@reventlessdev/reventless-aws 3.0.0-alpha.196 → 3.0.0-alpha.198

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -4,7 +4,6 @@ import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
-import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
@@ -21,6 +20,7 @@ import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res
 import * as AppSync_Error$ReventlessAws from "../../errors/AppSync_Error.res.mjs";
 import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as AppSync_SdlDecorate$ReventlessAws from "./AppSync_SdlDecorate.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -236,17 +236,6 @@ function _stampTypeDualAuth(decl) {
   }
 }
 
-let sharedIamTypeNames = [
-  "PageInfo",
-  "CommandAccepted",
-  "CommandRejected",
-  "CommandPending"
-];
-
-function stampSharedIamTypes(sdl) {
-  return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
-}
-
 function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
   let iamFields = {};
@@ -341,70 +330,23 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
       return decl;
     }
   });
-  let encoded = JSON.stringify(Object.fromEntries([
-    [
-      "types",
-      augmentedTypes.map(prim => prim)
-    ],
-    [
-      "mutations",
-      augmentedMutations.map(prim => prim)
-    ],
-    [
-      "queries",
-      augmentedQueries.map(prim => prim)
-    ],
-    [
-      "subscriptions",
-      parts.subscriptions.map(prim => prim)
-    ]
-  ]));
-  return {
-    encoded: encoded,
-    protocol: "graphql"
-  };
+  return GraphQL_Stitcher$ReventlessCore.encode({
+    types: augmentedTypes,
+    mutations: augmentedMutations,
+    queries: augmentedQueries,
+    subscriptions: parts.subscriptions,
+    subscriptionSources: parts.subscriptionSources
+  });
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
-  let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
-  let augmentedMutations = parts.mutations.map(field => {
-    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
-      return field + `\n    ` + _formatDualAuthDirective([group]);
-    } else {
-      return field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`;
-    }
-  });
-  let augmentedQueries = parts.queries.map(field => {
-    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
-      return field + ` ` + _formatDualAuthDirective([group]);
-    } else {
-      return field + ` @aws_auth(cognito_groups: ["` + group + `"])`;
-    }
-  });
-  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
-  let encoded = JSON.stringify(Object.fromEntries([
-    [
-      "types",
-      parts.types.map(prim => prim)
-    ],
-    [
-      "mutations",
-      augmentedMutations.map(prim => prim)
-    ],
-    [
-      "queries",
-      augmentedQueries.map(prim => prim)
-    ],
-    [
-      "subscriptions",
-      augmentedSubscriptions.map(prim => prim)
-    ]
-  ]));
-  return {
-    encoded: encoded,
-    protocol: "graphql"
-  };
+  return AppSync_SdlDecorate$ReventlessAws.injectAwsAuthAll(fragment, group, iamFieldNames);
+}
+
+function stitchWithAwsDirectives(baseFragment, pluginFragments) {
+  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(baseFragment, pluginFragments);
+  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, pluginFragments), sources));
 }
 
 function makeApiResource(name, opts) {
@@ -444,7 +386,7 @@ function generateFragment(mutationEntries, queryEntries) {
 
 function updateSchema(api, baseFragment, pluginFragments) {
   let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin", undefined);
-  let sdl = stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(augmentedBaseFragment, pluginFragments));
+  let sdl = stitchWithAwsDirectives(augmentedBaseFragment, pluginFragments);
   let resultPromise = {
     contents: Promise.resolve()
   };
@@ -456,6 +398,8 @@ function updateSchema(api, baseFragment, pluginFragments) {
   return resultPromise.contents;
 }
 
+let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
+
 export {
   log,
   sha256Hex,
@@ -474,10 +418,10 @@ export {
   _formatDualAuthDirective,
   _typeDeclName,
   _stampTypeDualAuth,
-  sharedIamTypeNames,
   stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,
+  stitchWithAwsDirectives,
   makeApiResource,
   generateFragment,
   updateSchema,

package/src/components/Api/AppSync_SdlDecorate.res

@@ -0,0 +1,189 @@
+// AppSync_SdlDecorate.res
+// Pure SDL decoration for the AppSync dialect — no AWS SDK, no Pulumi.
+//
+// Core emits provider-neutral SDL plus structured `subscriptionSource`
+// metadata (which mutation(s) feed each subscription field). This module adds
+// the AppSync-specific `@aws_subscribe(mutations: [...])` directive onto the
+// STITCHED schema at push time — the additive counterpart of the neutral
+// emission, mirroring how `injectAwsAuthAll`/`stampSharedIamTypes` decorate
+// auth. Runtime-pure so the bundled Lambda entry points
+// (AdminEventCollectorEntryPoint.mjs) can import it without dragging
+// deploy-time dependencies into the runtime module graph.
+
+/**
+Append `@aws_subscribe(mutations: [...])` to every field of the SDL's
+`type Subscription { … }` block that has a source mapping. Fields without a
+mapping (e.g. Source A event-stream fields, pushed via the Events API) are
+left untouched. No-op when the SDL has no Subscription block or `sources` is
+empty.
+*/
+let injectAwsSubscribe = (
+  sdl: string,
+  ~sources: array<ReventlessCore.GraphQL_Stitcher.subscriptionSource>,
+): string => {
+  if sources->Array.length == 0 {
+    sdl
+  } else {
+    let sourceByField: Dict.t<array<string>> = Dict.make()
+    sources->Array.forEach(source => sourceByField->Dict.set(source.field, source.mutations))
+    switch sdl->String.indexOfOpt("type Subscription") {
+    | None => sdl
+    | Some(blockStart) =>
+      let before = sdl->String.slice(~start=0, ~end=blockStart)
+      let rest = sdl->String.slice(~start=blockStart)
+      switch rest->String.indexOfOpt("}") {
+      | None => sdl
+      | Some(closeIdx) =>
+        let block = rest->String.slice(~start=0, ~end=closeIdx)
+        let after = rest->String.slice(~start=closeIdx)
+        let decorated =
+          block
+          ->String.split("\n")
+          ->Array.map(line => {
+            // `name(args): T` → the arg list is stripped; `name: T` (no args)
+            // leaves a trailing colon on the token — drop it (same rule as
+            // GraphQL_Stitcher.rootTypeFieldNames).
+            let name = ReventlessCore.GraphQL_Stitcher.extractLeadingName(line)
+            let name = name->String.endsWith(":")
+              ? name->String.slice(~start=0, ~end=name->String.length - 1)
+              : name
+            switch sourceByField->Dict.get(name) {
+            | Some(mutations) =>
+              let list = mutations->Array.map(m => `"${m}"`)->Array.join(", ")
+              `${line}\n    @aws_subscribe(mutations: [${list}])`
+            | None => line
+            }
+          })
+          ->Array.join("\n")
+        before ++ decorated ++ after
+      }
+    }
+  }
+}
+
+// ── Auth decoration (runtime-pure) ───────────────────────────────────────────
+// Moved here from AppSync_Adapter so the reactive single-writer push (the
+// bundled AdminEventCollector Lambda) can decorate the admin base identically to
+// the deploy path without dragging Pulumi into the runtime graph. AppSync_Adapter
+// delegates its `injectAwsAuthAll` / `stampSharedIamTypes` to these definitions.
+
+// Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
+// `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps it
+// open to any authenticated Cognito user. `@aws_iam` admits the deploy-time
+// SigV4 system caller.
+let formatDualAuthDirective = (groups: option<array<string>>): string => {
+  let cognito = switch groups {
+  | Some(g) =>
+    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
+    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
+  | None => `@aws_cognito_user_pools`
+  }
+  `${cognito} @aws_iam`
+}
+
+// Injects @aws_auth with the given group on ALL mutation, query, and subscription
+// fields in a fragment. `~iamFieldNames` opts the named mutation/query fields into
+// deploy-time IAM (dual-auth): those fields emit
+// `@aws_cognito_user_pools(cognito_groups: ["<group>"]) @aws_iam` instead of the
+// single-mode `@aws_auth(...)`, keeping the same Cognito gating while also admitting
+// the SigV4 system caller. Subscriptions are never IAM-marked.
+let injectAwsAuthAll = (
+  fragment: Reventless.Plugin.apiSchemaFragment,
+  ~group: string,
+  ~iamFieldNames: array<string>=[],
+): Reventless.Plugin.apiSchemaFragment => {
+  let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
+  let isIam = (field: string): bool =>
+    iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
+
+  let augmentedMutations = parts.mutations->Array.map(field =>
+    isIam(field)
+      ? `${field}\n    ${formatDualAuthDirective(Some([group]))}`
+      : `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+  )
+  let augmentedQueries = parts.queries->Array.map(field =>
+    isIam(field)
+      ? `${field} ${formatDualAuthDirective(Some([group]))}`
+      : `${field} @aws_auth(cognito_groups: ["${group}"])`
+  )
+  let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
+    `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+  )
+
+  ReventlessCore.GraphQL_Stitcher.encode({
+    ...parts,
+    mutations: augmentedMutations,
+    queries: augmentedQueries,
+    subscriptions: augmentedSubscriptions,
+  })
+}
+
+// Shared traversal types every callable surface reaches — `PageInfo` (relay
+// connections, injected by the stitcher) and the `CommandResult` members
+// (mutation returns, deduped across fragments by the stitcher). Stamped once on
+// the ASSEMBLED SDL: per-fragment stamping would race the stitcher's first-wins
+// dedupe against unstamped sibling copies.
+let sharedIamTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
+
+let stampSharedIamTypes = (sdl: string): string =>
+  sharedIamTypeNames->Array.reduce(sdl, (acc, name) =>
+    acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
+  )
+
+// ── Reactive push planner (runtime-pure) ─────────────────────────────────────
+// The AWS-decorated counterpart of core `GraphQL_PushPlanner.planPushes`: given
+// the fragments currently in the ApiFragmentRegistry (each tagged with its target
+// API, as the bare string "Domain" / "Platform"), it produces one fully
+// AppSync-decorated SDL push plan per API. It reuses the core planner for the
+// neutral base-selection + stitch, then applies the AppSync dialect exactly as the
+// deploy path's `stitchWithAwsDirectives`:
+//   - the admin base is auth-decorated (group "Admin" + dual-auth on the system-
+//     caller field names) BEFORE stitching, so the Platform/unified base carries
+//     @aws_auth/@aws_iam (the empty Domain-split base needs none);
+//   - @aws_subscribe is injected from the neutral subscriptionSources metadata;
+//   - the shared traversal types are stamped once on the assembled SDL.
+// Plugin fragments already carry their own per-field @aws_auth (baked at
+// generateFragment time), so they stitch in as-is. `api` comes back as the bare
+// string "PlatformApi" / "DomainApi" for the mjs to map onto the AppSync ids.
+type targetedFragmentInput = {
+  encoded: string,
+  protocol: string,
+  // "Domain" | "Platform" — the bare-string runtime form of Reventless.Plugin.apiTarget.
+  target: string,
+}
+
+type awsPushPlan = {
+  // "PlatformApi" | "DomainApi" — the bare-string runtime form of GraphQL_PushPlanner.planTarget.
+  api: string,
+  sdl: string,
+}
+
+let planAwsPushes = (
+  ~rawAdminBase: Reventless.Plugin.apiSchemaFragment,
+  ~iamFieldNames: array<string>,
+  ~fragments: array<targetedFragmentInput>,
+  ~splitApi: bool,
+): array<awsPushPlan> => {
+  let authBase = injectAwsAuthAll(rawAdminBase, ~group="Admin", ~iamFieldNames)
+  let targeted = fragments->Array.map((f): ReventlessCore.GraphQL_PushPlanner.targetedFragment => {
+    fragment: {encoded: f.encoded, protocol: f.protocol},
+    target: switch f.target {
+    | "Platform" => Platform
+    | _ => Domain
+    },
+  })
+  let allFrags = targeted->Array.map(t => t.fragment)
+  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
+    ~baseFragment=rawAdminBase,
+    ~pluginFragments=allFrags,
+  )
+  ReventlessCore.GraphQL_PushPlanner.planPushes(~adminBase=authBase, ~fragments=targeted, ~splitApi)
+  ->Array.map(plan => {
+    let sdl = plan.sdl->injectAwsSubscribe(~sources)->stampSharedIamTypes
+    let api = switch plan.api {
+    | PlatformApi => "PlatformApi"
+    | DomainApi => "DomainApi"
+    }
+    {api, sdl}
+  })
+}

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -0,0 +1,125 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as GraphQL_PushPlanner$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_PushPlanner.res.mjs";
+
+function injectAwsSubscribe(sdl, sources) {
+  if (sources.length === 0) {
+    return sdl;
+  }
+  let sourceByField = {};
+  sources.forEach(source => {
+    sourceByField[source.field] = source.mutations;
+  });
+  let blockStart = Stdlib_String.indexOfOpt(sdl, "type Subscription");
+  if (blockStart === undefined) {
+    return sdl;
+  }
+  let before = sdl.slice(0, blockStart);
+  let rest = sdl.slice(blockStart);
+  let closeIdx = Stdlib_String.indexOfOpt(rest, "}");
+  if (closeIdx === undefined) {
+    return sdl;
+  }
+  let block = rest.slice(0, closeIdx);
+  let after = rest.slice(closeIdx);
+  let decorated = block.split("\n").map(line => {
+    let name = GraphQL_Stitcher$ReventlessCore.extractLeadingName(line);
+    let name$1 = name.endsWith(":") ? name.slice(0, name.length - 1 | 0) : name;
+    let mutations = sourceByField[name$1];
+    if (mutations === undefined) {
+      return line;
+    }
+    let list = mutations.map(m => `"` + m + `"`).join(", ");
+    return line + `\n    @aws_subscribe(mutations: [` + list + `])`;
+  }).join("\n");
+  return before + decorated + after;
+}
+
+function formatDualAuthDirective(groups) {
+  let cognito;
+  if (groups !== undefined) {
+    let quoted = groups.map(x => `"` + x + `"`).join(", ");
+    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
+  } else {
+    cognito = `@aws_cognito_user_pools`;
+  }
+  return cognito + ` @aws_iam`;
+}
+
+function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
+  let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
+  let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let augmentedMutations = parts.mutations.map(field => {
+    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
+      return field + `\n    ` + formatDualAuthDirective([group]);
+    } else {
+      return field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`;
+    }
+  });
+  let augmentedQueries = parts.queries.map(field => {
+    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
+      return field + ` ` + formatDualAuthDirective([group]);
+    } else {
+      return field + ` @aws_auth(cognito_groups: ["` + group + `"])`;
+    }
+  });
+  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
+  return GraphQL_Stitcher$ReventlessCore.encode({
+    types: parts.types,
+    mutations: augmentedMutations,
+    queries: augmentedQueries,
+    subscriptions: augmentedSubscriptions,
+    subscriptionSources: parts.subscriptionSources
+  });
+}
+
+let sharedIamTypeNames = [
+  "PageInfo",
+  "CommandAccepted",
+  "CommandRejected",
+  "CommandPending"
+];
+
+function stampSharedIamTypes(sdl) {
+  return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
+}
+
+function planAwsPushes(rawAdminBase, iamFieldNames, fragments, splitApi) {
+  let authBase = injectAwsAuthAll(rawAdminBase, "Admin", iamFieldNames);
+  let targeted = fragments.map(f => {
+    let match = f.target;
+    let tmp = match === "Platform" ? "Platform" : "Domain";
+    return {
+      fragment: {
+        encoded: f.encoded,
+        protocol: f.protocol
+      },
+      target: tmp
+    };
+  });
+  let allFrags = targeted.map(t => t.fragment);
+  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(rawAdminBase, allFrags);
+  return GraphQL_PushPlanner$ReventlessCore.planPushes(authBase, targeted, splitApi).map(plan => {
+    let sdl = stampSharedIamTypes(injectAwsSubscribe(plan.sdl, sources));
+    let match = plan.api;
+    let api;
+    api = match === "DomainApi" ? "DomainApi" : "PlatformApi";
+    return {
+      api: api,
+      sdl: sdl
+    };
+  });
+}
+
+export {
+  injectAwsSubscribe,
+  formatDualAuthDirective,
+  injectAwsAuthAll,
+  sharedIamTypeNames,
+  stampSharedIamTypes,
+  planAwsPushes,
+}
+/* GraphQL_Stitcher-ReventlessCore Not a pure module */

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -12,6 +12,14 @@ type adminConfig = {
   schedulerQueueName: option<Pulumi.Output.t<string>>,
   appSyncApiId: option<Pulumi.Output.t<string>>,
   clonerEnabled: bool,
+  // Reactive ApiFragmentRegistry single writer (2e), admin EventCollector only:
+  // the Platform AppSync id (split mode; unified → same as appSyncApiId), the
+  // ApiFragments StateViewSlice table it scans, the admin DCB command-topic FIFO
+  // URL it dispatches RecordApiFragmentPush to, and the split/unified mode flag.
+  platformApiId: option<Pulumi.Output.t<string>>,
+  apiFragmentRegistryTableName: option<Pulumi.Output.t<string>>,
+  adminDcbCmdTopicUrl: option<Pulumi.Output.t<string>>,
+  splitApi: bool,
 }
 
 let configRef: ref<adminConfig> = ref({
@@ -23,6 +31,10 @@ let configRef: ref<adminConfig> = ref({
   schedulerQueueName: None,
   appSyncApiId: None,
   clonerEnabled: false,
+  platformApiId: None,
+  apiFragmentRegistryTableName: None,
+  adminDcbCmdTopicUrl: None,
+  splitApi: false,
 })
 
 type sliceModulePaths = {
@@ -48,6 +60,17 @@ let registerStateChangeSliceSpec = (~specPath: string, ~behaviorPath: string) =>
   let _ = registeredSliceModulePaths->Array.push({specPath, behaviorPath})
 }
 
+/**
+Redundant with the seams that populate `dcbConfigRef` automatically:
+`pluginName` is set by `registerPluginName` (called from `Plugin_Builder.make`
+when the plugin builds), the DCB table name by `registerDcbTableName`, and slice
+module paths by `registerStateChangeSliceSpec` (from each slice's `moduleUrl`).
+No deploy program needs to call this. Kept only so any out-of-tree caller still
+compiles; slated for removal.
+*/
+@deprecated(
+  "pluginName is auto-registered by Plugin_Builder.make; use registerDcbTableName / registerStateChangeSliceSpec for the other fields. This call is unnecessary and will be removed."
+)
 let registerDcbConfig = (~pluginName, ~dcbTableName=?, ~stateChangeSliceModulePaths=[], ()) => {
   dcbConfigRef := {pluginName, dcbTableName, stateChangeSliceModulePaths}
   stateChangeSliceModulePaths->Array.length
@@ -94,6 +117,10 @@ let registerConfig = (
   ~schedulerQueueName=?,
   ~appSyncApiId=?,
   ~clonerEnabled=false,
+  ~platformApiId=?,
+  ~apiFragmentRegistryTableName=?,
+  ~adminDcbCmdTopicUrl=?,
+  ~splitApi=false,
   (),
 ) =>
   configRef := {
@@ -105,6 +132,10 @@ let registerConfig = (
     schedulerQueueName,
     appSyncApiId,
     clonerEnabled,
+    platformApiId,
+    apiFragmentRegistryTableName,
+    adminDcbCmdTopicUrl,
+    splitApi,
   }
 
 // PluginRuntime_Builder is a functor so that the caller can inject the EventCollectorChannel
@@ -144,13 +175,15 @@ module Make = (
     // Stable JSON literal — matches Reventless.Plugin.pluginDefinitionSchema
     // (optional fields encoded as null via js_nullable).
     let fakePluginDefinitionJson =
-      `{"id":"Admin@INTERNAL","name":"Admin","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"uiFragments":null,"structure":null}`->Pulumi.Output.make
+      `{"id":"Admin@INTERNAL","name":"Admin","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"structure":null}`->Pulumi.Output.make
     let adminEpEventTopicArn = switch config.eventTopicArn {
     | Some(arn) => arn
     | None => Pulumi.Output.make("NOT_AVAILABLE")
     }
     {
       pluginDefinitionJson: fakePluginDefinitionJson,
+      // Admin ships no UI-fragment manifest.
+      uiFragmentsJson: "null"->Pulumi.Output.make,
       extensionPoints: [
         {
           specModule: ReventlessCore.Plugin_Helpers.adminPluginExtensionPointSpecModule,
@@ -286,6 +319,9 @@ module Make = (
         config.appSyncApiId->outputOrPlaceholder->Obj.magic,
         epEventTopicArnsOutput->Pulumi.Output.asInput->Obj.magic,
         config.pluginSchemaPersistenceTableName->outputOrPlaceholder->Obj.magic,
+        config.platformApiId->outputOrPlaceholder->Obj.magic,
+        config.apiFragmentRegistryTableName->outputOrPlaceholder->Obj.magic,
+        config.adminDcbCmdTopicUrl->outputOrPlaceholder->Obj.magic,
       ])
       ->Pulumi.Output.apply(values => {
         let queueUrl = values->Array.getUnsafe(0)
@@ -298,6 +334,9 @@ module Make = (
         let appSyncApiId = values->Array.getUnsafe(7)
         let epEventTopicArns: array<string> = Obj.magic(values->Array.getUnsafe(8))
         let schemaPersistenceTable = values->Array.getUnsafe(9)
+        let platformApiId = values->Array.getUnsafe(10)
+        let apiFragmentRegistryTable = values->Array.getUnsafe(11)
+        let adminDcbCmdTopicUrl = values->Array.getUnsafe(12)
 
         let dict = Dict.make()
         dict->Dict.set("queueUrl", JSON.Encode.string(queueUrl))
@@ -309,6 +348,12 @@ module Make = (
           JSON.Encode.string(schemaPersistenceTable),
         )
         dict->Dict.set("appSyncApiId", JSON.Encode.string(appSyncApiId))
+        // Reactive ApiFragmentRegistry single writer (2e) — placeholders for
+        // plugin ECs / all-at-once platforms disable it in the mjs.
+        dict->Dict.set("platformApiId", JSON.Encode.string(platformApiId))
+        dict->Dict.set("apiFragmentRegistryTableName", JSON.Encode.string(apiFragmentRegistryTable))
+        dict->Dict.set("adminDcbCmdTopicUrl", JSON.Encode.string(adminDcbCmdTopicUrl))
+        dict->Dict.set("splitApi", JSON.Encode.bool(config.splitApi))
         dict->Dict.set("clonerEnabled", JSON.Encode.bool(config.clonerEnabled))
         dict->Dict.set("schedulerRoleArn", JSON.Encode.string(schedRoleArn))
         dict->Dict.set("schedulerQueueArn", JSON.Encode.string(schedQueueArn))
@@ -469,9 +514,15 @@ module Make = (
     // is identity at runtime, so the Output unwraps correctly inside the
     // Lambda Function args.
     let bundleOutput =
-      context.pluginDefinitionJson->Pulumi.Output.apply(pluginDefinitionJson => {
+      (context.pluginDefinitionJson, context.uiFragmentsJson)
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((pluginDefinitionJson, uiFragmentsJson)) => {
         let extraStringAssets = Dict.make()
         extraStringAssets->Dict.set("pluginDefinition.json", pluginDefinitionJson)
+        // The UI-fragment manifest no longer rides pluginDefinition — ship it as
+        // its own asset ("null" for plugins without a UI) so the bundled Connect
+        // extension can emit RegisterUiFragment in the handshake answer.
+        extraStringAssets->Dict.set("uiFragments.json", uiFragmentsJson)
         Util_Bundle.buildCodeArchive(
           ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/AdminEventCollectorEntryPoint.mjs",
           ~packageDirs,
@@ -621,6 +672,71 @@ module Make = (
         )
       | None => ()
       }
+
+      // 2e: the reactive ApiFragmentRegistry single writer scans the ApiFragments
+      // StateViewSlice table to re-fold the registry on each ApiFragment* event.
+      // The table is owned by the admin DcbBuilder, so grant Scan explicitly.
+      switch config.apiFragmentRegistryTableName {
+      | Some(tableOutput) =>
+        let policyJson =
+          tableOutput->Pulumi.Output.apply(tableName =>
+            PulumiAws.PolicyDocument.make(
+              ~id=`${name}ApiFragmentsScanPolicy`,
+              ~statements=[
+                {
+                  sid: "AllowAdminScanApiFragments",
+                  effect: Allow,
+                  actions: Actions(["dynamodb:Scan"]),
+                  resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
+                },
+              ],
+            )->PulumiAws.PolicyDocument.toJsonString
+          )
+        let _ = PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-apiFragmentsScan`,
+          ~args={
+            policy: policyJson->Pulumi.Output.asInput,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
+        )
+      | None => ()
+      }
+
+      // 2e: the reactive push writes the outcome back with RecordApiFragmentPush,
+      // dispatched onto the admin DCB command-topic FIFO queue — grant
+      // sqs:SendMessage on it (queue URL → ARN, same derivation as
+      // publishToAggregates below).
+      switch config.adminDcbCmdTopicUrl {
+      | Some(urlOutput) =>
+        let policyJson =
+          urlOutput->Pulumi.Output.apply(url => {
+            let arn = switch url->String.split("/") {
+            | [_, _, host, acct, qn] =>
+              let region = host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
+              `arn:aws:sqs:${region}:${acct}:${qn}`
+            | _ => url
+            }
+            PulumiAws.PolicyDocument.make(
+              ~id=`${name}AdminDcbSendPolicy`,
+              ~statements=[
+                {
+                  sid: "AllowAdminDispatchRecordApiFragmentPush",
+                  effect: Allow,
+                  actions: Actions(["sqs:SendMessage"]),
+                  resources: Resource(arn),
+                },
+              ],
+            )->PulumiAws.PolicyDocument.toJsonString
+          })
+        let _ = PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-adminDcbSend`,
+          ~args={
+            policy: policyJson->Pulumi.Output.asInput,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
+        )
+      | None => ()
+      }
     }
 
     // Plugin EC sqs:SendMessage grants on the aggregate / StateChangeSlice