@reventlessdev/reventless-postgres 3.0.0-alpha.11 → 3.0.0-alpha.110

package/README.md

@@ -0,0 +1,83 @@
+[![npm](https://img.shields.io/npm/v/@reventlessdev/reventless-postgres.svg?label=npm)](https://www.npmjs.com/package/@reventlessdev/reventless-postgres)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+[![Docs](https://img.shields.io/badge/docs-reventless.dev-blue)](https://docs.reventless.dev)
+
+# @reventlessdev/reventless-postgres
+
+> ⚠️ **Alpha.** APIs and on-disk formats can change without notice between releases.
+> Pin exact versions and expect breaking changes.
+
+The **Postgres storage backend** for [Reventless](https://docs.reventless.dev) — a
+spec-driven, event-sourced CQRS framework written in [ReScript](https://rescript-lang.org).
+It implements the core storage adapters (classic and DCB event logs, the query
+database, and change feeds) over a plain Postgres connection. It carries **no**
+IaC/provider SDK dependency: it connects by connection string, so it runs against
+RDS/Aurora, any managed provider, or a local container.
+
+## What it provides
+
+ReScript modules, consumed by adding the package to your `rescript.json` `dependencies`:
+
+- **`PgDriver`** — the [`node-postgres`](https://node-postgres.com) (`pg`) binding
+  (pool/client). Accepts a full `connectionString` or discrete fields, with SSL
+  and rotating-secret (password-provider) support.
+- **`PgSchema`** — an idempotent schema + migration runner (`ensureSchema(pool)`),
+  safe to run on every startup and concurrently across processes.
+- **`EventLogStorage_Postgres`** — the classic optimistic-concurrency event log
+  (`event_log` / `snapshot`).
+- **`DcbEventLogStorage_Postgres`** — the DCB (Dynamic Consistency Boundary) event
+  log with a global position sequence and a concurrency-critical `dcb_append`.
+- **`QueryDbStorage_Postgres`** — read-side storage over JSONB `qdb_<name>` tables.
+- **`QueryEnginePostgres`** — compiles the core QueryEngine query/scan AST down to
+  SQL, pushing filters into the database.
+- **`EventLogChangeFeed`** / **`PgChangeFeed`** — checkpointed change feeds for the
+  classic and DCB logs, using an `xmin`-fenced read plus `LISTEN`/`NOTIFY`
+  (`pg_notify`) for near-real-time wakeup. A documented public consumer surface.
+
+The `*_Ops` modules hold the runtime-pure operations (no Pulumi import) so a
+deployed handler's ESM graph stays clean; the wrapper modules add the deploy-time
+adapter shape.
+
+## Where it fits
+
+`reventless-postgres` is a storage **adapter** for the Reventless framework.
+[`reventless-core`](https://www.npmjs.com/package/@reventlessdev/reventless-core)
+is provider-agnostic; this package supplies the Postgres implementation of its
+event-log, query-db, and change-feed interfaces:
+
+- [`@reventlessdev/reventless-aws`](https://www.npmjs.com/package/@reventlessdev/reventless-aws) — AWS (DynamoDB, Lambda, SQS, SNS, S3); can delegate event logs to this package for managed Postgres
+- [`@reventlessdev/reventless-postgres`](https://www.npmjs.com/package/@reventlessdev/reventless-postgres) — **this package**
+- [`@reventlessdev/reventless-local`](https://www.npmjs.com/package/@reventlessdev/reventless-local) — in-memory / SQLite platform that uses this storage against a local Postgres
+
+Because it depends only on `pg` (plus
+[`reventless-core`](https://www.npmjs.com/package/@reventlessdev/reventless-core),
+[`reventless-infra`](https://www.npmjs.com/package/@reventlessdev/reventless-infra),
+and [`reventless-spec`](https://www.npmjs.com/package/@reventlessdev/reventless-spec)),
+the platform package that embeds it owns provisioning; this package only needs a
+reachable Postgres.
+
+## Install
+
+```bash
+pnpm add @reventlessdev/reventless-postgres
+```
+
+Then register it as a ReScript dependency in `rescript.json`:
+
+```json
+{
+  "dependencies": ["@reventlessdev/reventless-postgres"]
+}
+```
+
+Requires ReScript `^12.3.0` (peer dependency).
+
+## Links
+
+- 📚 Documentation — [docs.reventless.dev](https://docs.reventless.dev)
+- 📦 Repository — [ReventlessDev/reventless-core](https://github.com/ReventlessDev/reventless-core)
+- 📋 [Changelog](./CHANGELOG.md)
+
+## License
+
+[Apache-2.0](https://opensource.org/licenses/Apache-2.0)

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1783552919574)
-#Done(1783552921556)
+#Start(1787354433221)
+#Done(1787354439157)

package/lib/bs/ReventlessPostgres.mlmap

@@ -7,8 +7,6 @@ EventLogStorage_Postgres_Ops
 PgChangeFeed
 PgDriver
 PgSchema
-PostgresIntegrationTest
 QueryDbStorage_Postgres
 QueryDbStorage_Postgres_Ops
 QueryEnginePostgres
-QueryEnginePostgresListPageTest

package/lib/bs/compiler-info.json

@@ -2,7 +2,7 @@
   "version": "12.3.0",
   "bsc_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/linux-x64/bin/bsc.exe",
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
-  "rescript_config_hash": "48ea15db3d741cf15a2ff49dd0b47d86badf2b548ecb3859a896faf1e3a82a15",
+  "rescript_config_hash": "af2af60a0fa33b8249a96ff2758f36482843126dc4e07b9302842d011e0ad8c6",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1783552921559"
+  "generated_at": "1787354439163"
 }

package/lib/bs/src/DcbEventLogStorage_Postgres.res

@@ -8,7 +8,7 @@
 // existing `DcbEventLogStorage_Postgres.*` reference keeps working) and adds only
 // the deploy-time `DcbEventLog_Adapter` shape, keeping the historic `makeStorage`
 // 3-tuple `(name, ops, adapter)` API unchanged.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 include DcbEventLogStorage_Postgres_Ops

package/lib/bs/src/DcbEventLogStorage_Postgres_Ops.res

@@ -6,7 +6,7 @@
 // would leak into the Lambda import graph and fail resolution on real Lambda. The
 // thin `DcbEventLogStorage_Postgres` wrapper `include`s this and adds the
 // deploy-time `Pulumi.Output`-shaped adapter for local/deploy consumers.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 open Reventless
@@ -67,7 +67,7 @@ let rowToEvent = (row: dict<JSON.t>): DcbEventLog_Adapter.rawSequencedEvent => {
     | _ => ""
     }
   let meta = switch row->Dict.get("meta") {
-  | Some(metaJson) => metaJson->S.parseJsonOrThrow(Reventless.Message.metaSchema)
+  | Some(metaJson) => metaJson->Reventless.Util_Sury.fromJson(Reventless.Message.metaSchema)
   | None => JsError.throwWithMessage("missing meta column in dcb_event row")
   }
   {
@@ -236,7 +236,7 @@ let makeOps = (
               JSON.Array(ev.tags->Array.map(t => JSON.Encode.string(t.key ++ "=" ++ t.value))),
             ),
             ("data", ev.data),
-            ("meta", ev.meta->S.reverseConvertToJsonOrThrow(Reventless.Message.metaSchema)),
+            ("meta", ev.meta->Reventless.Util_Sury.toJson(Reventless.Message.metaSchema)),
           ]),
         )
       ),

package/lib/bs/src/DcbEventLogStorage_Postgres_Ops.res.mjs

@@ -1,6 +1,5 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
 import * as Stream from "@reventlessdev/rescript-effect/src/Stream.res.mjs";
 import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
@@ -11,6 +10,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as PgDriver$ReventlessPostgres from "./PgDriver.res.mjs";
 
 function strategyParam(s) {
@@ -68,7 +68,7 @@ function rowToEvent(row) {
     }
   };
   let metaJson = row["meta"];
-  let meta = metaJson !== undefined ? S.parseJsonOrThrow(metaJson, Message$Reventless.metaSchema) : Stdlib_JsError.throwWithMessage("missing meta column in dcb_event row");
+  let meta = metaJson !== undefined ? Util_Sury$Reventless.fromJson(metaJson, Message$Reventless.metaSchema) : Stdlib_JsError.throwWithMessage("missing meta column in dcb_event row");
   return {
     position: str("cursor"),
     eventType: str("event_type"),
@@ -226,7 +226,7 @@ function makeOps(pool, name, param, param$1, param$2, param$3, lockStrategyOpt,
       ],
       [
         "meta",
-        S.reverseConvertToJsonOrThrow(ev.meta, Message$Reventless.metaSchema)
+        Util_Sury$Reventless.toJson(ev.meta, Message$Reventless.metaSchema)
       ]
     ])));
     let conditionParam;
@@ -377,4 +377,4 @@ export {
   countAll,
   makeOps,
 }
-/* S Not a pure module */
+/* Stream Not a pure module */

package/lib/bs/src/EventLogChangeFeed.res

@@ -15,8 +15,11 @@
 // later commit) is never skipped by a checkpointing reader. `global_seq` alone,
 // being an IDENTITY assigned at INSERT, could NOT provide that guarantee.
 
-// Reuse the shared `<a>:<b>` cursor codec from the DCB storage — identical format.
-module Dcb = DcbEventLogStorage_Postgres
+// Reuse the shared `<a>:<b>` cursor codec from the DCB storage — identical
+// format. Point at the runtime-pure `_Ops` module (no `@pulumi/pulumi`): this
+// feed is drained by the deployed change-feed relay Lambda, whose cold-start
+// graph must stay Pulumi-free.
+module Dcb = DcbEventLogStorage_Postgres_Ops
 
 // One classic event as the feed surfaces it. `payload` is the stored event JSON
 // verbatim; a bus/topic relay transforms it into its target shape (e.g. the AWS

package/lib/bs/src/EventLogChangeFeed.res.mjs

@@ -3,7 +3,7 @@
 import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as PgDriver$ReventlessPostgres from "./PgDriver.res.mjs";
-import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "./DcbEventLogStorage_Postgres.res.mjs";
+import * as DcbEventLogStorage_Postgres_Ops$ReventlessPostgres from "./DcbEventLogStorage_Postgres_Ops.res.mjs";
 
 let selectColumns = "\n  lpad(transaction_id::text, 20, '0') || ':' || lpad(global_seq::text, 20, '0') AS cursor,\n  aggregate_id,\n  seq_nr,\n  payload,\n  msg_id\n";
 
@@ -43,7 +43,7 @@ async function readBatch(pool, logName, after, limitOpt) {
   let limit = limitOpt !== undefined ? limitOpt : 500;
   let params = [logName];
   let where = "log_name = $1 AND transaction_id < pg_snapshot_xmin(pg_current_snapshot())";
-  let match = Stdlib_Option.flatMap(after, DcbEventLogStorage_Postgres$ReventlessPostgres.decodeCursor);
+  let match = Stdlib_Option.flatMap(after, DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.decodeCursor);
   if (match !== undefined) {
     params.push(match[0]);
     params.push(match[1]);
@@ -72,7 +72,7 @@ async function loadCheckpoint(pool, subscriber) {
 }
 
 async function saveCheckpoint(pool, subscriber, cursor) {
-  let match = DcbEventLogStorage_Postgres$ReventlessPostgres.decodeCursor(cursor);
+  let match = DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.decodeCursor(cursor);
   if (match !== undefined) {
     await PgDriver$ReventlessPostgres.query(pool, "INSERT INTO event_log_subscription(subscriber, last_tx, last_global_seq)\n       VALUES ($1, $2::xid8, $3::bigint)\n       ON CONFLICT (subscriber)\n       DO UPDATE SET last_tx = EXCLUDED.last_tx, last_global_seq = EXCLUDED.last_global_seq", [
       subscriber,

package/lib/bs/src/EventLogStorage_Postgres.res

@@ -7,7 +7,7 @@
 // real Lambda). This module `include`s that pure module and adds only the
 // deploy-time `EventLog_Adapter` shape (`operations` wrapped in `Pulumi.Output`),
 // keeping the historic `makeStorage` 3-tuple `(name, ops, adapter)` API unchanged.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 include EventLogStorage_Postgres_Ops

package/lib/bs/src/EventLogStorage_Postgres_Ops.res

@@ -7,7 +7,7 @@
 // in no Lambda — not the layer, not `/var/runtime`). The thin
 // `EventLogStorage_Postgres` wrapper adds the deploy-time `Pulumi.Output`-shaped
 // adapter on top for local/deploy consumers; the runtime imports `makeOps` here.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 

package/lib/bs/src/PgChangeFeed.res

@@ -18,7 +18,12 @@
 open ReventlessCore
 open Reventless
 
-module Dcb = DcbEventLogStorage_Postgres
+// Runtime-pure ops module (no `@pulumi/pulumi`) — this feed is drained by the
+// deployed change-feed relay Lambda, so its cold-start graph must stay
+// Pulumi-free. `_Ops` carries every helper used below (mkBuilder,
+// buildReadWhere, decodeCursor, selectColumns, rowToEvent); the deploy-time
+// DcbEventLogStorage_Postgres only `include`s it and adds the Pulumi adapter.
+module Dcb = DcbEventLogStorage_Postgres_Ops
 
 // One page of the feed. `events` are in (transaction_id, position) order;
 // `cursor` is the checkpoint to persist and to pass as the next `after` (None

package/lib/bs/src/PgChangeFeed.res.mjs

@@ -2,15 +2,15 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as PgDriver$ReventlessPostgres from "./PgDriver.res.mjs";
-import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "./DcbEventLogStorage_Postgres.res.mjs";
+import * as DcbEventLogStorage_Postgres_Ops$ReventlessPostgres from "./DcbEventLogStorage_Postgres_Ops.res.mjs";
 
 async function readBatch(pool, logName, after, limitOpt) {
   let limit = limitOpt !== undefined ? limitOpt : 500;
-  let b = DcbEventLogStorage_Postgres$ReventlessPostgres.mkBuilder();
-  let where = DcbEventLogStorage_Postgres$ReventlessPostgres.buildReadWhere(b, logName, [], Stdlib_Option.flatMap(after, DcbEventLogStorage_Postgres$ReventlessPostgres.decodeCursor), true);
-  let sql = `SELECT ` + DcbEventLogStorage_Postgres$ReventlessPostgres.selectColumns + ` FROM dcb_event WHERE ` + where + ` ORDER BY transaction_id ASC, position ASC LIMIT ` + limit.toString();
+  let b = DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.mkBuilder();
+  let where = DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.buildReadWhere(b, logName, [], Stdlib_Option.flatMap(after, DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.decodeCursor), true);
+  let sql = `SELECT ` + DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.selectColumns + ` FROM dcb_event WHERE ` + where + ` ORDER BY transaction_id ASC, position ASC LIMIT ` + limit.toString();
   let rows = await PgDriver$ReventlessPostgres.query(pool, sql, b.params);
-  let events = rows.map(DcbEventLogStorage_Postgres$ReventlessPostgres.rowToEvent);
+  let events = rows.map(DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.rowToEvent);
   let last = events[events.length - 1 | 0];
   let cursor = last !== undefined ? last.position : undefined;
   return {
@@ -31,7 +31,7 @@ async function loadCheckpoint(pool, subscriber) {
 }
 
 async function saveCheckpoint(pool, subscriber, cursor) {
-  let match = DcbEventLogStorage_Postgres$ReventlessPostgres.decodeCursor(cursor);
+  let match = DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.decodeCursor(cursor);
   if (match !== undefined) {
     await PgDriver$ReventlessPostgres.query(pool, "INSERT INTO dcb_subscription(subscriber, last_tx, last_position)\n       VALUES ($1, $2::xid8, $3::bigint)\n       ON CONFLICT (subscriber)\n       DO UPDATE SET last_tx = EXCLUDED.last_tx, last_position = EXCLUDED.last_position", [
       subscriber,

package/lib/bs/src/QueryDbStorage_Postgres.res

@@ -6,7 +6,7 @@
 // that pure module (so every existing `QueryDbStorage_Postgres.*` reference keeps
 // working) and adds only the deploy-time `Pulumi.Output`-shaped `storage` record
 // and the `Make` provider functor.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 open Reventless.ReadModel
@@ -37,6 +37,6 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     ~ttl as _=?,
     ~api as _,
     ~apiRole as _,
-    ~opts as _,
+    ~owner as _, ~opts as _,
   ) => makeStorage(~pool=P.pool, ~name, ~indexes, ~subIdField)
 }

package/lib/bs/src/QueryDbStorage_Postgres.res.mjs

@@ -12,7 +12,7 @@ function makeStorage(pool, name, indexes, subIdField) {
 }
 
 function Make(P) {
-  let make = (name, indexes, subIdField, param, param$1, param$2, param$3) => makeStorage(P.pool, name, indexes, subIdField);
+  let make = (name, indexes, subIdField, param, param$1, param$2, param$3, param$4) => makeStorage(P.pool, name, indexes, subIdField);
   return {
     make: make
   };

package/lib/bs/src/QueryDbStorage_Postgres_Ops.res

@@ -6,7 +6,7 @@
 // a deploy-time dep into its ESM import graph (which fails resolution on real
 // Lambda). The thin `QueryDbStorage_Postgres` wrapper `include`s this and adds the
 // deploy-time `Pulumi.Output`-shaped `storage` record + the `Make` functor.
-// See docs/plans/deployed-lambda-esm-self-containment.md (Rung-3 finding).
+// See docs/plans/done/deployed-lambda-esm-self-containment.md (Rung-3 finding).
 
 open ReventlessCore
 open Reventless.ReadModel

package/lib/bs/src/QueryEnginePostgres.res

@@ -63,18 +63,18 @@ let subIdSql = (b: paramBuilder, field: string, cmp: QueryEngine.SubId.comparato
   }
 }
 
-let notExpired = QueryDbStorage_Postgres.notExpiredClause
+let notExpired = QueryDbStorage_Postgres_Ops.notExpiredClause
 
 // Add `id` (from partition_key) when absent — matches allRows/scan in the SQLite
 // engine; partition-key queries return items as stored.
 let decodeRow = (~withId, row: dict<JSON.t>): JSON.t => {
-  let item = QueryDbStorage_Postgres.decodeItem(row)
+  let item = QueryDbStorage_Postgres_Ops.decodeItem(row)
   if withId {
     let pk = switch row->Dict.get("partition_key") {
     | Some(JSON.String(s)) => s
     | _ => ""
     }
-    QueryDbStorage_Postgres.withId(item, pk)
+    QueryDbStorage_Postgres_Ops.withId(item, pk)
   } else {
     item
   }
@@ -90,7 +90,7 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     ~ascending=?,
     ~limit=?,
   ): array<JSON.t> => {
-    let table = QueryDbStorage_Postgres.tableName(readModelName)
+    let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
     let keyStr = switch key {
     | Some(k) => k
     | None => valueToText(id)
@@ -114,7 +114,7 @@ module Make = (P: {let pool: PgDriver.pool}) => {
   }
 
   let scan = async (~readModelName, ~filterConfigs, ~limit): array<JSON.t> => {
-    let table = QueryDbStorage_Postgres.tableName(readModelName)
+    let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
     let b = {params: []}
     let where = [notExpired]
     filterConfigs->Array.forEach(((field, cmp, v)) => where->Array.push(filterSql(b, field, cmp, v)))
@@ -138,7 +138,7 @@ module Make = (P: {let pool: PgDriver.pool}) => {
   // (`ensureIndexes`) instead of scanning. String comparison mirrors the
   // resolver's JS path (which only matched string-typed fields).
   let indexLookup = async (~readModelName, field: string, value: string): array<JSON.t> => {
-    let table = QueryDbStorage_Postgres.tableName(readModelName)
+    let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
     let b = {params: []}
     let sql = `SELECT partition_key, item FROM ${table} WHERE ${col(field)} = ${b->param(
         JSON.Encode.string(value),
@@ -154,7 +154,7 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     if ids->Array.length == 0 {
       []
     } else {
-      let table = QueryDbStorage_Postgres.tableName(readModelName)
+      let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
       let b = {params: []}
       let idsJson = JSON.Encode.array(ids->Array.map(JSON.Encode.string))
       let sql = `SELECT partition_key, item FROM ${table} WHERE partition_key = ANY(${b->param(
@@ -168,6 +168,39 @@ module Make = (P: {let pool: PgDriver.pool}) => {
   let idExprC = `COALESCE(item->>'id', partition_key) COLLATE "C"`
   let jsonTextC = (field: string): string => `${col(field)} COLLATE "C"`
 
+  // "not retired", as jsonb rather than text. `->` keeps the value typed, so a
+  // JSON boolean true is distinguishable from the JSON string "true"; `->>`
+  // would render both as 'true' and hide a row the shared spec keeps, since that
+  // spec decodes strictly and reads a non-boolean as "no flag". `IS DISTINCT
+  // FROM` rather than `<>` so an absent key — NULL — keeps the row instead of
+  // making the whole predicate NULL and dropping it.
+  //
+  // The state form compares against JSON strings instead of `true`, one
+  // `IS DISTINCT FROM` per state, ANDed. Not `NOT IN`: that is ordinary
+  // equality, so an absent key makes the predicate NULL and drops a row this
+  // spec keeps. Same shape and same index behaviour as the single-state form —
+  // a handful of equality predicates over an enum-valued attribute cost what one
+  // over a boolean does — so the `@index` guidance carries over unchanged.
+  //
+  // A set naming no states withdraws nothing, so the predicate is vacuously
+  // true, matching what `isRetiredValue` answers for it.
+  let notRetiredC = (scope: Reventless.OwnerScope.retiredScope): string => {
+    let key = scope.field->String.replaceAll("'", "''")
+    let distinctFrom = lit => `(item->'${key}') IS DISTINCT FROM ${lit}`
+    switch scope.values {
+    | None => distinctFrom("'true'::jsonb")
+    | Some([]) => "TRUE"
+    | Some(states) =>
+      // Parenthesised though every caller ANDs these together already: a clause
+      // that is safe only because of where it is spliced is a clause that breaks
+      // the first time it is spliced somewhere else.
+      "(" ++
+      states
+      ->Array.map(state => distinctFrom(`'"${state->String.replaceAll("'", "''")}"'::jsonb`))
+      ->Array.join(" AND ") ++ ")"
+    }
+  }
+
   // Connection-list push-down. Builds `item->>'field'` predicates + keyset
   // WHERE + `ORDER BY … LIMIT pageSize+1` so a page reads only what it returns
   // rather than the whole read model. Reproduces `QueryDbListQuery` semantics
@@ -183,8 +216,10 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     ~argsDict: dict<JSON.t>,
     ~capability: GraphQL_FragmentGenerator.serverCapability,
     ~labelField as _,
+    ~ownerScope: option<(string, string)>=?,
+    ~retiredScope: option<Reventless.OwnerScope.retiredScope>=?,
   ): option<JSON.t> => {
-    let table = QueryDbStorage_Postgres.tableName(readModelName)
+    let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
     let filterDict =
       argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
     let strNonEmpty = k =>
@@ -210,6 +245,19 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     } else {
       let b = {params: []}
       let whereParts = [notExpired]
+      // Into the SQL, before the LIMIT — narrowing the returned page instead
+      // would hand back fewer rows than asked for while still claiming a next
+      // page. Mirrors the SQLite push-down; the parity harness holds the two
+      // and the shared spec to the same answer.
+      switch ownerScope {
+      | Some((field, required)) =>
+        whereParts->Array.push(`${jsonTextC(field)} = ${b->param(JSON.Encode.string(required))}`)
+      | None => ()
+      }
+      switch retiredScope {
+      | Some(scope) => whereParts->Array.push(notRetiredC(scope))
+      | None => ()
+      }
       let valString = v =>
         switch v->JSON.Decode.string {
         | Some(s) => Some(s)
@@ -309,8 +357,10 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     ~subIdField as _: string,
     ~id: string,
     ~argsDict: dict<JSON.t>,
+    ~ownerScope: option<(string, string)>=?,
+    ~retiredScope: option<Reventless.OwnerScope.retiredScope>=?,
   ): JSON.t => {
-    let table = QueryDbStorage_Postgres.tableName(readModelName)
+    let table = QueryDbStorage_Postgres_Ops.tableName(readModelName)
     let filterDict =
       argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
     let fstr = k => filterDict->Dict.get(k)->Option.flatMap(JSON.Decode.string)
@@ -324,6 +374,16 @@ module Make = (P: {let pool: PgDriver.pool}) => {
     let sk = `sub_key COLLATE "C"`
     let b = {params: []}
     let where = [`partition_key = ${b->param(JSON.Encode.string(id))}`, notExpired]
+    // Before the keyset window and the LIMIT, for the same reason as `listPage`.
+    switch ownerScope {
+    | Some((field, required)) =>
+      where->Array.push(`${jsonTextC(field)} = ${b->param(JSON.Encode.string(required))}`)
+    | None => ()
+    }
+    switch retiredScope {
+    | Some(scope) => where->Array.push(notRetiredC(scope))
+    | None => ()
+    }
     fstr("prefix")->Option.forEach(p =>
       where->Array.push(`starts_with(sub_key, ${b->param(JSON.Encode.string(p))})`)
     )
@@ -380,7 +440,4 @@ module Make = (P: {let pool: PgDriver.pool}) => {
       },
     })
   }
-
-  let make: QueryDb_Adapter.queryEngineMaker = _allQueryDbs =>
-    Pulumi.Output.make({QueryEngine.scan, query})
 }