@reventlessdev/reventless-aws 3.0.0-alpha.197 → 3.0.0-alpha.199

package/src/adapter/Api/ApiFragmentDeregistration.res

@@ -0,0 +1,137 @@
+/** Pulumi dynamic resource whose sole purpose is to deregister a plugin's
+    API-schema fragment on `pulumi destroy` (final retirement of the plugin
+    stack). `create` / `update` are no-ops — registration is done by
+    `Platform.registerFragmentViaApi` at deploy time; only `delete` matters,
+    and it calls `Platform_DeregisterApiFragment` on the platform's Platform API
+    (SigV4), whose event triggers the platform-side reactive single writer (2e)
+    to re-stitch the schema WITHOUT this plugin's fields.
+
+    Serialization: Pulumi serialises the provider object (and its captured import
+    closure) into stack state, so it must NOT statically capture the AWS SDK —
+    that breaks Pulumi's closure serialiser (the CJS/ESM dual-export confusion
+    documented in AppSync_Resolver_Retrying). The delete handler therefore
+    DYNAMICALLY imports the signed caller at invocation time; only the string
+    specifier lands in state.
+
+    Version supersession must NOT deregister: `diff` never reports changes/replaces
+    (pluginId, endpoint, and region are all version-stable), so a version bump is
+    an in-place no-op and the `delete` handler fires only on a genuine stack
+    destroy — the "final retirement, resolvers gone" trigger. */
+
+let log = ReventlessCore.Logger.fromEnv()
+
+type providerInputs = {
+  pluginId: string,
+  endpoint: string,
+  region: string,
+}
+
+// Pulumi passes OUTPUTS (possibly undefined) to delete/read handlers, so encode
+// the carrier fields into the resource id — always available. "|" cannot appear
+// in a plugin name, an AWS region, or an AppSync GraphQL endpoint URL.
+let encodeId = (i: providerInputs): string => `${i.pluginId}|${i.region}|${i.endpoint}`
+let decodeId = (id: string): option<providerInputs> =>
+  switch id->String.split("|") {
+  | [pluginId, region, endpoint] => Some({pluginId, region, endpoint})
+  | _ => None
+  }
+
+// Dynamically import the signed caller and send Platform_DeregisterApiFragment.
+// The `import(...)` keeps Util_AppSync_Caller (and its transitive @aws-sdk/@smithy
+// deps) OUT of the serialised provider closure — only this string is captured.
+// Positional call matches the compiled signature
+// `sendMutation(endpoint, region, mutation, selection, variables)`.
+let sendDeregister: (JSON.t, string, string) => promise<unit> = %raw(`
+  async function (variables, endpoint, region) {
+    const mod = await import("@reventlessdev/reventless-aws/src/util/Util_AppSync_Caller.res.mjs");
+    await mod.sendMutation(endpoint, region, "Platform_DeregisterApiFragment", "{ __typename }", variables);
+  }
+`)
+
+let errMessage: 'a => string = %raw(`(e) => (e && e.message) ? String(e.message) : String(e)`)
+
+type createResult = {id: string, outs: providerInputs}
+type updateResult = {outs: providerInputs}
+type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace: bool}
+
+let create = async (inputs: providerInputs): createResult => {id: encodeId(inputs), outs: inputs}
+
+let update = async (_id: string, _olds: providerInputs, news: providerInputs): updateResult => {
+  outs: news,
+}
+
+// Never change/replace — see the module note: keeps version bumps from deleting
+// (and therefore deregistering) the fragment.
+let diff = (_id: string, _olds: providerInputs, _news: providerInputs): diffResult => {
+  changes: false,
+  replaces: [],
+  deleteBeforeReplace: false,
+}
+
+let delete_ = async (id: string, props: providerInputs): unit => {
+  let carrier = switch decodeId(id) {
+  | Some(c) => c
+  | None => props
+  }
+  let variables =
+    Dict.fromArray([
+      // Platform_DeregisterApiFragment(id: ID!, pluginId: ID!) — id is the
+      // generator-prepended arg (unused server-side); pass the pluginId for both.
+      ("id", JSON.Encode.string(carrier.pluginId)),
+      ("pluginId", JSON.Encode.string(carrier.pluginId)),
+    ])->JSON.Encode.object
+  // Best-effort: on a full teardown the platform API may already be gone, and a
+  // destroy must not fail because deregistration could not reach it.
+  try {
+    await sendDeregister(variables, carrier.endpoint, carrier.region)
+    log.info(~comp="ApiFragmentDeregistration", `Deregistered API fragment for ${carrier.pluginId}`)
+  } catch {
+  | exn =>
+    log.warn(
+      ~comp="ApiFragmentDeregistration",
+      `deregister for ${carrier.pluginId} failed (best-effort; platform may be gone): ${errMessage(
+          exn,
+        )}`,
+    )
+  }
+}
+
+// Provider as a plain JS object — no Pulumi Output captures; all state flows
+// through inputs / id.
+let provider = {
+  "create": create,
+  "update": update,
+  "delete": delete_,
+  "diff": diff,
+}
+
+// ── Pulumi dynamic resource binding ──────────────────────────────────────────
+
+type t
+
+type constructorProps = {
+  pluginId: Pulumi.Input.t<string>,
+  endpoint: Pulumi.Input.t<string>,
+  region: Pulumi.Input.t<string>,
+}
+
+// pulumi.dynamic.Resource constructor: (provider, name, props, opts). Explicit
+// /index.js path because @pulumi/pulumi/dynamic is a directory import not
+// resolvable in ESM mode.
+@module("@pulumi/pulumi/dynamic/index.js") @new
+external _newResource: ('provider, string, 'props, Pulumi.CustomResourceOptions.t) => t = "Resource"
+
+let make = (
+  ~name: string,
+  ~pluginId: string,
+  ~endpoint: Pulumi.Input.t<string>,
+  ~region: string,
+  ~opts: Pulumi.CustomResourceOptions.t={},
+): t => {
+  let props: constructorProps = {
+    pluginId: pluginId->Pulumi.Input.make,
+    endpoint,
+    region: region->Pulumi.Input.make,
+  }
+  _newResource(provider, name, props, opts)
+}

package/src/adapter/Api/ApiFragmentDeregistration.res.mjs

@@ -0,0 +1,108 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as IndexJs from "@pulumi/pulumi/dynamic/index.js";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function encodeId(i) {
+  return i.pluginId + `|` + i.region + `|` + i.endpoint;
+}
+
+function decodeId(id) {
+  let match = id.split("|");
+  if (match.length !== 3) {
+    return;
+  }
+  let pluginId = match[0];
+  let region = match[1];
+  let endpoint = match[2];
+  return {
+    pluginId: pluginId,
+    endpoint: endpoint,
+    region: region
+  };
+}
+
+let sendDeregister = (async function (variables, endpoint, region) {
+    const mod = await import("@reventlessdev/reventless-aws/src/util/Util_AppSync_Caller.res.mjs");
+    await mod.sendMutation(endpoint, region, "Platform_DeregisterApiFragment", "{ __typename }", variables);
+  });
+
+let errMessage = ((e) => (e && e.message) ? String(e.message) : String(e));
+
+async function create(inputs) {
+  return {
+    id: encodeId(inputs),
+    outs: inputs
+  };
+}
+
+async function update(_id, _olds, news) {
+  return {
+    outs: news
+  };
+}
+
+function diff(_id, _olds, _news) {
+  return {
+    changes: false,
+    replaces: [],
+    deleteBeforeReplace: false
+  };
+}
+
+async function delete_(id, props) {
+  let c = decodeId(id);
+  let carrier = c !== undefined ? c : props;
+  let variables = Object.fromEntries([
+    [
+      "id",
+      carrier.pluginId
+    ],
+    [
+      "pluginId",
+      carrier.pluginId
+    ]
+  ]);
+  try {
+    await sendDeregister(variables, carrier.endpoint, carrier.region);
+    return log.info("ApiFragmentDeregistration", undefined, `Deregistered API fragment for ` + carrier.pluginId);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    return log.warn("ApiFragmentDeregistration", undefined, `deregister for ` + carrier.pluginId + ` failed (best-effort; platform may be gone): ` + errMessage(exn));
+  }
+}
+
+let provider = {
+  create: create,
+  update: update,
+  delete: delete_,
+  diff: diff
+};
+
+function make(name, pluginId, endpoint, region, optsOpt) {
+  let opts = optsOpt !== undefined ? optsOpt : ({});
+  let props = {
+    pluginId: pluginId,
+    endpoint: endpoint,
+    region: region
+  };
+  return new IndexJs.Resource(provider, name, props, opts);
+}
+
+export {
+  log,
+  encodeId,
+  decodeId,
+  sendDeregister,
+  errMessage,
+  create,
+  update,
+  diff,
+  delete_,
+  provider,
+  make,
+}
+/* log Not a pure module */

package/src/adapter/Api/CommandSubscriptionResolvers_AppSync.res

@@ -2,9 +2,10 @@
 // Source C: mutation-triggered subscription resolvers.
 //
 // Creates one AppSync Subscription-type resolver per command mutation field.
-// The corresponding SDL field (e.g. `onPlugin_Agg_Cmd`) with its
-// `@aws_subscribe(mutations: ["Plugin_Agg_Cmd"])` directive is emitted by
-// Plugin_SubscriptionSchema (Phase 2). This resolver registers the handler
+// The corresponding neutral SDL field (e.g. `onPlugin_Agg_Cmd`) is emitted by
+// Plugin_SubscriptionSchema; its `@aws_subscribe(mutations: ["Plugin_Agg_Cmd"])`
+// directive is appended at push time by AppSync_SdlDecorate from the
+// fragment's subscription-source metadata. This resolver registers the handler
 // on the Subscription type so AppSync can deliver the mutation return value
 // to all matching subscribers automatically. AWS requires a dataSourceName
 // on every resolver; we reuse the corresponding mutation's data source since

package/src/adapter/Api/Platform_ApiFragments_Lambda.res

@@ -0,0 +1,222 @@
+// AWS resolver for the `Platform_ApiFragments` admin GraphQL query — the deploy-facing
+// push-status surface of the API-schema fragment registry.
+//
+// Backed by a Lambda DataSource that scans the ApiFragments StateViewSlice table (one item per
+// plugin name that has registered an API-schema fragment). The persisted state carries the same
+// status fields the in-memory adapter's `Platform_ApiFragmentsApi.encodeApiFragmentEntry`
+// projects (pluginId, apiTarget, pushStatus, pushMessage, pushedAt, registeredAt, updatedAt) —
+// all plain/bare-string primitives in DynamoDB — so the handler projects them as-is. The encoded
+// SDL is deliberately NOT exposed (the deploy waiter needs status only). The registry is keyed by
+// bare plugin name, so no name@version collapse is required (mirrors the ApiFragments slice).
+
+open PulumiAws
+
+let makeHandlerCode = (~tableName as _: string): string =>
+  `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.API_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_ApiFragments: API_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Status-only projection, byte-identical to Platform_ApiFragmentsApi.encodeApiFragmentEntry.
+  // The registry is keyed by bare plugin name; split("@")[0] is a defensive no-op against any
+  // legacy name@version row.
+  return items
+    .filter((item) => item && item.pluginId)
+    .map((item) => ({
+      pluginId: String(item.pluginId).split("@")[0],
+      apiTarget: item.apiTarget || "Domain",
+      pushStatus: item.pushStatus || "pending",
+      pushMessage: item.pushMessage || "",
+      pushedAt: item.pushedAt || "",
+      registeredAt: item.registeredAt || "",
+      updatedAt: item.updatedAt || "",
+    }));
+}
+`
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+let make = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~apiFragmentRegistryTableName: Pulumi.Output.t<string>,
+  // Resolves when the admin-base schema push has completed and the API is ACTIVE
+  // (Platform_Admin.adminSchemaPushed). CreateResolver is gated on it so it never
+  // races StartSchemaCreation on this first-ever-deployed field.
+  ~schemaReady: Pulumi.Output.t<unit>,
+  ~opts: Pulumi.ComponentResource.options,
+) => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let name = "PlatformApiFragments"
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "Lambda",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    apiFragmentRegistryTableName->Pulumi.Output.apply(tableName => {
+      open PolicyDocument
+      let _rolePolicy = IAM.RolePolicy.make(
+        ~name=name ++ "LambdaPolicy",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "LambdaPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Action("logs:*"),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowScanApiFragmentsTable",
+                effect: Allow,
+                actions: Actions(["dynamodb:Scan"]),
+                resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  let handlerCodeStub = makeHandlerCode(~tableName="")
+  archiveContents->Dict.set(
+    "index.mjs",
+    Pulumi.Asset.stringAsset(handlerCodeStub)->Pulumi.Archive.assetToAssetOrArchive,
+  )
+  // ESM self-containment: the handler imports @aws-sdk/* bare specifiers the
+  // nodejs22.x runtime provides only under /var/runtime — unreachable from
+  // /var/task ESM without the resolver hook. Ship the loader + set its env vars.
+  let loaderHash = Util_Bundle.addEsmLoaderAssets(archiveContents)
+  let code = Pulumi.Archive.assetArchive(archiveContents)
+  let sourceCodeHash = Util_Bundle.hashString(handlerCodeStub ++ "\n---\n" ++ loaderHash)
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "Lambda",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 512->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(~name=name ++ "Lambda", ReventlessCore.ReadModel.componentType),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("API_FRAGMENT_RM_TABLE", apiFragmentRegistryTableName->Pulumi.Output.asInput),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+    },
+    ~opts,
+  )
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      open PolicyDocument
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          IAM.RolePolicy.policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  // Create the resolver only after the admin schema push is ACTIVE — otherwise
+  // CreateResolver races StartSchemaCreation and fails with "No field named
+  // Platform_ApiFragments found on type Query" the first time this field ships.
+  let _resolver =
+    schemaReady->Pulumi.Output.apply(() =>
+      AppSync_Resolver_Native.makeUnitJsResolver(
+        ~name=name ++ "Resolver",
+        ~api,
+        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+        ~type_="Query"->Pulumi.Input.make,
+        ~field="Platform_ApiFragments"->Pulumi.Input.make,
+        ~code=resolverCode,
+        ~opts,
+      )
+    )
+}

package/src/adapter/Api/Platform_ApiFragments_Lambda.res.mjs

@@ -0,0 +1,202 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
+
+function makeHandlerCode(param) {
+  return `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.API_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_ApiFragments: API_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Status-only projection, byte-identical to Platform_ApiFragmentsApi.encodeApiFragmentEntry.
+  // The registry is keyed by bare plugin name; split("@")[0] is a defensive no-op against any
+  // legacy name@version row.
+  return items
+    .filter((item) => item && item.pluginId)
+    .map((item) => ({
+      pluginId: String(item.pluginId).split("@")[0],
+      apiTarget: item.apiTarget || "Domain",
+      pushStatus: item.pushStatus || "pending",
+      pushMessage: item.pushMessage || "",
+      pushedAt: item.pushedAt || "",
+      registeredAt: item.registeredAt || "",
+      updatedAt: item.updatedAt || "",
+    }));
+}
+`;
+}
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function make(api, apiFragmentRegistryTableName, schemaReady, opts) {
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PlatformApiFragments";
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), opts$1);
+  apiFragmentRegistryTableName.apply(tableName => {
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: "logs:*",
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowScanApiFragmentsTable",
+          Effect: "Allow",
+          Action: ["dynamodb:Scan"],
+          Resource: "arn:aws:dynamodb:*:*:table/" + tableName
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let archiveContents = {};
+  let handlerCodeStub = `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.API_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_ApiFragments: API_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Status-only projection, byte-identical to Platform_ApiFragmentsApi.encodeApiFragmentEntry.
+  // The registry is keyed by bare plugin name; split("@")[0] is a defensive no-op against any
+  // legacy name@version row.
+  return items
+    .filter((item) => item && item.pluginId)
+    .map((item) => ({
+      pluginId: String(item.pluginId).split("@")[0],
+      apiTarget: item.apiTarget || "Domain",
+      pushStatus: item.pushStatus || "pending",
+      pushMessage: item.pushMessage || "",
+      pushedAt: item.pushedAt || "",
+      registeredAt: item.registeredAt || "",
+      updatedAt: item.updatedAt || "",
+    }));
+}
+`;
+  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCodeStub);
+  let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(archiveContents);
+  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub + "\n---\n" + loaderHash);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: code,
+    role: lambdaRole.arn,
+    memorySize: 512,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", ReadModel$ReventlessCore.componentType),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "API_FRAGMENT_RM_TABLE",
+          apiFragmentRegistryTableName
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ]
+      ])
+    },
+    sourceCodeHash: sourceCodeHash
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  schemaReady.apply(() => AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Resolver", api, dataSource.name, "Query", "Platform_ApiFragments", resolverCode, opts$1));
+}
+
+export {
+  makeHandlerCode,
+  resolverCode,
+  make,
+}
+/* @pulumi/aws Not a pure module */