@reventlessdev/reventless-local 3.0.0-alpha.223 → 3.0.0-alpha.225

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.225 (2026-08-16)
+
+### Bug Fixes
+
+* **seed:** let seed:reset take the yes it asks for ([1f646f6](https://github.com/ReventlessDev/reventless-core/commit/1f646f6ce13a4238e92b7047ee31650ccc4de4f3))
+### Features
+
+* **core:** exclude retired rows from reads a caller may not widen ([662f31a](https://github.com/ReventlessDev/reventless-core/commit/662f31abb717bda5154199d349da6dcf8e2d3e78))
+* **core:** let [@retired](https://github.com/retired) name a lifecycle state, not only a boolean ([6bb346b](https://github.com/ReventlessDev/reventless-core/commit/6bb346b4f6a5f33826fc24537953482a76067177))
+* **core:** mark the state that retires a row, and allow more than one ([cb1461f](https://github.com/ReventlessDev/reventless-core/commit/cb1461f024d3ca3b53fd9c8b010a054e3fcc4555))
+* **core:** withhold a retired row's payload from the live channel ([82c62db](https://github.com/ReventlessDev/reventless-core/commit/82c62db00b87f7135378496e36601b544d4d2b62))
+* **spec:** [@retired](https://github.com/retired) state-field annotation and its schema emission ([2d8234b](https://github.com/ReventlessDev/reventless-core/commit/2d8234b6b3dd8f479031a67eb5b4b47b5c0c2ff9))
+
+
+# 3.0.0-alpha.224 (2026-08-15)
+
+### Features
+
+* **aws:** serve one baked manifest per journey ([16d6307](https://github.com/ReventlessDev/reventless-core/commit/16d63071f059cf1fc7025f9be9206dda51f71053))
+
+
 # 3.0.0-alpha.223 (2026-08-15)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.223",
+  "version": "3.0.0-alpha.225",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -35,23 +35,23 @@
     "sury": "11.0.0-alpha.4",
     "ws": "^8.18.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.7",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.83",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.182",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.142",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.99",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.235",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.14",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.114"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.237",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.143",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.85",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.184",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.101",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.115",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.15"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-alpha.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.66"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.67"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/BakedManifest.res

@@ -9,50 +9,24 @@
 
 let log = ReventlessCore.Logger.fromEnv()
 
-/**
- A declared bake writes the file or fails loudly. Both failure modes it can hit
- are the deployment's own mistake — a name that matches no component, or a shell
- package that is not installed — and both produce the same symptom if swallowed:
- a shop that renders nothing, with no line in the log saying why.
- */
-let toSelections = (
-  components: array<ReventlessInfra.Platform.bakedManifestSelection>,
-): array<ReventlessCore.Platform_BakedManifest.selection> =>
-  components->Array.map((s): ReventlessCore.Platform_BakedManifest.selection => {
-    plugin: s.plugin,
-    views: s.views,
-    commands: s.commands,
-    derived: s.derived,
-  })
-
 /**
  Every file this declaration produces, as (key, selections) pairs.
 
- The default journey first, then one per declared journey. Separate from the
- write so the whole set is reachable from a test — the same reason
- `ShellConfig.overlay` exists apart from its write.
+ The resolution itself is `Platform_BakedManifest.files`, shared with the deploy
+ for the reason the curation is: the key a file is written under and the URL a
+ shell fetches it from have to be the same string on either platform.
  */
 let files = (
   ~config: ReventlessInfra.Platform.bakedManifest,
-): array<(string, array<ReventlessCore.Platform_BakedManifest.selection>)> => {
-  let base = [
-    (
-      config.key->Option.getOr(ReventlessCore.Platform_BakedManifest.defaultKey),
-      toSelections(config.components),
-    ),
-  ]
-  switch config.journeys {
-  | None => base
-  | Some(journeys) =>
-    base->Array.concat(
-      journeys->Array.map(j => (
-        j.key->Option.getOr(ReventlessCore.Platform_BakedManifest.journeyKey(~group=j.group)),
-        toSelections(j.components),
-      )),
-    )
-  }
-}
+): array<(string, array<ReventlessCore.Platform_BakedManifest.selection>)> =>
+  ReventlessCore.Platform_BakedManifest.files(~config)
 
+/**
+ A declared bake writes the files or fails loudly. Both failure modes it can hit
+ are the deployment's own mistake — a name that matches no component, or a shell
+ package that is not installed — and both produce the same symptom if swallowed:
+ a shop that renders nothing, with no line in the log saying why.
+ */
 let emit = (
   ~structures: array<(string, Reventless.Plugin.pluginStructure)>,
   ~config: ReventlessInfra.Platform.bakedManifest,

package/src/BakedManifest.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Nodefs from "node:fs";
 import * as Nodepath from "node:path";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as HostShellDist$ReventlessLocal from "./HostShellDist.res.mjs";
@@ -10,33 +9,10 @@ import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventles
 
 let log = Logger$ReventlessCore.fromEnv();
 
-function toSelections(components) {
-  return components.map(s => ({
-    plugin: s.plugin,
-    views: s.views,
-    commands: s.commands,
-    derived: s.derived
-  }));
-}
-
-function files(config) {
-  let base = [[
-      Stdlib_Option.getOr(config.key, Platform_BakedManifest$ReventlessCore.defaultKey),
-      toSelections(config.components)
-    ]];
-  let journeys = config.journeys;
-  if (journeys !== undefined) {
-    return base.concat(journeys.map(j => [
-      Stdlib_Option.getOr(j.key, Platform_BakedManifest$ReventlessCore.journeyKey(j.group)),
-      toSelections(j.components)
-    ]));
-  } else {
-    return base;
-  }
-}
+let files = Platform_BakedManifest$ReventlessCore.files;
 
 function emit(structures, config) {
-  let outputs = files(config);
+  let outputs = Platform_BakedManifest$ReventlessCore.files(config);
   let curated = outputs.map(param => {
     let e = Platform_BakedManifest$ReventlessCore.curate(structures, param[1]);
     let tmp;
@@ -62,7 +38,6 @@ function emit(structures, config) {
 
 export {
   log,
-  toSelections,
   files,
   emit,
 }

package/src/ShellConfig.res

@@ -61,26 +61,16 @@ let overlay = (
     // Omitted entirely when nothing is declared, so a single-audience deployment
     // writes the same key set it always did and a shell that has never heard of
     // journeys sees no new keys.
-    switch config.journeys {
-    | None => ()
-    | Some([]) => ()
-    | Some(journeys) =>
-      let map = Dict.make()
-      journeys->Array.forEach(j =>
-        map->Dict.set(
-          j.group,
-          JSON.Encode.string(
-            ReventlessCore.Platform_BakedManifest.urlForKey(
-              Some(
-                j.key->Option.getOr(
-                  ReventlessCore.Platform_BakedManifest.journeyKey(~group=j.group),
-                ),
-              ),
-            ),
-          ),
-        )
+    switch ReventlessCore.Platform_BakedManifest.journeyUrls(~config) {
+    | [] => ()
+    | urls =>
+      out->Dict.set(
+        journeyManifestsKey,
+        urls
+        ->Array.map(((group, url)) => (group, JSON.Encode.string(url)))
+        ->Dict.fromArray
+        ->JSON.Encode.object,
       )
-      out->Dict.set(journeyManifestsKey, map->JSON.Encode.object)
     }
   })
 

package/src/ShellConfig.res.mjs

@@ -31,18 +31,14 @@ function overlay(bakedManifest, shellConfig) {
   let out = {};
   Stdlib_Option.forEach(bakedManifest, config => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(config.key);
-    let journeys = config.journeys;
-    if (journeys === undefined) {
+    let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(config);
+    if (urls.length !== 0) {
+      out[journeyManifestsKey] = Object.fromEntries(urls.map(param => [
+        param[0],
+        param[1]
+      ]));
       return;
     }
-    if (journeys.length === 0) {
-      return;
-    }
-    let map = {};
-    journeys.forEach(j => {
-      map[j.group] = Platform_BakedManifest$ReventlessCore.urlForKey(Stdlib_Option.getOr(j.key, Platform_BakedManifest$ReventlessCore.journeyKey(j.group)));
-    });
-    out[journeyManifestsKey] = map;
   });
   Stdlib_Option.forEach(shellConfig, extra => {
     let collisions = Object.keys(extra).filter(k => computedKeys.includes(k));

package/src/adapter/LocalBus.res

@@ -133,6 +133,7 @@ module type T = {
       ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
       ~ownerScope: (string, string)=?,
+      ~retiredScope: Reventless.OwnerScope.retiredScope=?,
     ) => option<JSON.t>,
   ) => unit
   let getQueryDbListPage: string => option<
@@ -141,6 +142,7 @@ module type T = {
       ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
       ~ownerScope: (string, string)=?,
+      ~retiredScope: Reventless.OwnerScope.retiredScope=?,
     ) => option<JSON.t>,
   >
 
@@ -238,6 +240,7 @@ module Impl = (C: BusConfig): T => {
         ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
         ~labelField: string,
         ~ownerScope: (string, string)=?,
+        ~retiredScope: Reventless.OwnerScope.retiredScope=?,
       ) => option<JSON.t>,
     >,
   > = ref(Dict.make())

package/src/adapter/LocalStateChangeDescriptor.res

@@ -27,6 +27,19 @@
     tell it nothing. */
 let maxStateChars = 60 * 1024
 
+/** The `@retired` field of a registered read model, or `None`.
+
+    Looked up by view name rather than passed down from the storage's
+    construction, for the reason the resolvers look it up per request: a storage
+    is built before every plugin's state schema is necessarily registered, and a
+    lookup that missed at construction would publish payloads for the rest of
+    the process. */
+let retiredSpecFor = (name: string): option<Reventless.StateAnnotations.retiredSpec> =>
+  ReventlessCore.Plugin_Helpers.stateSchemaRegistry
+  ->Dict.get(name)
+  ->Option.flatMap(Reventless.StateAnnotations.getSpec)
+  ->Option.flatMap(spec => spec.retired)
+
 let pickSortKeyValue = (state: JSON.t): option<string> =>
   switch state->JSON.Decode.object {
   | Some(obj) =>
@@ -68,16 +81,47 @@ let nextSequence = (): string => {
     - `state`: the resulting row for save(); `None` for delete(), which has no new
       row — the descriptor then omits both `state` and `sortKeyValue`.
     - `seq`: monotonic ordering token, from `nextSequence`. */
-let make = (~changeKind: string, ~id: string, ~state: option<JSON.t>, ~seq: string): JSON.t => {
+let make = (
+  ~changeKind: string,
+  ~id: string,
+  ~state: option<JSON.t>,
+  ~seq: string,
+  ~retiredField: option<string>=?,
+  ~retiredValues: option<array<string>>=?,
+): JSON.t => {
   let descriptor = Dict.make()
   descriptor->Dict.set("changeKind", JSON.Encode.string(changeKind))
   descriptor->Dict.set("id", JSON.Encode.string(id))
-  switch state->Option.flatMap(pickSortKeyValue) {
+  // Whether the row this descriptor announces has been withdrawn from ordinary
+  // reads. A publish cannot be scoped per subscriber — the channel is keyed by
+  // list field and entity, and everyone watching the view receives it — so a
+  // payload here would hand the row to exactly the callers the resolvers just
+  // refused it to.
+  // Both forms of `@retired` are the one question `isRetiredValue` answers, so
+  // nothing here branches on which the view declared.
+  let isRetired = switch (retiredField, state) {
+  | (Some(field), Some(s)) =>
+    {Reventless.OwnerScope.field, values: retiredValues}->Reventless.OwnerScope.isRetiredValue(
+      s->JSON.Decode.object->Option.flatMap(d => d->Dict.get(field)),
+    )
+  | _ => false
+  }
+  // Dropped along with the payload, not just the payload: the sort value is a
+  // timestamp off a row the subscriber may not read, and a subscriber without
+  // one is conservative rather than wrong — it refetches instead of deciding
+  // which page the row belongs on.
+  switch isRetired ? None : state->Option.flatMap(pickSortKeyValue) {
   | Some(v) => descriptor->Dict.set("sortKeyValue", JSON.Encode.string(v))
   | None => ()
   }
   descriptor->Dict.set("seq", JSON.Encode.string(seq))
   switch state {
+  // `Updated` with no payload is the shape this already emits for an oversized
+  // row, and it means the same thing to a client: refetch and let the query
+  // layer answer. Deliberately not `Removed` — the row is not gone, and saying
+  // so would be false for an elevated subscriber reading with `includeRetired`
+  // and false again the moment the row is restored.
+  | Some(_) if isRetired => ()
   | Some(s) =>
     let encoded = s->JSON.stringify
     if encoded->String.length <= maxStateChars {

package/src/adapter/LocalStateChangeDescriptor.res.mjs

@@ -2,6 +2,13 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
+import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+
+function retiredSpecFor(name) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name], StateAnnotations$Reventless.getSpec), spec => spec.retired);
+}
 
 function pickSortKeyValue(state) {
   let obj = Stdlib_JSON.Decode.object(state);
@@ -29,16 +36,20 @@ function nextSequence() {
   return next.toString();
 }
 
-function make(changeKind, id, state, seq) {
+function make(changeKind, id, state, seq, retiredField, retiredValues) {
   let descriptor = {};
   descriptor["changeKind"] = changeKind;
   descriptor["id"] = id;
-  let v = Stdlib_Option.flatMap(state, pickSortKeyValue);
+  let isRetired = retiredField !== undefined && state !== undefined ? OwnerScope$Reventless.isRetiredValue({
+      field: retiredField,
+      values: retiredValues
+    }, Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(state), d => d[retiredField])) : false;
+  let v = isRetired ? undefined : Stdlib_Option.flatMap(state, pickSortKeyValue);
   if (v !== undefined) {
     descriptor["sortKeyValue"] = v;
   }
   descriptor["seq"] = seq;
-  if (state !== undefined) {
+  if (state !== undefined && !isRetired) {
     let encoded = JSON.stringify(state);
     if (encoded.length <= 61440) {
       descriptor["state"] = state;
@@ -53,9 +64,10 @@ let maxStateChars = 61440;
 
 export {
   maxStateChars,
+  retiredSpecFor,
   pickSortKeyValue,
   lastSequence,
   nextSequence,
   make,
 }
-/* No side effect */
+/* OwnerScope-Reventless Not a pure module */

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res

@@ -180,6 +180,54 @@ module Make = (Bus: LocalBus.T) => {
         ->Option.mapOr(false, v => v == required)
       }
 
+    // ── Retirement narrowing ─────────────────────────────────────────────────
+    // The same two forms as owner scoping above, for the same reason: a door
+    // that narrows the page and a door that hands back one row both have to ask.
+    // Read per request for the same reason too.
+    let retiredSpecOf = () =>
+      Plugin_Helpers.stateSchemaRegistry
+      ->Dict.get(name)
+      ->Option.flatMap(Reventless.StateAnnotations.getSpec)
+      ->Option.flatMap(spec => spec.retired)
+
+    // `includeRetired` is the caller asking; `decideRetired` decides whether the
+    // asking counts. Read here rather than inside the decision so the argument
+    // stays an argument — the door reports what was asked, the classifier says
+    // who may be answered.
+    let askedForRetired = (~args) =>
+      args
+      ->JSON.Decode.object
+      ->Option.flatMap(d => d->Dict.get("includeRetired"))
+      ->Option.flatMap(JSON.Decode.bool)
+      ->Option.getOr(false)
+
+    let retiredDecision = (~ctx, ~args) =>
+      extractIdentity(ctx)->Reventless.OwnerScope.decideRetired(
+        ~retiredField=retiredSpecOf()->Option.map(r => r.field),
+        ~retiredValues=?retiredSpecOf()->Option.flatMap(r => r.values),
+        ~asked=askedForRetired(~args),
+      )
+
+    let retiredScopeFor = (~ctx, ~args) =>
+      retiredDecision(~ctx, ~args)->Reventless.OwnerScope.retiredScopeOf
+
+    // Post-read form. The single-row and by-ids doors are where a filtered list
+    // would otherwise be walked around: a pasted URL, or a reference resolved
+    // from another row, reaches the entity directly.
+    let retiredAllows = (~ctx, ~args, item: JSON.t) =>
+      switch retiredScopeFor(~ctx, ~args) {
+      | None => true
+      // Absent keeps the row, matching `QueryDbListQuery`: a row written before
+      // the annotation existed is not retired. Which of the two forms decides
+      // that is `isRetiredValue`'s question, not this door's.
+      | Some(scope) =>
+        !(
+          scope->Reventless.OwnerScope.isRetiredValue(
+            item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(scope.field)),
+          )
+        )
+      }
+
     let cap = s => s->String.charAt(0)->String.toUpperCase ++ s->String.slice(~start=1)
 
     // Resolve query field names: check registry first, fall back to safe defaults.
@@ -260,7 +308,8 @@ module Make = (Bus: LocalBus.T) => {
           // A row the caller does not own answers as though it were not there.
           // Distinguishing "not yours" from "not found" here would turn this door
           // into an oracle for which ids exist.
-          | Some(item) if !ownerAllows(~ctx, item) => JSON.Encode.null
+          | Some(item) if !ownerAllows(~ctx, item) || !retiredAllows(~ctx, ~args, item) =>
+            JSON.Encode.null
           | Some(item) =>
             if includeIdParam {
               // Copied — `JSON.Decode.object` hands back the stored object itself,
@@ -327,7 +376,7 @@ module Make = (Bus: LocalBus.T) => {
               loaded
               ->Array.filterMap(((id, opt)) =>
                 opt
-                ->Option.filter(item => ownerAllows(~ctx, item))
+                ->Option.filter(item => ownerAllows(~ctx, item) && retiredAllows(~ctx, ~args, item))
                 ->Option.map(item => {
                   let obj = item->JSON.Decode.object->Option.mapOr(Dict.make(), Dict.copy)
                   obj->Dict.set("id", JSON.Encode.string(id))
@@ -411,6 +460,11 @@ module Make = (Bus: LocalBus.T) => {
           | RefuseOwned => emptyConnection
           | decision =>
             let ownerScope = Reventless.OwnerScope.scopeOf(decision)
+            // Same both-arms rule as `ownerScope`, and the same reason it is
+            // spelled out: this predicate decides what the caller may see, so a
+            // push-down that did not receive it would serve the archive to
+            // everyone on the path that is hardest to notice.
+            let retiredScope = retiredScopeFor(~ctx, ~args)
             let argsDict = args->JSON.Decode.object->Option.getOr(Dict.make())
             // Prefer a backend list push-down (SQLite builds json_extract predicates
             // + ORDER BY … LIMIT so it never materialises the whole read model). When
@@ -427,7 +481,7 @@ module Make = (Bus: LocalBus.T) => {
               DomainGraphQL_Server.decodeGlobalId(id)->Option.map(((_, lid)) => lid)
             switch Bus.getQueryDbListPage(name) {
             | Some(listPage) =>
-              switch listPage(~argsDict, ~capability, ~labelField, ~ownerScope?) {
+              switch listPage(~argsDict, ~capability, ~labelField, ~ownerScope?, ~retiredScope?) {
               | Some(conn) => conn
               | None =>
                 let items = await fetchAllItems()
@@ -438,6 +492,7 @@ module Make = (Bus: LocalBus.T) => {
                   ~labelField,
                   ~decodeLocalId,
                   ~ownerScope?,
+                  ~retiredScope?,
                 )
               }
             | None =>
@@ -449,6 +504,7 @@ module Make = (Bus: LocalBus.T) => {
                 ~labelField,
                 ~decodeLocalId,
                 ~ownerScope?,
+                ~retiredScope?,
               )
             }
           }
@@ -466,7 +522,8 @@ module Make = (Bus: LocalBus.T) => {
           // The legacy shape has no push-down to reach, so the narrowing is a plain
           // filter here. `scannedCount` counts what is returned, not what was read:
           // the pre-scoping total would tell a caller how many rows they may not see.
-          let items = all->Array.filter(item => ownerAllows(~ctx, item))
+          let items =
+            all->Array.filter(item => ownerAllows(~ctx, item) && retiredAllows(~ctx, ~args, item))
           Obj.magic({"nextToken": Nullable.null, "scannedCount": items->Array.length, "items": items})
         }
       }
@@ -531,7 +588,10 @@ module Make = (Bus: LocalBus.T) => {
             // Narrowed here, before the cursor window and the sort-key filter, so
             // every page this door emits is a page of rows the caller owns. Doing
             // it after would hand back short pages with valid cursors.
-            let allItems = loaded->Array.filter(item => ownerAllows(~ctx, item))
+            let allItems =
+              loaded->Array.filter(item =>
+                ownerAllows(~ctx, item) && retiredAllows(~ctx, ~args, item)
+              )
 
             // Cursor-keyed filtering: exclude items on the cursor side of the boundary
             let cursorFiltered = if isBackward {
@@ -624,7 +684,8 @@ module Make = (Bus: LocalBus.T) => {
             // push-down and the scan are two ways to reach the same rows, and a
             // narrowing that lives in only one is a hole that appears when a
             // backend gains or loses an index.
-            let scoped = rows => rows->Array.filter(item => ownerAllows(~ctx, item))
+            let scoped = rows =>
+              rows->Array.filter(item => ownerAllows(~ctx, item) && retiredAllows(~ctx, ~args, item))
             // Prefer the pushed-down equality lookup (SQLite rides the GSI index;
             // in-memory reuses its lazy snapshot). Fall back to scan+filter only
             // if no lookup is registered for this QueryDb.

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res.mjs

@@ -11,6 +11,7 @@ import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/I
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
+import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as SortKey_Filter$ReventlessLocal from "./SortKey_Filter.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
@@ -100,6 +101,17 @@ function Make(Bus) {
       let field = match._0;
       return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]), Stdlib_JSON.Decode.string), false, v => v === required);
     };
+    let retiredSpecOf = () => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name], StateAnnotations$Reventless.getSpec), spec => spec.retired);
+    let askedForRetired = args => Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(args), d => d["includeRetired"]), Stdlib_JSON.Decode.bool), false);
+    let retiredDecision = (ctx, args) => OwnerScope$Reventless.decideRetired(extractIdentity(ctx), Stdlib_Option.map(retiredSpecOf(), r => r.field), Stdlib_Option.flatMap(retiredSpecOf(), r => r.values), askedForRetired(args), undefined);
+    let retiredAllows = (ctx, args, item) => {
+      let scope = OwnerScope$Reventless.retiredScopeOf(retiredDecision(ctx, args));
+      if (scope !== undefined) {
+        return !OwnerScope$Reventless.isRetiredValue(scope, Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[scope.field]));
+      } else {
+        return true;
+      }
+    };
     let cap = s => s.charAt(0).toUpperCase() + s.slice(1);
     let registryEntry = Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name];
     let singleQueryName = registryEntry !== undefined ? registryEntry.singleFieldName : name.charAt(0).toLowerCase() + name.slice(1);
@@ -139,7 +151,7 @@ function Make(Bus) {
       if (item === undefined) {
         return null;
       }
-      if (!ownerAllows(ctx, item)) {
+      if (!ownerAllows(ctx, item) || !retiredAllows(ctx, args, item)) {
         return null;
       }
       if (!includeIdParam) {
@@ -186,7 +198,13 @@ function Make(Bus) {
         }));
         return Stdlib_Array.filterMap(loaded, param => {
           let id = param[0];
-          return Stdlib_Option.map(Stdlib_Option.filter(param[1], item => ownerAllows(ctx, item)), item => {
+          return Stdlib_Option.map(Stdlib_Option.filter(param[1], item => {
+            if (ownerAllows(ctx, item)) {
+              return retiredAllows(ctx, args, item);
+            } else {
+              return false;
+            }
+          }), item => {
             let obj = Stdlib_Option.mapOr(Stdlib_JSON.Decode.object(item), {}, prim => Object.assign({}, prim));
             obj["id"] = id;
             return obj;
@@ -242,19 +260,20 @@ function Make(Bus) {
           return emptyConnection;
         }
         let ownerScope = OwnerScope$Reventless.scopeOf(decision);
+        let retiredScope = OwnerScope$Reventless.retiredScopeOf(retiredDecision(ctx, args));
         let argsDict = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(args), {});
         let decodeLocalId = id => Stdlib_Option.map(DomainGraphQL_Server$ReventlessLocal.decodeGlobalId(id), param => param[1]);
         let listPage = Bus.getQueryDbListPage(name);
         if (listPage !== undefined) {
-          let conn = listPage(argsDict, capability, labelField, ownerScope);
+          let conn = listPage(argsDict, capability, labelField, ownerScope, retiredScope);
           if (conn !== undefined) {
             return conn;
           }
           let items = await fetchAllItems();
-          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId, ownerScope);
+          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId, ownerScope, retiredScope);
         }
         let items$1 = await fetchAllItems();
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId, ownerScope);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId, ownerScope, retiredScope);
       };
       match = [
         sdl,
@@ -272,7 +291,13 @@ function Make(Bus) {
           };
         }
         let all = await fetchAllItems();
-        let items = all.filter(item => ownerAllows(ctx, item));
+        let items = all.filter(item => {
+          if (ownerAllows(ctx, item)) {
+            return retiredAllows(ctx, args, item);
+          } else {
+            return false;
+          }
+        });
         return {
           nextToken: null,
           scannedCount: items.length,
@@ -331,7 +356,13 @@ function Make(Bus) {
           return emptyConn;
         }
         let loaded = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
-        let allItems = loaded.filter(item => ownerAllows(ctx, item));
+        let allItems = loaded.filter(item => {
+          if (ownerAllows(ctx, item)) {
+            return retiredAllows(ctx, args, item);
+          } else {
+            return false;
+          }
+        });
         let cursorFiltered;
         if (isBackward) {
           let beforeKey = Stdlib_Option.map(before, decodeCursor);
@@ -408,7 +439,13 @@ function Make(Bus) {
           return [];
         }
         let value = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(args), d => d[index]), Stdlib_JSON.Decode.string), "");
-        let scoped = rows => rows.filter(item => ownerAllows(ctx, item));
+        let scoped = rows => rows.filter(item => {
+          if (ownerAllows(ctx, item)) {
+            return retiredAllows(ctx, args, item);
+          } else {
+            return false;
+          }
+        });
         let lookup = Bus.getQueryDbIndexLookup(name);
         if (lookup !== undefined) {
           return scoped(lookup(filterField, value));

package/src/adapter/QueryDb/QueryDbStorage_InMemory.res

@@ -198,6 +198,8 @@ module Make = (Bus: LocalBus.T) => {
         ~id=entityKeyFor(id, subKey),
         ~state=Some(state),
         ~seq=LocalStateChangeDescriptor.nextSequence(),
+        ~retiredField=?LocalStateChangeDescriptor.retiredSpecFor(name)->Option.map(r => r.field),
+      ~retiredValues=?LocalStateChangeDescriptor.retiredSpecFor(name)->Option.flatMap(r => r.values),
       )
       Bus.publishStateChange(~name, ~descriptor)
     }