@reventlessdev/reventless-aws 3.0.0-alpha.199 → 3.0.0-alpha.201

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.201 (2026-07-13)
+
+### Bug Fixes
+
+* **api:** dual-auth arg-less IAM fields — extractLeadingName dropped the trailing colon ([ea34da2](https://github.com/ReventlessDev/reventless-core/commit/ea34da229164db63988ad035138c17ba9134ac55))
+
+
+# 3.0.0-alpha.200 (2026-07-12)
+
+### Bug Fixes
+
+* **admin:** fix admin-DCB-on-AWS deploy — Output-in-option corruption + orphan resolvers ([edde07d](https://github.com/ReventlessDev/reventless-core/commit/edde07d1d7a89a47a7496d46fbf83fbadffa74a9))
+
+
 # 3.0.0-alpha.199 (2026-07-12)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.199",
+  "version": "3.0.0-alpha.201",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -8,17 +8,17 @@
     "@aws-sdk/client-cloudfront": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.27",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.15",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.158",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.15",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.160",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.98",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.26",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.76",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.22"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.24"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -862,6 +862,7 @@ module MakeWithConfig = (
         ~runtime=runtimeTyped,
         ~fieldNames,
         ~tags,
+        ~onAdminApi,
         ~opts,
       )
     },
@@ -1981,10 +1982,21 @@ module MakeWithConfig = (
       // table it re-folds from; the admin DCB command-topic FIFO URL it dispatches
       // RecordApiFragmentPush to (captured during Admin.construct); and the mode flag.
       ~platformApiId=platformApi->Pulumi.Output.flatMap(api => api.id),
-      ~apiFragmentRegistryTableName=?admin.stateViewSlicesOutputs
+      // NB: must NOT be `->Option.map(r => r.name)`. `apiFragmentRegistryTableName`
+      // is `option<Pulumi.Output.t<string>>` (the forbidden pattern, CLAUDE.md code
+      // smells). The generic `Option.map` body runs `Primitive_option.some(r.name)`,
+      // and because a Pulumi Output lifts arbitrary property access, `some` inspects
+      // `.BS_PRIVATE_NESTED_SOME_NONE`, mis-reads the Output as a nested option, and
+      // stores the sentinel `{BS_PRIVATE_NESTED_SOME_NONE: 0}` instead of the Output —
+      // so the consumer's `tableOutput->Pulumi.Output.apply` crashes with
+      // "apply is not a function". A `Some(r.name)` LITERAL compiles unboxed (bare
+      // r.name), preserving the Output — the same dodge `pluginReadModelTableName` uses.
+      ~apiFragmentRegistryTableName=?switch admin.stateViewSlicesOutputs
       ->Dict.get("ApiFragments")
-      ->Option.flatMap(rm => rm.queryDb.resources->Array.get(0))
-      ->Option.map(r => r.name),
+      ->Option.flatMap(rm => rm.queryDb.resources->Array.get(0)) {
+      | Some(r) => Some(r.name)
+      | None => None
+      },
       ~adminDcbCmdTopicUrl=?AutomationSliceRuntime_Builder_Single.getDcbQueueUrl(),
       ~splitApi=Config.splitApi,
       (),

package/src/Platform.res.mjs

@@ -867,7 +867,10 @@ function MakeWithConfig(Config) {
     return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
-  let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(param.onAdminApi ? resolveAdminHookedApi() : resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
+  let hooks_dcbAppSyncResolverHook = param => {
+    let onAdminApi = param.onAdminApi;
+    CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(onAdminApi ? resolveAdminHookedApi() : resolveHookedApi(), param.runtime, param.fieldNames, param.tags, onAdminApi, param.opts);
+  };
   let hooks_onDcbEventLogCreated = dcbEventLogUnknown => {
     if (DcbBackend$ReventlessAws.isPostgres()) {
       return;
@@ -1265,23 +1268,24 @@ function MakeWithConfig(Config) {
         return Pulumi.output("NOT_AVAILABLE");
       }
     });
-    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, pluginSchemaPersistenceTable.name, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, Config.cloner, Output$Pulumi.flatMap(platformApi, api => api.id), Stdlib_Option.map(Stdlib_Option.flatMap(admin.stateViewSlicesOutputs["ApiFragments"], rm => rm.queryDb.resources[0]), r => r.name), AutomationSliceRuntime_Builder_Single$ReventlessAws.getDcbQueueUrl(), Config.splitApi, undefined);
+    let r$1 = Stdlib_Option.flatMap(admin.stateViewSlicesOutputs["ApiFragments"], rm => rm.queryDb.resources[0]);
+    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, pluginSchemaPersistenceTable.name, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, Config.cloner, Output$Pulumi.flatMap(platformApi, api => api.id), r$1 !== undefined ? r$1.name : undefined, AutomationSliceRuntime_Builder_Single$ReventlessAws.getDcbQueueUrl(), Config.splitApi, undefined);
     if (pluginReadModelTableName !== undefined) {
       AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
       Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, {});
     }
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
-      let r$1 = rm.queryDb.resources[0];
-      if (r$1 !== undefined) {
-        Platform_UIFragments_Lambda$ReventlessAws.make(platformApi, r$1.name, admin.adminSchemaPushed, {});
+      let r$2 = rm.queryDb.resources[0];
+      if (r$2 !== undefined) {
+        Platform_UIFragments_Lambda$ReventlessAws.make(platformApi, r$2.name, admin.adminSchemaPushed, {});
       }
     }
     let rm$1 = admin.stateViewSlicesOutputs["ApiFragments"];
     if (rm$1 !== undefined) {
-      let r$2 = rm$1.queryDb.resources[0];
-      if (r$2 !== undefined) {
-        Platform_ApiFragments_Lambda$ReventlessAws.make(platformApi, r$2.name, admin.adminSchemaPushed, {});
+      let r$3 = rm$1.queryDb.resources[0];
+      if (r$3 !== undefined) {
+        Platform_ApiFragments_Lambda$ReventlessAws.make(platformApi, r$3.name, admin.adminSchemaPushed, {});
       }
     }
     if (Config.splitApi) {
@@ -2248,7 +2252,10 @@ function Make($star) {
     return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
-  let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(param.onAdminApi ? resolveAdminHookedApi() : resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
+  let hooks_dcbAppSyncResolverHook = param => {
+    let onAdminApi = param.onAdminApi;
+    CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(onAdminApi ? resolveAdminHookedApi() : resolveHookedApi(), param.runtime, param.fieldNames, param.tags, onAdminApi, param.opts);
+  };
   let hooks_onDcbEventLogCreated = dcbEventLogUnknown => {
     if (DcbBackend$ReventlessAws.isPostgres()) {
       return;
@@ -2629,23 +2636,24 @@ function Make($star) {
         return Pulumi.output("NOT_AVAILABLE");
       }
     });
-    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, pluginSchemaPersistenceTable.name, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, false, Output$Pulumi.flatMap(platformApi, api => api.id), Stdlib_Option.map(Stdlib_Option.flatMap(admin.stateViewSlicesOutputs["ApiFragments"], rm => rm.queryDb.resources[0]), r => r.name), AutomationSliceRuntime_Builder_Single$ReventlessAws.getDcbQueueUrl(), true, undefined);
+    let r$1 = Stdlib_Option.flatMap(admin.stateViewSlicesOutputs["ApiFragments"], rm => rm.queryDb.resources[0]);
+    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, pluginSchemaPersistenceTable.name, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, false, Output$Pulumi.flatMap(platformApi, api => api.id), r$1 !== undefined ? r$1.name : undefined, AutomationSliceRuntime_Builder_Single$ReventlessAws.getDcbQueueUrl(), true, undefined);
     if (pluginReadModelTableName !== undefined) {
       AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName);
       Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, {});
     }
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
-      let r$1 = rm.queryDb.resources[0];
-      if (r$1 !== undefined) {
-        Platform_UIFragments_Lambda$ReventlessAws.make(platformApi, r$1.name, admin.adminSchemaPushed, {});
+      let r$2 = rm.queryDb.resources[0];
+      if (r$2 !== undefined) {
+        Platform_UIFragments_Lambda$ReventlessAws.make(platformApi, r$2.name, admin.adminSchemaPushed, {});
       }
     }
     let rm$1 = admin.stateViewSlicesOutputs["ApiFragments"];
     if (rm$1 !== undefined) {
-      let r$2 = rm$1.queryDb.resources[0];
-      if (r$2 !== undefined) {
-        Platform_ApiFragments_Lambda$ReventlessAws.make(platformApi, r$2.name, admin.adminSchemaPushed, {});
+      let r$3 = rm$1.queryDb.resources[0];
+      if (r$3 !== undefined) {
+        Platform_ApiFragments_Lambda$ReventlessAws.make(platformApi, r$3.name, admin.adminSchemaPushed, {});
       }
     }
     Pulumi$Pulumi.$$export("platformApiId", Output$Pulumi.flatMap(platformApi, api => api.id));

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_AppSync.res

@@ -174,6 +174,12 @@ let makeDcb = (
   ~runtime: ReventlessCore.Runtime.environment<runtimeParts>,
   ~fieldNames: array<string>,
   ~tags: array<string>,
+  // Admin (onAdminApi) DCB slices expose ONLY their mutation fields (declared in the
+  // static AdminApi.baseFragment). The static base does NOT declare their `on<Field>`
+  // subscription counterparts, so creating Source-C subscription resolvers would fail
+  // with CreateResolver NotFound. Suppress subscriptions for admin; plugins keep them
+  // (their generated fragment declares the matching subscription fields).
+  ~onAdminApi: bool=false,
   ~opts: Pulumi.ComponentResource.options,
 ) => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
@@ -242,11 +248,14 @@ let makeDcb = (
     )
   })
 
-  // Source C: create Subscription.onX resolver for each DCB mutation field.
-  CommandSubscriptionResolvers_AppSync.make(
-    ~api,
-    ~mutationFields=fieldNames,
-    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
-    ~opts,
-  )
+  // Source C: create Subscription.onX resolver for each DCB mutation field — skipped
+  // for admin slices, whose static base declares no such subscription fields.
+  if !onAdminApi {
+    CommandSubscriptionResolvers_AppSync.make(
+      ~api,
+      ~mutationFields=fieldNames,
+      ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+      ~opts,
+    )
+  }
 }

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_AppSync.res.mjs

@@ -85,7 +85,8 @@ function make(name, api, fields, param, runtime, resources, opts) {
   };
 }
 
-function makeDcb(api, runtime, fieldNames, tags, opts) {
+function makeDcb(api, runtime, fieldNames, tags, onAdminApiOpt, opts) {
+  let onAdminApi = onAdminApiOpt !== undefined ? onAdminApiOpt : false;
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let lambda = runtime.parts.lambda;
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy("DcbMutationDS", Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts$1);
@@ -115,7 +116,9 @@ function makeDcb(api, runtime, fieldNames, tags, opts) {
     let fieldName = param[0];
     AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(Stdlib_String.capitalize(fieldName), api, dataSource.name, "Mutation", fieldName, AppSync_Resolver_Functions$PulumiAws.invokeDcbMutation(param[1]), opts$1);
   });
-  CommandSubscriptionResolvers_AppSync$ReventlessAws.make(api, fieldNames, dataSource.name, opts$1);
+  if (!onAdminApi) {
+    return CommandSubscriptionResolvers_AppSync$ReventlessAws.make(api, fieldNames, dataSource.name, opts$1);
+  }
 }
 
 export {

package/tests/AppSync_SdlDecorateTest.res

@@ -94,6 +94,38 @@ describe("AppSync_Adapter.stitchWithAwsDirectives", () => {
   })
 })
 
+describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
+  // Regression: an ARG-LESS field named in iamFieldNames must still get @aws_iam.
+  // extractLeadingName used to return `Platform_ApiFragments:` (trailing colon) for
+  // arg-less fields, so isIam missed it and the field stayed Cognito-only — which
+  // 401'd the deploy waiter's SigV4 poll of Platform_ApiFragments on real AWS.
+  testSync("dual-auths an arg-less query field named in iamFieldNames", () => {
+    let base = ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: [`  Platform_RegisterApiFragment(input: In): CommandResult`],
+      queries: [`  Platform_ApiFragments: [Entry!]!`, `  Other_Query: Int`],
+      subscriptions: [],
+      subscriptionSources: [],
+    })
+    let decorated = AppSync_SdlDecorate.injectAwsAuthAll(
+      base,
+      ~group="Admin",
+      ~iamFieldNames=["Platform_RegisterApiFragment", "Platform_ApiFragments"],
+    )
+    let parts = ReventlessCore.GraphQL_Stitcher.decode(decorated)
+    let queryField = name =>
+      parts.queries->Array.find(q => q->String.includes(name))->Option.getOrThrow
+    // The arg-less IAM query gets dual-auth.
+    expect(queryField("Platform_ApiFragments"))->toContain("@aws_iam")
+    // The arg-full IAM mutation still does too.
+    expect(parts.mutations->Array.getUnsafe(0))->toContain("@aws_iam")
+    // A query NOT in iamFieldNames stays Cognito-only.
+    let other = queryField("Other_Query")
+    expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(other->String.includes("@aws_iam"))->toBe(false)
+  })
+})
+
 describe("AppSync_SdlDecorate.planAwsPushes", () => {
   // Neutral admin base: a system-callable mutation + a shared traversal type.
   let rawAdminBase = ReventlessCore.GraphQL_Stitcher.encode({

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -89,6 +89,32 @@ globalThis.describe("AppSync_Adapter.stitchWithAwsDirectives", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
+  globalThis.test("dual-auths an arg-less query field named in iamFieldNames", () => {
+    let base = GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: [`  Platform_RegisterApiFragment(input: In): CommandResult`],
+      queries: [
+        `  Platform_ApiFragments: [Entry!]!`,
+        `  Other_Query: Int`
+      ],
+      subscriptions: [],
+      subscriptionSources: []
+    });
+    let decorated = AppSync_SdlDecorate$ReventlessAws.injectAwsAuthAll(base, "Admin", [
+      "Platform_RegisterApiFragment",
+      "Platform_ApiFragments"
+    ]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(decorated);
+    let queryField = name => Stdlib_Option.getOrThrow(parts.queries.find(q => q.includes(name)), undefined);
+    globalThis.expect(queryField("Platform_ApiFragments")).toContain("@aws_iam");
+    globalThis.expect(parts.mutations[0]).toContain("@aws_iam");
+    let other = queryField("Other_Query");
+    globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(other.includes("@aws_iam")).toBe(false);
+  });
+});
+
 globalThis.describe("AppSync_SdlDecorate.planAwsPushes", () => {
   let rawAdminBase = GraphQL_Stitcher$ReventlessCore.encode({
     types: [`type CommandAccepted {\n  id: ID!\n}`],