@reventlessdev/reventless-aws 3.0.0-alpha.317 → 3.0.0-alpha.318

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.318 (2026-08-21)
+
+### Bug Fixes
+
+* **core:** make @resolves/[@resolves](https://github.com/resolves)Many work end to end ([4c52957](https://github.com/ReventlessDev/reventless-core/commit/4c5295759dcb4b3eda4f0f4f2c1bc387fed88fcb))
+* **deps:** update sury to 11.0.0-rc.2 to fix unreachable union constructors ([fa5744f](https://github.com/ReventlessDev/reventless-core/commit/fa5744fed8de975e2f14725c856c6e5ce7d04a74))
+
+
 # 3.0.0-alpha.317 (2026-08-20)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.317",
+  "version": "3.0.0-alpha.318",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -10,24 +10,24 @@
     "@aws-sdk/client-location": "3.970.0",
     "@aws-sdk/client-s3": "3.970.0",
     "@aws-sdk/s3-request-presigner": "3.970.0",
-    "sury": "11.0.0-rc.1",
+    "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.12",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.1",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.2",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.246",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.149",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.245",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.148",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.32",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.109",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.120"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.121",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.110"
   },
   "devDependencies": {
     "rescript": "12.3.0",
-    "sury-ppx": "11.0.0-rc.1"
+    "sury-ppx": "11.0.0-rc.2"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -443,10 +443,15 @@ let dispatch = async (
         items->Array.filter(it => it->argStr(subField)->Option.getOr("") == subVal)
       | _ => items
       }
+      // The target's own rules, applied to the target's rows — `binding` here is
+      // the target's, so `ownerAllows` / `retiredAllows` ask its questions. A
+      // nested field takes no `includeRetired` argument, so a retired row never
+      // travels through one.
+      let allowed = filtered->Array.filter(item => ownerAllows(item) && retiredAllows(item))
       if payload.multi->Option.getOr(false) {
-        JSON.Encode.array(filtered)
+        JSON.Encode.array(allowed)
       } else {
-        switch filtered->Array.get(0) {
+        switch allowed->Array.get(0) {
         | Some(item) => item
         | None => JSON.Encode.null
         }
@@ -459,7 +464,11 @@ let dispatch = async (
       let target = payload.target->Option.getOr(rm)
       let source = payload.source->Option.getOr(JSON.Encode.null)
       let ids = source->argStrs(payload.sourceIdsField->Option.getOr(""))
-      JSON.Encode.array(await binding.pushdowns.byIds(~readModelName=target, ids))
+      JSON.Encode.array(
+        (await binding.pushdowns.byIds(~readModelName=target, ids))->Array.filter(item =>
+          ownerAllows(item) && retiredAllows(item)
+        ),
+      )
 
     | other =>
       // Fail loudly on unmapped kinds (feature-parity guard, per the B3.2 plan).

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -241,7 +241,13 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
         let ids$2 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
-        return await binding.pushdowns.byIds(target, ids$2);
+        return (await binding.pushdowns.byIds(target, ids$2)).filter(item => {
+          if (ownerAllows(item)) {
+            return retiredAllows(item);
+          } else {
+            return false;
+          }
+        });
       case "resolveOne" :
         let target$1 = Stdlib_Option.getOr(payload.target, rm);
         let source$1 = Stdlib_Option.getOr(payload.source, null);
@@ -265,10 +271,17 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         } else {
           filtered = items$2;
         }
+        let allowed = filtered.filter(item => {
+          if (ownerAllows(item)) {
+            return retiredAllows(item);
+          } else {
+            return false;
+          }
+        });
         if (Stdlib_Option.getOr(payload.multi, false)) {
-          return filtered;
+          return allowed;
         }
-        let item = filtered[0];
+        let item = allowed[0];
         if (item !== undefined) {
           return item;
         } else {

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -522,6 +522,32 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       None
     }
 
+    // The GraphQL type the cross-table fields hang off. `name` is the QueryDb's
+    // own (capitalised spec) name; the SDL calls the type by its plugin-prefixed
+    // name, and a resolver naming the other one is refused at deploy with
+    // "No field named X found on type Y".
+    let parentTypeName = switch registryEntry {
+    | Some({returnTypeName}) => returnTypeName
+    | None => name
+    }
+
+    // A cross-table field hands back rows from the TARGET's table, so the owner
+    // and retirement rules that apply are the target's. Read from the same
+    // registry this view reads its own from — populated for every queryable in
+    // the plugin before any resolver is built.
+    let targetScope = (targetName: string) => {
+      let schema = ReventlessCore.Plugin_Helpers.stateSchemaRegistry->Dict.get(targetName)
+      let retired =
+        schema
+        ->Option.flatMap(Reventless.StateAnnotations.getSpec)
+        ->Option.flatMap(spec => spec.retired)
+      (
+        schema->Option.flatMap(s => Reventless.Owner.fieldNames(s)->Array.get(0)),
+        retired->Option.map(r => r.field),
+        retired->Option.flatMap(r => r.values),
+      )
+    }
+
     let idResolvers = idResolverConfigs->Array.map(config => {
       let {
         source: {idField: sourceIdField, subId: sourceSubId, resolvedField},
@@ -533,71 +559,100 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       | _ => ("", "")
       }
       let storageResource = storageResource(~pluginName=target.pluginName, ~tableName)
-      switch resolvedField {
-      | Single(field)
-      | Multi(field) =>
-        let dataSourceName =
-          DataSource.makeDynamoDBDataSourceWithTableName(
-            ~name=name ++ (field->String.capitalize ++ "Resolver"),
-            ~api,
-            ~tableName=storageResource.name,
-            ~serviceRole=apiRole,
-            ~opts,
-          ).name->Pulumi.Output.asInput
-
-        Resolver.makeUnitJsResolver(
-          ~name=name ++ field->String.capitalize,
+      let (targetOwnerField, targetRetiredField, targetRetiredValues) = targetScope(tableName)
+      let (field, multi) = switch resolvedField {
+      | Single(field) => (field, false)
+      | Multi(field) => (field, true)
+      }
+      let response = Resolver.Functions.resolvedFieldResponse(
+        ~multi,
+        ~ownerField=targetOwnerField,
+        ~elevatedGroups,
+        ~retiredField=?targetRetiredField,
+        ~retiredValues=?targetRetiredValues,
+      )
+      let dataSourceName =
+        DataSource.makeDynamoDBDataSourceWithTableName(
+          ~name=name ++ (field->String.capitalize ++ "Resolver"),
           ~api,
-          ~dataSourceName,
-          ~type_=name->Pulumi.Input.make,
-          ~field=field->Pulumi.Input.make,
-          ~code=switch (targetId, sourceSubId, target.subIdField) {
-          | (Id, Field(sourceSortField), Some(targetSortField)) =>
-            Resolver.Functions.resolveIdSort(~sourceIdField, ~sourceSortField, ~targetSortField)
-          | (Id, Argument(sourceSortArgument), Some(targetSortField)) =>
-            Resolver.Functions.resolveIdSortArgument(
-              ~sourceIdField,
-              ~sourceSortArgument,
-              ~targetSortField,
-            )
-          | (Id, _, _) => Resolver.Functions.resolveId(~sourceIdField)
-
-          | (_, Field(sourceSortField), Some(targetSortField)) =>
-            Resolver.Functions.resolveIdByIndexSort(
-              ~index,
-              ~sourceIdField,
-              ~targetIdField,
-              ~sourceSortField,
-              ~targetSortField,
-            )
-          | (_, Argument(sourceSortArgument), Some(targetSortField)) =>
-            Resolver.Functions.resolveIdByIndexSortArgument(
-              ~index,
-              ~sourceIdField,
-              ~targetIdField,
-              ~sourceSortArgument,
-              ~targetSortField,
-            )
-          | _ => Resolver.Functions.resolveIdByIndex(~index, ~sourceIdField, ~targetIdField)
-          },
+          ~tableName=storageResource.name,
+          ~serviceRole=apiRole,
           ~opts,
-        )
-      }
+        ).name->Pulumi.Output.asInput
+
+      Resolver.makeUnitJsResolver(
+        ~name=name ++ field->String.capitalize,
+        ~api,
+        ~dataSourceName,
+        ~type_=parentTypeName->Pulumi.Input.make,
+        ~field=field->Pulumi.Input.make,
+        ~code=switch (targetId, sourceSubId, target.subIdField) {
+        | (Id, Field(sourceSortField), Some(targetSortField)) =>
+          Resolver.Functions.resolveIdSort(
+            ~sourceIdField,
+            ~sourceSortField,
+            ~targetSortField,
+            ~response,
+          )
+        | (Id, Argument(sourceSortArgument), Some(targetSortField)) =>
+          Resolver.Functions.resolveIdSortArgument(
+            ~sourceIdField,
+            ~sourceSortArgument,
+            ~targetSortField,
+            ~response,
+          )
+        | (Id, _, _) => Resolver.Functions.resolveId(~sourceIdField, ~response)
+
+        | (_, Field(sourceSortField), Some(targetSortField)) =>
+          Resolver.Functions.resolveIdByIndexSort(
+            ~index,
+            ~sourceIdField,
+            ~targetIdField,
+            ~sourceSortField,
+            ~targetSortField,
+            ~response,
+          )
+        | (_, Argument(sourceSortArgument), Some(targetSortField)) =>
+          Resolver.Functions.resolveIdByIndexSortArgument(
+            ~index,
+            ~sourceIdField,
+            ~targetIdField,
+            ~sourceSortArgument,
+            ~targetSortField,
+            ~response,
+          )
+        | _ =>
+          Resolver.Functions.resolveIdByIndex(~index, ~sourceIdField, ~targetIdField, ~response)
+        },
+        ~opts,
+      )
     })
 
+    // `@resolvesMany` — BatchGetItem against the target's table. Runs on THIS
+    // view's data source rather than one of the target's: the tables map names
+    // the target explicitly, and every QueryDb in the plugin has already granted
+    // `dynamodb:*` on itself to the API role the data source assumes.
     let idsResolvers = idsResolverConfigs->Array.map(config => {
       let {source: {idsField, resolvedField}, target: {tableName} as target} = config
       let storageResource = storageResource(~pluginName=target.pluginName, ~tableName)
+      let (targetOwnerField, targetRetiredField, targetRetiredValues) = targetScope(tableName)
 
       Resolver.makeUnitJsResolver(
-        ~name=name ++ idsField->String.capitalize,
+        ~name=name ++ resolvedField->String.capitalize,
         ~api,
         ~dataSourceName,
-        ~type_=name->Pulumi.Input.make,
+        ~type_=parentTypeName->Pulumi.Input.make,
         ~field=resolvedField->Pulumi.Input.make,
         ~code=generateCode(
           ~storageResource,
-          ~template=Resolver.Functions.resolveIds(~idsField, ~sortField=target.subIdField, ...),
+          ~template=Resolver.Functions.resolveIds(
+            ~idsField,
+            ~sortField=target.subIdField,
+            ~ownerField=?targetOwnerField,
+            ~retiredField=?targetRetiredField,
+            ~retiredValues=?targetRetiredValues,
+            ~elevatedGroups,
+          ),
         ),
         ~opts,
       )

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -171,10 +171,22 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     } else {
       resolverRefs = undefined;
     }
+    let parentTypeName = registryEntry !== undefined ? registryEntry.returnTypeName : name$1;
+    let targetScope = targetName => {
+      let schema = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[targetName];
+      let retired = Stdlib_Option.flatMap(Stdlib_Option.flatMap(schema, StateAnnotations$Reventless.getSpec), spec => spec.retired);
+      return [
+        Stdlib_Option.flatMap(schema, s => Owner$Reventless.fieldNames(s)[0]),
+        Stdlib_Option.map(retired, r => r.field),
+        Stdlib_Option.flatMap(retired, r => r.values)
+      ];
+    };
     let idResolvers = idResolverConfigs.map(config => {
       let target = config.target;
       let targetId = target.idField;
+      let tableName = target.tableName;
       let match = config.source;
+      let resolvedField = match.resolvedField;
       let sourceSubId = match.subId;
       let sourceIdField = match.idField;
       let match$1;
@@ -197,40 +209,62 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
       }
       let targetIdField = match$1[1];
       let index$1 = match$1[0];
-      let storageResource$1 = storageResource(target.pluginName, target.tableName);
-      let field = match.resolvedField._0;
+      let storageResource$1 = storageResource(target.pluginName, tableName);
+      let match$2 = targetScope(tableName);
+      let match$3;
+      match$3 = resolvedField.TAG === "Single" ? [
+          resolvedField._0,
+          false
+        ] : [
+          resolvedField._0,
+          true
+        ];
+      let field = match$3[0];
+      let response = AppSync_Resolver_Functions$PulumiAws.resolvedFieldResponse(match$3[1], match$2[0], elevatedGroups, match$2[1], match$2[2]);
       let dataSourceName = AppSync_DataSource$PulumiAws.makeDynamoDBDataSourceWithTableName(name$1 + (Stdlib_String.capitalize(field) + "Resolver"), api, storageResource$1.name, apiRole, opts).name;
-      let match$2 = target.subIdField;
+      let match$4 = target.subIdField;
       let tmp;
       let exit = 0;
+      let exit$1 = 0;
       if (typeof targetId !== "object") {
-        tmp = typeof sourceSubId !== "object" ? AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField) : (
+        tmp = typeof sourceSubId !== "object" ? AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField, response) : (
             sourceSubId.TAG === "Field" ? (
-                match$2 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdSort(sourceIdField, sourceSubId._0, match$2) : AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField)
+                match$4 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdSort(sourceIdField, sourceSubId._0, match$4, response) : AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField, response)
               ) : (
-                match$2 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdSortArgument(sourceIdField, sourceSubId._0, match$2) : AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField)
+                match$4 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdSortArgument(sourceIdField, sourceSubId._0, match$4, response) : AppSync_Resolver_Functions$PulumiAws.resolveId(sourceIdField, response)
               )
           );
       } else {
-        exit = 1;
+        exit$1 = 2;
+      }
+      if (exit$1 === 2) {
+        if (typeof sourceSubId !== "object") {
+          exit = 1;
+        } else if (sourceSubId.TAG === "Field") {
+          if (match$4 !== undefined) {
+            tmp = AppSync_Resolver_Functions$PulumiAws.resolveIdByIndexSort(index$1, sourceIdField, sourceSubId._0, targetIdField, match$4, response);
+          } else {
+            exit = 1;
+          }
+        } else if (match$4 !== undefined) {
+          tmp = AppSync_Resolver_Functions$PulumiAws.resolveIdByIndexSortArgument(index$1, sourceIdField, sourceSubId._0, targetIdField, match$4, response);
+        } else {
+          exit = 1;
+        }
       }
       if (exit === 1) {
-        tmp = typeof sourceSubId !== "object" ? AppSync_Resolver_Functions$PulumiAws.resolveIdByIndex(index$1, sourceIdField, targetIdField) : (
-            sourceSubId.TAG === "Field" ? (
-                match$2 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdByIndexSort(index$1, sourceIdField, sourceSubId._0, targetIdField, match$2) : AppSync_Resolver_Functions$PulumiAws.resolveIdByIndex(index$1, sourceIdField, targetIdField)
-              ) : (
-                match$2 !== undefined ? AppSync_Resolver_Functions$PulumiAws.resolveIdByIndexSortArgument(index$1, sourceIdField, sourceSubId._0, targetIdField, match$2) : AppSync_Resolver_Functions$PulumiAws.resolveIdByIndex(index$1, sourceIdField, targetIdField)
-              )
-          );
+        tmp = AppSync_Resolver_Functions$PulumiAws.resolveIdByIndex(index$1, sourceIdField, targetIdField, response);
       }
-      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(field), api, dataSourceName, name$1, field, tmp, opts);
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(field), api, dataSourceName, parentTypeName, field, tmp, opts);
     });
     let idsResolvers = idsResolverConfigs.map(config => {
       let target = config.target;
+      let tableName = target.tableName;
       let match = config.source;
-      let idsField = match.idsField;
-      let storageResource$1 = storageResource(target.pluginName, target.tableName);
-      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(idsField), api, dataSourceName, name$1, match.resolvedField, generateCode(storageResource$1, none => AppSync_Resolver_Functions$PulumiAws.resolveIds(none, idsField, target.subIdField)), opts);
+      let resolvedField = match.resolvedField;
+      let storageResource$1 = storageResource(target.pluginName, tableName);
+      let match$1 = targetScope(tableName);
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(resolvedField), api, dataSourceName, parentTypeName, resolvedField, generateCode(storageResource$1, AppSync_Resolver_Functions$PulumiAws.resolveIds(match.idsField, target.subIdField, match$1[0], match$1[1], match$1[2], elevatedGroups)), opts);
     });
     let mainResolvers = resolverByIdMultiple !== undefined ? (
         resolverByIds !== undefined ? [

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res

@@ -231,6 +231,14 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       }
     })
 
+    // The GraphQL type the cross-table fields hang off — the plugin-prefixed SDL
+    // name, not the QueryDb's own. A resolver naming the other one is refused at
+    // deploy with "No field named X found on type Y".
+    let parentTypeName = switch registryEntry {
+    | Some({returnTypeName}) => returnTypeName
+    | None => name
+    }
+
     // @resolves — single cross-table field resolver on this (parent) type. The
     // target's binding key is its capitalized spec name (mirrors how the binding
     // registry is keyed); the parent object flows via ctx.source.
@@ -259,7 +267,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         ~name=name ++ field->String.capitalize,
         ~api,
         ~dataSourceName,
-        ~type_=name->Pulumi.Input.make,
+        ~type_=parentTypeName->Pulumi.Input.make,
         ~field=field->Pulumi.Input.make,
         ~code=invokeFieldTemplate(~sourceType=name, ~kind="resolveOne", ~target=targetKey, ~extra),
         ~opts,
@@ -275,7 +283,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
         ~name=name ++ resolvedField->String.capitalize,
         ~api,
         ~dataSourceName,
-        ~type_=name->Pulumi.Input.make,
+        ~type_=parentTypeName->Pulumi.Input.make,
         ~field=resolvedField->Pulumi.Input.make,
         ~code=invokeFieldTemplate(~sourceType=name, ~kind="resolveMany", ~target=targetKey, ~extra),
         ~opts,

package/src/adapter/QueryDb/QueryDbResolvers_Lambda.res.mjs

@@ -107,6 +107,7 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
         return mkResolver(resolverName, field, "index", index, undefined, undefined);
       }
     });
+    let parentTypeName = registryEntry !== undefined ? registryEntry.returnTypeName : name$1;
     let idResolvers = idResolverConfigs.map(config => {
       let target = config.target;
       let match = config.source;
@@ -139,14 +140,14 @@ function make(name, api, param, dataSourceName, indexes, subIdField, idResolverC
       let extra = `\n      sourceIdField: '` + match.idField + `',\n      multi: ` + (
         match$1[1] ? "true" : "false"
       ) + `,` + targetFrag + subIdFrag;
-      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(field), api, dataSourceName, name$1, field, invokeFieldTemplate(name$1, "resolveOne", targetKey, extra), opts);
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(field), api, dataSourceName, parentTypeName, field, invokeFieldTemplate(name$1, "resolveOne", targetKey, extra), opts);
     });
     let idsResolvers = idsResolverConfigs.map(config => {
       let match = config.source;
       let resolvedField = match.resolvedField;
       let targetKey = Stdlib_String.capitalize(config.target.tableName);
       let extra = `\n      sourceIdsField: '` + match.idsField + `',`;
-      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(resolvedField), api, dataSourceName, name$1, resolvedField, invokeFieldTemplate(name$1, "resolveMany", targetKey, extra), opts);
+      return AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name$1 + Stdlib_String.capitalize(resolvedField), api, dataSourceName, parentTypeName, resolvedField, invokeFieldTemplate(name$1, "resolveMany", targetKey, extra), opts);
     });
     return [
       byId,

package/tests/AppSync_RetirementNarrowingTest.res

@@ -308,3 +308,81 @@ describe("the unowned stub is callable where the door calls it", () => {
     ))->Expect.toEqual((true, true))
   })
 })
+
+// ── The cross-table doors (`@resolves` / `@resolvesMany`) ────────────────────
+//
+// A field that follows a foreign key hands back the TARGET's rows, so the
+// target's rules narrow them. The field takes no `includeRetired` argument, so
+// `_wantsRetired` is never true through one — `{list}Refs` is the door that
+// names a row the archive took.
+
+describe("the cross-table batch door", () => {
+  let code = F.resolveIds(
+    ~idsField="productIds",
+    ~sortField=None,
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived"],
+    ~elevatedGroups=elevated,
+  )("ProductsTable")
+
+  // BatchGetItem answers `{data: {<table>: [...]}}`; returning `ctx.result`
+  // handed the whole envelope to a field typed as a list, which fails at
+  // execution for every caller that selects it.
+  testSync("returns the rows out of the batch envelope", () =>
+    expect(code->String.includes("ctx.result?.data?.['ProductsTable']"))->Expect.toBe(true)
+  )
+
+  testSync("drops retired rows from the returned array", () =>
+    expect(code->String.includes("item !== null && _live(item)"))->Expect.toBe(true)
+  )
+
+  // An empty id array used to fall through to a GetItem on the PARENT's own id
+  // against the target's table — a read that answers a shape the field cannot be.
+  testSync("short-circuits an empty id array instead of reading", () =>
+    expect((
+      code->String.includes("if (idList.length === 0) return runtime.earlyReturn([]);"),
+      code->String.includes("operation: 'GetItem'"),
+    ))->toEqual((true, false))
+  )
+
+  testSync("is unchanged for a target that declares neither rule", () => {
+    let plain = F.resolveIds(~idsField="productIds", ~sortField=None)("ProductsTable")
+    expect((plain->String.includes("_owns"), plain->String.includes("_live")))->toEqual((
+      false,
+      false,
+    ))
+  })
+})
+
+describe("the cross-table single door", () => {
+  let response = (~multi) =>
+    F.resolvedFieldResponse(
+      ~multi,
+      ~ownerField=Some("customerId"),
+      ~elevatedGroups=elevated,
+      ~retiredField="shelfStatus",
+      ~retiredValues=["Archived"],
+    )
+
+  testSync("narrows the one row it hands back", () =>
+    expect(response(~multi=false)->String.includes("_owns(_row) && _live(_row) ? _row : null"))
+    ->Expect.toBe(true)
+  )
+
+  testSync("narrows every row of the list form", () =>
+    expect(
+      response(~multi=true)->String.includes("filter(_row => _owns(_row) && _live(_row))"),
+    )->Expect.toBe(true)
+  )
+
+  // The list form used to answer with the first row alone, whatever the SDL said.
+  testSync("the list form returns the list", () =>
+    expect(response(~multi=true)->String.includes("ctx.result.items[0]"))->Expect.toBe(false)
+  )
+
+  testSync("a target with neither rule keeps the plain response", () => {
+    let plain = F.resolvedFieldResponse(~multi=false, ~ownerField=None, ~elevatedGroups=elevated)
+    expect((plain->String.includes("_owns"), plain->String.includes("ctx.result.items[0]")))
+    ->toEqual((false, true))
+  })
+})

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -206,6 +206,58 @@ globalThis.describe("the unowned stub is callable where the door calls it", () =
   });
 });
 
+globalThis.describe("the cross-table batch door", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.resolveIds("productIds", undefined, undefined, "shelfStatus", ["Archived"], elevated)("ProductsTable");
+  globalThis.test("returns the rows out of the batch envelope", () => {
+    globalThis.expect(code.includes("ctx.result?.data?.['ProductsTable']")).toBe(true);
+  });
+  globalThis.test("drops retired rows from the returned array", () => {
+    globalThis.expect(code.includes("item !== null && _live(item)")).toBe(true);
+  });
+  globalThis.test("short-circuits an empty id array instead of reading", () => {
+    globalThis.expect([
+      code.includes("if (idList.length === 0) return runtime.earlyReturn([]);"),
+      code.includes("operation: 'GetItem'")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+  globalThis.test("is unchanged for a target that declares neither rule", () => {
+    let plain = AppSync_Resolver_Functions$PulumiAws.resolveIds("productIds", undefined, undefined, undefined, undefined, undefined)("ProductsTable");
+    globalThis.expect([
+      plain.includes("_owns"),
+      plain.includes("_live")
+    ]).toEqual([
+      false,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the cross-table single door", () => {
+  let response = multi => AppSync_Resolver_Functions$PulumiAws.resolvedFieldResponse(multi, "customerId", elevated, "shelfStatus", ["Archived"]);
+  globalThis.test("narrows the one row it hands back", () => {
+    globalThis.expect(response(false).includes("_owns(_row) && _live(_row) ? _row : null")).toBe(true);
+  });
+  globalThis.test("narrows every row of the list form", () => {
+    globalThis.expect(response(true).includes("filter(_row => _owns(_row) && _live(_row))")).toBe(true);
+  });
+  globalThis.test("the list form returns the list", () => {
+    globalThis.expect(response(true).includes("ctx.result.items[0]")).toBe(false);
+  });
+  globalThis.test("a target with neither rule keeps the plain response", () => {
+    let plain = AppSync_Resolver_Functions$PulumiAws.resolvedFieldResponse(false, undefined, elevated, undefined, undefined);
+    globalThis.expect([
+      plain.includes("_owns"),
+      plain.includes("ctx.result.items[0]")
+    ]).toEqual([
+      false,
+      true
+    ]);
+  });
+});
+
 let F;
 
 export {