@reventlessdev/reventless-aws 3.0.0-alpha.204 → 3.0.0-alpha.205

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.205 (2026-07-13)
+
+### Bug Fixes
+
+* **admin:** type-level [@aws](https://github.com/aws)_iam on Platform_ApiFragmentEntry for the SigV4 waiter (deploy [#7](https://github.com/ReventlessDev/reventless-core/issues/7)) ([927a93b](https://github.com/ReventlessDev/reventless-core/commit/927a93b550f9f3f56dca93810cafa9575663a0e9))
+
+
 # 3.0.0-alpha.204 (2026-07-13)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.204",
+  "version": "3.0.0-alpha.205",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -8,16 +8,16 @@
     "@aws-sdk/client-cloudfront": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.27",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.15",
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.15",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.163",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.98",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.26",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.163",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.27",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.26",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.76"
   },
   "devDependencies": {

package/src/components/Api/AppSync_SdlDecorate.res

@@ -119,11 +119,20 @@ let injectAwsAuthAll = (
 }
 
 // Shared traversal types every callable surface reaches — `PageInfo` (relay
-// connections, injected by the stitcher) and the `CommandResult` members
-// (mutation returns, deduped across fragments by the stitcher). Stamped once on
-// the ASSEMBLED SDL: per-fragment stamping would race the stitcher's first-wins
-// dedupe against unstamped sibling copies.
-let sharedIamTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
+// connections, injected by the stitcher), the `CommandResult` members (mutation
+// returns, deduped across fragments by the stitcher), and `Platform_ApiFragmentEntry`
+// (the return type of the IAM-callable `Platform_ApiFragments` status query the deploy
+// waiter polls via SigV4 — without the type-level `@aws_iam` the SigV4 caller reaches the
+// query field but is "Not Authorized to access <field> on type Platform_ApiFragmentEntry").
+// Stamped once on the ASSEMBLED SDL: per-fragment stamping would race the stitcher's
+// first-wins dedupe against unstamped sibling copies.
+let sharedIamTypeNames = [
+  "PageInfo",
+  "CommandAccepted",
+  "CommandRejected",
+  "CommandPending",
+  "Platform_ApiFragmentEntry",
+]
 
 let stampSharedIamTypes = (sdl: string): string =>
   sharedIamTypeNames->Array.reduce(sdl, (acc, name) =>

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -80,7 +80,8 @@ let sharedIamTypeNames = [
   "PageInfo",
   "CommandAccepted",
   "CommandRejected",
-  "CommandPending"
+  "CommandPending",
+  "Platform_ApiFragmentEntry"
 ];
 
 function stampSharedIamTypes(sdl) {

package/tests/AppSync_SdlDecorateTest.res

@@ -187,3 +187,21 @@ describe("AppSync_SdlDecorate.planAwsPushes", () => {
     expect(plan.sdl)->toContain("Catalog_AddProduct")
   })
 })
+
+describe("AppSync_SdlDecorate.stampSharedIamTypes", () => {
+  // Regression: the deploy waiter polls the IAM-callable Platform_ApiFragments query via
+  // SigV4; its return type Platform_ApiFragmentEntry must carry the type-level @aws_iam or
+  // the SigV4 caller reaches the query field but gets "Not Authorized to access <field> on
+  // type Platform_ApiFragmentEntry" (deploy validation #7).
+  testSync("stamps Platform_ApiFragmentEntry with dual-auth", () => {
+    let sdl = AppSync_SdlDecorate.stampSharedIamTypes(
+      "type Platform_ApiFragmentEntry {\n  pluginId: String!\n  pushStatus: String!\n}",
+    )
+    expect(sdl)->toContain("type Platform_ApiFragmentEntry @aws_cognito_user_pools @aws_iam {")
+  })
+
+  testSync("still stamps the CommandResult members", () => {
+    let sdl = AppSync_SdlDecorate.stampSharedIamTypes("type CommandAccepted {\n  id: ID!\n}")
+    expect(sdl)->toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {")
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -166,6 +166,17 @@ globalThis.describe("AppSync_SdlDecorate.planAwsPushes", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.stampSharedIamTypes", () => {
+  globalThis.test("stamps Platform_ApiFragmentEntry with dual-auth", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes("type Platform_ApiFragmentEntry {\n  pluginId: String!\n  pushStatus: String!\n}");
+    globalThis.expect(sdl).toContain("type Platform_ApiFragmentEntry @aws_cognito_user_pools @aws_iam {");
+  });
+  globalThis.test("still stamps the CommandResult members", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes("type CommandAccepted {\n  id: ID!\n}");
+    globalThis.expect(sdl).toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {");
+  });
+});
+
 export {
   sources,
   stitchedSdl,