@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.321

package/tests/Auth_ActiveRoleStore_SchemaTest.res.mjs

@@ -0,0 +1,97 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
+
+globalThis.describe("Auth_ActiveRoleStore_Schema.derivedStoreName", () => {
+  globalThis.test("names the store after the provider whose trigger reads it", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_CQTwafSeX")).toBe("ReventlessActiveRoleStore-eu-west-1_CQTwafSeX");
+  });
+  globalThis.test("two deployments on one provider derive the same store", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_Shared")).toBe(Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_Shared"));
+  });
+  globalThis.test("different providers do not collide", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_A") === Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_B")).toBe(false);
+  });
+  globalThis.test("the derived name is a legal DynamoDB table name", () => {
+    let name = Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_CQTwafSeX");
+    globalThis.expect([
+      new RegExp("^[A-Za-z0-9_.-]+$").test(name),
+      name.length >= 3 && name.length <= 255
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleStore_Schema.keySchemaRefusal", () => {
+  let store = "ReventlessActiveRoleStore-eu-west-1_x";
+  globalThis.test("the expected pair is adopted without complaint", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, [
+      [
+        "id",
+        "HASH"
+      ],
+      [
+        "clientId",
+        "RANGE"
+      ]
+    ])).toEqual(undefined);
+  });
+  globalThis.test("order is not part of the comparison", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, [
+      [
+        "clientId",
+        "RANGE"
+      ],
+      [
+        "id",
+        "HASH"
+      ]
+    ])).toEqual(undefined);
+  });
+  globalThis.test("the pre-clientId store is refused rather than adopted", () => {
+    globalThis.expect(Stdlib_Option.isSome(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, [[
+        "id",
+        "HASH"
+      ]]))).toBe(true);
+  });
+  globalThis.test("the refusal names the table, what it found, and what is needed", () => {
+    let message = Stdlib_Option.getOr(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, [[
+        "id",
+        "HASH"
+      ]]), "");
+    globalThis.expect([
+      message.includes(store),
+      message.includes("id:HASH"),
+      message.includes("clientId:RANGE")
+    ]).toEqual([
+      true,
+      true,
+      true
+    ]);
+  });
+  globalThis.test("a table keyed on something else entirely is refused", () => {
+    globalThis.expect(Stdlib_Option.isSome(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, [
+      [
+        "pk",
+        "HASH"
+      ],
+      [
+        "sk",
+        "RANGE"
+      ]
+    ]))).toBe(true);
+  });
+  globalThis.test("an empty key schema is refused, not treated as a match", () => {
+    globalThis.expect(Stdlib_Option.isSome(Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(store, []))).toBe(true);
+  });
+});
+
+let Schema;
+
+export {
+  Schema,
+}
+/*  Not a pure module */

package/tests/AwsErrorFixtures.mjs

@@ -0,0 +1,16 @@
+// Throws the shape an AWS SDK v3 client actually throws, so a test catches it
+// through the same path the real code does.
+//
+// It has to *throw* rather than return: ReScript's `exn` for a JS error is the
+// wrapper its own catch builds, not the bare `Error` object. A fixture that
+// returned one would be a different value than any real call produces, and a test
+// built on it would prove nothing about the code that catches them.
+//
+// Here rather than in a `%raw` inside the test, per the repo convention that
+// untyped reflection lives in a companion `.mjs` bound through `@module`.
+
+export const throwAwsError = (name, message) => {
+  const error = new Error(message)
+  error.name = name
+  throw error
+}

package/tests/ProvisionIdentityTest.res

@@ -0,0 +1,109 @@
+open JestGlobals
+
+// Argument handling for the operator script. Testable at all only because the
+// module no longer calls `main` at the top level — `run-provision-identity.mjs`
+// does. While it ran itself on import, nothing in here could be reached, and
+// that is how a guard that could never match shipped in the same file.
+//
+// What these cover is the one thing this script does that is hard to undo:
+// deciding whether to *adopt* a user pool or *create* one.
+
+module Provision = ProvisionIdentity
+
+describe("ProvisionIdentity.parseArgs", () => {
+  testSync("no arguments means adopt-or-create the default name", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({
+        Provision.poolName: Provision.defaultPoolName,
+        providerId: None,
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--provider-id names an existing pool", () =>
+    expect(Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Ok({
+        Provision.poolName: Provision.defaultPoolName,
+        providerId: Some("eu-west-1_AbCdEfGhI"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--name selects which pool to adopt by name", () =>
+    expect(Provision.parseArgs(["--name", "examples-dev"]))->toEqual(
+      Ok({Provision.poolName: "examples-dev", providerId: None, help: false}),
+    )
+  )
+
+  testSync("both together are accepted, and the id wins at resolve time", () =>
+    expect(Provision.parseArgs(["--name", "ignored", "--provider-id", "eu-west-1_x"]))->toEqual(
+      Ok({Provision.poolName: "ignored", providerId: Some("eu-west-1_x"), help: false}),
+    )
+  )
+
+  // 🚨 The reason unknown flags are refused rather than skipped. A misspelled
+  // `--provider-id` that parsed as "absent" would silently take the *create* path
+  // and stand up a second user pool beside the one the operator meant to extend.
+  testSync("a misspelled flag is refused, not ignored", () =>
+    expect(Provision.parseArgs(["--provider_id", "eu-west-1_x"]))->toEqual(
+      Error(`unknown argument "--provider_id"`),
+    )
+  )
+
+  // Same hazard from the other direction: a flag whose value was left off must
+  // not read as "no id given".
+  testSync("a flag with no value is refused", () =>
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(
+      Error("--provider-id needs a value"),
+    )
+  )
+
+  testSync("--name with no value is refused too", () =>
+    expect(Provision.parseArgs(["--name"]))->toEqual(Error("--name needs a value"))
+  )
+
+  testSync("--help and -h both ask for the usage text", () =>
+    expect((
+      Provision.parseArgs(["--help"])->Result.map(a => a.help),
+      Provision.parseArgs(["-h"])->Result.map(a => a.help),
+    ))->toEqual((Ok(true), Ok(true)))
+  )
+
+  // The first error stops the scan rather than the last one winning: an operator
+  // fixing what they are told about should not then meet a second surprise.
+  testSync("the first refusal is the one reported", () =>
+    expect(Provision.parseArgs(["--nope", "--also-nope"]))->toEqual(
+      Error(`unknown argument "--nope"`),
+    )
+  )
+})
+
+// The pool this script creates when it creates one. Asserted because a pool is
+// the one thing here that outlives every stack — nothing in a `pulumi destroy`
+// touches it — so its settings are not a detail an operator can revise cheaply
+// once accounts exist in it.
+describe("ProvisionIdentity.poolSettings", () => {
+  let settings = Provision.poolSettings(~poolName="MyIdentity")
+
+  testSync("carries the name it was asked for", () =>
+    expect(settings.poolName)->toBe("MyIdentity")
+  )
+
+  testSync("matches what auto mode declares: email sign-in, no MFA, admin-only", () =>
+    expect((
+      settings.usernameAttributes,
+      settings.mfaConfiguration,
+      settings.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+    ))->toEqual((Some(["email"]), Some("OFF"), Some(true)))
+  )
+
+  testSync("keeps the 12-character password policy", () =>
+    expect(
+      settings.policies
+      ->Option.flatMap(p => p.passwordPolicy)
+      ->Option.flatMap(p => p.minimumLength),
+    )->toEqual(Some(12))
+  )
+})

package/tests/ProvisionIdentityTest.res.mjs

@@ -0,0 +1,132 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionIdentity$ReventlessAws from "../scripts/ProvisionIdentity.res.mjs";
+
+globalThis.describe("ProvisionIdentity.parseArgs", () => {
+  globalThis.test("no arguments means adopt-or-create the default name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("--provider-id names an existing pool", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: "eu-west-1_AbCdEfGhI",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--name selects which pool to adopt by name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "examples-dev"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "examples-dev",
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("both together are accepted, and the id wins at resolve time", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "ignored",
+      "--provider-id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "ignored",
+        providerId: "eu-west-1_x",
+        help: false
+      }
+    });
+  });
+  globalThis.test("a misspelled flag is refused, not ignored", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider_id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider_id"`
+    });
+  });
+  globalThis.test("a flag with no value is refused", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("--name with no value is refused too", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--name"])).toEqual({
+      TAG: "Error",
+      _0: "--name needs a value"
+    });
+  });
+  globalThis.test("--help and -h both ask for the usage text", () => {
+    globalThis.expect([
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["--help"]), a => a.help),
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["-h"]), a => a.help)
+    ]).toEqual([
+      {
+        TAG: "Ok",
+        _0: true
+      },
+      {
+        TAG: "Ok",
+        _0: true
+      }
+    ]);
+  });
+  globalThis.test("the first refusal is the one reported", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--nope",
+      "--also-nope"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--nope"`
+    });
+  });
+});
+
+globalThis.describe("ProvisionIdentity.poolSettings", () => {
+  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity");
+  globalThis.test("carries the name it was asked for", () => {
+    globalThis.expect(settings.PoolName).toBe("MyIdentity");
+  });
+  globalThis.test("matches what auto mode declares: email sign-in, no MFA, admin-only", () => {
+    globalThis.expect([
+      settings.UsernameAttributes,
+      settings.MfaConfiguration,
+      Stdlib_Option.flatMap(settings.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly)
+    ]).toEqual([
+      ["email"],
+      "OFF",
+      true
+    ]);
+  });
+  globalThis.test("keeps the 12-character password policy", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(settings.Policies, p => p.PasswordPolicy), p => p.MinimumLength)).toEqual(12);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/QueryDbOwnerIndexTableTest.res

@@ -0,0 +1,53 @@
+// The table half of the index `@owner` derives. Both assertions are about the
+// DynamoDB resource the deploy would submit, which is the only artifact that
+// exists before one.
+
+open JestGlobals
+
+// `Pulumi.Input.make` is `%identity`, so the provider-facing shape can be read
+// back as the ReScript value it wraps.
+external unwrap: Pulumi.Input.t<'a> => 'a = "%identity"
+
+let ownerIndex: Reventless.ReadModel.indexConfig = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: ALL,
+  derived: true,
+}
+
+describe("the derived owner index", () => {
+  // Not KEYS_ONLY and not INCLUDE: the list door pushes the caller's filter, the
+  // retirement predicate and `requireAttribute` down as FilterExpressions over
+  // arbitrary columns, and a DynamoDB filter on a GSI may only name projected
+  // attributes. A row read through a narrow projection also comes back missing
+  // fields, which resolves a non-null SDL field to null.
+  testSync("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb.globalSecondaryIndexes([ownerIndex])->unwrap
+    expect(
+      gsis->Array.map(g => {
+        let g = g->unwrap
+        (g.name, g.hashKey, g.rangeKey, g.projectionType)
+      }),
+    )->toEqual([("_owner", "customerId", Some("id"), PulumiAws.DynamoDb.Table.ALL)])
+  })
+
+  // Pulumi rejects a table that defines the same attribute twice, and the derived
+  // index sorts on `id` — the table's own partition key — on any view with no
+  // `@subId`. Undeduped, adding `@owner` to such a view fails the deploy outright.
+  testSync("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb.attributes(None, [ownerIndex])->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "customerId"])
+  })
+
+  // The same collision one step out: an index that sorts on the table's sort key.
+  testSync("dedupes against the table's own sort key too", () => {
+    let names =
+      QueryDbStorage_DynamoDb.attributes(
+        Some("placedAt"),
+        [{...ownerIndex, subIdField: "placedAt"}],
+      )->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "placedAt", "customerId"])
+  })
+})

package/tests/QueryDbOwnerIndexTableTest.res.mjs

@@ -0,0 +1,50 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as QueryDbStorage_DynamoDb$ReventlessAws from "../src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs";
+
+let ownerIndex = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: "ALL",
+  derived: true
+};
+
+globalThis.describe("the derived owner index", () => {
+  globalThis.test("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb$ReventlessAws.globalSecondaryIndexes([ownerIndex]);
+    globalThis.expect(gsis.map(g => [
+      g.name,
+      g.hashKey,
+      g.rangeKey,
+      g.projectionType
+    ])).toEqual([[
+        "_owner",
+        "customerId",
+        "id",
+        "ALL"
+      ]]);
+  });
+  globalThis.test("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes(undefined, [ownerIndex]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "customerId"
+    ]);
+  });
+  globalThis.test("dedupes against the table's own sort key too", () => {
+    let newrecord = {...ownerIndex};
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes("placedAt", [(newrecord.subIdField = "placedAt", newrecord)]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "placedAt",
+      "customerId"
+    ]);
+  });
+});
+
+export {
+  ownerIndex,
+}
+/*  Not a pure module */

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,10 +1,8 @@
 open JestGlobals
 
-// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
-// the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
-// (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
-// The auto-generated Connection Scan must exclude them, or `name: String!` resolves
-// to null and nulls the entire Platform_PluginConnection ("No data" on the page).
+// The Plugins admin RM shares its table with bookkeeping rows (`deploy-schema:*`,
+// `plugin-info:*`, `deploy-schema-hash:*`) carrying no `name`. The Connection Scan
+// must exclude them, or `name: String!` nulls the whole connection.
 
 // `Pulumi.Input.make` is `%identity`, so a generated resolver's `Pulumi.Input.t<string>`
 // IS the underlying JS string — recover it with Obj.magic for assertion.
@@ -39,43 +37,38 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
-// resolver's cursor must round-trip DynamoDB's own continuation token, not a
-// synthetic index — every list past page 1 was unreachable before this.
-describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
+// Tripwires for the Scan connection's paging. The behaviour itself is exercised
+// against the evaluated resolver in `rescript/pulumi-aws`; these guard the wiring
+// this package is responsible for emitting.
+describe("listAllItemsConnection — paging", () => {
   let code = AppSync_Resolver_Retrying.Functions.listAllItemsConnection(~labelField="name")->codeOf
 
-  testSync("Fix 1: response encodes the real nextToken as the cursor", () => {
-    expect(code->String.includes("const next = ctx.result?.nextToken ?? null;"))->toBe(true)
-    expect(
-      code->String.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))"),
-    )->toBe(true)
-    expect(code->String.includes("hasNextPage: !!next,"))->toBe(true)
-  })
-
-  testSync("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+  testSync("the cursor round-trips a read window, not a synthetic index", () => {
     expect(code->String.includes("JSON.parse(util.base64Decode(ctx.args.after))"))->toBe(true)
-    expect(code->String.includes("nextToken: after,"))->toBe(true)
-  })
-
-  testSync("Fix 1: the old synthetic-index cursor is gone", () => {
+    expect(code->String.includes("nextToken: _window,"))->toBe(true)
     // The regression: `cursor: ctx.args.after ? ctx.args.after + '_' + i : '' + i`.
     expect(code->String.includes("ctx.args.after + '_' + i"))->toBe(false)
   })
 
-  testSync("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  testSync("a filtered read examines more rows than it serves", () => {
+    expect(code->String.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)"))->toBe(true)
+    expect(code->String.includes("const _page = _rest.slice(0, _first);"))->toBe(true)
+    expect(code->String.includes("hasNextPage: _more || !!_next,"))->toBe(true)
+  })
+
+  testSync("backward paging (last/before) is rejected, not silently mishandled", () => {
     expect(code->String.includes("ctx.args.before != null || ctx.args.last != null"))->toBe(true)
     expect(code->String.includes("UnsupportedPagination"))->toBe(true)
   })
 
-  testSync("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
+  testSync("a window emptied by the filter still yields a resumable boundary cursor", () => {
     expect(
       code->String.includes(
-        "const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;",
+        "const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;",
       ),
     )->toBe(true)
     expect(
-      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary"),
+      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary"),
     )->toBe(true)
   })
 })

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -19,37 +19,35 @@ globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
 
 globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
     globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
   });
   globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists")).toBe(false);
   });
 });
 
-globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
-  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
-  globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
-    globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
-    globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);
-    globalThis.expect(code.includes("hasNextPage: !!next,")).toBe(true);
-  });
-  globalThis.test("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+globalThis.describe("listAllItemsConnection — paging", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+  globalThis.test("the cursor round-trips a read window, not a synthetic index", () => {
     globalThis.expect(code.includes("JSON.parse(util.base64Decode(ctx.args.after))")).toBe(true);
-    globalThis.expect(code.includes("nextToken: after,")).toBe(true);
-  });
-  globalThis.test("Fix 1: the old synthetic-index cursor is gone", () => {
+    globalThis.expect(code.includes("nextToken: _window,")).toBe(true);
     globalThis.expect(code.includes("ctx.args.after + '_' + i")).toBe(false);
   });
-  globalThis.test("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  globalThis.test("a filtered read examines more rows than it serves", () => {
+    globalThis.expect(code.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)")).toBe(true);
+    globalThis.expect(code.includes("const _page = _rest.slice(0, _first);")).toBe(true);
+    globalThis.expect(code.includes("hasNextPage: _more || !!_next,")).toBe(true);
+  });
+  globalThis.test("backward paging (last/before) is rejected, not silently mishandled", () => {
     globalThis.expect(code.includes("ctx.args.before != null || ctx.args.last != null")).toBe(true);
     globalThis.expect(code.includes("UnsupportedPagination")).toBe(true);
   });
-  globalThis.test("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
-    globalThis.expect(code.includes("const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;")).toBe(true);
-    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary")).toBe(true);
+  globalThis.test("a window emptied by the filter still yields a resumable boundary cursor", () => {
+    globalThis.expect(code.includes("const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;")).toBe(true);
+    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary")).toBe(true);
   });
 });