@reventlessdev/reventless-aws 3.0.0-alpha.182 → 3.0.0-alpha.184

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.184 (2026-07-08)
+
+### Bug Fixes
+
+* **reventless-aws:** exclude internal rows from Platform_Plugins connection scan ([df14af2](https://github.com/ReventlessDev/reventless-core/commit/df14af2cbd70d49062f2afc03418cdbf18d151d6))
+
+
+# 3.0.0-alpha.183 (2026-07-08)
+
+### Bug Fixes
+
+* **reventless-aws:** stop admin-base schema clobber of split-mode DomainApi ([afce85f](https://github.com/ReventlessDev/reventless-core/commit/afce85fa57474735cea3dcb1c2a151c2d8804f0e))
+
+
 # 3.0.0-alpha.182 (2026-07-07)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.182",
+  "version": "3.0.0-alpha.184",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,16 +9,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.46",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.25",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.47",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.14",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.144",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.145",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.90",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.68",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.8"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.9",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.68"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -689,37 +689,56 @@ module MakeWithConfig = (
     //   - split mode: platformApi from splitApiOutputsRef
     //   - unified mode / not-yet-populated: domainApi
     preAdminResolversSchemaHook: (~adminBarrier) => {
-      let targetApi = switch splitApiOutputsRef.contents {
-      | Some({platformApi}) => platformApi
-      | None => domainApi
+      // The admin-base SDL stitches AdminApi.baseFragment with an EMPTY plugin
+      // list, and startSchemaCreation REPLACES the whole schema. In split mode
+      // the admin schema belongs on the PlatformApi ONLY — the DomainApi carries
+      // plugin fields (emptyBaseFragment). If we pushed the admin-base-only SDL
+      // to the DomainApi it would wipe every plugin field, leaving exactly the
+      // admin-base set (the alpha 2026-07-08 clobber). So in split mode we push
+      // ONLY when the PlatformApi is known; if the ref is not yet populated we
+      // SKIP (never fall back to domainApi). Unified mode legitimately shares one
+      // API, so an unpopulated ref there means domainApi.
+      let targetApiOpt = switch (Config.splitApi, splitApiOutputsRef.contents) {
+      | (_, Some({platformApi})) => Some(platformApi)
+      | (false, None) => Some(domainApi)
+      | (true, None) => None
       }
-      let adminBaseFragment = AppSync_Adapter.injectAwsAuthAll(
-        ReventlessCore.AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group="Admin",
-      )
-      let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
-        ~baseFragment=adminBaseFragment,
-        ~pluginFragments=[],
-      )->AppSync_Adapter.stampSharedIamTypes
-      (targetApi, adminBarrier)
-      ->Pulumi.Output.all2
-      ->Pulumi.Output.flatMap(((api, _)) =>
-        api.id->Pulumi.Output.flatMap(apiId => {
-          log.info(~comp="preAdminResolversSchemaHook", `Pushing admin schema to ${apiId}`)
-          let client = AppSync_Adapter.getClient()
-          client
-          ->AppSync_Adapter.startSchemaCreationRetrying({apiId, definition: sdl})
-          ->Promise.then(async _ => {
-            log.info(
-              ~comp="preAdminResolversSchemaHook",
-              "startSchemaCreation called, waiting for ACTIVE",
-            )
-            await AppSync_Adapter.waitForSchemaActive(client, apiId)
-            log.info(~comp="preAdminResolversSchemaHook", "schema is ACTIVE")
+      switch targetApiOpt {
+      | None =>
+        log.error(
+          ~comp="preAdminResolversSchemaHook",
+          "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)",
+        )
+        adminBarrier
+      | Some(targetApi) =>
+        let adminBaseFragment = AppSync_Adapter.injectAwsAuthAll(
+          ReventlessCore.AdminApi.baseFragment(~cloner=Config.cloner),
+          ~group="Admin",
+        )
+        let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
+          ~baseFragment=adminBaseFragment,
+          ~pluginFragments=[],
+        )->AppSync_Adapter.stampSharedIamTypes
+        (targetApi, adminBarrier)
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.flatMap(((api, _)) =>
+          api.id->Pulumi.Output.flatMap(apiId => {
+            log.info(~comp="preAdminResolversSchemaHook", `Pushing admin schema to ${apiId}`)
+            let client = AppSync_Adapter.getClient()
+            client
+            ->AppSync_Adapter.startSchemaCreationRetrying({apiId, definition: sdl})
+            ->Promise.then(async _ => {
+              log.info(
+                ~comp="preAdminResolversSchemaHook",
+                "startSchemaCreation called, waiting for ACTIVE",
+              )
+              await AppSync_Adapter.waitForSchemaActive(client, apiId)
+              log.info(~comp="preAdminResolversSchemaHook", "schema is ACTIVE")
+            })
+            ->Pulumi.Output.fromPromise
           })
-          ->Pulumi.Output.fromPromise
-        })
-      )
+        )
+      }
     },
 
     // Accumulate fragments across independent plugin deployments: each plugin
@@ -957,26 +976,44 @@ module MakeWithConfig = (
                   ~sdl=s,
                   ~typeName="Subscription",
                 )
+              // Identity-aware drift check (not a bare count): the live schema is
+              // "intact" only when it is a SUPERSET of every root field we would
+              // push. Comparing name SETS heals equal-cardinality drift and field
+              // *swaps* — an admin-base clobber that leaves the DomainApi with the
+              // SAME number of root fields but the WRONG ones (admin-base instead
+              // of plugin fields) has a matching count yet is missing every
+              // expected plugin field, so a count test would wrongly skip.
+              let missingFields = ReventlessCore.GraphQL_Stitcher.missingRootFields(
+                ~expectedSdl=sdl,
+                ~liveSdl,
+              )
               let skipPush = switch storedHash {
               | Some(prev) if prev == currentHash =>
-                let expected = countRoots(sdl)
-                let live = countRoots(liveSdl)
                 if liveSdl == "" {
                   log.info(
                     ~comp="preResolversSchemaHook",
                     `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`,
                   )
                   false
-                } else if live < expected {
+                } else if missingFields->Array.length > 0 {
                   log.info(
                     ~comp="preResolversSchemaHook",
-                    `hash matches but live schema drifted (${live->Int.toString} root field(s) live vs ${expected->Int.toString} expected) — forcing repair push`,
+                    `hash matches but live schema is missing ${missingFields
+                      ->Array.length
+                      ->Int.toString} expected root field(s) (e.g. ${missingFields
+                      ->Array.slice(~start=0, ~end=5)
+                      ->Array.join(", ")}) — forcing repair push`,
                   )
                   false
                 } else {
                   log.info(
                     ~comp="preResolversSchemaHook",
-                    `SDL unchanged (hash ${currentHash->String.slice(~start=0, ~end=12)}…) and live schema intact (${live->Int.toString} root fields); skipping push`,
+                    `SDL unchanged (hash ${currentHash->String.slice(
+                        ~start=0,
+                        ~end=12,
+                      )}…) and live schema is a superset of the expected root fields (${countRoots(
+                        liveSdl,
+                      )->Int.toString} live); skipping push`,
                   )
                   true
                 }

package/src/Platform.res.mjs

@@ -645,23 +645,12 @@ function MakeWithConfig(Config) {
           let client = AppSync_Adapter$ReventlessAws.getClient();
           let liveSdl = await AppSync_Adapter$ReventlessAws.getIntrospectionSdl(client, apiId);
           let countRoots = s => (GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Mutation") + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Query") | 0) + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Subscription") | 0;
-          let skipPush;
-          if (storedHash !== undefined && storedHash === currentHash) {
-            let expected = countRoots(sdl);
-            let live = countRoots(liveSdl);
-            if (liveSdl === "") {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`);
-              skipPush = false;
-            } else if (live < expected) {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema drifted (` + live.toString() + ` root field(s) live vs ` + expected.toString() + ` expected) — forcing repair push`);
-              skipPush = false;
-            } else {
-              log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema intact (` + live.toString() + ` root fields); skipping push`);
-              skipPush = true;
-            }
-          } else {
-            skipPush = false;
-          }
+          let missingFields = GraphQL_Stitcher$ReventlessCore.missingRootFields(sdl, liveSdl);
+          let skipPush = storedHash !== undefined && storedHash === currentHash ? (
+              liveSdl === "" ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`), false) : (
+                  missingFields.length !== 0 ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema is missing ` + missingFields.length.toString() + ` expected root field(s) (e.g. ` + missingFields.slice(0, 5).join(", ") + `) — forcing repair push`), false) : (log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema is a superset of the expected root fields (` + countRoots(liveSdl).toString() + ` live); skipping push`), true)
+                )
+            ) : false;
           if (!skipPush) {
             if (GraphQL_Stitcher$ReventlessCore.isCatastrophicSchemaShrink(liveSdl, sdl, deploySchemaShrinkThreshold)) {
               return log.error("preResolversSchemaHook", undefined, `ABORTED schema push for ` + apiId + `: stitched SDL (` + countRoots(sdl).toString() + ` root field(s)) would catastrophically shrink the live schema (` + countRoots(liveSdl).toString() + ` root field(s), threshold ` + deploySchemaShrinkThreshold.toString() + `) — refusing to clobber resolvers (likely a stale concurrent-deploy scan)`);
@@ -692,24 +681,30 @@ function MakeWithConfig(Config) {
   };
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
-    let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
-    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
-    return Output$Pulumi.flatMap(Pulumi.all([
-      targetApi,
-      adminBarrier
-    ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
-      log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
-      let client = AppSync_Adapter$ReventlessAws.getClient();
-      return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
-        apiId: apiId,
-        definition: sdl
-      }).then(async () => {
-        log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
-        await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
-        return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
-      });
-    }));
+    let targetApiOpt = match !== undefined ? match.platformApi : (
+        Config.splitApi ? undefined : domainApi
+      );
+    if (targetApiOpt !== undefined) {
+      let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
+      return Output$Pulumi.flatMap(Pulumi.all([
+        targetApiOpt,
+        adminBarrier
+      ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
+        log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
+        let client = AppSync_Adapter$ReventlessAws.getClient();
+        return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
+          apiId: apiId,
+          definition: sdl
+        }).then(async () => {
+          log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
+          await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
+          return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
+        });
+      }));
+    }
+    log.error("preAdminResolversSchemaHook", undefined, "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)");
+    return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
@@ -1876,23 +1871,12 @@ function Make($star) {
           let client = AppSync_Adapter$ReventlessAws.getClient();
           let liveSdl = await AppSync_Adapter$ReventlessAws.getIntrospectionSdl(client, apiId);
           let countRoots = s => (GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Mutation") + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Query") | 0) + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Subscription") | 0;
-          let skipPush;
-          if (storedHash !== undefined && storedHash === currentHash) {
-            let expected = countRoots(sdl);
-            let live = countRoots(liveSdl);
-            if (liveSdl === "") {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`);
-              skipPush = false;
-            } else if (live < expected) {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema drifted (` + live.toString() + ` root field(s) live vs ` + expected.toString() + ` expected) — forcing repair push`);
-              skipPush = false;
-            } else {
-              log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema intact (` + live.toString() + ` root fields); skipping push`);
-              skipPush = true;
-            }
-          } else {
-            skipPush = false;
-          }
+          let missingFields = GraphQL_Stitcher$ReventlessCore.missingRootFields(sdl, liveSdl);
+          let skipPush = storedHash !== undefined && storedHash === currentHash ? (
+              liveSdl === "" ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`), false) : (
+                  missingFields.length !== 0 ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema is missing ` + missingFields.length.toString() + ` expected root field(s) (e.g. ` + missingFields.slice(0, 5).join(", ") + `) — forcing repair push`), false) : (log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema is a superset of the expected root fields (` + countRoots(liveSdl).toString() + ` live); skipping push`), true)
+                )
+            ) : false;
           if (!skipPush) {
             if (GraphQL_Stitcher$ReventlessCore.isCatastrophicSchemaShrink(liveSdl, sdl, deploySchemaShrinkThreshold)) {
               return log.error("preResolversSchemaHook", undefined, `ABORTED schema push for ` + apiId + `: stitched SDL (` + countRoots(sdl).toString() + ` root field(s)) would catastrophically shrink the live schema (` + countRoots(liveSdl).toString() + ` root field(s), threshold ` + deploySchemaShrinkThreshold.toString() + `) — refusing to clobber resolvers (likely a stale concurrent-deploy scan)`);
@@ -1923,24 +1907,28 @@ function Make($star) {
   };
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
-    let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
-    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
-    return Output$Pulumi.flatMap(Pulumi.all([
-      targetApi,
-      adminBarrier
-    ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
-      log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
-      let client = AppSync_Adapter$ReventlessAws.getClient();
-      return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
-        apiId: apiId,
-        definition: sdl
-      }).then(async () => {
-        log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
-        await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
-        return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
-      });
-    }));
+    let targetApiOpt = match !== undefined ? match.platformApi : undefined;
+    if (targetApiOpt !== undefined) {
+      let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
+      return Output$Pulumi.flatMap(Pulumi.all([
+        targetApiOpt,
+        adminBarrier
+      ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
+        log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
+        let client = AppSync_Adapter$ReventlessAws.getClient();
+        return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
+          apiId: apiId,
+          definition: sdl
+        }).then(async () => {
+          log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
+          await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
+          return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
+        });
+      }));
+    }
+    log.error("preAdminResolversSchemaHook", undefined, "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)");
+    return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -57,6 +57,17 @@ export function response(ctx) {
 }
 `->Pulumi.Input.make
 
+/** The discriminator attribute whose absence marks an internal bookkeeping row for a
+    read model whose physical DynamoDB table co-hosts rows written outside the projection.
+    Only the Plugins admin RM has this: its table also holds `deploy-schema:*` /
+    `plugin-info:*` / `deploy-schema-hash:*` rows (Platform.res preResolversSchemaHook)
+    that carry no `name`. Returning `Some(attr)` makes the Connection Scan emit an
+    `attribute_exists(#attr)` filter so those rows never reach the non-null GraphQL schema.
+    `name` is the already-capitalized read-model name (spec name, e.g. "Plugins").
+    See docs/plans/platform-plugins-admin-connection-null-rows.md. */
+let internalRowRequiredAttr = (name: string): option<string> =>
+  name == "Plugins" ? Some("name") : None
+
 let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   ~name: string,
   ~api: api,
@@ -217,6 +228,15 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       )->Array.forEach(msg => log.warn(~comp="QueryDbResolvers_AppSync", msg))
     | None => ()
     }
+    // The Plugins admin RM's DynamoDB table co-hosts deploy-time infra rows
+    // (`deploy-schema:<name>`, `plugin-info:<name>`, `deploy-schema-hash:<apiId>`)
+    // written directly by the platform (Platform.res preResolversSchemaHook), not by
+    // the projection. Those rows carry no `name` attribute, so an unfiltered Scan
+    // resolves `name: String!` to null → non-null violation that nulls the entire
+    // Platform_PluginConnection. Exclude them with an `attribute_exists(#name)` filter
+    // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
+    // See docs/plans/platform-plugins-admin-connection-null-rows.md.
+    let requireAttribute = internalRowRequiredAttr(name)
     let resolverAll = makeQueryResolver(
       ~resolverName=fieldNameForAll->String.capitalize,
       ~field=fieldNameForAll->Pulumi.Input.make,
@@ -226,6 +246,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~filterFields=filterFieldNames,
           ~rangeFields=rangeFieldNames,
           ~sortFields=sortFieldNames,
+          ~requireAttribute?,
         )
       } else {
         Resolver.Functions.listAllItems

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -58,6 +58,12 @@ export function response(ctx) {
 `;
 }
 
+function internalRowRequiredAttr(name) {
+  if (name === "Plugins") {
+    return "name";
+  }
+}
+
 function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolverConfigs, idsResolverConfigs, param, opts) {
   let name$1 = Stdlib_String.capitalize(name);
   let registryEntry = Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name$1];
@@ -100,7 +106,8 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
       ).concat(Stdlib_Array.filterMap(indexes, param => param.subIdField));
       GraphQL_FragmentGenerator$ReventlessCore.validateScanSortAlignment(stateSchemaOpt, name$1, knownSortFields).forEach(msg => log.warn("QueryDbResolvers_AppSync", undefined, msg));
     }
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let requireAttribute = internalRowRequiredAttr(name$1);
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.map(indexConfig => {
       let index = indexConfig.index;
       let stripLeadingBy = s => {
@@ -238,6 +245,7 @@ export {
   log,
   queryInterceptorConfig,
   interceptorCode,
+  internalRowRequiredAttr,
   make,
 }
 /* log Not a pure module */

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -0,0 +1,40 @@
+open JestGlobals
+
+// Regression guard for docs/plans/platform-plugins-admin-connection-null-rows.md:
+// the Plugins admin RM shares its DynamoDB table with internal bookkeeping rows
+// (`deploy-schema:*`, `plugin-info:*`, `deploy-schema-hash:*`) that carry no `name`.
+// The auto-generated Connection Scan must exclude them, or `name: String!` resolves
+// to null and nulls the entire Platform_PluginConnection ("No data" on the page).
+
+// `Pulumi.Input.make` is `%identity`, so a generated resolver's `Pulumi.Input.t<string>`
+// IS the underlying JS string — recover it with Obj.magic for assertion.
+let codeOf = (input: Pulumi.Input.t<string>): string => Obj.magic(input)
+
+describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
+  testSync("Plugins RM requires the `name` discriminator", () => {
+    expect(QueryDbResolvers_AppSync.internalRowRequiredAttr("Plugins"))->toEqual(Some("name"))
+  })
+
+  testSync("ordinary read models require nothing (unchanged behaviour)", () => {
+    expect(QueryDbResolvers_AppSync.internalRowRequiredAttr("Products"))->toEqual(None)
+    expect(QueryDbResolvers_AppSync.internalRowRequiredAttr("Orders"))->toEqual(None)
+  })
+})
+
+describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
+  testSync("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
+    let code =
+      AppSync_Resolver_Retrying.Functions.listAllItemsConnection(
+        ~labelField="name",
+        ~requireAttribute="name",
+      )->codeOf
+    expect(code->String.includes("attribute_exists(#name)"))->toBe(true)
+    expect(code->String.includes("names['#name'] = 'name'"))->toBe(true)
+  })
+
+  testSync("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
+    let code =
+      AppSync_Resolver_Retrying.Functions.listAllItemsConnection(~labelField="name")->codeOf
+    expect(code->String.includes("attribute_exists"))->toBe(false)
+  })
+})

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -0,0 +1,35 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+import * as QueryDbResolvers_AppSync$ReventlessAws from "../src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs";
+
+function codeOf(input) {
+  return input;
+}
+
+globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
+  globalThis.test("Plugins RM requires the `name` discriminator", () => {
+    globalThis.expect(QueryDbResolvers_AppSync$ReventlessAws.internalRowRequiredAttr("Plugins")).toEqual("name");
+  });
+  globalThis.test("ordinary read models require nothing (unchanged behaviour)", () => {
+    globalThis.expect(QueryDbResolvers_AppSync$ReventlessAws.internalRowRequiredAttr("Products")).toEqual(undefined);
+    globalThis.expect(QueryDbResolvers_AppSync$ReventlessAws.internalRowRequiredAttr("Orders")).toEqual(undefined);
+  });
+});
+
+globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
+  globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name");
+    globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
+    globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
+  });
+  globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+    globalThis.expect(code.includes("attribute_exists")).toBe(false);
+  });
+});
+
+export {
+  codeOf,
+}
+/*  Not a pure module */