@reventlessdev/reventless-core 3.0.0-alpha.223 → 3.0.0-alpha.225

package/src/components/Api/Api_Ids.res.mjs

@@ -0,0 +1,43 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+
+function encode(typeName, localId) {
+  return btoa(typeName + `:` + localId);
+}
+
+function decode(globalId) {
+  try {
+    let decoded = atob(globalId);
+    let idx = decoded.indexOf(":");
+    if (idx > 0) {
+      return [
+        decoded.slice(0, idx),
+        decoded.slice(idx + 1 | 0, decoded.length)
+      ];
+    } else {
+      return;
+    }
+  } catch (exn) {
+    return;
+  }
+}
+
+function toLocalId(id) {
+  return Stdlib_Option.map(decode(id), param => param[1]);
+}
+
+function alternateKey(id) {
+  let localId = toLocalId(id);
+  if (localId !== undefined && localId !== id) {
+    return localId;
+  }
+}
+
+export {
+  encode,
+  decode,
+  toLocalId,
+  alternateKey,
+}
+/* No side effect */

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -62,10 +62,28 @@ let rec fromSchemaType = (
       collectedTypes->Array.push(`enum ${name} {\n  ${valuesStr}\n}`)
     }
     `${name}${bang}`
-  // GraphQL carries the value's shape, not its meaning: a storage ref is a
-  // String on the wire exactly as it is in the event log. The semantic reaches
-  // the UI through the field's JSON Schema, which is the channel that can
-  // express it.
+  // A semantic composite is one named type rather than one per field that uses
+  // it. The name comes from the semantic rather than the field path, so every
+  // plugin emits a byte-identical definition — which is what lets AppSync union
+  // the copies from each source API back into one, the way it already does for
+  // the `Node` / `PageInfo` / `SortOrder` base types.
+  //
+  // GraphQL forbids one name serving as both an object and an input, so the
+  // input position takes an `Input` suffix. Only these types are suffixed:
+  // positionally-named objects can't collide, since their names already carry
+  // the command or read model they belong to.
+  | Semantic({id}, ObjectRef(name, fields)) if SchemaType.canonicalName(id)->Option.isSome =>
+    let typeName = asInput ? name ++ "Input" : name
+    if !(seenTypes->Set.has(typeName)) {
+      seenTypes->Set.add(typeName)
+      let typeDef = objectRefToGraphQL(~asInput, typeName, fields, collectedTypes, seenTypes)
+      collectedTypes->Array.push(typeDef)
+    }
+    `${typeName}${bang}`
+  // Every other semantic carries the value's shape, not its meaning: a storage
+  // ref is a String on the wire exactly as it is in the event log. The semantic
+  // reaches the UI through the field's JSON Schema, which is the channel that
+  // can express it.
   | Semantic(_, inner) => fromSchemaType(~required, ~asInput, inner, collectedTypes, seenTypes)
   | Unknown => `String${bang}`
   }
@@ -187,30 +205,93 @@ let rec scalarOfSchemaType = (st: SchemaType.schemaType): string =>
   | _ => "String"
   }
 
-let deriveServerCapability = (schema: S.t<unknown>): serverCapability => {
+// A `*Id`-suffixed field name, case-sensitively. Deliberately NOT
+// `SchemaType.isIdFieldName`, which lowercases before testing the suffix and so
+// accepts `paid` and `valid` — harmless where it is used, but here it would
+// nominate an ordinary word as a row's key.
+let isKeyFieldName = (name: string): bool =>
+  name->String.length > 2 && name->String.endsWith("Id")
+
+/**
+The field that identifies a row, and which rung answered:
+
+- `"annotation"` — the state declares `@id`. Nothing outranks it.
+- `"convention"` — a field named `<singular entity name>Id` exists
+  (`Products` → `productId`). A guess, but one that can only fire on a field
+  that is actually there.
+- `"sole"` — the state has exactly one `*Id` field, so there is nothing else it
+  could be (`AvailableProducts` → `productId`).
+
+`None` is the honest answer for a state with several `*Id` fields and no name
+match (`ProductDemand`: `productId` + `categoryId`), or with none at all — those
+need `@id`. Convention outranks sole so a view carrying one foreign key and no
+key of its own is not keyed by the foreign key.
+*/
+let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> => {
+  let declared = switch Reventless.StateAnnotations.getSpec(schema) {
+  | Some({ids}) => ids->Array.get(0)
+  | None => None
+  }
+  switch declared {
+  | Some(field) => Some((field, "annotation"))
+  | None =>
+    let candidates =
+      SchemaType.fromSuryObject(~typeName="", schema)
+      ->Option.getOr(Dict.make())
+      ->Dict.keysToArray
+      ->Array.filter(isKeyFieldName)
+    let singular = entityName->Api_Naming.stripViewSuffix->Api_Naming.singularize
+    let conventional =
+      singular->String.slice(~start=0, ~end=1)->String.toLowerCase ++
+      singular->String.slice(~start=1, ~end=singular->String.length) ++ "Id"
+    if candidates->Array.includes(conventional) {
+      Some((conventional, "convention"))
+    } else if candidates->Array.length == 1 {
+      Some((candidates->Array.getUnsafe(0), "sole"))
+    } else {
+      None
+    }
+  }
+}
+
+// The component name the key-field convention is read against. `specName` is the
+// read model's own `Spec.name`; without it, `returnTypeName` minus its plugin
+// prefix is the same string (`Catalog_Product` → `Product`).
+let entityNameOf = (entry: ReventlessInfra.Api.querySchemaEntry): string =>
+  switch entry.specName {
+  | Some(n) => n
+  | None =>
+    switch entry.returnTypeName->String.lastIndexOf("_") {
+    | -1 => entry.returnTypeName
+    | i =>
+      entry.returnTypeName->String.slice(~start=i + 1, ~end=entry.returnTypeName->String.length)
+    }
+  }
+
+let deriveServerCapability = (~entityName: string, schema: S.t<unknown>): serverCapability => {
+  let fieldTypes = SchemaType.fromSuryObject(~typeName="", schema)->Option.getOr(Dict.make())
+  let scalarOf = (fieldName: string): string =>
+    fieldTypes->Dict.get(fieldName)->Option.mapOr("String", scalarOfSchemaType)
+
+  let filterFields: array<filterField> = []
+  let sortFields: array<string> = []
+  let seenFilter: Set.t<string> = Set.make()
+  let seenSort: Set.t<string> = Set.make()
+
+  let pushFilter = (name, ~range) =>
+    if !(seenFilter->Set.has(name)) {
+      seenFilter->Set.add(name)
+      filterFields->Array.push({name, gqlType: scalarOf(name), range})
+    }
+  let pushSort = name =>
+    if !(seenSort->Set.has(name)) {
+      seenSort->Set.add(name)
+      sortFields->Array.push(name)
+    }
+
   switch Reventless.StateAnnotations.getSpec(schema) {
-  | None => emptyCapability
+  | None => ()
   | Some(spec) =>
-    let fieldTypes = SchemaType.fromSuryObject(~typeName="", schema)->Option.getOr(Dict.make())
-    let scalarOf = (fieldName: string): string =>
-      fieldTypes->Dict.get(fieldName)->Option.mapOr("String", scalarOfSchemaType)
-
-    let filterFields: array<filterField> = []
-    let sortFields: array<string> = []
-    let seenFilter: Set.t<string> = Set.make()
-    let seenSort: Set.t<string> = Set.make()
-
-    let pushFilter = (name, ~range) =>
-      if !(seenFilter->Set.has(name)) {
-        seenFilter->Set.add(name)
-        filterFields->Array.push({name, gqlType: scalarOf(name), range})
-      }
-    let pushSort = name =>
-      if !(seenSort->Set.has(name)) {
-        seenSort->Set.add(name)
-        sortFields->Array.push(name)
-      }
-
     spec.ids->Array.forEach(name => {
       pushFilter(name, ~range=false)
       pushSort(name)
@@ -234,9 +315,21 @@ let deriveServerCapability = (schema: S.t<unknown>): serverCapability => {
     // path is needed here.
     spec.scan->Array.forEach(name => pushFilter(name, ~range=false))
     spec.scanSort->Array.forEach(name => pushSort(name))
+  }
 
-    {filterFields, sortFields}
+  // A state that declares nothing structural used to land here with an empty
+  // capability — no per-field filter and no order-by at all, so every narrowing
+  // a client asked for happened client-side over one page. Its key is knowable
+  // without the annotation in the common cases; take it. Pushed last, and both
+  // pushes dedupe, so a declared `@id` keeps its position and this is a no-op.
+  switch resolveKeyField(~entityName, schema) {
+  | Some((field, _rung)) =>
+    pushFilter(field, ~range=false)
+    pushSort(field)
+  | None => ()
   }
+
+  {filterFields, sortFields}
 }
 
 // Returns one warning per `@scanSort` field that is NOT also a sort key of the
@@ -564,7 +657,7 @@ let generate = (
         deriveConnectionTypes(~singularTypeName=entry.returnTypeName)
         ->Array.forEach(t => types->Array.push(t))
       }
-      let capability = deriveServerCapability(entry.stateSchema)
+      let capability = deriveServerCapability(~entityName=entityNameOf(entry), entry.stateSchema)
       let connectionFilterTypeName = entry.returnTypeName ++ "Filter"
       if !(seenTypes->Set.has(connectionFilterTypeName)) {
         seenTypes->Set.add(connectionFilterTypeName)

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Api_Naming$ReventlessCore from "./Api_Naming.res.mjs";
 import * as SchemaType$ReventlessCore from "./SchemaType.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "./GraphQL_Stitcher.res.mjs";
@@ -72,7 +73,20 @@ function fromSchemaType(_required, _asInputOpt, _st, collectedTypes, seenTypes)
           }
           return name$1 + bang;
         case "Semantic" :
-          _st = st._1;
+          let inner = st._1;
+          if (typeof inner === "object" && inner.TAG === "ObjectRef") {
+            let name$2 = inner._0;
+            if (Stdlib_Option.isSome(SchemaType$ReventlessCore.canonicalName(st._0.id))) {
+              let typeName = asInput ? name$2 + "Input" : name$2;
+              if (!seenTypes.has(typeName)) {
+                seenTypes.add(typeName);
+                let typeDef$1 = objectRefToGraphQL(asInput, typeName, inner._1, collectedTypes, seenTypes);
+                collectedTypes.push(typeDef$1);
+              }
+              return typeName + bang;
+            }
+          }
+          _st = inner;
           _asInputOpt = asInput;
           continue;
       }
@@ -172,11 +186,55 @@ function scalarOfSchemaType(_st) {
   };
 }
 
-function deriveServerCapability(schema) {
-  let spec = StateAnnotations$Reventless.getSpec(schema);
-  if (spec === undefined) {
-    return emptyCapability;
+function isKeyFieldName(name) {
+  if (name.length > 2) {
+    return name.endsWith("Id");
+  } else {
+    return false;
+  }
+}
+
+function resolveKeyField(entityName, schema) {
+  let match = StateAnnotations$Reventless.getSpec(schema);
+  let declared = match !== undefined ? match.ids[0] : undefined;
+  if (declared !== undefined) {
+    return [
+      declared,
+      "annotation"
+    ];
+  }
+  let candidates = Object.keys(Stdlib_Option.getOr(SchemaType$ReventlessCore.fromSuryObject("", schema), {})).filter(isKeyFieldName);
+  let singular = Api_Naming$ReventlessCore.singularize(Api_Naming$ReventlessCore.stripViewSuffix(entityName));
+  let conventional = singular.slice(0, 1).toLowerCase() + singular.slice(1, singular.length) + "Id";
+  if (candidates.includes(conventional)) {
+    return [
+      conventional,
+      "convention"
+    ];
+  } else if (candidates.length === 1) {
+    return [
+      candidates[0],
+      "sole"
+    ];
+  } else {
+    return;
+  }
+}
+
+function entityNameOf(entry) {
+  let n = entry.specName;
+  if (n !== undefined) {
+    return n;
+  }
+  let i = entry.returnTypeName.lastIndexOf("_");
+  if (i !== -1) {
+    return entry.returnTypeName.slice(i + 1 | 0, entry.returnTypeName.length);
+  } else {
+    return entry.returnTypeName;
   }
+}
+
+function deriveServerCapability(entityName, schema) {
   let fieldTypes = Stdlib_Option.getOr(SchemaType$ReventlessCore.fromSuryObject("", schema), {});
   let scalarOf = fieldName => Stdlib_Option.mapOr(fieldTypes[fieldName], "String", scalarOfSchemaType);
   let filterFields = [];
@@ -201,26 +259,35 @@ function deriveServerCapability(schema) {
       return;
     }
   };
-  spec.ids.forEach(name => {
-    pushFilter(name, false);
-    pushSort(name);
-  });
-  spec.compositeIds.forEach(name => pushFilter(name, false));
-  spec.subIds.forEach(name => {
-    pushFilter(name, true);
-    pushSort(name);
-  });
-  spec.compositeSubIds.forEach(name => {
-    pushFilter(name, true);
-    pushSort(name);
-  });
-  spec.indexes.forEach(param => {
-    let name = param[0];
-    pushFilter(name, false);
-    pushSort(name);
-  });
-  spec.scan.forEach(name => pushFilter(name, false));
-  spec.scanSort.forEach(pushSort);
+  let spec = StateAnnotations$Reventless.getSpec(schema);
+  if (spec !== undefined) {
+    spec.ids.forEach(name => {
+      pushFilter(name, false);
+      pushSort(name);
+    });
+    spec.compositeIds.forEach(name => pushFilter(name, false));
+    spec.subIds.forEach(name => {
+      pushFilter(name, true);
+      pushSort(name);
+    });
+    spec.compositeSubIds.forEach(name => {
+      pushFilter(name, true);
+      pushSort(name);
+    });
+    spec.indexes.forEach(param => {
+      let name = param[0];
+      pushFilter(name, false);
+      pushSort(name);
+    });
+    spec.scan.forEach(name => pushFilter(name, false));
+    spec.scanSort.forEach(pushSort);
+  }
+  let match = resolveKeyField(entityName, schema);
+  if (match !== undefined) {
+    let field = match[0];
+    pushFilter(field, false);
+    pushSort(field);
+  }
   return {
     filterFields: filterFields,
     sortFields: sortFields
@@ -435,7 +502,7 @@ function generate(mutationEntries, queryEntries) {
           types.push(t);
         });
       }
-      let capability = deriveServerCapability(entry.stateSchema);
+      let capability = deriveServerCapability(entityNameOf(entry), entry.stateSchema);
       let connectionFilterTypeName = entry.returnTypeName + "Filter";
       if (!seenTypes.has(connectionFilterTypeName)) {
         seenTypes.add(connectionFilterTypeName);
@@ -491,6 +558,9 @@ export {
   deriveSubIdFilterType,
   emptyCapability,
   scalarOfSchemaType,
+  isKeyFieldName,
+  resolveKeyField,
+  entityNameOf,
   deriveServerCapability,
   validateScanSortAlignment,
   deriveConnectionFilterType,
@@ -503,4 +573,4 @@ export {
   deriveMutationFieldFromObject,
   generate,
 }
-/* SchemaType-ReventlessCore Not a pure module */
+/* Api_Naming-ReventlessCore Not a pure module */

package/src/components/Api/OwnerScopeDiagnostics.res

@@ -0,0 +1,54 @@
+// The one thing a deployment can get wrong about `@owner` without anything
+// failing.
+//
+// `OwnerScope.elevatedGroups` defaults to `[]`, which is the safe default: it
+// scopes everybody rather than exempting somebody by accident. But a deployment
+// that never calls `setElevatedGroups` gets that default silently, and then
+// *administrators are scoped too* — an operator opening an owner-scoped view
+// sees only the rows they happen to own.
+//
+// Nothing errors, and it is invisible from outside: an operator whose elevated
+// list is empty and an operator who genuinely owns nothing produce the identical
+// empty page. That is the same unfalsifiability that makes a denied read
+// indistinguishable from an empty one, arriving by a different route — so it is
+// worth a line at registration rather than a support ticket later.
+//
+// Lives in core rather than in each adapter so the rule and its wording are
+// stated once. Local and AWS both register owner-scoped views; two copies of
+// this check would be two chances to word the consequence differently, or to
+// fix one and not the other.
+
+let log = Logger.fromEnv()
+
+// Warned once per read model. Resolver registration can run more than once in a
+// process (tests build several platforms; a deploy walks every plugin), and a
+// warning repeated per construction is a warning people learn to scroll past.
+let warned: Set.t<string> = Set.make()
+
+/**
+Warn when `view` declares an `@owner` field but no group is exempt from scoping.
+
+`~comp` names the calling adapter so the line points at the transport it came
+from. Silent when the view declares no owner, and silent once the deployment has
+configured any elevated group — this is a "you probably forgot" signal, not a
+policy about which groups are correct.
+*/
+let warnIfNoElevatedGroups = (~comp: string, ~view: string, ~ownerField: option<string>) =>
+  switch ownerField {
+  | Some(field) if Reventless.OwnerScope.elevatedGroups()->Array.length == 0 =>
+    if !(warned->Set.has(view)) {
+      warned->Set.add(view)
+      log.warn(
+        ~comp,
+        `${view}: "${field}" is declared @owner, but no elevated groups are configured. ` ++
+        "Every caller — administrators included — will see only their own rows. " ++
+        "Call OwnerScope.setElevatedGroups([...]) before components are built, or set " ++
+        "REVENTLESS_ELEVATED_GROUPS — the environment is what reaches a deployment's " ++
+        "separate function runtimes, which a call in the deploy program does not.",
+      )
+    }
+  | _ => ()
+  }
+
+/** Test seam: forget what has already been warned about. */
+let resetWarnings = () => warned->Set.clear

package/src/components/Api/OwnerScopeDiagnostics.res.mjs

@@ -0,0 +1,27 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let warned = new Set();
+
+function warnIfNoElevatedGroups(comp, view, ownerField) {
+  if (ownerField !== undefined && OwnerScope$Reventless.elevatedGroups().length === 0 && !warned.has(view)) {
+    warned.add(view);
+    return log.warn(comp, undefined, view + `: "` + ownerField + `" is declared @owner, but no elevated groups are configured. ` + "Every caller — administrators included — will see only their own rows. Call OwnerScope.setElevatedGroups([...]) before components are built, or set REVENTLESS_ELEVATED_GROUPS — the environment is what reaches a deployment's separate function runtimes, which a call in the deploy program does not.");
+  }
+}
+
+function resetWarnings() {
+  warned.clear();
+}
+
+export {
+  log,
+  warned,
+  warnIfNoElevatedGroups,
+  resetWarnings,
+}
+/* log Not a pure module */

package/src/components/Api/QueryDbListQuery.res

@@ -71,15 +71,32 @@ let buildConnection = (
 }
 
 // Compute the Relay connection response (edges + pageInfo) for `items` under the
-// GraphQL args. `decodeLocalId` maps a possibly-Relay-encoded id to its local id
-// (the resolver passes DomainGraphQL_Server.decodeGlobalId); everything else is
-// pure over the item array.
+// GraphQL args. `decodeLocalId` maps a possibly-Relay-encoded id to its local id;
+// it defaults to the shared rule so every caller applies the same one — the AWS
+// Lambda used to pass a no-op here, which silently made `filter.ids` reject a
+// global id on that provider only. Everything else is pure over the item array.
+// `ownerScope` is `(fieldName, requiredValue)`, and it is deliberately NOT read
+// out of `argsDict`. Two reasons, both fatal to the obvious alternative of
+// injecting `filter.<owner>Eq`:
+//
+//   - the owner field usually is not in `capability.filterFields` at all (it is
+//     admitted only by `@id` / `@index` / `@scan` and friends), so there is no
+//     filter input to inject into; and
+//   - `filter` is the caller's own argument. A predicate that decides what the
+//     caller may see must arrive on a channel the caller cannot name or
+//     overwrite.
+//
+// It joins the same `filtered` pass as everything else, which puts it BEFORE
+// ordering and pagination. Narrowing a materialised page afterwards would return
+// short pages with valid-looking cursors — a bug that reads as "the list
+// sometimes ends early" rather than as an access-control fault.
 let run = (
   ~items: array<JSON.t>,
   ~argsDict: Dict.t<JSON.t>,
   ~capability: GraphQL_FragmentGenerator.serverCapability,
   ~labelField: string,
-  ~decodeLocalId: string => option<string>,
+  ~decodeLocalId: string => option<string>=Api_Ids.toLocalId,
+  ~ownerScope: option<(string, string)>=?,
 ): JSON.t => {
   let filterDict =
     argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
@@ -145,15 +162,30 @@ let run = (
       getLabel(item)->String.toLowerCase->String.startsWith(p->String.toLowerCase)
     | _ => true
     }
+    // Either id form matches, in both directions: the argument may be a Relay
+    // global id while the row carries its storage key (the normal case — every
+    // door but `node` reports the storage key), and the row may carry a global id
+    // where some caller stamped one. Decoding only the row's id, as this did,
+    // covered just the second.
     let passIds = switch ids {
     | Some(idList) if idList->Array.length > 0 =>
       let itemId = getId(item)
       let itemLocalId = decodeLocalId(itemId)
-      idList->Array.some(i => i == itemId || itemLocalId == Some(i))
+      idList->Array.some(i =>
+        i == itemId || itemLocalId == Some(i) || decodeLocalId(i) == Some(itemId)
+      )
     | _ => true
     }
     let passPerField = perFieldChecks->Array.every(check => check(item))
-    passSearch && passPrefix && passIds && passPerField
+    // A row that does not state an owner never matches a scoped read. Treating a
+    // missing field as "belongs to everyone" would expose exactly the rows that
+    // predate the annotation, which are the ones nobody remembers to check.
+    let passOwner = switch ownerScope {
+    | Some((field, required)) =>
+      getFieldString(item, field)->Option.mapOr(false, v => v == required)
+    | None => true
+    }
+    passSearch && passPrefix && passIds && passPerField && passOwner
   })
 
   let orderByDict = argsDict->Dict.get("orderBy")->Option.flatMap(JSON.Decode.object)

package/src/components/Api/QueryDbListQuery.res.mjs

@@ -5,6 +5,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Api_Ids$ReventlessCore from "./Api_Ids.res.mjs";
 
 function encodeCursor(value) {
   return btoa(value);
@@ -47,7 +48,8 @@ function buildConnection(pageItems, hasNextPage, hasPreviousPage, cursorValueOf)
   };
 }
 
-function run(items, argsDict, capability, labelField, decodeLocalId) {
+function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerScope) {
+  let decodeLocalId = decodeLocalIdOpt !== undefined ? decodeLocalIdOpt : Api_Ids$ReventlessCore.toLocalId;
   let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
   let search = Stdlib_Option.flatMap(filterDict["search"], Stdlib_JSON.Decode.string);
   let searchPrefix = Stdlib_Option.flatMap(filterDict["searchPrefix"], Stdlib_JSON.Decode.string);
@@ -83,18 +85,25 @@ function run(items, argsDict, capability, labelField, decodeLocalId) {
       let itemId = getId(item);
       let itemLocalId = decodeLocalId(itemId);
       passIds = ids.some(i => {
-        if (i === itemId) {
+        if (i === itemId || Primitive_object.equal(itemLocalId, i)) {
           return true;
         } else {
-          return Primitive_object.equal(itemLocalId, i);
+          return Primitive_object.equal(decodeLocalId(i), itemId);
         }
       });
     } else {
       passIds = true;
     }
     let passPerField = perFieldChecks.every(check => check(item));
-    if (passSearch && passPrefix && passIds) {
-      return passPerField;
+    let passOwner;
+    if (ownerScope !== undefined) {
+      let required = ownerScope[1];
+      passOwner = Stdlib_Option.mapOr(getFieldString(item, ownerScope[0]), false, v => v === required);
+    } else {
+      passOwner = true;
+    }
+    if (passSearch && passPrefix && passIds && passPerField) {
+      return passOwner;
     } else {
       return false;
     }

package/src/components/Api/SchemaType.res

@@ -32,8 +32,34 @@ let isIdsFieldName = (name: string): bool => {
   len > 3 && String.endsWith(lower, "ids")
 }
 
+/**
+The GraphQL type name a semantic **composite** is emitted under.
+
+The branded scalars are absent on purpose: they refine a `string` or a number
+without changing its shape, so each is already a `String` or a `Float` in GraphQL
+and has no definition that could be duplicated. Only the semantics that turn a
+field into an object or an enum need a name of their own — without one, the same
+type is emitted once per *field* that uses it, under the field path that reached
+it (`Catalog_AddProductPriceCurrency`, `Ordering_SyncNewProductPriceCurrency`, …
+six copies of ISO 4217 in one example schema).
+
+Naming them is what makes the definitions identical across plugins, which is the
+property merged-API composition needs: AppSync unions same-named types from
+different source APIs, and a union of identical definitions is that definition.
+The `Node` / `PageInfo` / `SortOrder` base types already rely on exactly this.
+*/
+let semanticCompositeNames = [
+  (Reventless.Semantic.Id.money, "Money"),
+  (Reventless.Semantic.Id.dateRange, "DateRange"),
+  (Reventless.Semantic.Id.geoPoint, "GeoPoint"),
+]
+
+let canonicalName = (id: string): option<string> =>
+  semanticCompositeNames
+  ->Array.find(((semanticId, _)) => semanticId == id)
+  ->Option.map(((_, name)) => name)
+
 let rec fromSury = (~parentName: string, ~fieldName: string, schema: S.t<unknown>): schemaType => {
-  let shape = shapeOf(~parentName, ~fieldName, schema)
   // Semantics the IR already has a dedicated shape for keep it: `dateTime` and
   // `reference` are read below via `isDateTime` / `getTarget`, both of which now
   // consult the generic marker, and their `format` output is a published
@@ -42,8 +68,16 @@ let rec fromSury = (~parentName: string, ~fieldName: string, schema: S.t<unknown
   switch Reventless.Semantic.get(schema) {
   | Some({id} as sem)
     if id !== Reventless.Semantic.Id.dateTime && id !== Reventless.Semantic.Id.reference =>
+    // A composite is one type wherever it appears, so its shape is walked under
+    // its own name rather than under the field path that reached it. That
+    // renames what is nested inside it too — `Money`'s currency enum becomes
+    // `MoneyCurrency` for every field, rather than one enum per price field.
+    let shape = switch canonicalName(id) {
+    | Some(name) => shapeOf(~parentName=name, ~fieldName="", schema)
+    | None => shapeOf(~parentName, ~fieldName, schema)
+    }
     Semantic(sem, shape)
-  | _ => shape
+  | _ => shapeOf(~parentName, ~fieldName, schema)
   }
 }