@reventlessdev/reventless-aws 3.0.0-alpha.320 → 3.0.0-alpha.322

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.322 (2026-08-23)
+
+### Bug Fixes
+
+* **aws:** grant the AppSync data source Query on the table's indexes ([0dc5ed2](https://github.com/ReventlessDev/reventless-core/commit/0dc5ed2e783be22af5b418c94c95fc35f4b73851))
+
+
+# 3.0.0-alpha.321 (2026-08-23)
+
+### Bug Fixes
+
+* **aws:** serve a full page from a filtered AppSync read ([b7dca5d](https://github.com/ReventlessDev/reventless-core/commit/b7dca5dac02e8c35c4848828152b90ade0f3c8ba))
+### Features
+
+* **querydb:** serve owner-scoped lists from an index instead of a filtered Scan ([ad26c28](https://github.com/ReventlessDev/reventless-core/commit/ad26c284b4b0650fa3f3b6109ed33bbfe8608f6d))
+
+
 # 3.0.0-alpha.320 (2026-08-23)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.320",
+  "version": "3.0.0-alpha.322",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -16,17 +16,17 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.13",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.3",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.4",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.249",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.151",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.150",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.248",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.122",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.112"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.113",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.123"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -283,13 +283,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
     // See docs/plans/done/platform-plugins-admin-connection-null-rows.md.
     let requireAttribute = internalRowRequiredAttr(name)
-    // A DynamoDB FilterExpression is applied AFTER the page is read, so a scoped
-    // list over a table with no index on the owner field returns short pages —
-    // correct, but pathological once a caller owns a small fraction of the rows.
-    // Warned rather than refused: the resolver does serve the query, and a
-    // deployment may legitimately accept the cost on a small table. Mirrors the
-    // `@scanSort` alignment warning above, which exists for the same class of
-    // "works, but scans" mistake.
     ReventlessCore.OwnerScopeDiagnostics.warnIfNoElevatedGroups(
       ~comp="QueryDbResolvers_AppSync",
       ~view=name,
@@ -298,39 +291,75 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     let isIndexed = f =>
       indexes->Array.some(ic => ic.idField->Option.getOr(ic.index) == f) ||
         subIdField->Option.getOr("") == f
-    switch ownerField {
+    // The index `@owner` derives, and the sort key that orders one caller's rows
+    // inside it. Its absence means the author declined it — the list then falls
+    // back to the Scan-and-filter this used to prescribe an `@index` for.
+    let ownerIndexConfig = switch ownerField {
     | Some(f) =>
-      if !isIndexed(f) {
-        log.warn(
-          ~comp="QueryDbResolvers_AppSync",
-          `${name}: @owner field "${f}" is not the key of any index on this table. ` ++
-          "Owner-scoped reads will Scan and filter, so pages shrink as the caller's " ++
-          "share of the rows falls. Add an @index on that field before this read model grows.",
-        )
-      }
-    | None => ()
+      indexes->Array.find(ic =>
+        Reventless.ReadModel.isDerivedIndex(ic) && ic.idField->Option.getOr(ic.index) == f
+      )
+    | None => None
+    }
+    let ownerIndex = ownerIndexConfig->Option.map(ic => ic.index)
+    let ownerIndexSortField = ownerIndexConfig->Option.flatMap(ic => ic.subIdField)
+    // Only reachable through `@owner({index: false})` now that the index is
+    // derived by default, so this states the cost of that choice rather than
+    // prescribing an `@index` — which would provision a second index on the same
+    // key and still not be the one the list reads.
+    switch (ownerField, ownerIndex) {
+    | (Some(f), None) if !isIndexed(f) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @owner field "${f}" keys no index on this table, so owner-scoped ` ++
+        "reads Scan the table and filter after the page is read — cost grows with the " ++
+        "table while the answer shrinks with the caller's share of it. Drop " ++
+        "`@owner({index: false})` to let the framework derive the index, or accept " ++
+        "the cost on a view that stays small.",
+      )
+    | _ => ()
     }
-    // The same class of "works, but scans" mistake as the owner warning above,
-    // and the retirement case degrades the same way: the FilterExpression is
-    // applied after the page is read, so pages shrink as the archive's share of
-    // the table grows.
+    // The same "works, but scans" cost as the owner warning above: the
+    // FilterExpression is applied after the page is read, so pages shrink as the
+    // archive's share of the table grows.
     //
-    // `@scan` deliberately does not satisfy this. It adds no index and removes
-    // no read unit — it only widens the client's filter surface — so accepting it
-    // here would make the warning dismissible by an annotation that changes
-    // nothing about the cost being warned about.
-    switch retiredField {
-    | Some(f) =>
-      if !isIndexed(f) {
-        log.warn(
-          ~comp="QueryDbResolvers_AppSync",
-          `${name}: @retired field "${f}" is not the key of any index on this table. ` ++
-          "Reads that exclude retired rows will Scan and filter, so pages shrink as " ++
-          "the archive's share of the rows grows. Add an @index on that field before " ++
-          "this read model grows.",
-        )
-      }
-    | None => ()
+    // What it must NOT say any more is "add an @index on that field". That was
+    // the same defect the owner warning had — following it changed nothing — and
+    // here it is worse advice, twice over: a GSI partitioned on a two- or
+    // three-valued flag funnels the whole table through one partition, and the
+    // list door reads neither it nor the by-index door it provisions.
+    //
+    // Retirement has no partition key of its own. It is only useful as the
+    // leading component of a sort key INSIDE some other partition, and `@owner`
+    // is what supplies one — see
+    // docs/plans/Backlog/retirement-folded-into-the-owner-index.md. On a view
+    // with no owner there is nothing to fold into, and the honest answer is a
+    // purpose-built view or the constant-PK index in
+    // docs/plans/Backlog/aws-fulllist-ordered-index-promotion.md.
+    //
+    // Fires whatever the field keys, unlike the owner check: an `@index` on the
+    // retirement field does not make this read cheaper, so suppressing on one
+    // would silence a cost that is still being paid. `@scan` does not satisfy it
+    // either — it widens the client's filter surface and removes no read unit.
+    switch (retiredField, ownerField) {
+    | (Some(f), Some(o)) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @retired field "${f}" is filtered after the page is read, so pages ` ++
+        `shrink as the archive's share of the rows grows. This view is scoped on "${o}", ` ++
+        "so a scoped caller only sifts their own partition and pays in proportion to " ++
+        "their rows; it is the elevated whole-table read that pays in full.",
+      )
+    | (Some(f), None) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @retired field "${f}" is filtered after the page is read, so pages ` ++
+        "shrink as the archive's share of the rows grows. An @index on that field " ++
+        "would not help — the list read does not use one, and a flag makes a poor " ++
+        "partition key. Reshape the view so the rows you serve are the rows you " ++
+        "keep, or accept the cost while the archive stays small.",
+      )
+    | (None, _) => ()
     }
     let resolverAll = makeQueryResolver(
       ~resolverName=fieldNameForAll->String.capitalize,
@@ -346,12 +375,19 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~elevatedGroups,
           ~retiredField?,
           ~retiredValues?,
+          ~ownerIndex?,
+          ~ownerIndexSortField?,
         )
       } else {
         Resolver.Functions.listAllItems
       },
     )
-    let resolversByIndex = indexes->Array.map(({index} as indexConfig) => {
+    // Derived indexes are absent from the SDL (`GraphQL_FragmentGenerator` skips
+    // them), so a resolver here would attach to a field that does not exist and
+    // fail the deploy. The list resolver above is the only thing that reads one.
+    let resolversByIndex = indexes
+    ->Array.filter(ic => !Reventless.ReadModel.isDerivedIndex(ic))
+    ->Array.map(({index} as indexConfig) => {
       // Name and key field both come from `GraphQL_FragmentGenerator`, which is
       // where the SDL field this attaches to is derived. Deriving them here as
       // well is how the two came to disagree: the emitted field declared `id`

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
@@ -123,14 +124,27 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
         return Stdlib_Option.getOr(subIdField, "") === f;
       }
     };
-    if (ownerField !== undefined && !isIndexed(ownerField)) {
-      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" is not the key of any index on this table. ` + "Owner-scoped reads will Scan and filter, so pages shrink as the caller's share of the rows falls. Add an @index on that field before this read model grows.");
+    let ownerIndexConfig = ownerField !== undefined ? indexes.find(ic => {
+        if (ReadModel$Reventless.isDerivedIndex(ic)) {
+          return Stdlib_Option.getOr(ic.idField, ic.index) === ownerField;
+        } else {
+          return false;
+        }
+      }) : undefined;
+    let ownerIndex = Stdlib_Option.map(ownerIndexConfig, ic => ic.index);
+    let ownerIndexSortField = Stdlib_Option.flatMap(ownerIndexConfig, ic => ic.subIdField);
+    if (ownerField !== undefined && !(ownerIndex !== undefined || isIndexed(ownerField))) {
+      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" keys no index on this table, so owner-scoped ` + "reads Scan the table and filter after the page is read — cost grows with the table while the answer shrinks with the caller's share of it. Drop `@owner({index: false})` to let the framework derive the index, or accept the cost on a view that stays small.");
     }
-    if (retiredField !== undefined && !isIndexed(retiredField)) {
-      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is not the key of any index on this table. ` + "Reads that exclude retired rows will Scan and filter, so pages shrink as the archive's share of the rows grows. Add an @index on that field before this read model grows.");
+    if (retiredField !== undefined) {
+      if (ownerField !== undefined) {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is filtered after the page is read, so pages ` + (`shrink as the archive's share of the rows grows. This view is scoped on "` + ownerField + `", `) + "so a scoped caller only sifts their own partition and pays in proportion to their rows; it is the elevated whole-table read that pays in full.");
+      } else {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is filtered after the page is read, so pages ` + "shrink as the archive's share of the rows grows. An @index on that field would not help — the list read does not use one, and a flag makes a poor partition key. Reshape the view so the rows you serve are the rows you keep, or accept the cost while the archive stays small.");
+      }
     }
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
-    let resolversByIndex = indexes.map(indexConfig => {
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues, ownerIndex, ownerIndexSortField) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let resolversByIndex = indexes.filter(ic => !ReadModel$Reventless.isDerivedIndex(ic)).map(indexConfig => {
       let index = indexConfig.index;
       let fieldName = GraphQL_FragmentGenerator$ReventlessCore.indexQueryFieldName(fieldNameForSingle, index);
       let resolverName = Stdlib_String.capitalize(fieldName);

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res

@@ -29,20 +29,61 @@ let globalSecondaryIndexes = (indexes: array<Reventless.ReadModel.indexConfig>)
   })
   ->Pulumi.Input.make
 
-let attributes = (sortField, indexes: array<Reventless.ReadModel.indexConfig>) =>
-  [
-    [{name: "id", type_: "S"}],
-    sortField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
-    indexes
-    ->Array.map((indexConfig: Reventless.ReadModel.indexConfig) => {
-      let {index, type_} = indexConfig
-      [
-        [{name: indexConfig.idField->Option.getOr(index), type_}],
-        indexConfig.subIdField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
-      ]->Array.flat
-    })
-    ->Array.flat,
-  ]->Array.flat
+// Pulumi rejects a table that defines the same attribute twice, and an index may
+// legitimately key on one the table already declares — the derived `@owner` index
+// sorts on `id`, and any index may sort on the table's own sort key. First
+// declaration wins; they agree on the type because both name the same column.
+let attributes = (sortField, indexes: array<Reventless.ReadModel.indexConfig>) => {
+  let all =
+    [
+      [{name: "id", type_: "S"}],
+      sortField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
+      indexes
+      ->Array.map((indexConfig: Reventless.ReadModel.indexConfig) => {
+        let {index, type_} = indexConfig
+        [
+          [{name: indexConfig.idField->Option.getOr(index), type_}],
+          indexConfig.subIdField->Option.mapOr([], sortField => [{name: sortField, type_: "S"}]),
+        ]->Array.flat
+      })
+      ->Array.flat,
+    ]->Array.flat
+  let seen = Set.make()
+  all->Array.filter(({name}) =>
+    if seen->Set.has(name) {
+      false
+    } else {
+      seen->Set.add(name)
+      true
+    }
+  )
+}
+
+/**
+The DynamoDB grant the AppSync data source assumes.
+
+An index is a SEPARATE IAM resource (`<table>/index/<name>`), so a grant naming
+only the table permits `Scan` and `GetItem` and denies every `Query` against a
+GSI — silently at deploy time, loudly at the first request. Two doors read one:
+the by-index door, and the list door's owner-scoped branch.
+
+Pure and named so the resource list is assertable without a deploy; the failure
+it guards has no other artifact to check.
+*/
+let dataSourcePolicyDocument = (~name: string, ~tableArn: string): string => {
+  open PolicyDocument
+  PolicyDocument.make(
+    ~id=name ++ "DataSourcePolicy",
+    ~statements=[
+      {
+        sid: "AllowDynamoDbActions",
+        effect: Allow,
+        actions: Action("dynamodb:*"),
+        resources: Resources([tableArn, tableArn ++ "/index/*"]),
+      },
+    ],
+  )->toJsonString
+}
 
 let dataSource = (name, table, api, apiRole, opts) => {
   let _dataSourceRolePolicy = {
@@ -50,20 +91,7 @@ let dataSource = (name, table, api, apiRole, opts) => {
       ~name,
       ~args={
         IAM.RolePolicy.policy: table.arn
-        ->Pulumi.Output.apply(tableArn => {
-          open PolicyDocument
-          PolicyDocument.make(
-            ~id=name ++ "DataSourcePolicy",
-            ~statements=[
-              {
-                sid: "AllowDynamoDbActions",
-                effect: Allow,
-                actions: Action("dynamodb:*"),
-                resources: Resource(tableArn),
-              },
-            ],
-          )->toJsonString
-        })
+        ->Pulumi.Output.apply(tableArn => dataSourcePolicyDocument(~name, ~tableArn))
         ->Pulumi.Output.asInput,
         role: apiRole
         ->Pulumi.Output.flatMap((role: PulumiAws.IAM.Role.t) => role.id)

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs

@@ -38,7 +38,7 @@ function globalSecondaryIndexes(indexes) {
 }
 
 function attributes(sortField, indexes) {
-  return [
+  let all = [
     [{
         name: "id",
         type: "S"
@@ -58,16 +58,33 @@ function attributes(sortField, indexes) {
         }])
     ].flat()).flat()
   ].flat();
+  let seen = new Set();
+  return all.filter(param => {
+    let name = param.name;
+    if (seen.has(name)) {
+      return false;
+    } else {
+      seen.add(name);
+      return true;
+    }
+  });
+}
+
+function dataSourcePolicyDocument(name, tableArn) {
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+      Sid: "AllowDynamoDbActions",
+      Effect: "Allow",
+      Action: "dynamodb:*",
+      Resource: [
+        tableArn,
+        tableArn + "/index/*"
+      ]
+    }]));
 }
 
 function dataSource(name, table, api, apiRole, opts) {
   new (Aws.iam.RolePolicy)(name, {
-    policy: table.arn.apply(tableArn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
-        Sid: "AllowDynamoDbActions",
-        Effect: "Allow",
-        Action: "dynamodb:*",
-        Resource: tableArn
-      }]))),
+    policy: table.arn.apply(tableArn => dataSourcePolicyDocument(name, tableArn)),
     role: Output$Pulumi.flatMap(apiRole, role => role.id)
   }, opts);
   return AppSync_DataSource$PulumiAws.makeDynamoDBDataSource(name, api, table, apiRole, opts);
@@ -94,6 +111,7 @@ function make(name, indexes, subIdField, ttl, api, apiRole, owner, opts) {
 export {
   globalSecondaryIndexes,
   attributes,
+  dataSourcePolicyDocument,
   dataSource,
   make,
 }

package/tests/AppSync_RetirementNarrowingTest.res

@@ -1,11 +1,7 @@
-// The DynamoDB backend narrows retirement on every door the rule names, not
-// only on the list.
-//
-// These assert the *generated resolver source*, which is the only artifact that
-// exists before a deploy: the predicate runs inside AppSync's JS runtime, so a
-// unit test cannot execute it against a table, and what can be checked here is
-// that each door carries the guard, in the half of the template its operation
-// allows, and that a view declaring no retirement is untouched.
+// The DynamoDB backend narrows retirement on every door the rule names, not only
+// on the list. These assert the generated resolver source — the only artifact
+// that exists before a deploy — for the guard, the half of the template its
+// operation allows, and a view declaring no retirement staying untouched.
 
 open JestGlobals
 
@@ -210,18 +206,20 @@ describe("the by-index door answers the field it is attached to", () => {
   testSync("returns a Relay connection, not the raw DynamoDB result", () =>
     expect((
       code->String.includes("edges,"),
-      code->String.includes("hasNextPage: !!next"),
+      code->String.includes("hasNextPage: _more || !!_next"),
       code->String.includes("return ctx.result;"),
     ))->Expect.toEqual((true, true, false))
   )
 
   // `first`/`after` are what the field declares; `limit`/`nextToken` were what
-  // the template read, and nothing translated between the two.
+  // the template read, and nothing translated between the two. `limit` counts
+  // rows examined, so a filtered read looks wider than the page it serves.
   testSync("pages on the Relay arguments the field declares", () =>
     expect((
-      code->String.includes("limit: (args.first ?? 50)"),
+      code->String.includes("const _first = args.first ?? 50;"),
+      code->String.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code->String.includes("util.base64Decode(args.after)"),
-    ))->Expect.toEqual((true, true))
+    ))->Expect.toEqual((true, true, true))
   )
 
   // Every declared argument has a job other than matching a column, so each one

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -133,7 +133,7 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   globalThis.test("returns a Relay connection, not the raw DynamoDB result", () => {
     globalThis.expect([
       code.includes("edges,"),
-      code.includes("hasNextPage: !!next"),
+      code.includes("hasNextPage: _more || !!_next"),
       code.includes("return ctx.result;")
     ]).toEqual([
       true,
@@ -143,9 +143,11 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   });
   globalThis.test("pages on the Relay arguments the field declares", () => {
     globalThis.expect([
-      code.includes("limit: (args.first ?? 50)"),
+      code.includes("const _first = args.first ?? 50;"),
+      code.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code.includes("util.base64Decode(args.after)")
     ]).toEqual([
+      true,
       true,
       true
     ]);

package/tests/QueryDbOwnerIndexTableTest.res

@@ -0,0 +1,90 @@
+// The table half of the index `@owner` derives. Both assertions are about the
+// DynamoDB resource the deploy would submit, which is the only artifact that
+// exists before one.
+
+open JestGlobals
+
+// `Pulumi.Input.make` is `%identity`, so the provider-facing shape can be read
+// back as the ReScript value it wraps.
+external unwrap: Pulumi.Input.t<'a> => 'a = "%identity"
+
+let ownerIndex: Reventless.ReadModel.indexConfig = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: ALL,
+  derived: true,
+}
+
+describe("the derived owner index", () => {
+  // Not KEYS_ONLY and not INCLUDE: the list door pushes the caller's filter, the
+  // retirement predicate and `requireAttribute` down as FilterExpressions over
+  // arbitrary columns, and a DynamoDB filter on a GSI may only name projected
+  // attributes. A row read through a narrow projection also comes back missing
+  // fields, which resolves a non-null SDL field to null.
+  testSync("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb.globalSecondaryIndexes([ownerIndex])->unwrap
+    expect(
+      gsis->Array.map(g => {
+        let g = g->unwrap
+        (g.name, g.hashKey, g.rangeKey, g.projectionType)
+      }),
+    )->toEqual([("_owner", "customerId", Some("id"), PulumiAws.DynamoDb.Table.ALL)])
+  })
+
+  // Pulumi rejects a table that defines the same attribute twice, and the derived
+  // index sorts on `id` — the table's own partition key — on any view with no
+  // `@subId`. Undeduped, adding `@owner` to such a view fails the deploy outright.
+  testSync("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb.attributes(None, [ownerIndex])->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "customerId"])
+  })
+
+  // The same collision one step out: an index that sorts on the table's sort key.
+  testSync("dedupes against the table's own sort key too", () => {
+    let names =
+      QueryDbStorage_DynamoDb.attributes(
+        Some("placedAt"),
+        [{...ownerIndex, subIdField: "placedAt"}],
+      )->Array.map(a => a.name)
+    expect(names)->toEqual(["id", "placedAt", "customerId"])
+  })
+})
+
+// Provisioning the index is half of it. An index is a separate IAM resource, so
+// a grant naming only the table lets every Scan through and denies every Query
+// against a GSI — which is how the owner-scoped branch reached production
+// deniable: nothing in the generated resolver, the table config or the SDL says
+// anything about it, and the first request is where it surfaces.
+describe("the data source's DynamoDB grant", () => {
+  let tableArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders-10f6a39"
+  let policy =
+    QueryDbStorage_DynamoDb.dataSourcePolicyDocument(~name="Orders", ~tableArn)->JSON.parseOrThrow
+
+  let field = (json, key) => json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(key))
+  let statement =
+    policy
+    ->field("Statement")
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.getOr([])
+    ->Array.get(0)
+    ->Option.getOr(JSON.Encode.null)
+  let resources =
+    statement
+    ->field("Resource")
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.getOr([])
+    ->Array.filterMap(JSON.Decode.string)
+
+  testSync("covers the table's indexes, not only the table", () =>
+    expect(resources)->toEqual([tableArn, tableArn ++ "/index/*"])
+  )
+
+  // Dropping the table itself would break Scan — the elevated branch — while the
+  // scoped branch kept working, so both halves are asserted rather than just the
+  // one that was missing.
+  testSync("still covers the table itself", () =>
+    expect(resources->Array.includes(tableArn))->toBe(true)
+  )
+})

package/tests/QueryDbOwnerIndexTableTest.res.mjs

@@ -0,0 +1,70 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as QueryDbStorage_DynamoDb$ReventlessAws from "../src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs";
+
+let ownerIndex = {
+  index: "_owner",
+  type_: "S",
+  idField: "customerId",
+  subIdField: "id",
+  projectionType: "ALL",
+  derived: true
+};
+
+globalThis.describe("the derived owner index", () => {
+  globalThis.test("is provisioned projecting every attribute", () => {
+    let gsis = QueryDbStorage_DynamoDb$ReventlessAws.globalSecondaryIndexes([ownerIndex]);
+    globalThis.expect(gsis.map(g => [
+      g.name,
+      g.hashKey,
+      g.rangeKey,
+      g.projectionType
+    ])).toEqual([[
+        "_owner",
+        "customerId",
+        "id",
+        "ALL"
+      ]]);
+  });
+  globalThis.test("does not redeclare an attribute the table already has", () => {
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes(undefined, [ownerIndex]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "customerId"
+    ]);
+  });
+  globalThis.test("dedupes against the table's own sort key too", () => {
+    let newrecord = {...ownerIndex};
+    let names = QueryDbStorage_DynamoDb$ReventlessAws.attributes("placedAt", [(newrecord.subIdField = "placedAt", newrecord)]).map(a => a.name);
+    globalThis.expect(names).toEqual([
+      "id",
+      "placedAt",
+      "customerId"
+    ]);
+  });
+});
+
+globalThis.describe("the data source's DynamoDB grant", () => {
+  let tableArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders-10f6a39";
+  let policy = JSON.parse(QueryDbStorage_DynamoDb$ReventlessAws.dataSourcePolicyDocument("Orders", tableArn));
+  let field = (json, key) => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[key]);
+  let statement = Stdlib_Option.getOr(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), [])[0], null);
+  let resources = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(statement, "Resource"), Stdlib_JSON.Decode.array), []), Stdlib_JSON.Decode.string);
+  globalThis.test("covers the table's indexes, not only the table", () => {
+    globalThis.expect(resources).toEqual([
+      tableArn,
+      tableArn + "/index/*"
+    ]);
+  });
+  globalThis.test("still covers the table itself", () => {
+    globalThis.expect(resources.includes(tableArn)).toBe(true);
+  });
+});
+
+export {
+  ownerIndex,
+}
+/*  Not a pure module */

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -1,10 +1,8 @@
 open JestGlobals
 
-// Regression guard for docs/plans/done/platform-plugins-admin-connection-null-rows.md:
-// the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
-// (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
-// The auto-generated Connection Scan must exclude them, or `name: String!` resolves
-// to null and nulls the entire Platform_PluginConnection ("No data" on the page).
+// The Plugins admin RM shares its table with bookkeeping rows (`deploy-schema:*`,
+// `plugin-info:*`, `deploy-schema-hash:*`) carrying no `name`. The Connection Scan
+// must exclude them, or `name: String!` nulls the whole connection.
 
 // `Pulumi.Input.make` is `%identity`, so a generated resolver's `Pulumi.Input.t<string>`
 // IS the underlying JS string — recover it with Obj.magic for assertion.
@@ -39,43 +37,38 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   })
 })
 
-// Tripwires for docs/plans/done/aws-scan-connection-cursor-roundtrip.md. The Scan
-// resolver's cursor must round-trip DynamoDB's own continuation token, not a
-// synthetic index — every list past page 1 was unreachable before this.
-describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
+// Tripwires for the Scan connection's paging. The behaviour itself is exercised
+// against the evaluated resolver in `rescript/pulumi-aws`; these guard the wiring
+// this package is responsible for emitting.
+describe("listAllItemsConnection — paging", () => {
   let code = AppSync_Resolver_Retrying.Functions.listAllItemsConnection(~labelField="name")->codeOf
 
-  testSync("Fix 1: response encodes the real nextToken as the cursor", () => {
-    expect(code->String.includes("const next = ctx.result?.nextToken ?? null;"))->toBe(true)
-    expect(
-      code->String.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))"),
-    )->toBe(true)
-    expect(code->String.includes("hasNextPage: !!next,"))->toBe(true)
-  })
-
-  testSync("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+  testSync("the cursor round-trips a read window, not a synthetic index", () => {
     expect(code->String.includes("JSON.parse(util.base64Decode(ctx.args.after))"))->toBe(true)
-    expect(code->String.includes("nextToken: after,"))->toBe(true)
-  })
-
-  testSync("Fix 1: the old synthetic-index cursor is gone", () => {
+    expect(code->String.includes("nextToken: _window,"))->toBe(true)
     // The regression: `cursor: ctx.args.after ? ctx.args.after + '_' + i : '' + i`.
     expect(code->String.includes("ctx.args.after + '_' + i"))->toBe(false)
   })
 
-  testSync("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  testSync("a filtered read examines more rows than it serves", () => {
+    expect(code->String.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)"))->toBe(true)
+    expect(code->String.includes("const _page = _rest.slice(0, _first);"))->toBe(true)
+    expect(code->String.includes("hasNextPage: _more || !!_next,"))->toBe(true)
+  })
+
+  testSync("backward paging (last/before) is rejected, not silently mishandled", () => {
     expect(code->String.includes("ctx.args.before != null || ctx.args.last != null"))->toBe(true)
     expect(code->String.includes("UnsupportedPagination"))->toBe(true)
   })
 
-  testSync("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
+  testSync("a window emptied by the filter still yields a resumable boundary cursor", () => {
     expect(
       code->String.includes(
-        "const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;",
+        "const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;",
       ),
     )->toBe(true)
     expect(
-      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary"),
+      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary"),
     )->toBe(true)
   })
 })

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -19,37 +19,35 @@ globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
 
 globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
     globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
   });
   globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists")).toBe(false);
   });
 });
 
-globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
-  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
-  globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
-    globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
-    globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);
-    globalThis.expect(code.includes("hasNextPage: !!next,")).toBe(true);
-  });
-  globalThis.test("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+globalThis.describe("listAllItemsConnection — paging", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+  globalThis.test("the cursor round-trips a read window, not a synthetic index", () => {
     globalThis.expect(code.includes("JSON.parse(util.base64Decode(ctx.args.after))")).toBe(true);
-    globalThis.expect(code.includes("nextToken: after,")).toBe(true);
-  });
-  globalThis.test("Fix 1: the old synthetic-index cursor is gone", () => {
+    globalThis.expect(code.includes("nextToken: _window,")).toBe(true);
     globalThis.expect(code.includes("ctx.args.after + '_' + i")).toBe(false);
   });
-  globalThis.test("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+  globalThis.test("a filtered read examines more rows than it serves", () => {
+    globalThis.expect(code.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)")).toBe(true);
+    globalThis.expect(code.includes("const _page = _rest.slice(0, _first);")).toBe(true);
+    globalThis.expect(code.includes("hasNextPage: _more || !!_next,")).toBe(true);
+  });
+  globalThis.test("backward paging (last/before) is rejected, not silently mishandled", () => {
     globalThis.expect(code.includes("ctx.args.before != null || ctx.args.last != null")).toBe(true);
     globalThis.expect(code.includes("UnsupportedPagination")).toBe(true);
   });
-  globalThis.test("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
-    globalThis.expect(code.includes("const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;")).toBe(true);
-    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary")).toBe(true);
+  globalThis.test("a window emptied by the filter still yields a resumable boundary cursor", () => {
+    globalThis.expect(code.includes("const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;")).toBe(true);
+    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary")).toBe(true);
   });
 });