retiredField=None,
   ~retiredValues=None,
+  ~namedWhenRetired=false,
   (),
 ): PgQueryResolver_Lambda.binding => {
   ops,
@@ -111,6 +112,7 @@ let makeBinding = (
   ownerField,
   retiredField,
   retiredValues,
+  namedWhenRetired,
 }
 
 let mkPayload = (

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -121,12 +121,13 @@ let capability = {
   sortFields: capability_sortFields
 };
 
-function makeBinding(authorizationOpt, subIdFieldOpt, ownerFieldOpt, retiredFieldOpt, retiredValuesOpt, param) {
+function makeBinding(authorizationOpt, subIdFieldOpt, ownerFieldOpt, retiredFieldOpt, retiredValuesOpt, namedWhenRetiredOpt, param) {
   let authorization = authorizationOpt !== undefined ? authorizationOpt : "AllowAnonymous";
   let subIdField = subIdFieldOpt !== undefined ? Primitive_option.valFromOption(subIdFieldOpt) : undefined;
   let ownerField = ownerFieldOpt !== undefined ? Primitive_option.valFromOption(ownerFieldOpt) : undefined;
   let retiredField = retiredFieldOpt !== undefined ? Primitive_option.valFromOption(retiredFieldOpt) : undefined;
   let retiredValues = retiredValuesOpt !== undefined ? Primitive_option.valFromOption(retiredValuesOpt) : undefined;
+  let namedWhenRetired = namedWhenRetiredOpt !== undefined ? namedWhenRetiredOpt : false;
   return {
     ops: ops,
     pushdowns: pushdowns,
@@ -143,7 +144,8 @@ function makeBinding(authorizationOpt, subIdFieldOpt, ownerFieldOpt, retiredFiel
     authorization: authorization,
     ownerField: ownerField,
     retiredField: retiredField,
-    retiredValues: retiredValues
+    retiredValues: retiredValues,
+    namedWhenRetired: namedWhenRetired
   };
 }
 
@@ -186,7 +188,7 @@ function ids(arr) {
 
 globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("getById returns the item (id-carrying)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined, undefined));
@@ -194,14 +196,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById miss → null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "absent"
       ]]), undefined, undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds returns matches, drops missing", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
@@ -215,7 +217,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("index routes to indexLookup on the idField", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
         "byStatus",
         "active"
       ]]), undefined, undefined));
@@ -226,13 +228,13 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("list with push-down → returns the connection listPage gives", async () => {
     listPageReturn.contents = "PUSHED";
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     listPageReturn.contents = undefined;
     globalThis.expect(r).toEqual("PUSHED");
   });
   globalThis.test("list without push-down → falls back to the shared spec", async () => {
     listPageReturn.contents = undefined;
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     let edgeIds = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []), e => Stdlib_Option.flatMap(field(e, "node"), n => str(n, "id")));
     globalThis.expect(edgeIds).toEqual([
       "p-1",
@@ -241,21 +243,21 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("items with subId routes to itemsPage (id echoed)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined, undefined));
     globalThis.expect(str(r, "itemsFor")).toEqual("p-2");
   });
   globalThis.test("items without subId → empty connection", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
   });
   globalThis.test("authorization DenyAll → empty shape per kind", async () => {
-    let b = makeBinding("DenyAll", undefined, undefined, undefined, undefined, undefined);
+    let b = makeBinding("DenyAll", undefined, undefined, undefined, undefined, undefined, undefined);
     let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
@@ -274,7 +276,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       TAG: "Deny",
       _0: "nope"
     }));
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
       ]]), undefined, undefined));
@@ -300,7 +302,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("resolveOne multi via target index → array", async () => {
@@ -326,7 +328,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -353,14 +355,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("node decodes global id → __typename + item", async () => {
-    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined, undefined, undefined, undefined));
+    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined));
     PgQueryResolver_Lambda$ReventlessAws.registerNodeType("Thing", "Things");
     let payload_arguments = Object.fromEntries([[
         "id",
@@ -410,7 +412,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     delete: 0,
     deleteBatch: 0
   };
-  let init = makeBinding(undefined, undefined, undefined, undefined, undefined, undefined);
+  let init = makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined);
   let authBinding_pushdowns = init.pushdowns;
   let authBinding_indexes = init.indexes;
   let authBinding_subIdField = init.subIdField;
@@ -421,6 +423,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   let authBinding_ownerField = init.ownerField;
   let authBinding_retiredField = init.retiredField;
   let authBinding_retiredValues = init.retiredValues;
+  let authBinding_namedWhenRetired = init.namedWhenRetired;
   let authBinding = {
     ops: authOps,
     pushdowns: authBinding_pushdowns,
@@ -432,7 +435,8 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     authorization: authBinding_authorization,
     ownerField: authBinding_ownerField,
     retiredField: authBinding_retiredField,
-    retiredValues: authBinding_retiredValues
+    retiredValues: authBinding_retiredValues,
+    namedWhenRetired: authBinding_namedWhenRetired
   };
   let lookupAuth = name => {
     if (name === "AuthTable") {
@@ -458,18 +462,18 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     identity: ident(username, groups)
   });
   globalThis.test("auth index: group member who owns → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("auth index: group member who does NOT own → empty", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(r), []).length).toBe(0);
   });
   globalThis.test("auth index: non-member passes through → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -478,7 +482,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("unmapped kind throws", async () => {
     let threw;
     try {
-      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined, undefined));
+      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined, undefined));
       threw = false;
     } catch (exn) {
       threw = true;
@@ -489,35 +493,35 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
 
 globalThis.describe("id form — the typed doors take either", () => {
   globalThis.test("getById resolves a Relay global id", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "p-2")
       ]]), undefined, undefined));
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById reports the storage key it resolved to", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "p-2")
       ]]), undefined, undefined));
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("getById still resolves a plain storage key", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined, undefined));
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById on a global id for a row that does not exist is still null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "absent")
       ]]), undefined, undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds accepts the two forms mixed in one call", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
@@ -530,7 +534,7 @@ globalThis.describe("id form — the typed doors take either", () => {
     ]);
   });
   globalThis.test("byIds with every id found does not double-count", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
@@ -545,7 +549,7 @@ globalThis.describe("id form — the typed doors take either", () => {
 });
 
 globalThis.describe("owner scoping", () => {
-  let ownedBinding = () => makeBinding(undefined, undefined, "owner", undefined, undefined, undefined);
+  let ownedBinding = () => makeBinding(undefined, undefined, "owner", undefined, undefined, undefined, undefined);
   let shopper = cognito("u-a", ["User"]);
   let listWith = async (binding, identity) => {
     lastOwnerScope.contents = undefined;
@@ -570,7 +574,7 @@ globalThis.describe("owner scoping", () => {
     globalThis.expect(match[1]).toBe(undefined);
   });
   globalThis.test("a view with no owner field is never scoped", async () => {
-    let match = await listWith(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined), shopper);
+    let match = await listWith(makeBinding(undefined, undefined, undefined, undefined, undefined, undefined, undefined), shopper);
     globalThis.expect(match[1]).toBe(undefined);
   });
   globalThis.test("an unidentified caller is refused before the push-down runs", async () => {

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,6 +1,6 @@
 open JestGlobals
 
-// Regression guard for docs/plans/platform-plugins-admin-connection-null-rows.md:
+// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
 // the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
 // (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
 // The auto-generated Connection Scan must exclude them, or `name: String!` resolves
@@ -39,7 +39,7 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/aws-scan-connection-cursor-roundtrip.md. The Scan
+// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
 // resolver's cursor must round-trip DynamoDB's own continuation token, not a
 // synthetic index — every list past page 1 was unreachable before this.
 describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {

package/tests/Util_BundleEsmLoaderTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // load-bearing contract: every code archive that ships the loader files MUST set
 // NODE_OPTIONS=--import pointing at the shipped register-hook.mjs, and the two
 // files must keep cross-referencing each other by the exact filenames used here.
-// See docs/plans/deployed-lambda-esm-self-containment.md.
+// See docs/plans/done/deployed-lambda-esm-self-containment.md.
 
 describe("Util_Bundle ESM loader — env-var contract", () => {
   testSync("NODE_OPTIONS --imports the shipped register-hook file by name", () => {

package/tests/Util_BundleRuntimeExtensionTest.res

@@ -4,7 +4,7 @@ open JestGlobals
 // packages its runtime import graph reaches (`companionModuleUrls`), the
 // bundler carries them into the archive, and the archive build fails loudly on
 // any statically imported package that would not resolve at cold start. See
-// docs/plans/runtime-extension-companion-packages.md.
+// docs/plans/done/runtime-extension-companion-packages.md.
 
 // realpath because macOS hands out /var/... symlinks for tmpdir while the
 // package-root walk reports paths as given.

package/tests/integration/AggregateEntryPoint_IntegrationTest.res

@@ -11,7 +11,7 @@
 // CommandAccepted -> Lambda:Unhandled.
 //
 // This is also the harness that unblocks moving the Aggregate functor wiring
-// behind a typed core (docs/plans/minimize-lambda-entrypoint-mjs-shell.md,
+// behind a typed core (docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md,
 // Tier 2.5): with it green, that refactor is verifiable end-to-end rather than
 // only at compile time. Boots via the same Docker-gated
 // `pnpm run test:integration` suite as the storage-runtime tests.

package/tests/integration/DcbCommandTopicEntryPoint_IntegrationTest.res

@@ -161,7 +161,7 @@ describe("DcbCommandTopicEntryPoint integration", () => {
   )
 
   // Residual composite-fence burst contention
-  // (docs/plans/dcb-composite-fence-residual-burst-contention.md).
+  // (docs/plans/done/dcb-composite-fence-residual-burst-contention.md).
   //
   // The entry point must derive `partitionTag = Composite(...)` and thread it
   // into the DynamoDB `append`, so a `@compositePartitionTag` slice collapses to

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -331,7 +331,7 @@ describe("DCB DynamoDb integration — optimistic concurrency primitives", () =>
 // on the WHOLE composite key, not on each member. Distinct entities sharing a
 // low-cardinality prefix (environment/platformName/pluginName) must therefore NOT
 // serialize on that prefix — the deploy-fan-out hot-fence regression. Plan:
-// docs/plans/Backlog/dcb-hot-tag-fence-contention.md § "Root-cause correction".
+// docs/plans/done/dcb-hot-tag-fence-contention.md § "Root-cause correction".
 describe("DCB DynamoDb integration — composite partition hot-fence fix", () => {
   let composite = (keys, seps): Reventless.DcbTag.derivedPartitionTag => Composite({keys, seps})
   let specKeys = ["environment", "platformName", "pluginName", "resourceName"]
@@ -464,7 +464,7 @@ describe("DCB DynamoDb integration — per-type fence granularity", () => {
 // DynamoDB used to reject the whole append: `tag_<key>` is a GSI hash key and a key
 // attribute cannot hold an empty string. The adapter now skips that one attribute,
 // leaving the index sparse — everything else about the event is unchanged.
-// See docs/plans/dcb-empty-tag-values-break-append.md.
+// See docs/plans/done/dcb-empty-tag-values-break-append.md.
 describe("DCB DynamoDb integration — an empty tag value does not break the append", () => {
   let tags = [tag("orderId", "O-empty"), tag("customerId", "")]