@reventlessdev/reventless-aws 3.0.0-alpha.320 → 3.0.0-alpha.321

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.321 (2026-08-23)
+
+### Bug Fixes
+
+* **aws:** serve a full page from a filtered AppSync read ([b7dca5d](https://github.com/ReventlessDev/reventless-core/commit/b7dca5dac02e8c35c4848828152b90ade0f3c8ba))
+### Features
+
+* **querydb:** serve owner-scoped lists from an index instead of a filtered Scan ([ad26c28](https://github.com/ReventlessDev/reventless-core/commit/ad26c284b4b0650fa3f3b6109ed33bbfe8608f6d))
+
+
 # 3.0.0-alpha.320 (2026-08-23)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.320",
+  "version": "3.0.0-alpha.321",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -17,16 +17,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.13",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.4",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.3",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.150",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.248",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.151",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.122",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.112"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.249",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.113",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.123"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -283,13 +283,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
     // See docs/plans/done/platform-plugins-admin-connection-null-rows.md.
     let requireAttribute = internalRowRequiredAttr(name)
-    // A DynamoDB FilterExpression is applied AFTER the page is read, so a scoped
-    // list over a table with no index on the owner field returns short pages —
-    // correct, but pathological once a caller owns a small fraction of the rows.
-    // Warned rather than refused: the resolver does serve the query, and a
-    // deployment may legitimately accept the cost on a small table. Mirrors the
-    // `@scanSort` alignment warning above, which exists for the same class of
-    // "works, but scans" mistake.
     ReventlessCore.OwnerScopeDiagnostics.warnIfNoElevatedGroups(
       ~comp="QueryDbResolvers_AppSync",
       ~view=name,
@@ -298,17 +291,33 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     let isIndexed = f =>
       indexes->Array.some(ic => ic.idField->Option.getOr(ic.index) == f) ||
         subIdField->Option.getOr("") == f
-    switch ownerField {
+    // The index `@owner` derives, and the sort key that orders one caller's rows
+    // inside it. Its absence means the author declined it — the list then falls
+    // back to the Scan-and-filter this used to prescribe an `@index` for.
+    let ownerIndexConfig = switch ownerField {
     | Some(f) =>
-      if !isIndexed(f) {
-        log.warn(
-          ~comp="QueryDbResolvers_AppSync",
-          `${name}: @owner field "${f}" is not the key of any index on this table. ` ++
-          "Owner-scoped reads will Scan and filter, so pages shrink as the caller's " ++
-          "share of the rows falls. Add an @index on that field before this read model grows.",
-        )
-      }
-    | None => ()
+      indexes->Array.find(ic =>
+        Reventless.ReadModel.isDerivedIndex(ic) && ic.idField->Option.getOr(ic.index) == f
+      )
+    | None => None
+    }
+    let ownerIndex = ownerIndexConfig->Option.map(ic => ic.index)
+    let ownerIndexSortField = ownerIndexConfig->Option.flatMap(ic => ic.subIdField)
+    // Only reachable through `@owner({index: false})` now that the index is
+    // derived by default, so this states the cost of that choice rather than
+    // prescribing an `@index` — which would provision a second index on the same
+    // key and still not be the one the list reads.
+    switch (ownerField, ownerIndex) {
+    | (Some(f), None) if !isIndexed(f) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @owner field "${f}" keys no index on this table, so owner-scoped ` ++
+        "reads Scan the table and filter after the page is read — cost grows with the " ++
+        "table while the answer shrinks with the caller's share of it. Drop " ++
+        "`@owner({index: false})` to let the framework derive the index, or accept " ++
+        "the cost on a view that stays small.",
+      )
+    | _ => ()
     }
     // The same class of "works, but scans" mistake as the owner warning above,
     // and the retirement case degrades the same way: the FilterExpression is
@@ -346,12 +355,19 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~elevatedGroups,
           ~retiredField?,
           ~retiredValues?,
+          ~ownerIndex?,
+          ~ownerIndexSortField?,
         )
       } else {
         Resolver.Functions.listAllItems
       },
     )
-    let resolversByIndex = indexes->Array.map(({index} as indexConfig) => {
+    // Derived indexes are absent from the SDL (`GraphQL_FragmentGenerator` skips
+    // them), so a resolver here would attach to a field that does not exist and
+    // fail the deploy. The list resolver above is the only thing that reads one.
+    let resolversByIndex = indexes
+    ->Array.filter(ic => !Reventless.ReadModel.isDerivedIndex(ic))
+    ->Array.map(({index} as indexConfig) => {
       // Name and key field both come from `GraphQL_FragmentGenerator`, which is
       // where the SDL field this attaches to is derived. Deriving them here as
       // well is how the two came to disagree: the emitted field declared `id`

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
@@ -123,14 +124,23 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
         return Stdlib_Option.getOr(subIdField, "") === f;
       }
     };
-    if (ownerField !== undefined && !isIndexed(ownerField)) {
-      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" is not the key of any index on this table. ` + "Owner-scoped reads will Scan and filter, so pages shrink as the caller's share of the rows falls. Add an @index on that field before this read model grows.");
+    let ownerIndexConfig = ownerField !== undefined ? indexes.find(ic => {
+        if (ReadModel$Reventless.isDerivedIndex(ic)) {
+          return Stdlib_Option.getOr(ic.idField, ic.index) === ownerField;
+        } else {
+          return false;
+        }
+      }) : undefined;
+    let ownerIndex = Stdlib_Option.map(ownerIndexConfig, ic => ic.index);
+    let ownerIndexSortField = Stdlib_Option.flatMap(ownerIndexConfig, ic => ic.subIdField);
+    if (ownerField !== undefined && !(ownerIndex !== undefined || isIndexed(ownerField))) {
+      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" keys no index on this table, so owner-scoped ` + "reads Scan the table and filter after the page is read — cost grows with the table while the answer shrinks with the caller's share of it. Drop `@owner({index: false})` to let the framework derive the index, or accept the cost on a view that stays small.");
     }
     if (retiredField !== undefined && !isIndexed(retiredField)) {
       log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is not the key of any index on this table. ` + "Reads that exclude retired rows will Scan and filter, so pages shrink as the archive's share of the rows grows. Add an @index on that field before this read model grows.");
     }
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
-    let resolversByIndex = indexes.map(indexConfig => {
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues, ownerIndex, ownerIndexSortField) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let resolversByIndex = indexes.filter(ic => !ReadModel$Reventless.isDerivedIndex(ic)).map(indexConfig => {
       let index = indexConfig.index;
       let fieldName = GraphQL_FragmentGenerator$ReventlessCore.indexQueryFieldName(fieldNameForSingle, index);
       let resolverName = Stdlib_String.capitalize(fieldName);

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res

@@ -29,20 +29,35 @@ let globalSecondaryIndexes = (indexes: array<Reventless.ReadModel.indexConfig>)
   })
   ->Pulumi.Input.make
 
-let attributes = (sortField, indexes: array<Reventless.ReadModel.indexConfig>) =>
-  [
-    [{name: "id", type_: "S"}],
-    sortField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
-    indexes
-    ->Array.map((indexConfig: Reventless.ReadModel.indexConfig) => {
-      let {index, type_} = indexConfig
-      [
-        [{name: indexConfig.idField->Option.getOr(index), type_}],
-        indexConfig.subIdField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
-      ]->Array.flat
-    })
-    ->Array.flat,
-  ]->Array.flat
+// Pulumi rejects a table that defines the same attribute twice, and an index may
+// legitimately key on one the table already declares — the derived `@owner` index
+// sorts on `id`, and any index may sort on the table's own sort key. First
+// declaration wins; they agree on the type because both name the same column.
+let attributes = (sortField, indexes: array<Reventless.ReadModel.indexConfig>) => {
+  let all =
+    [
+      [{name: "id", type_: "S"}],
+      sortField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
+      indexes
+      ->Array.map((indexConfig: Reventless.ReadModel.indexConfig) => {
+        let {index, type_} = indexConfig
+        [
+          [{name: indexConfig.idField->Option.getOr(index), type_}],
+          indexConfig.subIdField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
+        ]->Array.flat
+      })
+      ->Array.flat,
+    ]->Array.flat
+  let seen = Set.make()
+  all->Array.filter(({name}) =>
+    if seen->Set.has(name) {
+      false
+    } else {
+      seen->Set.add(name)
+      true
+    }
+  )
+}
 
 let dataSource = (name, table, api, apiRole, opts) => {
   let _dataSourceRolePolicy = {

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs

@@ -38,7 +38,7 @@ function globalSecondaryIndexes(indexes) {
 }
 
 function attributes(sortField, indexes) {
-  return [
+  let all = [
     [{
         name: "id",
         type: "S"
@@ -58,6 +58,16 @@ function attributes(sortField, indexes) {
         }])
     ].flat()).flat()
   ].flat();
+  let seen = new Set();
+  return all.filter(param => {
+    let name = param.name;
+    if (seen.has(name)) {
+      return false;
+    } else {
+      seen.add(name);
+      return true;
+    }
+  });
 }
 
 function dataSource(name, table, api, apiRole, opts) {

package/tests/AppSync_RetirementNarrowingTest.res

@@ -1,11 +1,7 @@
-// The DynamoDB backend narrows retirement on every door the rule names, not
-// only on the list.
-//
-// These assert the *generated resolver source*, which is the only artifact that
-// exists before a deploy: the predicate runs inside AppSync's JS runtime, so a
-// unit test cannot execute it against a table, and what can be checked here is
-// that each door carries the guard, in the half of the template its operation
-// allows, and that a view declaring no retirement is untouched.
+// The DynamoDB backend narrows retirement on every door the rule names, not only
+// on the list. These assert the generated resolver source — the only artifact
+// that exists before a deploy — for the guard, the half of the template its
+// operation allows, and a view declaring no retirement staying untouched.
 
 open JestGlobals
 
@@ -210,18 +206,20 @@ describe("the by-index door answers the field it is attached to", () => {
   testSync("returns a Relay connection, not the raw DynamoDB result", () =>
     expect((
       code->String.includes("edges,"),
-      code->String.includes("hasNextPage: !!next"),
+      code->String.includes("hasNextPage: _more || !!_next"),
       code->String.includes("return ctx.result;"),
     ))->Expect.toEqual((true, true, false))
   )
 
   // `first`/`after` are what the field declares; `limit`/`nextToken` were what
-  // the template read, and nothing translated between the two.
+  // the template read, and nothing translated between the two. `limit` counts
+  // rows examined, so a filtered read looks wider than the page it serves.
   testSync("pages on the Relay arguments the field declares", () =>
     expect((
-      code->String.includes("limit: (args.first ?? 50)"),
+      code->String.includes("const _first = args.first ?? 50;"),
+      code->String.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code->String.includes("util.base64Decode(args.after)"),
-    ))->Expect.toEqual((true, true))
+    ))->Expect.toEqual((true, true, true))
   )
 
   // Every declared argument has a job other than matching a column, so each one

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -133,7 +133,7 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   globalThis.test("returns a Relay connection, not the raw DynamoDB result", () => {
     globalThis.expect([
       code.includes("edges,"),
-      code.includes("hasNextPage: !!next"),
+      code.includes("hasNextPage: _more || !!_next"),
       code.includes("return ctx.result;")
     ]).toEqual([
       true,
@@ -143,9 +143,11 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   });
   globalThis.test("pages on the Relay arguments the field declares", () => {
     globalThis.expect([
-      code.includes("limit: (args.first ?? 50)"),
+      code.includes("const _first = args.first ?? 50;"),
+      code.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code.includes("util.base64Decode(args.after)")
     ]).toEqual([
+      true,
       true,
       true
     ]);

package/tests/QueryDbOwnerIndexTableTest.res

@@ -0,0 +1,53 @@
+// The table half of the index `@owner` derives. Both assertions are about the
+// DynamoDB resource the deploy would submit, which is the only artifact that
+// exists before one.
+
+open JestGlobals
+
+// `Pulumi.Input.make` is `%identity`, so the provider-facing shape can be read
+// back as the ReScript value it wraps.
+external unwrap: Pulumi.Input.t<'a> => 'a = "%identity"
+
+let ownerIndex: Reventless.ReadModel.indexConfig = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: ALL,
+  derived: true,
+}
+
+describe("the derived owner index", () => {
+  // Not KEYS_ONLY and not INCLUDE: the list door pushes the caller's filter, the
+  // retirement predicate and `requireAttribute` down as FilterExpressions over
+  // arbitrary columns, and a DynamoDB filter on a GSI may only name projected
+  // attributes. A row read through a narrow projection also comes back missing
+  // fields, which resolves a non-null SDL field to null.
+  testSync("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb.globalSecondaryIndexes([ownerIndex])->unwrap
+    expect(
+      gsis->Array.map(g => {
+        let g = g->unwrap
+        (g.name, g.hashKey, g.rangeKey, g.projectionType)
+      }),
+    )->toEqual([("_owner", "customerId", Some("id"), PulumiAws.DynamoDb.Table.ALL)])
+  })
+
+  // Pulumi rejects a table that defines the same attribute twice, and the derived
+  // index sorts on `id` — the table's own partition key — on any view with no
+  // `@subId`. Undeduped, adding `@owner` to such a view fails the deploy outright.
+  testSync("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb.attributes(None, [ownerIndex])->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "customerId"])
+  })
+
+  // The same collision one step out: an index that sorts on the table's sort key.
+  testSync("dedupes against the table's own sort key too", () => {
+    let names =
+      QueryDbStorage_DynamoDb.attributes(
+        Some("placedAt"),
+        [{...ownerIndex, subIdField: "placedAt"}],
+      )->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "placedAt", "customerId"])
+  })
+})

package/tests/QueryDbOwnerIndexTableTest.res.mjs

@@ -0,0 +1,50 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as QueryDbStorage_DynamoDb$ReventlessAws from "../src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs";
+
+let ownerIndex = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: "ALL",
+  derived: true
+};
+
+globalThis.describe("the derived owner index", () => {
+  globalThis.test("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb$ReventlessAws.globalSecondaryIndexes([ownerIndex]);
+    globalThis.expect(gsis.map(g => [
+      g.name,
+      g.hashKey,
+      g.rangeKey,
+      g.projectionType
+    ])).toEqual([[
+        "_owner",
+        "customerId",
+        "id",
+        "ALL"
+      ]]);
+  });
+  globalThis.test("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes(undefined, [ownerIndex]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "customerId"
+    ]);
+  });
+  globalThis.test("dedupes against the table's own sort key too", () => {
+    let newrecord = {...ownerIndex};
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes("placedAt", [(newrecord.subIdField = "placedAt", newrecord)]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "placedAt",
+      "customerId"
+    ]);
+  });
+});
+
+export {
+  ownerIndex,
+}
+/*  Not a pure module */

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,10 +1,8 @@
 open JestGlobals
 
-// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
-// the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
-// (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
-// The auto-generated Connection Scan must exclude them, or `name: String!` resolves
-// to null and nulls the entire Platform_PluginConnection ("No data" on the page).
+// The Plugins admin RM shares its table with bookkeeping rows (`deploy-schema:*`,
+// `plugin-info:*`, `deploy-schema-hash:*`) carrying no `name`. The Connection Scan
+// must exclude them, or `name: String!` nulls the whole connection.
 
 // `Pulumi.Input.make` is `%identity`, so a generated resolver's `Pulumi.Input.t<string>`
 // IS the underlying JS string — recover it with Obj.magic for assertion.
@@ -39,43 +37,38 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
-// resolver's cursor must round-trip DynamoDB's own continuation token, not a
-// synthetic index — every list past page 1 was unreachable before this.
-describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
+// Tripwires for the Scan connection's paging. The behaviour itself is exercised
+// against the evaluated resolver in `rescript/pulumi-aws`; these guard the wiring
+// this package is responsible for emitting.
+describe("listAllItemsConnection — paging", () => {
   let code = AppSync_Resolver_Retrying.Functions.listAllItemsConnection(~labelField="name")->codeOf
 
-  testSync("Fix 1: response encodes the real nextToken as the cursor", () => {
-    expect(code->String.includes("const next = ctx.result?.nextToken ?? null;"))->toBe(true)
-    expect(
-      code->String.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))"),
-    )->toBe(true)
-    expect(code->String.includes("hasNextPage: !!next,"))->toBe(true)
-  })
-
-  testSync("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+  testSync("the cursor round-trips a read window, not a synthetic index", () => {
     expect(code->String.includes("JSON.parse(util.base64Decode(ctx.args.after))"))->toBe(true)
-    expect(code->String.includes("nextToken: after,"))->toBe(true)
-  })
-
-  testSync("Fix 1: the old synthetic-index cursor is gone", () => {
+    expect(code->String.includes("nextToken: _window,"))->toBe(true)
     // The regression: `cursor: ctx.args.after ? ctx.args.after + '_' + i : '' + i`.
     expect(code->String.includes("ctx.args.after + '_' + i"))->toBe(false)
   })
 
-  testSync("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  testSync("a filtered read examines more rows than it serves", () => {
+    expect(code->String.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)"))->toBe(true)
+    expect(code->String.includes("const _page = _rest.slice(0, _first);"))->toBe(true)
+    expect(code->String.includes("hasNextPage: _more || !!_next,"))->toBe(true)
+  })
+
+  testSync("backward paging (last/before) is rejected, not silently mishandled", () => {
     expect(code->String.includes("ctx.args.before != null || ctx.args.last != null"))->toBe(true)
     expect(code->String.includes("UnsupportedPagination"))->toBe(true)
   })
 
-  testSync("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
+  testSync("a window emptied by the filter still yields a resumable boundary cursor", () => {
     expect(
       code->String.includes(
-        "const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;",
+        "const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;",
       ),
     )->toBe(true)
     expect(
-      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary"),
+      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary"),
     )->toBe(true)
   })
 })

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -19,37 +19,35 @@ globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
 
 globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
     globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
   });
   globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists")).toBe(false);
   });
 });
 
-globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
-  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
-  globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
-    globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
-    globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);
-    globalThis.expect(code.includes("hasNextPage: !!next,")).toBe(true);
-  });
-  globalThis.test("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+globalThis.describe("listAllItemsConnection — paging", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+  globalThis.test("the cursor round-trips a read window, not a synthetic index", () => {
     globalThis.expect(code.includes("JSON.parse(util.base64Decode(ctx.args.after))")).toBe(true);
-    globalThis.expect(code.includes("nextToken: after,")).toBe(true);
-  });
-  globalThis.test("Fix 1: the old synthetic-index cursor is gone", () => {
+    globalThis.expect(code.includes("nextToken: _window,")).toBe(true);
     globalThis.expect(code.includes("ctx.args.after + '_' + i")).toBe(false);
   });
-  globalThis.test("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  globalThis.test("a filtered read examines more rows than it serves", () => {
+    globalThis.expect(code.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)")).toBe(true);
+    globalThis.expect(code.includes("const _page = _rest.slice(0, _first);")).toBe(true);
+    globalThis.expect(code.includes("hasNextPage: _more || !!_next,")).toBe(true);
+  });
+  globalThis.test("backward paging (last/before) is rejected, not silently mishandled", () => {
     globalThis.expect(code.includes("ctx.args.before != null || ctx.args.last != null")).toBe(true);
     globalThis.expect(code.includes("UnsupportedPagination")).toBe(true);
   });
-  globalThis.test("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
-    globalThis.expect(code.includes("const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;")).toBe(true);
-    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary")).toBe(true);
+  globalThis.test("a window emptied by the filter still yields a resumable boundary cursor", () => {
+    globalThis.expect(code.includes("const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;")).toBe(true);
+    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary")).toBe(true);
   });
 });