@reventlessdev/reventless-aws 3.0.0-alpha.178 → 3.0.0-alpha.180

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.180 (2026-07-07)
+
+### Bug Fixes
+
+* **reventless-aws:** type-level dual-auth + derived query fields for system callers ([91e01f8](https://github.com/ReventlessDev/reventless-core/commit/91e01f82f43f64f07e7eb0a4aaa8cf5dc77a916e))
+
+
+# 3.0.0-alpha.179 (2026-07-07)
+
+### Bug Fixes
+
+* **reventless-postgres:** keep [@pulumi](https://github.com/pulumi) out of the deployed Lambda runtime graph ([0f363cd](https://github.com/ReventlessDev/reventless-core/commit/0f363cd273590591c8f9353fa38ac8b6072e6c49))
+
+
 # 3.0.0-alpha.178 (2026-07-06)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.178",
+  "version": "3.0.0-alpha.180",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -15,10 +15,10 @@
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.46",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.14",
     "@reventlessdev/reventless-core": "3.0.0-alpha.143",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.89",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.6",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.67"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.67",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.7"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -700,7 +700,7 @@ module MakeWithConfig = (
       let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
         ~baseFragment=adminBaseFragment,
         ~pluginFragments=[],
-      )
+      )->AppSync_Adapter.stampSharedIamTypes
       (targetApi, adminBarrier)
       ->Pulumi.Output.all2
       ->Pulumi.Output.flatMap(((api, _)) =>
@@ -928,7 +928,7 @@ module MakeWithConfig = (
               let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
                 ~baseFragment,
                 ~pluginFragments=allPluginFragments,
-              )
+              )->AppSync_Adapter.stampSharedIamTypes
               let currentHash = AppSync_Adapter.sha256Hex(sdl)
               let storedHash = switch tableNameOpt {
               | Some(tn) => await readSchemaHash(~tableName=tn, ~apiId)
@@ -1628,7 +1628,7 @@ module MakeWithConfig = (
         let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
           ~baseFragment,
           ~pluginFragments=fragments,
-        )
+        )->AppSync_Adapter.stampSharedIamTypes
         await AppSync_Adapter.getClient()->AppSync_Adapter.startSchemaCreationRetrying({
           apiId,
           definition: sdl,

package/src/Platform.res.mjs

@@ -639,7 +639,7 @@ function MakeWithConfig(Config) {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
           baseFragment = capturedDeployTarget === "Domain" && Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
-          let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
+          let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments));
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
           let client = AppSync_Adapter$ReventlessAws.getClient();
@@ -694,7 +694,7 @@ function MakeWithConfig(Config) {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
     let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
-    let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
+    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
       adminBarrier
@@ -1066,7 +1066,7 @@ function MakeWithConfig(Config) {
         }
       });
       let baseFragment = Config.splitApi ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
-      let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, fragments);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, fragments));
       return await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(AppSync_Adapter$ReventlessAws.getClient(), {
         apiId: apiId,
         definition: sdl
@@ -1870,7 +1870,7 @@ function Make($star) {
         let runSchemaPush = () => writeAndScanFragments().then(async allPluginFragments => {
           let baseFragment;
           baseFragment = capturedDeployTarget === "Domain" ? emptyBaseFragment : AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
-          let sdl = GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments);
+          let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, allPluginFragments));
           let currentHash = AppSync_Adapter$ReventlessAws.sha256Hex(sdl);
           let storedHash = tableNameOpt !== undefined ? await readSchemaHash(tableNameOpt, apiId) : undefined;
           let client = AppSync_Adapter$ReventlessAws.getClient();
@@ -1925,7 +1925,7 @@ function Make($star) {
     let match = splitApiOutputsRef.contents;
     let targetApi = match !== undefined ? match.platformApi : domainApi;
     let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
-    let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []);
+    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
     return Output$Pulumi.flatMap(Pulumi.all([
       targetApi,
       adminBarrier
@@ -2280,7 +2280,7 @@ function Make($star) {
           return;
         }
       });
-      let sdl = GraphQL_Stitcher$ReventlessCore.stitch(emptyBaseFragment, fragments);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(emptyBaseFragment, fragments));
       return await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(AppSync_Adapter$ReventlessAws.getClient(), {
         apiId: apiId,
         definition: sdl

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res

@@ -11,10 +11,12 @@
 let opsFor = (
   config: PgConnection.connectionConfig,
   ~logName: string,
-  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres_Ops.lockStrategy=#AdvisoryLocks,
 ): ReventlessCore.DcbEventLog_Adapter.operations => {
   let pool = PgRuntime.poolFor(config)
-  let (_name, ops, _storage) = ReventlessPostgres.DcbEventLogStorage_Postgres.makeStorage(
+  // Import the runtime-pure ops module (no @pulumi/pulumi) so this deployed-Lambda
+  // path never drags a deploy-time dep into its ESM import graph.
+  let (_name, ops) = ReventlessPostgres.DcbEventLogStorage_Postgres_Ops.makeOps(
     ~pool,
     ~name=logName,
     ~indexes=[],

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs

@@ -1,12 +1,12 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
-import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres.res.mjs";
+import * as DcbEventLogStorage_Postgres_Ops$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres_Ops.res.mjs";
 
 function opsFor(config, logName, lockStrategyOpt) {
   let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
   let pool = PgRuntime$ReventlessAws.poolFor(config);
-  return DcbEventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, [], undefined, undefined, undefined, lockStrategy, undefined)[1];
+  return DcbEventLogStorage_Postgres_Ops$ReventlessPostgres.makeOps(pool, logName, [], undefined, undefined, undefined, lockStrategy, undefined)[1];
 }
 
 export {

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res

@@ -14,7 +14,9 @@ let opsFor = (
   ~logName: string,
 ): ReventlessCore.EventLog_Adapter.operations => {
   let pool = PgRuntime.poolFor(config)
-  let (_name, ops, _storage) = ReventlessPostgres.EventLogStorage_Postgres.makeStorage(
+  // Import the runtime-pure ops module (no @pulumi/pulumi) so this deployed-Lambda
+  // path never drags a deploy-time dep into its ESM import graph.
+  let (_name, ops) = ReventlessPostgres.EventLogStorage_Postgres_Ops.makeOps(
     ~pool,
     ~name=logName,
     ~opts=(),

package/src/adapter/EventLog/EventLogStorage_Postgres_Runtime.res.mjs

@@ -1,11 +1,11 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
-import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+import * as EventLogStorage_Postgres_Ops$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres_Ops.res.mjs";
 
 function opsFor(config, logName) {
   let pool = PgRuntime$ReventlessAws.poolFor(config);
-  return EventLogStorage_Postgres$ReventlessPostgres.makeStorage(pool, logName, undefined, undefined)[1];
+  return EventLogStorage_Postgres_Ops$ReventlessPostgres.makeOps(pool, logName, undefined, undefined)[1];
 }
 
 export {

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res

@@ -15,5 +15,7 @@ let opsFor = (
   ~subIdField: option<string>=?,
 ): ReventlessCore.QueryDb_Adapter.operations => {
   let pool = PgRuntime.poolFor(config)
-  ReventlessPostgres.QueryDbStorage_Postgres.makeOperations(~pool, ~name, ~indexes, ~subIdField)
+  // Import the runtime-pure ops module (no @pulumi/pulumi) so this deployed-Lambda
+  // path never drags a deploy-time dep into its ESM import graph.
+  ReventlessPostgres.QueryDbStorage_Postgres_Ops.makeOperations(~pool, ~name, ~indexes, ~subIdField)
 }

package/src/adapter/QueryDb/QueryDbStorage_Postgres_Runtime.res.mjs

@@ -1,12 +1,12 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
-import * as QueryDbStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/QueryDbStorage_Postgres.res.mjs";
+import * as QueryDbStorage_Postgres_Ops$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/QueryDbStorage_Postgres_Ops.res.mjs";
 
 function opsFor(config, name, indexesOpt, subIdField) {
   let indexes = indexesOpt !== undefined ? indexesOpt : [];
   let pool = PgRuntime$ReventlessAws.poolFor(config);
-  return QueryDbStorage_Postgres$ReventlessPostgres.makeOperations(pool, name, indexes, subIdField);
+  return QueryDbStorage_Postgres_Ops$ReventlessPostgres.makeOperations(pool, name, indexes, subIdField);
 }
 
 export {

package/src/components/Api/AppSync_Adapter.res

@@ -311,6 +311,55 @@ let _formatDualAuthDirective = (groups: option<array<string>>): string => {
   `${cognito} @aws_iam`
 }
 
+// ── Type-level dual-auth ─────────────────────────────────────────────────────
+// On a multi-auth API, object TYPES without auth directives are accessible only
+// via the default auth mode — a field-level `@aws_iam` admits the system caller
+// to the top-level field, but response shaping then walks the return types
+// (`…Connection` → `…Edge` → node type → nested state types) and dies with
+// "Not Authorized to access <field> on type <T>" one level in. Types reachable
+// from a systemCallable field therefore carry the bare multi-auth pair: the
+// group-less Cognito arm matches the pre-existing accessibility of an
+// undirectived type (any authenticated user; entry gating stays on the fields),
+// the IAM arm admits the traversal. Only `type` declarations take auth
+// directives (inputs/enums/interfaces do not).
+
+// The declared name of a `type …` SDL declaration; None for input/enum/union/etc.
+let _typeDeclName = (decl: string): option<string> =>
+  if decl->String.startsWith("type ") {
+    let rest = decl->String.slice(~start=5, ~end=decl->String.length)
+    let end = switch rest->String.search(%re("/[\s{]/")) {
+    | -1 => rest->String.length
+    | i => i
+    }
+    Some(rest->String.slice(~start=0, ~end))
+  } else {
+    None
+  }
+
+// Insert the multi-auth pair into a type declaration header (before its `{`).
+let _stampTypeDualAuth = (decl: string): string =>
+  switch decl->String.indexOfOpt("{") {
+  | Some(i) =>
+    decl->String.slice(~start=0, ~end=i) ++
+    "@aws_cognito_user_pools @aws_iam " ++
+    decl->String.slice(~start=i, ~end=decl->String.length)
+  | None => decl
+  }
+
+// Shared traversal types every callable surface reaches — `PageInfo` (relay
+// connections, injected by the stitcher) and the `CommandResult` members
+// (mutation returns, deduped across fragments by the stitcher). They must be
+// stamped exactly once on the ASSEMBLED SDL: stamping per-fragment would race
+// the stitcher's first-wins dedupe against unstamped copies from sibling
+// fragments. Unconditional — the API always configures AWS_IAM as an
+// additional provider, so the directive is always valid.
+let sharedIamTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
+
+let stampSharedIamTypes = (sdl: string): string =>
+  sharedIamTypeNames->Array.reduce(sdl, (acc, name) =>
+    acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
+  )
+
 let injectAwsAuth = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry>,
@@ -323,8 +372,15 @@ let injectAwsAuth = (
   // `authorization.group` per-entry single-group form.
   // Fields opted into deploy-time IAM invocation (dual-auth). Membership here
   // switches a field from the single-mode `@aws_auth` form to the multi-auth
-  // `@aws_cognito_user_pools(...) @aws_iam` form.
+  // `@aws_cognito_user_pools(...) @aws_iam` form. Query entries mark by PREFIX
+  // (single/list field name) because the generator derives further fields from
+  // them — `…Items` (sub-id), `…ByIds`, `…By<Index>` (GSI) — which a system
+  // caller (reconcile reads) uses too. Type declarations reachable from a
+  // callable entry are stamped by returnTypeName prefix (see the type-level
+  // dual-auth note above).
   let iamFields: Dict.t<bool> = Dict.make()
+  let iamQueryFieldPrefixes: array<string> = []
+  let iamTypePrefixes: array<string> = []
 
   let mutationAuthMap: Dict.t<array<string>> = Dict.make()
   mutationEntries->Array.forEach(entry => {
@@ -359,6 +415,9 @@ let injectAwsAuth = (
     if entry.systemCallable->Option.getOr(false) {
       iamFields->Dict.set(entry.singleFieldName, true)
       iamFields->Dict.set(entry.listFieldName, true)
+      iamQueryFieldPrefixes->Array.push(entry.singleFieldName)
+      iamQueryFieldPrefixes->Array.push(entry.listFieldName)
+      iamTypePrefixes->Array.push(entry.returnTypeName)
     }
     switch entry.authorization {
     | Some({group}) =>
@@ -396,7 +455,10 @@ let injectAwsAuth = (
   let augmentedQueries = parts.queries->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     let groups = queryAuthMap->Dict.get(fieldName)
-    if iamFields->Dict.get(fieldName)->Option.getOr(false) {
+    let isIam =
+      iamFields->Dict.get(fieldName)->Option.getOr(false) ||
+        iamQueryFieldPrefixes->Array.some(p => fieldName->String.startsWith(p))
+    if isIam {
       `${field} ${_formatDualAuthDirective(groups)}`
     } else {
       switch groups {
@@ -406,10 +468,21 @@ let injectAwsAuth = (
     }
   })
 
+  // Type-level dual-auth for every type the callable entries' responses reach —
+  // the node type, its Connection/Edge wrappers, and nested state types all
+  // share the entry's returnTypeName prefix.
+  let augmentedTypes = parts.types->Array.map(decl =>
+    switch _typeDeclName(decl) {
+    | Some(name) if iamTypePrefixes->Array.some(p => name->String.startsWith(p)) =>
+      _stampTypeDualAuth(decl)
+    | _ => decl
+    }
+  )
+
   let encoded =
     JSON.Encode.object(
       Dict.fromArray([
-        ("types", JSON.Encode.array(parts.types->Array.map(JSON.Encode.string))),
+        ("types", JSON.Encode.array(augmentedTypes->Array.map(JSON.Encode.string))),
         ("mutations", JSON.Encode.array(augmentedMutations->Array.map(JSON.Encode.string))),
         ("queries", JSON.Encode.array(augmentedQueries->Array.map(JSON.Encode.string))),
         (
@@ -546,7 +619,13 @@ let updateSchema = (
   // The base fragment contains core Plugin aggregate queries/mutations — all Admin-only.
   // Plugin fragments already have @aws_auth injected via generateFragment.
   let augmentedBaseFragment = injectAwsAuthAll(baseFragment, ~group="Admin")
-  let sdl = ReventlessCore.GraphQL_Stitcher.stitch(~baseFragment=augmentedBaseFragment, ~pluginFragments)
+  // Shared traversal types are stamped once on the assembled SDL (post-stitch,
+  // post-dedupe) — see stampSharedIamTypes.
+  let sdl =
+    ReventlessCore.GraphQL_Stitcher.stitch(
+      ~baseFragment=augmentedBaseFragment,
+      ~pluginFragments,
+    )->stampSharedIamTypes
   // Resolve the API ID from the Output chain. In mock mode (tests) and in Lambda runtime
   // (where the Output is backed by already-known values), this completes synchronously.
   // The resulting promise wraps the AppSync SDK call.

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -4,8 +4,10 @@ import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Effect$1 from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
@@ -215,9 +217,41 @@ function _formatDualAuthDirective(groups) {
   return cognito + ` @aws_iam`;
 }
 
+function _typeDeclName(decl) {
+  if (!decl.startsWith("type ")) {
+    return;
+  }
+  let rest = decl.slice(5, decl.length);
+  let i = rest.search(/[\s{]/);
+  let end = i !== -1 ? i : rest.length;
+  return rest.slice(0, end);
+}
+
+function _stampTypeDualAuth(decl) {
+  let i = Stdlib_String.indexOfOpt(decl, "{");
+  if (i !== undefined) {
+    return decl.slice(0, i) + "@aws_cognito_user_pools @aws_iam " + decl.slice(i, decl.length);
+  } else {
+    return decl;
+  }
+}
+
+let sharedIamTypeNames = [
+  "PageInfo",
+  "CommandAccepted",
+  "CommandRejected",
+  "CommandPending"
+];
+
+function stampSharedIamTypes(sdl) {
+  return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
+}
+
 function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
   let iamFields = {};
+  let iamQueryFieldPrefixes = [];
+  let iamTypePrefixes = [];
   let mutationAuthMap = {};
   mutationEntries.forEach(entry => {
     if (Stdlib_Option.getOr(entry.systemCallable, false)) {
@@ -252,6 +286,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     if (Stdlib_Option.getOr(entry.systemCallable, false)) {
       iamFields[entry.singleFieldName] = true;
       iamFields[entry.listFieldName] = true;
+      iamQueryFieldPrefixes.push(entry.singleFieldName);
+      iamQueryFieldPrefixes.push(entry.listFieldName);
+      iamTypePrefixes.push(entry.returnTypeName);
     }
     let match = entry.authorization;
     if (match !== undefined) {
@@ -287,7 +324,8 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let augmentedQueries = parts.queries.map(field => {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = queryAuthMap[fieldName];
-    if (Stdlib_Option.getOr(iamFields[fieldName], false)) {
+    let isIam = Stdlib_Option.getOr(iamFields[fieldName], false) || iamQueryFieldPrefixes.some(p => fieldName.startsWith(p));
+    if (isIam) {
       return field + ` ` + _formatDualAuthDirective(groups);
     } else if (groups !== undefined) {
       return field + ` ` + _formatGroupsDirective(groups);
@@ -295,10 +333,18 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
       return field;
     }
   });
+  let augmentedTypes = parts.types.map(decl => {
+    let name = _typeDeclName(decl);
+    if (name !== undefined && iamTypePrefixes.some(p => name.startsWith(p))) {
+      return _stampTypeDualAuth(decl);
+    } else {
+      return decl;
+    }
+  });
   let encoded = JSON.stringify(Object.fromEntries([
     [
       "types",
-      parts.types.map(prim => prim)
+      augmentedTypes.map(prim => prim)
     ],
     [
       "mutations",
@@ -398,7 +444,7 @@ function generateFragment(mutationEntries, queryEntries) {
 
 function updateSchema(api, baseFragment, pluginFragments) {
   let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin", undefined);
-  let sdl = GraphQL_Stitcher$ReventlessCore.stitch(augmentedBaseFragment, pluginFragments);
+  let sdl = stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(augmentedBaseFragment, pluginFragments));
   let resultPromise = {
     contents: Promise.resolve()
   };
@@ -426,6 +472,10 @@ export {
   _permissionToCognitoGroups,
   _formatGroupsDirective,
   _formatDualAuthDirective,
+  _typeDeclName,
+  _stampTypeDualAuth,
+  sharedIamTypeNames,
+  stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,
   makeApiResource,

package/tests/AppSync_AdapterTest.res

@@ -452,6 +452,118 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
     | _ => JsError.throwWithMessage("missing query fields")
     }
   })
+
+  testSync("systemCallable dual-auth extends to derived query fields (Items/ByIds/By<Index>)", () => {
+    let entry: ReventlessInfra.Api.querySchemaEntry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      systemCallable: true,
+    }
+    let frag = makeFragment(
+      [],
+      [
+        "p_ItemItems(id: ID!, first: Int): p_ItemConnection!",
+        "p_ItemsByIds(ids: [ID!]!): [p_Item]!",
+        "p_ItemByOwner(id: ID!, first: Int): p_ItemConnection!",
+        "q_Unrelated(id: ID!): String",
+      ],
+    )
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[entry])
+    let parts = decodeFragment(aug)
+    parts.queries->Array.forEach(field =>
+      if field->String.includes("q_Unrelated") {
+        expect(field)->not_->toContain("@aws_iam")
+      } else {
+        expect(field)->toContain("@aws_iam")
+      }
+    )
+  })
+})
+
+// ── Type-level dual-auth ─────────────────────────────────────────────────────
+//
+// On a multi-auth API a field directive alone is not enough: response shaping
+// walks the return TYPES (Connection → Edge → node → nested state types), each
+// of which is default-mode-only without its own directive. Types prefixed by a
+// systemCallable entry's returnTypeName get the bare multi-auth pair; shared
+// traversal types (PageInfo / CommandResult members) are stamped once on the
+// assembled SDL.
+
+describe("AppSync_Adapter — type-level dual-auth", () => {
+  let makeFragmentWithTypes = (types, queryFields) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types,
+      mutations: [],
+      queries: queryFields,
+      subscriptions: [],
+    })
+
+  let callableEntry: ReventlessInfra.Api.querySchemaEntry = {
+    singleFieldName: "p_Item",
+    listFieldName: "p_Items",
+    returnTypeName: "p_Item",
+    stateSchema: S.unknown,
+    authorization: None,
+    permission: Reventless.Authorization.AllowGroups(["Admin"]),
+    systemCallable: true,
+  }
+
+  let types = [
+    "type p_Item implements Node {\n  id: ID!\n}",
+    "type p_ItemConnection {\n  edges: [p_ItemEdge!]!\n}",
+    "type p_ItemEdge {\n  node: p_Item!\n}",
+    "type p_ItemNested {\n  x: String\n}",
+    "type q_Sibling {\n  id: ID!\n}",
+    "input p_ItemItemsFilter {\n  eq: String\n}",
+  ]
+
+  testSync("types prefixed by a callable entry's returnTypeName carry the multi-auth pair", () => {
+    let frag = makeFragmentWithTypes(types, ["p_Item(id: ID!): p_Item"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[callableEntry])
+    let parts = decodeFragment(aug)
+    parts.types->Array.forEach(decl =>
+      if decl->String.startsWith("type p_Item") {
+        expect(decl)->toContain("@aws_cognito_user_pools @aws_iam {")
+      } else {
+        // The sibling view's type and the (non-authorizable) input stay untouched.
+        expect(decl)->not_->toContain("@aws_iam")
+      }
+    )
+  })
+
+  testSync("without a systemCallable entry no type is stamped", () => {
+    let plainEntry: ReventlessInfra.Api.querySchemaEntry = {
+      ...callableEntry,
+      systemCallable: false,
+    }
+    let frag = makeFragmentWithTypes(types, ["p_Item(id: ID!): p_Item"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[plainEntry])
+    decodeFragment(aug).types->Array.forEach(decl => expect(decl)->not_->toContain("@aws_iam"))
+  })
+
+  testSync("stampSharedIamTypes marks PageInfo + CommandResult members on the assembled SDL", () => {
+    let sdl = [
+      "interface Node {\n  id: ID!\n}",
+      "type PageInfo {\n  hasNextPage: Boolean!\n}",
+      "union CommandResult = CommandAccepted | CommandRejected | CommandPending",
+      "type CommandAccepted {\n  msgId: ID!\n}",
+      "type CommandRejected {\n  msgId: ID!\n}",
+      "type CommandPending {\n  msgId: ID!\n}",
+      "type Untouched {\n  id: ID!\n}",
+    ]->Array.join("\n\n")
+    let stamped = AppSync_Adapter.stampSharedIamTypes(sdl)
+    expect(stamped)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam {")
+    expect(stamped)->toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {")
+    expect(stamped)->toContain("type CommandRejected @aws_cognito_user_pools @aws_iam {")
+    expect(stamped)->toContain("type CommandPending @aws_cognito_user_pools @aws_iam {")
+    expect(stamped)->toContain("type Untouched {")
+    // The union declaration itself takes no directive.
+    expect(stamped)->toContain("union CommandResult = CommandAccepted | CommandRejected | CommandPending")
+  })
 })
 
 describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {

package/tests/AppSync_AdapterTest.res.mjs

@@ -426,6 +426,107 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
       return Stdlib_JsError.throwWithMessage("missing query fields");
     }
   });
+  globalThis.test("systemCallable dual-auth extends to derived query fields (Items/ByIds/By<Index>)", () => {
+    let entry_permission = {
+      TAG: "AllowGroups",
+      _0: ["Admin"]
+    };
+    let entry_systemCallable = true;
+    let entry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: undefined,
+      permission: entry_permission,
+      systemCallable: entry_systemCallable
+    };
+    let frag = makeFragment([], [
+      "p_ItemItems(id: ID!, first: Int): p_ItemConnection!",
+      "p_ItemsByIds(ids: [ID!]!): [p_Item]!",
+      "p_ItemByOwner(id: ID!, first: Int): p_ItemConnection!",
+      "q_Unrelated(id: ID!): String"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    parts.queries.forEach(field => {
+      if (field.includes("q_Unrelated")) {
+        globalThis.expect(field).not.toContain("@aws_iam");
+      } else {
+        globalThis.expect(field).toContain("@aws_iam");
+      }
+    });
+  });
+});
+
+globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {
+  let makeFragmentWithTypes = (types, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
+    types: types,
+    mutations: [],
+    queries: queryFields,
+    subscriptions: []
+  });
+  let callableEntry_permission = {
+    TAG: "AllowGroups",
+    _0: ["Admin"]
+  };
+  let callableEntry_systemCallable = true;
+  let callableEntry = {
+    singleFieldName: "p_Item",
+    listFieldName: "p_Items",
+    returnTypeName: "p_Item",
+    stateSchema: S.unknown,
+    authorization: undefined,
+    permission: callableEntry_permission,
+    systemCallable: callableEntry_systemCallable
+  };
+  let types = [
+    "type p_Item implements Node {\n  id: ID!\n}",
+    "type p_ItemConnection {\n  edges: [p_ItemEdge!]!\n}",
+    "type p_ItemEdge {\n  node: p_Item!\n}",
+    "type p_ItemNested {\n  x: String\n}",
+    "type q_Sibling {\n  id: ID!\n}",
+    "input p_ItemItemsFilter {\n  eq: String\n}"
+  ];
+  globalThis.test("types prefixed by a callable entry's returnTypeName carry the multi-auth pair", () => {
+    let frag = makeFragmentWithTypes(types, ["p_Item(id: ID!): p_Item"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [callableEntry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    parts.types.forEach(decl => {
+      if (decl.startsWith("type p_Item")) {
+        globalThis.expect(decl).toContain("@aws_cognito_user_pools @aws_iam {");
+      } else {
+        globalThis.expect(decl).not.toContain("@aws_iam");
+      }
+    });
+  });
+  globalThis.test("without a systemCallable entry no type is stamped", () => {
+    let newrecord = {...callableEntry};
+    newrecord.systemCallable = false;
+    let frag = makeFragmentWithTypes(types, ["p_Item(id: ID!): p_Item"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [newrecord]);
+    GraphQL_Stitcher$ReventlessCore.decode(aug).types.forEach(decl => {
+      globalThis.expect(decl).not.toContain("@aws_iam");
+    });
+  });
+  globalThis.test("stampSharedIamTypes marks PageInfo + CommandResult members on the assembled SDL", () => {
+    let sdl = [
+      "interface Node {\n  id: ID!\n}",
+      "type PageInfo {\n  hasNextPage: Boolean!\n}",
+      "union CommandResult = CommandAccepted | CommandRejected | CommandPending",
+      "type CommandAccepted {\n  msgId: ID!\n}",
+      "type CommandRejected {\n  msgId: ID!\n}",
+      "type CommandPending {\n  msgId: ID!\n}",
+      "type Untouched {\n  id: ID!\n}"
+    ].join("\n\n");
+    let stamped = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(sdl);
+    globalThis.expect(stamped).toContain("type PageInfo @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(stamped).toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(stamped).toContain("type CommandRejected @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(stamped).toContain("type CommandPending @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(stamped).toContain("type Untouched {");
+    globalThis.expect(stamped).toContain("union CommandResult = CommandAccepted | CommandRejected | CommandPending");
+  });
 });
 
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {