@reventlessdev/reventless-aws 3.0.0-alpha.306 → 3.0.0-alpha.308

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.308 (2026-08-18)
+
+### Bug Fixes
+
+* **aws:** make the unowned stub callable on the doors that call it ([931aa39](https://github.com/ReventlessDev/reventless-core/commit/931aa3968ae0e29befab7183125ed2453d4765cb))
+
+
+# 3.0.0-alpha.307 (2026-08-18)
+
+### Bug Fixes
+
+* **api:** make the by-index door answer, and let an elevated caller widen it ([0fe0c6f](https://github.com/ReventlessDev/reventless-core/commit/0fe0c6f8dec6228ecaba39577e28d780b4f79c83))
+* **aws:** apply [@owner](https://github.com/owner) on the DynamoDB by-ids and by-index doors ([a6b5afc](https://github.com/ReventlessDev/reventless-core/commit/a6b5afc2923bfa4d3e0b2990367f67e8ffdd8877))
+* **aws:** narrow retirement on every DynamoDB door, not only the list ([d6a799b](https://github.com/ReventlessDev/reventless-core/commit/d6a799b287b28e9c1f75e193adbf3f6328a6bf2d))
+### Features
+
+* **core:** let a reference name a retired row, and let an elevated caller open one ([9e2623a](https://github.com/ReventlessDev/reventless-core/commit/9e2623a4b22487561607fcc0ca19d51726069ee4))
+
+
 # 3.0.0-alpha.306 (2026-08-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.306",
+  "version": "3.0.0-alpha.308",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.12",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.78",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.80",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.238",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.144",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.102",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.116",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.239",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.145",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.117",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.103"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -99,6 +99,10 @@ type binding = {
   ownerField: option<string>,
   retiredField: option<string>,
   retiredValues: option<array<string>>,
+  /** Whether a reference to a retired row of this read model still resolves its
+      name — the `@namedWhenRetired` opt-in. Read only by the reference door;
+      every other door narrows as it always did. */
+  namedWhenRetired: bool,
 }
 
 // -- arg helpers -------------------------------------------------------------
@@ -253,6 +257,66 @@ let dispatch = async (
         Array.concat(found, extra)->Array.filter(item => ownerAllows(item) && retiredAllows(item)),
       )
 
+    | "refs" =>
+      // The reference door. The same by-ids read, projected on the way out to
+      // what naming a row needs, with the retirement lifted for a view that said
+      // its retired rows keep their names — and the owner rule left exactly where
+      // it was, so a row that is somebody's is still only theirs.
+      let ids = payload.arguments->argStrs("ids")
+      let found = await binding.pushdowns.byIds(~readModelName=rm, ids)
+      let missing =
+        found->Array.length < ids->Array.length
+          ? ids->Array.filterMap(ReventlessCore.Api_Ids.alternateKey)
+          : []
+      let extra = missing->Array.length > 0
+        ? await binding.pushdowns.byIds(~readModelName=rm, missing)
+        : []
+      let retirementOf = (item: JSON.t) =>
+        switch binding.retiredField {
+        | None => (false, None)
+        | Some(field) =>
+          let cell = item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(field))
+          let scope: Reventless.OwnerScope.retiredScope = {
+            field,
+            values: binding.retiredValues,
+          }
+          let retired = scope->Reventless.OwnerScope.isRetiredValue(cell)
+          (
+            retired,
+            retired && binding.retiredValues->Option.isSome
+              ? cell->Option.flatMap(JSON.Decode.string)
+              : None,
+          )
+        }
+      JSON.Encode.array(
+        Array.concat(found, extra)
+        ->Array.filter(ownerAllows)
+        ->Array.filterMap(item => {
+          let (retired, state) = retirementOf(item)
+          if retired && !binding.namedWhenRetired {
+            None
+          } else {
+            let get = key => item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(key))
+            let id = get("id")->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+            Some(
+              Dict.fromArray([
+                ("id", JSON.Encode.string(id)),
+                (
+                  "label",
+                  JSON.Encode.string(
+                    get(binding.labelField)
+                    ->Option.flatMap(JSON.Decode.string)
+                    ->Option.getOr(id),
+                  ),
+                ),
+                ("retired", JSON.Encode.bool(retired)),
+                ("retiredState", state->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+              ])->JSON.Encode.object,
+            )
+          }
+        }),
+      )
+
     | "items" =>
       // Sub-id connection: {single}Items(id, filter, first/after/last/before).
       // Requires a subIdField; without one it's an empty connection.

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -185,11 +185,63 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let items$1 = await binding.pushdowns.scanAll(rm);
         return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined, ownerScope, retiredScope);
         break;
+      case "refs" :
+        let ids$1 = argStrs(payload.arguments, "ids");
+        let found$2 = await binding.pushdowns.byIds(rm, ids$1);
+        let missing$1 = found$2.length < ids$1.length ? Stdlib_Array.filterMap(ids$1, Api_Ids$ReventlessCore.alternateKey) : [];
+        let extra$1 = missing$1.length !== 0 ? await binding.pushdowns.byIds(rm, missing$1) : [];
+        let retirementOf = item => {
+          let field = binding.retiredField;
+          if (field === undefined) {
+            return [
+              false,
+              undefined
+            ];
+          }
+          let cell = Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]);
+          let scope_values = binding.retiredValues;
+          let scope = {
+            field: field,
+            values: scope_values
+          };
+          let retired = OwnerScope$Reventless.isRetiredValue(scope, cell);
+          return [
+            retired,
+            retired && Stdlib_Option.isSome(binding.retiredValues) ? Stdlib_Option.flatMap(cell, Stdlib_JSON.Decode.string) : undefined
+          ];
+        };
+        return Stdlib_Array.filterMap(found$2.concat(extra$1).filter(ownerAllows), item => {
+          let match = retirementOf(item);
+          let retired = match[0];
+          if (retired && !binding.namedWhenRetired) {
+            return;
+          }
+          let get = key => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[key]);
+          let id = Stdlib_Option.getOr(Stdlib_Option.flatMap(get("id"), Stdlib_JSON.Decode.string), "");
+          return Object.fromEntries([
+            [
+              "id",
+              id
+            ],
+            [
+              "label",
+              Stdlib_Option.getOr(Stdlib_Option.flatMap(get(binding.labelField), Stdlib_JSON.Decode.string), id)
+            ],
+            [
+              "retired",
+              retired
+            ],
+            [
+              "retiredState",
+              Stdlib_Option.mapOr(match[1], null, prim => prim)
+            ]
+          ]);
+        });
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
-        let ids$1 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
-        return await binding.pushdowns.byIds(target, ids$1);
+        let ids$2 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
+        return await binding.pushdowns.byIds(target, ids$2);
       case "resolveOne" :
         let target$1 = Stdlib_Option.getOr(payload.target, rm);
         let source$1 = Stdlib_Option.getOr(payload.source, null);

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -184,13 +184,38 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     }
     let elevatedGroups = Reventless.OwnerScope.elevatedGroups()
 
+    // Read here for exactly the reason `ownerField` above is, and after making
+    // the same mistake: the by-id, by-ids and by-index resolvers are built below
+    // and this lookup used to sit past all of them, so they were generated
+    // without a retirement predicate — a list that withheld archived rows beside
+    // by-key doors that handed any one of them over on request.
+    let retiredSpec =
+      stateSchemaOpt
+      ->Option.flatMap(Reventless.StateAnnotations.getSpec)
+      ->Option.flatMap(spec => spec.retired)
+    let retiredField = retiredSpec->Option.map(r => r.field)
+    let retiredValues = retiredSpec->Option.flatMap(r => r.values)
+
     let resolverByIdSingle = if includeIdParam {
       makeQueryResolver(
         ~resolverName=fieldNameForSingle->String.capitalize,
         ~field=fieldNameForSingle->Pulumi.Input.make,
         ~code=switch subIdField {
-        | Some(sortField) => Resolver.Functions.queryByIdSort(sortField, ~ownerField?, ~elevatedGroups)
-        | None => Resolver.Functions.getItemById(~ownerField?, ~elevatedGroups)
+        | Some(sortField) =>
+          Resolver.Functions.queryByIdSort(
+            sortField,
+            ~ownerField?,
+            ~elevatedGroups,
+            ~retiredField?,
+            ~retiredValues?,
+          )
+        | None =>
+          Resolver.Functions.getItemById(
+            ~ownerField?,
+            ~elevatedGroups,
+            ~retiredField?,
+            ~retiredValues?,
+          )
         },
       )
     } else {
@@ -285,12 +310,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       }
     | None => ()
     }
-    let retiredSpec =
-      stateSchemaOpt
-      ->Option.flatMap(Reventless.StateAnnotations.getSpec)
-      ->Option.flatMap(spec => spec.retired)
-    let retiredField = retiredSpec->Option.map(r => r.field)
-    let retiredValues = retiredSpec->Option.flatMap(r => r.values)
     // The same class of "works, but scans" mistake as the owner warning above,
     // and the retirement case degrades the same way: the FilterExpression is
     // applied after the page is read, so pages shrink as the archive's share of
@@ -333,26 +352,16 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       },
     )
     let resolversByIndex = indexes->Array.map(({index} as indexConfig) => {
-      // Strip a leading "by" from the index name before capitalizing to avoid
-      // double "By" in the generated field name (e.g. index "byPlugin" → "ByPlugin",
-      // not "ByByPlugin"). Uses the plugin-prefixed fieldNameForSingle so the
-      // resolver name is properly namespaced (e.g. "schemaHistoryByPlugin", not
-      // "SchemaHistoryByByPlugin" from the raw entity name).
-      let stripLeadingBy = s =>
-        if s->String.startsWith("by") && s->String.length > 2 {
-          s->String.slice(~start=2, ~end=s->String.length)
-        } else {
-          s
-        }
-      let resolverName =
-        fieldNameForSingle->String.capitalize ++
-        "By" ++
-        (index->stripLeadingBy->String.capitalize)
-      let fieldName =
-        fieldNameForSingle ++
-        "By" ++
-        (index->stripLeadingBy->String.capitalize)
-      let idField = indexConfig.idField->Option.getOr(index)
+      // Name and key field both come from `GraphQL_FragmentGenerator`, which is
+      // where the SDL field this attaches to is derived. Deriving them here as
+      // well is how the two came to disagree: the emitted field declared `id`
+      // while this resolver read the index key, so the door could not be called.
+      let fieldName = ReventlessCore.GraphQL_FragmentGenerator.indexQueryFieldName(
+        ~singleFieldName=fieldNameForSingle,
+        ~index,
+      )
+      let resolverName = fieldName->String.capitalize
+      let idField = ReventlessCore.GraphQL_FragmentGenerator.indexKeyField(indexConfig)
       switch indexConfig.authorization {
       | None =>
         makeQueryResolver(
@@ -360,8 +369,24 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~field=fieldName->Pulumi.Input.make,
           ~code=switch indexConfig.subIdField {
           | Some(sortField) =>
-            Resolver.Functions.queryByIndexSortFiltered(~index, ~idField, ~sortField)
-          | None => Resolver.Functions.queryByIndexFiltered(~index, ~idField)
+            Resolver.Functions.queryByIndexSortFiltered(
+              ~index,
+              ~idField,
+              ~sortField,
+              ~ownerField?,
+              ~retiredField?,
+              ~retiredValues?,
+              ~elevatedGroups,
+            )
+          | None =>
+            Resolver.Functions.queryByIndexFiltered(
+              ~index,
+              ~idField,
+              ~ownerField?,
+              ~retiredField?,
+              ~retiredValues?,
+              ~elevatedGroups,
+            )
           },
         )
       | Some({tableName, group}) =>
@@ -387,7 +412,20 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~name=resolverName,
           ~api,
           ~dataSource=dataSourceName,
-          ~code=Resolver.Functions.queryByIndexFiltered(~index, ~idField),
+          // No `~ownerField`, deliberately: this index declares its own
+          // authorization, and the rows it grants a group member are by
+          // construction owned by somebody else — an order assigned to a
+          // fulfilment operator belongs to the customer who placed it. Adding the
+          // owner predicate here would return nothing and revoke the access the
+          // auth table exists to grant. Retirement still applies: an archived row
+          // is withdrawn from everyone who has not asked, whoever owns it.
+          ~code=Resolver.Functions.queryByIndexFiltered(
+            ~index,
+            ~idField,
+            ~retiredField?,
+            ~retiredValues?,
+            ~elevatedGroups,
+          ),
           ~opts,
         )
         // The interceptor leads the chain, as it does in every other Query
@@ -440,7 +478,43 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~field=byIdsField->Pulumi.Input.make,
           ~code=generateCode(
             ~storageResource=storage,
-            ~template=Resolver.Functions.batchGetItemsByIds,
+            ~template=Resolver.Functions.batchGetItemsByIds(
+              ~ownerField?,
+              ~retiredField?,
+              ~retiredValues?,
+              ~elevatedGroups,
+            ),
+          ),
+        ),
+      )
+    } else {
+      None
+    }
+
+    // The reference door. Registered under the same conditions as by-ids because
+    // it is the same read; what differs is the projection on the way out, and
+    // that a view which named its retired rows lets them through it.
+    //
+    // Not conditional on the annotation: `GraphQL_FragmentGenerator` emits the
+    // field for every view — one SDL serves every backend — so a view without a
+    // resolver here would be a field that errors rather than one that is absent.
+    let resolverRefs = if includeIdParam && subIdField === None {
+      let storage = storageResource(~pluginName=None, ~tableName=name)
+      let refsField = fieldNameForAll ++ "Refs"
+      Some(
+        makeQueryResolver(
+          ~resolverName=refsField->String.capitalize,
+          ~field=refsField->Pulumi.Input.make,
+          ~code=generateCode(
+            ~storageResource=storage,
+            ~template=Resolver.Functions.refsByIds(
+              ~labelField,
+              ~retiredField,
+              ~retiredValues,
+              ~namedWhenRetired=retiredSpec->Option.mapOr(false, r => r.namedWhenRetired),
+              ~ownerField?,
+              ~elevatedGroups,
+            ),
           ),
         ),
       )
@@ -535,7 +609,11 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     | (None, Some(byIds)) => [resolverByIdSingle, resolverAll, byIds]
     | (None, None) => [resolverByIdSingle, resolverAll]
     }
-    Array.flat([mainResolvers, resolversByIndex, idResolvers, idsResolvers])
+    // Appended rather than folded into `mainResolvers`' four-way switch: the door
+    // is independent of whether this view has a sub-id door, and adding a third
+    // dimension to that match would spell eight cases to say one thing.
+    let refsResolvers = resolverRefs->Option.mapOr([], r => [r])
+    Array.flat([mainResolvers, refsResolvers, resolversByIndex, idResolvers, idsResolvers])
     ->Array.map(Util.AppSync.toResourceNative)
   }
 

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -94,7 +94,10 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     let stateSchemaOpt = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name$1];
     let ownerField = stateSchemaOpt !== undefined ? Owner$Reventless.fieldNames(stateSchemaOpt)[0] : undefined;
     let elevatedGroups = OwnerScope$Reventless.elevatedGroups();
-    let resolverByIdSingle = includeIdParam ? makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, subIdField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIdSort(subIdField, ownerField, elevatedGroups) : AppSync_Resolver_Functions$PulumiAws.getItemById(ownerField, elevatedGroups)) : makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let retiredSpec = Stdlib_Option.flatMap(Stdlib_Option.flatMap(stateSchemaOpt, StateAnnotations$Reventless.getSpec), spec => spec.retired);
+    let retiredField = Stdlib_Option.map(retiredSpec, r => r.field);
+    let retiredValues = Stdlib_Option.flatMap(retiredSpec, r => r.values);
+    let resolverByIdSingle = includeIdParam ? makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, subIdField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIdSort(subIdField, ownerField, elevatedGroups, retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.getItemById(ownerField, elevatedGroups, retiredField, retiredValues)) : makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolverByIdMultiple = includeIdParam ? Stdlib_Option.map(subIdField, sortField => makeQueryResolver(Stdlib_String.capitalize(fieldNameForSingle) + "Items", fieldNameForSingle + "Items", AppSync_Resolver_Functions$PulumiAws.queryItemsWithSortConditions(sortField, ownerField, elevatedGroups))) : undefined;
     let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(name$1, stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
@@ -123,30 +126,20 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     if (ownerField !== undefined && !isIndexed(ownerField)) {
       log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" is not the key of any index on this table. ` + "Owner-scoped reads will Scan and filter, so pages shrink as the caller's share of the rows falls. Add an @index on that field before this read model grows.");
     }
-    let retiredSpec = Stdlib_Option.flatMap(Stdlib_Option.flatMap(stateSchemaOpt, StateAnnotations$Reventless.getSpec), spec => spec.retired);
-    let retiredField = Stdlib_Option.map(retiredSpec, r => r.field);
-    let retiredValues = Stdlib_Option.flatMap(retiredSpec, r => r.values);
     if (retiredField !== undefined && !isIndexed(retiredField)) {
       log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is not the key of any index on this table. ` + "Reads that exclude retired rows will Scan and filter, so pages shrink as the archive's share of the rows grows. Add an @index on that field before this read model grows.");
     }
     let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.map(indexConfig => {
       let index = indexConfig.index;
-      let stripLeadingBy = s => {
-        if (s.startsWith("by") && s.length > 2) {
-          return s.slice(2, s.length);
-        } else {
-          return s;
-        }
-      };
-      let resolverName = Stdlib_String.capitalize(fieldNameForSingle) + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
-      let fieldName = fieldNameForSingle + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
-      let idField = Stdlib_Option.getOr(indexConfig.idField, index);
+      let fieldName = GraphQL_FragmentGenerator$ReventlessCore.indexQueryFieldName(fieldNameForSingle, index);
+      let resolverName = Stdlib_String.capitalize(fieldName);
+      let idField = GraphQL_FragmentGenerator$ReventlessCore.indexKeyField(indexConfig);
       let match = indexConfig.authorization;
       if (match !== undefined) {
         let authDataSource = AppSync_DataSource$PulumiAws.makeDynamoDBDataSourceWithTableName(resolverName + "Auth", api, Util_DynamoDb$ReventlessAws.findResource(Util_QueryDb$ReventlessCore.getLocalStorageResources(allQueryDbs, match.tableName)).name, apiRole, opts);
         let authFunction = AppSync_Function$PulumiAws.makeJs(resolverName + "Auth", api, authDataSource.name, AppSync_Resolver_Functions$PulumiAws.authorizeIndexedAccess(index, match.group), opts);
-        let queryFunction = AppSync_Function$PulumiAws.makeJs(resolverName, api, dataSourceName, AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField), opts);
+        let queryFunction = AppSync_Function$PulumiAws.makeJs(resolverName, api, dataSourceName, AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField, undefined, retiredField, retiredValues, elevatedGroups), opts);
         let interceptorFn = interceptorFunction(resolverName);
         return AppSync_Resolver_Retrying$ReventlessAws.makePipelineJsResolver(resolverName, api, "Query", fieldName, AppSync_Resolver_Functions$PulumiAws.pipelinePassThrough, interceptorFn !== undefined ? [
             interceptorFn,
@@ -158,7 +151,7 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
           ], opts);
       }
       let sortField = indexConfig.subIdField;
-      return makeQueryResolver(resolverName, fieldName, sortField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered(index, idField, sortField) : AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField));
+      return makeQueryResolver(resolverName, fieldName, sortField !== undefined ? AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered(index, idField, ownerField, sortField, retiredField, retiredValues, elevatedGroups) : AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered(index, idField, ownerField, retiredField, retiredValues, elevatedGroups));
     });
     let storageResource = (pluginName, tableName) => Adapter$ReventlessCore.outputToResource(Util_DynamoDb$ReventlessAws.findResourceInOutput(Plugin_Helpers$ReventlessCore.getStorageResources(allQueryDbs, pluginName, tableName)));
     let generateCode = (storageResource, template) => storageResource.name.apply(realTableName => template(realTableName));
@@ -166,10 +159,18 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     if (includeIdParam && subIdField === undefined) {
       let storage = storageResource(undefined, name$1);
       let byIdsField = fieldNameForAll + "ByIds";
-      resolverByIds = makeQueryResolver(Stdlib_String.capitalize(byIdsField), byIdsField, generateCode(storage, AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds));
+      resolverByIds = makeQueryResolver(Stdlib_String.capitalize(byIdsField), byIdsField, generateCode(storage, AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(ownerField, retiredField, retiredValues, elevatedGroups)));
     } else {
       resolverByIds = undefined;
     }
+    let resolverRefs;
+    if (includeIdParam && subIdField === undefined) {
+      let storage$1 = storageResource(undefined, name$1);
+      let refsField = fieldNameForAll + "Refs";
+      resolverRefs = makeQueryResolver(Stdlib_String.capitalize(refsField), refsField, generateCode(storage$1, AppSync_Resolver_Functions$PulumiAws.refsByIds(labelField, retiredField, retiredValues, Stdlib_Option.mapOr(retiredSpec, false, r => r.namedWhenRetired), ownerField, elevatedGroups)));
+    } else {
+      resolverRefs = undefined;
+    }
     let idResolvers = idResolverConfigs.map(config => {
       let target = config.target;
       let targetId = target.idField;
@@ -252,8 +253,10 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
             resolverAll
           ]
       );
+    let refsResolvers = Stdlib_Option.mapOr(resolverRefs, [], r => [r]);
     return [
       mainResolvers,
+      refsResolvers,
       resolversByIndex,
       idResolvers,
       idsResolvers

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res

@@ -9,7 +9,7 @@
 //
 // Field names / includeIdParam / connectionSpec come from the same registry the
 // AppSync path reads, so the SDL emitted by GraphQL_FragmentGenerator stays in
-// lockstep. Kinds covered: getById, list (connection), index, byIds. Deferred to
+// lockstep. Kinds covered: getById, list (connection), index, byIds, refs. Deferred to
 // B3.2c: items (sub-id connection), @resolves/@resolvesMany, node, auth-table.
 
 module Resolver = AppSync_Resolver_Retrying
@@ -150,13 +150,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       ~opts,
     )
 
-  let stripLeadingBy = s =>
-    if s->String.startsWith("by") && s->String.length > 2 {
-      s->String.slice(~start=2, ~end=s->String.length)
-    } else {
-      s
-    }
-
   // Resolvers are deferred into resourcesMaker (created inside the schema-pushed
   // builderOutputs.apply, like the AppSync path) — so they only exist after the
   // fields are ACTIVE and after PgQueryResolver_Builder.provision has resolved
@@ -202,14 +195,28 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       []
     }
 
+    // The reference door — {list}Refs(ids). Same shape as by-ids and registered
+    // under the same conditions, because it is the same read: a set of keys in,
+    // rows out. What differs is on the way out, where the row is projected to
+    // what a reference needs and a retirement is lifted for a view that named its
+    // rows.
+    let refs = if includeIdParam && subIdField === None {
+      let refsField = fieldNameForAll ++ "Refs"
+      [mkResolver(~resolverName=refsField->String.capitalize, ~field=refsField, ~kind="refs")]
+    } else {
+      []
+    }
+
     // Per-index equality queries: {single}By{Index}. A group-restricted index
     // (indexConfig.authorization) bakes the auth-table pipeline params — the
     // Lambda verifies group membership + ownership against the auth read model.
     let byIndex = indexes->Array.map((ic: indexConfig) => {
       let index = ic.index
-      let resolverName =
-        fieldNameForSingle->String.capitalize ++ "By" ++ index->stripLeadingBy->String.capitalize
-      let field = fieldNameForSingle ++ "By" ++ index->stripLeadingBy->String.capitalize
+      let field = ReventlessCore.GraphQL_FragmentGenerator.indexQueryFieldName(
+        ~singleFieldName=fieldNameForSingle,
+        ~index,
+      )
+      let resolverName = field->String.capitalize
       switch ic.authorization {
       | Some({tableName, group}) =>
         mkResolver(
@@ -278,6 +285,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     [byId, all]
     ->Array.concat(items)
     ->Array.concat(byIds)
+    ->Array.concat(refs)
     ->Array.concat(byIndex)
     ->Array.concat(idResolvers)
     ->Array.concat(idsResolvers)

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res.mjs

@@ -7,6 +7,7 @@ import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./PgQueryResolver_Builder.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
+import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 let identityBlock = `id != null && id.sub != null
       ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
@@ -77,13 +78,6 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
     PgQueryResolver_Builder$ReventlessAws.registerNodeType(returnTypeName, name$1);
   }
   let mkResolver = (resolverName, field, kind, index, authTable, authGroup) => AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(resolverName, api, dataSourceName, "Query", field, invokeTemplate(name$1, kind, index, authTable, authGroup), opts);
-  let stripLeadingBy = s => {
-    if (s.startsWith("by") && s.length > 2) {
-      return s.slice(2, s.length);
-    } else {
-      return s;
-    }
-  };
   let resourcesMaker = _allQueryDbs => {
     let byId = mkResolver(Stdlib_String.capitalize(fieldNameForSingle), fieldNameForSingle, includeIdParam ? "getById" : "list", undefined, undefined, undefined);
     let all = mkResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, "list", undefined, undefined, undefined);
@@ -95,10 +89,17 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
     } else {
       byIds = [];
     }
+    let refs;
+    if (includeIdParam && subIdField === undefined) {
+      let refsField = fieldNameForAll + "Refs";
+      refs = [mkResolver(Stdlib_String.capitalize(refsField), refsField, "refs", undefined, undefined, undefined)];
+    } else {
+      refs = [];
+    }
     let byIndex = indexes.map(ic => {
       let index = ic.index;
-      let resolverName = Stdlib_String.capitalize(fieldNameForSingle) + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
-      let field = fieldNameForSingle + "By" + Stdlib_String.capitalize(stripLeadingBy(index));
+      let field = GraphQL_FragmentGenerator$ReventlessCore.indexQueryFieldName(fieldNameForSingle, index);
+      let resolverName = Stdlib_String.capitalize(field);
       let match = ic.authorization;
       if (match !== undefined) {
         return mkResolver(resolverName, field, "index", index, Stdlib_String.capitalize(match.tableName), match.group);
@@ -150,7 +151,7 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
     return [
       byId,
       all
-    ].concat(items).concat(byIds).concat(byIndex).concat(idResolvers).concat(idsResolvers).map(Util_AppSync$ReventlessAws.toResourceNative);
+    ].concat(items).concat(byIds).concat(refs).concat(byIndex).concat(idResolvers).concat(idsResolvers).map(Util_AppSync$ReventlessAws.toResourceNative);
   };
   return {
     resources: [],

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -163,6 +163,12 @@ let registerBinding = (
       ->Reventless.StateAnnotations.getSpec
       ->Option.flatMap(a => a.retired)
       ->Option.flatMap(r => r.values),
+      // Read off the retirement rather than from a second annotation: a record
+      // cannot declare the reach of a retirement it does not have.
+      namedWhenRetired: spec.stateSchema
+      ->Reventless.StateAnnotations.getSpec
+      ->Option.flatMap(a => a.retired)
+      ->Option.mapOr(false, r => r.namedWhenRetired),
     },
   )
   logDebug("registered resolver binding for " ++ entry.readModelName, {comp: "PgQueryResolver"})

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -77,7 +77,8 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     authorization: spec.authorization,
     ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0],
     retiredField: Stdlib_Option.map(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.field),
-    retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values)
+    retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values),
+    namedWhenRetired: Stdlib_Option.mapOr(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), false, r => r.namedWhenRetired)
   });
   HandlerFactoryHelpersMjs.log.debug("registered resolver binding for " + entry.readModelName, {
     comp: "PgQueryResolver"