@reventlessdev/reventless-aws 3.0.0-alpha.197 → 3.0.0-alpha.198

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -1,7 +1,7 @@
 // AWS resolver for the `Platform_UIFragments` admin GraphQL query.
 //
-// Backed by a Lambda DataSource that scans the UIFragmentRegistry read model
-// (one item per plugin whose pluginDefinition carries a uiFragments manifest).
+// Backed by a Lambda DataSource that scans the UiFragments StateViewSlice table
+// (one item per plugin with a registered UI-fragment manifest).
 // The persisted state is sury-encoded with the same shape the in-memory adapter's
 // `Platform_UIFragmentsApi.encodeUIFragmentEntry` produces (null-encoded options,
 // nested panel/page objects), so the handler simply returns the rows as-is.
@@ -34,11 +34,11 @@ export async function handler() {
   } while (exclusiveStartKey);
 
   // Platform invariant: one version per plugin at a time, so the UI sees just
-  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
-  // accumulates one row per deployed plugin version and carries no lifecycle
-  // status of its own, so without deduping a redeployed federation plugin would
-  // surface duplicate fragments. Collapse to the highest version per plugin name
-  // (mirrors ReventlessCore.Plugin.compareVersions).
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The registry is
+  // keyed by bare plugin name (a no-op for the split below), but rows persisted
+  // by the pre-slice registry were keyed name@version — keep the collapse to the
+  // highest version per plugin name (mirrors ReventlessCore.Plugin.compareVersions)
+  // so a mixed table never surfaces duplicate fragments.
   const cmpVer = (a, b) => {
     const pa = String(a).replace(/[-+]/g, ".").split(".");
     const pb = String(b).replace(/[-+]/g, ".").split(".");
@@ -117,7 +117,7 @@ let make = (
                 resources: Resource("arn:aws:logs:*:*:*"),
               },
               {
-                sid: "AllowScanUIFragmentRegistryRm",
+                sid: "AllowScanUiFragmentsTable",
                 effect: Allow,
                 actions: Actions(["dynamodb:Scan"]),
                 resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -40,11 +40,11 @@ export async function handler() {
   } while (exclusiveStartKey);
 
   // Platform invariant: one version per plugin at a time, so the UI sees just
-  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
-  // accumulates one row per deployed plugin version and carries no lifecycle
-  // status of its own, so without deduping a redeployed federation plugin would
-  // surface duplicate fragments. Collapse to the highest version per plugin name
-  // (mirrors ReventlessCore.Plugin.compareVersions).
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The registry is
+  // keyed by bare plugin name (a no-op for the split below), but rows persisted
+  // by the pre-slice registry were keyed name@version — keep the collapse to the
+  // highest version per plugin name (mirrors ReventlessCore.Plugin.compareVersions)
+  // so a mixed table never surfaces duplicate fragments.
   const cmpVer = (a, b) => {
     const pa = String(a).replace(/[-+]/g, ".").split(".");
     const pb = String(b).replace(/[-+]/g, ".").split(".");
@@ -108,7 +108,7 @@ function make(api, uiFragmentRegistryTableName, opts) {
           Resource: "arn:aws:logs:*:*:*"
         },
         {
-          Sid: "AllowScanUIFragmentRegistryRm",
+          Sid: "AllowScanUiFragmentsTable",
           Effect: "Allow",
           Action: ["dynamodb:Scan"],
           Resource: "arn:aws:dynamodb:*:*:table/" + tableName
@@ -143,11 +143,11 @@ export async function handler() {
   } while (exclusiveStartKey);
 
   // Platform invariant: one version per plugin at a time, so the UI sees just
-  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
-  // accumulates one row per deployed plugin version and carries no lifecycle
-  // status of its own, so without deduping a redeployed federation plugin would
-  // surface duplicate fragments. Collapse to the highest version per plugin name
-  // (mirrors ReventlessCore.Plugin.compareVersions).
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). The registry is
+  // keyed by bare plugin name (a no-op for the split below), but rows persisted
+  // by the pre-slice registry were keyed name@version — keep the collapse to the
+  // highest version per plugin name (mirrors ReventlessCore.Plugin.compareVersions)
+  // so a mixed table never surfaces duplicate fragments.
   const cmpVer = (a, b) => {
     const pa = String(a).replace(/[-+]/g, ".").split(".");
     const pb = String(b).replace(/[-+]/g, ".").split(".");

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_AppSync.res

@@ -146,7 +146,8 @@ let make: ReventlessCore.CommandGenerator_Adapter.resolversMaker<api, Util.Lambd
   })
 
   // Source C: create Subscription.onX resolver for each mutation field.
-  // @aws_subscribe in the SDL (emitted by Plugin_SubscriptionSchema) handles
+  // @aws_subscribe in the pushed SDL (appended by AppSync_SdlDecorate from the
+  // fragment's subscription-source metadata) handles
   // delivery. AWS requires a dataSourceName even on UNIT subscription resolvers,
   // so we reuse the mutation's data source (its code never executes for subs).
   CommandSubscriptionResolvers_AppSync.make(

package/src/adapter/QueryDb/QueryDbBackend.res

@@ -13,7 +13,7 @@
 //     Postgres-backed handlers' HANDLER_CONFIG entries and put the projection
 //     Lambdas in-VPC with secret access.
 //
-// ADMIN EXEMPTION: platform/admin read models (Plugins, UIFragmentRegistry, …)
+// ADMIN EXEMPTION: platform/admin stores (Plugins, UiFragments, …)
 // stay on DynamoDB even when Postgres is selected. Deploy-time consumers (the
 // AppSync schema-clobber guard's Plugin-RM scan, `PLUGIN_RM_TABLE_NAME` gates,
 // retire hooks) query these tables during `pulumi up` — from outside the VPC —

package/src/adapter/Runtime/AdminEventCollectorEntryPoint.mjs

@@ -83,8 +83,10 @@ import {
   decode as decodeFragment,
   countRootTypeFields,
   isCatastrophicSchemaShrink,
+  collectSubscriptionSources,
 } from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
-import { baseFragment as adminBaseFragment } from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
+import { injectAwsSubscribe, planAwsPushes } from "@reventlessdev/reventless-aws/src/components/Api/AppSync_SdlDecorate.res.mjs";
+import { baseFragment as adminBaseFragment, systemCallerFieldNames } from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import { tag as requestContextTag } from "@reventlessdev/reventless-core/src/RequestContext.res.mjs";
 
 // The Plugin RM state schema uses `@s.matches(_jsNullable …)` for many
@@ -168,6 +170,13 @@ function parseHandlerConfig(rawJson) {
   // Optional fields with empty defaults — admin context omits them entirely.
   if (config.readModelQueueUrls === undefined) config.readModelQueueUrls = {};
   if (config.readModelNamesForSourceName === undefined) config.readModelNamesForSourceName = {};
+  // Reactive ApiFragmentRegistry single-writer (2e) — only the admin EventCollector
+  // carries a real registry table + admin DCB command topic; plugin ECs default to
+  // placeholders which disable the reactive push.
+  if (config.apiFragmentRegistryTableName === undefined) config.apiFragmentRegistryTableName = "NOT_AVAILABLE";
+  if (config.platformApiId === undefined) config.platformApiId = "NOT_AVAILABLE";
+  if (config.adminDcbCmdTopicUrl === undefined) config.adminDcbCmdTopicUrl = "";
+  if (config.splitApi === undefined) config.splitApi = false;
   // Per-extension defaults so older serialisers (or partial admin configs) keep working.
   for (const ext of config.extensions) {
     if (!Array.isArray(ext.aggregateNames)) ext.aggregateNames = [];
@@ -518,8 +527,14 @@ function mkUpdateApiSchema(schemaTableName, apiId, clonerEnabled) {
       fragments = resolved.map((json) => json && json.apiSchemaFragment).filter(Boolean);
       log.warn(`PluginSchemaPersistence table unavailable — falling back to ${fragments.length} Connected Plugin RM fragment(s)`, { comp: "updateApiSchema" });
     }
-    const adminBase = injectAwsAuthAll(adminBaseFragment(clonerEnabled || false), "Admin");
-    const sdl = graphqlStitch(adminBase, fragments);
+    const rawAdminBase = adminBaseFragment(clonerEnabled || false);
+    const adminBase = injectAwsAuthAll(rawAdminBase, "Admin");
+    // Core fragments are dialect-neutral — append @aws_subscribe from the
+    // structured subscription→mutation metadata (collected from the raw admin
+    // base + plugin fragments) onto the stitched SDL, mirroring the deploy
+    // path's stitchWithAwsDirectives.
+    const subscriptionSources = collectSubscriptionSources(rawAdminBase, fragments);
+    const sdl = injectAwsSubscribe(graphqlStitch(adminBase, fragments), subscriptionSources);
 
     // Shrink guard — never let a transient/incomplete stitch clobber the live schema.
     const threshold = parseShrinkThreshold(process.env["RUNTIME_SCHEMA_SHRINK_THRESHOLD"]);
@@ -537,6 +552,183 @@ function mkUpdateApiSchema(schemaTableName, apiId, clonerEnabled) {
   };
 }
 
+// ── Reactive ApiFragmentRegistry single writer (Plan 2e) ─────────────────────
+// The admin EventCollector is (as of 2e) also subscribed to the admin DcbEventLog
+// DynamoDB stream. On any ApiFragmentRegistered / ApiFragmentUpdated /
+// ApiFragmentDeregistered event, re-fold the ApiFragmentRegistry, stitch one
+// AppSync-decorated schema per target API (via the runtime-pure
+// AppSync_SdlDecorate.planAwsPushes — identical decoration to the deploy path),
+// push each with the shrink guard, and write the outcome back with
+// RecordApiFragmentPush onto the admin DCB command topic. This is ADDITIVE — the
+// legacy connect-driven mkUpdateApiSchema (deploy-schema:* → single Domain API)
+// stays until Plan Phase 4. ApiFragmentPushRecorded is intentionally NOT a
+// trigger (the write-back would otherwise loop); UiFragment* events on the same
+// stream are ignored (different prefix).
+
+const reactiveTriggerTags = new Set([
+  "ApiFragmentRegistered",
+  "ApiFragmentUpdated",
+  "ApiFragmentDeregistered",
+]);
+
+function isDynamoStreamRecord(r) {
+  return !!r && (r.eventSource === "aws:dynamodb" || r.EventSource === "aws:dynamodb");
+}
+
+// Read a DynamoDB attribute-value string, tolerating both the raw stream shape
+// ({S: "..."}) and an already-unmarshalled plain string.
+function avString(av) {
+  if (av == null) return undefined;
+  if (typeof av === "string") return av;
+  if (typeof av.S === "string") return av.S;
+  return undefined;
+}
+
+// Pull the {encoded, protocol} fragment out of an event's `data` attribute
+// (raw {M:{...}} or unmarshalled object), reading the named fragment field
+// (`fragment` for Registered, `newFragment` for Updated).
+function readFragmentField(dataAv, fieldName) {
+  const data = dataAv && dataAv.M ? dataAv.M : dataAv;
+  if (!data || typeof data !== "object") return null;
+  const fragAv = data[fieldName];
+  const frag = fragAv && fragAv.M ? fragAv.M : fragAv;
+  if (!frag || typeof frag !== "object") return null;
+  const encoded = avString(frag.encoded);
+  if (typeof encoded !== "string" || encoded.length === 0) return null;
+  return { encoded, protocol: avString(frag.protocol) || "graphql" };
+}
+
+// Scan the raw stream records for ApiFragment* trigger events; return one entry
+// per event carrying the pluginId and the fragment override the event asserts
+// (or {remove:true} for a deregistration). The override lets the push reflect
+// the just-happened change even if the ApiFragments projection (a separate
+// stream consumer) hasn't caught up yet — the plan's "stitch from consistent
+// state, not an eventually-consistent RM scan".
+function detectApiFragmentTriggers(records) {
+  const out = [];
+  for (const r of records || []) {
+    if (!isDynamoStreamRecord(r)) continue;
+    const img = r.dynamodb && r.dynamodb.NewImage;
+    if (!img) continue;
+    const tag = avString(img.event);
+    if (!tag || !reactiveTriggerTags.has(tag)) continue;
+    const dataAv = img.data;
+    const dataObj = dataAv && dataAv.M ? dataAv.M : dataAv;
+    let pluginId =
+      (dataObj && dataObj.pluginId && avString(dataObj.pluginId)) || avString(img.tag_pluginId);
+    if (!pluginId) continue;
+    if (tag === "ApiFragmentDeregistered") {
+      out.push({ pluginId, remove: true });
+    } else {
+      const fieldName = tag === "ApiFragmentUpdated" ? "newFragment" : "fragment";
+      const frag = readFragmentField(dataAv, fieldName);
+      const target = (dataObj && avString(dataObj.apiTarget)) === "Platform" ? "Platform" : "Domain";
+      out.push(frag ? { pluginId, encoded: frag.encoded, protocol: frag.protocol, target } : { pluginId });
+    }
+  }
+  return out;
+}
+
+// Enqueue one RecordApiFragmentPush per distinct triggering plugin onto the admin
+// DCB command topic (FIFO, MessageGroupId = pluginId). RecordApiFragmentPush is
+// @noApi and idempotent — a no-op in the slice behaviour if the plugin was
+// deregistered in the meantime.
+async function recordPushOutcomes(recordPublisher, pluginIds, ok, message) {
+  if (!recordPublisher || pluginIds.length === 0) return;
+  const at = new Date().toISOString();
+  const commandJsons = pluginIds.map((pluginId) => ({
+    id: pluginId,
+    // toMessageBody re-stamps msgId (uuid) + time (now); service + correlationId are required.
+    meta: { service: "AdminEventCollector", time: at, msgId: "pending", correlationId: pluginId },
+    commandJson: { TAG: "RecordApiFragmentPush", pluginId, ok, message, at },
+  }));
+  try {
+    await recordPublisher(commandJsons);
+  } catch (e) {
+    log.error(`RecordApiFragmentPush dispatch failed: ${(e && e.message) || e}`, { comp: "reactiveApiPush" });
+  }
+}
+
+function mkReactiveApiSchemaPush(config) {
+  const tableName = config.apiFragmentRegistryTableName;
+  const adminDcbUrl = config.adminDcbCmdTopicUrl;
+  // Only the admin EventCollector carries a real registry table + admin DCB topic.
+  if (!tableName || tableName === "NOT_AVAILABLE" || !adminDcbUrl || adminDcbUrl === "NOT_AVAILABLE") {
+    return undefined;
+  }
+  const domainApiId = config.appSyncApiId;
+  // In unified mode platformApiId is unset/"NOT_AVAILABLE" and every plan targets the Domain API.
+  const platformApiId =
+    config.platformApiId && config.platformApiId !== "NOT_AVAILABLE"
+      ? config.platformApiId
+      : domainApiId;
+  const splitApi = !!config.splitApi;
+  const clonerEnabled = config.clonerEnabled || false;
+  const recordPublisher = sqsPublishJsons(makeQueueRef(adminDcbUrl), "SQS_FIFO");
+
+  return async (triggers) => {
+    const pluginIds = [...new Set(triggers.map((t) => t.pluginId))];
+    // 1. Fold the registry: RM scan for all plugins, overlaid with this batch's
+    //    own asserted fragments (closes the projection-lag race for the trigger).
+    const byId = new Map();
+    try {
+      const rows = await scanByTableName(tableName, [], 1000);
+      for (const row of rows) {
+        if (!row || typeof row.pluginId !== "string" || typeof row.encoded !== "string" || !row.encoded) continue;
+        byId.set(row.pluginId, {
+          encoded: row.encoded,
+          protocol: typeof row.protocol === "string" ? row.protocol : "graphql",
+          target: row.apiTarget === "Platform" ? "Platform" : "Domain",
+        });
+      }
+    } catch (e) {
+      const msg = `ApiFragments scan failed: ${(e && e.message) || e}`;
+      log.error(msg, { comp: "reactiveApiPush" });
+      await recordPushOutcomes(recordPublisher, pluginIds, false, msg);
+      return;
+    }
+    for (const t of triggers) {
+      if (t.remove) byId.delete(t.pluginId);
+      else if (t.encoded) byId.set(t.pluginId, { encoded: t.encoded, protocol: t.protocol, target: t.target });
+    }
+    const fragments = [...byId.values()];
+
+    // 2. Plan one AWS-decorated push per target API.
+    const rawAdminBase = adminBaseFragment(clonerEnabled);
+    const plans = planAwsPushes(rawAdminBase, systemCallerFieldNames, fragments, splitApi);
+
+    // 3. Push each plan behind the shrink guard.
+    let ok = true;
+    let message = "";
+    for (const plan of plans) {
+      const apiId = plan.api === "PlatformApi" ? platformApiId : domainApiId;
+      if (!apiId || apiId === "NOT_AVAILABLE") continue;
+      const threshold = parseShrinkThreshold(process.env["RUNTIME_SCHEMA_SHRINK_THRESHOLD"]);
+      const currentSdl = await getCurrentSchemaSdl(apiId);
+      if (isCatastrophicSchemaShrink(currentSdl, plan.sdl, threshold)) {
+        const cur = countRootTypeFields(currentSdl, "Mutation") + countRootTypeFields(currentSdl, "Query");
+        const nw = countRootTypeFields(plan.sdl, "Mutation") + countRootTypeFields(plan.sdl, "Query");
+        log.error(`ABORTED reactive push for ${plan.api} (${apiId}): ${nw} root field(s) vs ${cur} live (threshold ${threshold}).`, { comp: "reactiveApiPush" });
+        emitShrinkRejectionMetric(apiId, cur, nw);
+        ok = false;
+        message = `shrink guard aborted push for ${plan.api}`;
+        continue;
+      }
+      try {
+        await updateAppSyncSchema(apiId, plan.sdl);
+        log.info(`reactive schema push OK: ${plan.api} (${apiId})`, { comp: "reactiveApiPush" });
+      } catch (e) {
+        ok = false;
+        message = (e && e.message) || String(e);
+        log.error(`reactive schema push FAILED: ${plan.api} (${apiId}): ${message}`, { comp: "reactiveApiPush" });
+      }
+    }
+
+    // 4. Write the outcome back per triggering plugin (the deploy waiter polls this).
+    await recordPushOutcomes(recordPublisher, pluginIds, ok, message);
+  };
+}
+
 function buildPublishToAggregates(map) {
   const out = {};
   for (const [aggName, envVarName] of Object.entries(map || {})) {
@@ -582,6 +774,19 @@ function loadPluginDefinition() {
   }
 }
 
+// The plugin's UI-fragment manifest — shipped as its own asset since the
+// manifest no longer rides pluginDefinition (the UiFragmentRegistry slice owns
+// fragment state). Contains JSON `null` for plugins without a UI; tolerate a
+// missing file (archives built before the asset existed) the same way.
+function loadUiFragments() {
+  try {
+    const raw = readFileSync(new URL("./uiFragments.json", `file://${process.cwd()}/`), "utf-8");
+    return JSON.parse(raw);
+  } catch (e) {
+    return null;
+  }
+}
+
 // Cross-plugin spec packages (e.g. "@reventlessdev/online-shop-hybrid-catalog-spec")
 // are bundled into the function asset under /var/task/node_modules/ by
 // PluginRuntime_Builder.forPluginEventCollector. This entry-point file, however,
@@ -649,6 +854,8 @@ async function buildHandler() {
     config.clonerEnabled,
   );
 
+  const reactiveApiSchemaPush = mkReactiveApiSchemaPush(config);
+
   const manageSubscriptionsFn = mkManageSubscriptions(config.pluginReadModelTableName);
 
   // EP operations — admin has 1 entry (Plugin EP), plugins have N user EPs.
@@ -731,10 +938,13 @@ async function buildHandler() {
     const specMod = patchSpecId(await importFromAsset(ext.specModule));
     const mappingsMod = await importFromAsset(ext.mappingsModule);
     // After Phase 3 of plugin-eventcollector-runtime-rewire, the Connect
-    // extension Spec carries only pluginDefinition — cross-plugin subscribe /
-    // unsubscribe directives moved to admin's manageSubscriptions hook.
+    // extension Spec carries pluginDefinition plus the plugin's UI-fragment
+    // manifest (its own asset) — cross-plugin subscribe / unsubscribe
+    // directives moved to admin's manageSubscriptions hook. ReScript None
+    // compiles to `undefined`, so map the asset's JSON null accordingly.
     const extBuilder = mappingsMod.Make({
       pluginDefinition,
+      uiFragments: loadUiFragments() ?? undefined,
     });
     // PluginConnectExtension_Builder.Make returns a module exposing:
     //   - ConnectPluginMapping  (single mapping)
@@ -863,17 +1073,33 @@ async function buildHandler() {
   // level, so the modest extra init latency is paid only on true cold starts.
   await reconcileSubscriptionsOnce(config.pluginReadModelTableName, manageSubscriptionsFn);
 
-  return handleDynamoDbOrSqsEvent(makeQueueRef(config.queueUrl), callback.handleJsonEvents);
+  const sqsHandler = handleDynamoDbOrSqsEvent(makeQueueRef(config.queueUrl), callback.handleJsonEvents);
+  return { sqsHandler, reactiveApiSchemaPush };
 }
 
-const sqsHandlerPromise = buildHandler();
+const handlerBundlePromise = buildHandler();
 
 export async function handler(event, context) {
   _currentRequestId = context?.awsRequestId || "unknown";
   const records = event.Records || [];
   const correlationId = extractCorrelationId(records);
   log.debug("processing " + records.length.toString() + " record(s)", { comp: "PluginEventCollectorRuntime" });
-  const sqsHandler = await sqsHandlerPromise;
-  await runEffect(correlationId, sqsHandler(event, context));
+  const { sqsHandler, reactiveApiSchemaPush } = await handlerBundlePromise;
+  if (reactiveApiSchemaPush) {
+    // Admin EC: DcbEventLog stream records drive the reactive ApiFragmentRegistry
+    // push; everything else (Plugin-aggregate lifecycle delivered SNS→SQS) goes to
+    // the plugin callback as before. Splitting keeps unrelated DCB-slice stream
+    // events out of the callback, which has no handler for them. (A Lambda batch
+    // is single-source, so in practice exactly one branch has records.)
+    const streamRecords = records.filter(isDynamoStreamRecord);
+    const otherRecords = records.filter((r) => !isDynamoStreamRecord(r));
+    if (otherRecords.length > 0) {
+      await runEffect(correlationId, sqsHandler({ ...event, Records: otherRecords }, context));
+    }
+    const triggers = detectApiFragmentTriggers(streamRecords);
+    if (triggers.length > 0) await reactiveApiSchemaPush(triggers);
+  } else {
+    await runEffect(correlationId, sqsHandler(event, context));
+  }
   return "";
 }

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -16,6 +16,10 @@ let bundledInfos: dict<sliceInfo> = Dict.make()
 
 let dcbQueueUrlRef: ref<option<Pulumi.Output.t<string>>> = ref(None)
 let setDcbQueueUrl = url => dcbQueueUrlRef := Some(url)
+// The admin/plugin DCB command-topic FIFO URL captured by the
+// onDcbCommandTopicCreated hook. Read by the admin EventCollector's reactive
+// ApiFragmentRegistry push (2e) to dispatch RecordApiFragmentPush.
+let getDcbQueueUrl = () => dcbQueueUrlRef.contents
 
 let registerAutomationSlice = (
   ~name,

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -22,6 +22,10 @@ function setDcbQueueUrl(url) {
   dcbQueueUrlRef.contents = url;
 }
 
+function getDcbQueueUrl() {
+  return dcbQueueUrlRef.contents;
+}
+
 function registerAutomationSlice(name, specModulePath, callbackTypeOpt, queryDbTableName) {
   let callbackType = callbackTypeOpt !== undefined ? callbackTypeOpt : "automation";
   bundledInfos[name] = {
@@ -137,6 +141,7 @@ export {
   bundledInfos,
   dcbQueueUrlRef,
   setDcbQueueUrl,
+  getDcbQueueUrl,
   registerAutomationSlice,
   storedSpecs,
   grandParent,

package/src/components/Api/AppSync_Adapter.res

@@ -353,12 +353,9 @@ let _stampTypeDualAuth = (decl: string): string =>
 // the stitcher's first-wins dedupe against unstamped copies from sibling
 // fragments. Unconditional — the API always configures AWS_IAM as an
 // additional provider, so the directive is always valid.
-let sharedIamTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
-
-let stampSharedIamTypes = (sdl: string): string =>
-  sharedIamTypeNames->Array.reduce(sdl, (acc, name) =>
-    acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
-  )
+// Canonical definition lives in the runtime-pure AppSync_SdlDecorate so the
+// bundled AdminEventCollector Lambda's reactive push decorates identically.
+let stampSharedIamTypes = AppSync_SdlDecorate.stampSharedIamTypes
 
 let injectAwsAuth = (
   fragment: Reventless.Plugin.apiSchemaFragment,
@@ -479,20 +476,12 @@ let injectAwsAuth = (
     }
   )
 
-  let encoded =
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("types", JSON.Encode.array(augmentedTypes->Array.map(JSON.Encode.string))),
-        ("mutations", JSON.Encode.array(augmentedMutations->Array.map(JSON.Encode.string))),
-        ("queries", JSON.Encode.array(augmentedQueries->Array.map(JSON.Encode.string))),
-        (
-          "subscriptions",
-          JSON.Encode.array(parts.subscriptions->Array.map(JSON.Encode.string)),
-        ),
-      ]),
-    )->JSON.stringify
-
-  {Reventless.Plugin.encoded, protocol: "graphql"}
+  ReventlessCore.GraphQL_Stitcher.encode({
+    ...parts,
+    types: augmentedTypes,
+    mutations: augmentedMutations,
+    queries: augmentedQueries,
+  })
 }
 
 // Injects @aws_auth with the given group on ALL mutation, query, and subscription
@@ -504,43 +493,35 @@ let injectAwsAuth = (
 // ["<group>"]) @aws_iam` instead of the single-mode `@aws_auth(...)`, keeping
 // the same Cognito group gating while also admitting the SigV4 system caller.
 // Subscriptions are never IAM-marked (the deploy caller does not subscribe).
+// Canonical definition lives in the runtime-pure AppSync_SdlDecorate so the
+// bundled AdminEventCollector Lambda's reactive push decorates the admin base
+// identically to this deploy path. Eta-expanded to preserve the optional arg.
 let injectAwsAuthAll = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~group: string,
   ~iamFieldNames: array<string>=[],
-): Reventless.Plugin.apiSchemaFragment => {
-  let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
-  let isIam = (field: string): bool =>
-    iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
-
-  let augmentedMutations = parts.mutations->Array.map(field =>
-    isIam(field)
-      ? `${field}\n    ${_formatDualAuthDirective(Some([group]))}`
-      : `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
-  )
-  let augmentedQueries = parts.queries->Array.map(field =>
-    isIam(field)
-      ? `${field} ${_formatDualAuthDirective(Some([group]))}`
-      : `${field} @aws_auth(cognito_groups: ["${group}"])`
-  )
-  let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
-    `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+): Reventless.Plugin.apiSchemaFragment =>
+  AppSync_SdlDecorate.injectAwsAuthAll(fragment, ~group, ~iamFieldNames)
+
+/**
+Stitch base + plugin fragments and decorate the assembled SDL with the AppSync
+dialect: `@aws_subscribe` on mutation-sourced subscription fields (from the
+fragments' neutral `subscriptionSources` metadata — core no longer emits the
+directive) and `@aws_cognito_user_pools @aws_iam` on the shared traversal
+types. Every AWS schema push assembles its SDL through here so the dialect is
+applied uniformly.
+*/
+let stitchWithAwsDirectives = (
+  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
+  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
+): string => {
+  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
+    ~baseFragment,
+    ~pluginFragments,
   )
-
-  let encoded =
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("types", JSON.Encode.array(parts.types->Array.map(JSON.Encode.string))),
-        ("mutations", JSON.Encode.array(augmentedMutations->Array.map(JSON.Encode.string))),
-        ("queries", JSON.Encode.array(augmentedQueries->Array.map(JSON.Encode.string))),
-        (
-          "subscriptions",
-          JSON.Encode.array(augmentedSubscriptions->Array.map(JSON.Encode.string)),
-        ),
-      ]),
-    )->JSON.stringify
-
-  {Reventless.Plugin.encoded, protocol: "graphql"}
+  ReventlessCore.GraphQL_Stitcher.stitch(~baseFragment, ~pluginFragments)
+  ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
+  ->stampSharedIamTypes
 }
 
 // ── Provider implementation ────────────────────────────────────────────────
@@ -619,13 +600,9 @@ let updateSchema = (
   // The base fragment contains core Plugin aggregate queries/mutations — all Admin-only.
   // Plugin fragments already have @aws_auth injected via generateFragment.
   let augmentedBaseFragment = injectAwsAuthAll(baseFragment, ~group="Admin")
-  // Shared traversal types are stamped once on the assembled SDL (post-stitch,
-  // post-dedupe) — see stampSharedIamTypes.
-  let sdl =
-    ReventlessCore.GraphQL_Stitcher.stitch(
-      ~baseFragment=augmentedBaseFragment,
-      ~pluginFragments,
-    )->stampSharedIamTypes
+  // Shared traversal types + @aws_subscribe are stamped once on the assembled
+  // SDL (post-stitch, post-dedupe) — see stitchWithAwsDirectives.
+  let sdl = stitchWithAwsDirectives(~baseFragment=augmentedBaseFragment, ~pluginFragments)
   // Resolve the API ID from the Output chain. In mock mode (tests) and in Lambda runtime
   // (where the Output is backed by already-known values), this completes synchronously.
   // The resulting promise wraps the AppSync SDK call.