@reventlessdev/reventless-aws 3.0.0-alpha.208 → 3.0.0-alpha.210

package/src/components/Api/AppSync_MergedApi.res

@@ -0,0 +1,218 @@
+// AppSync_MergedApi — merged-API construction for the push-free composition
+// path (docs/plans/merged-api-push-free-composition.md, Phase 3).
+//
+// A merged API carries no schema of its own: source APIs contribute theirs via
+// SourceApiAssociation and AWS composes the merged endpoint. The platform
+// stack creates the merged API(s) plus the association(s) for its own
+// source(s) (the admin/base canonical source); plugin stacks associate their
+// source APIs against the exported merged-API ARN (Phase 4).
+
+open PulumiAws
+
+// ── Primary-auth contract ───────────────────────────────────────────────────
+// A merged API and every associated source API must share the same PRIMARY
+// authentication mode (AWS rejects incompatible associations). The platform
+// exports the merged API's mode via StackReference (`mergedApiPrimaryAuth`);
+// stacks creating a source API assert against it before associating.
+
+let authenticationTypeName = (t: AppSync.GraphQLApi.authenticationType): string =>
+  switch t {
+  | API_KEY => "API_KEY"
+  | AWS_IAM => "AWS_IAM"
+  | AMAZON_COGNITO_USER_POOLS => "AMAZON_COGNITO_USER_POOLS"
+  | OPENID_CONNECT => "OPENID_CONNECT"
+  }
+
+// The merged APIs share the platform-wide primary mode (Cognito primary,
+// IAM secondary) — same shape the Phase-0 spike validated end-to-end.
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter.primaryAuthenticationType)
+
+let assertCompatiblePrimaryAuth = (~sourceMode: string, ~mergedMode: string): unit =>
+  if sourceMode != mergedMode {
+    failwith(
+      `Merged-API primary-auth mismatch: the source API uses ${sourceMode} but the merged API ` ++
+      `expects ${mergedMode}. A source API must share the merged API's primary authentication ` ++
+      `mode — align the source API's authenticationType with the platform's ` ++ `\`mergedApiPrimaryAuth\` export before associating.`,
+    )
+  }
+
+// ── Merged API + execution role ─────────────────────────────────────────────
+
+type t = {
+  api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  executionRole: IAM.Role.t,
+}
+
+let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+
+  // Execution role AWS assumes to proxy merged-endpoint requests to the source
+  // APIs (appsync:SourceGraphQL) and to run schema merges
+  // (appsync:StartSchemaMerge — required for MANUAL_MERGE, harmless under
+  // AUTO_MERGE). Source APIs associate later from independent plugin stacks,
+  // so their ARNs cannot be enumerated here — the policy stays unscoped.
+  let executionRole = IAM.Role.make(
+    ~name=`${name}-merge-exec-role`,
+    ~args={
+      assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+  let _ = {
+    open PolicyDocument
+    IAM.RolePolicy.make(
+      ~name=`${name}-merge-exec-policy`,
+      ~args={
+        policy: PolicyDocument.make(
+          ~id=`${name}-merge-exec-policy`,
+          ~statements=[
+            {
+              sid: "AllowSourceGraphQLAndMerge",
+              effect: Allow,
+              actions: Actions(["appsync:SourceGraphQL", "appsync:StartSchemaMerge"]),
+              resources: AllResources,
+            },
+          ],
+        )
+        ->PolicyDocument.toJsonString
+        ->Pulumi.Input.make,
+        role: executionRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
+  // Same auth shape as the source APIs (AppSync_Adapter.makeApiResource):
+  // Cognito primary + AWS_IAM secondary. Per-field multi-auth directives on
+  // the source schemas survive the merge verbatim (Phase-0 finding 4).
+  let authConfigOut = Auth_Cognito.make(~name=`${name}-auth`)
+  let userPoolConfigOut =
+    authConfigOut->Pulumi.Output.apply((
+      c: Auth_Cognito.authConfig,
+    ): AppSync.GraphQLApi.userPoolConfig => {
+      userPoolId: c.userPoolId,
+      awsRegion: c.region,
+      defaultAction: AppSync.GraphQLApi.ALLOW,
+    })
+
+  let mergedApi = AppSync.GraphQLApi.make(
+    ~name,
+    ~args={
+      authenticationType: AppSync_Adapter.primaryAuthenticationType->Pulumi.Input.make,
+      userPoolConfig: userPoolConfigOut->Pulumi.Output.asInput,
+      additionalAuthenticationProviders: [
+        (
+          {
+            authenticationType: AppSync.GraphQLApi.AWS_IAM->Pulumi.Input.make,
+          }: AppSync.GraphQLApi.additionalAuthenticationProvider
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+      apiType: AppSync.GraphQLApi.MERGED->Pulumi.Input.make,
+      mergedApiExecutionRoleArn: executionRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(customOpts),
+  )
+
+  {api: mergedApi->Pulumi.Output.make, executionRole}
+}
+
+// ── Source association ──────────────────────────────────────────────────────
+
+/** Associate a source API with the merged API under AUTO_MERGE. AWS
+    serializes association CREATES per merged API (409
+    ConcurrentModificationException) — the platform stack's own associations
+    are inherently sequential; concurrent first-time plugin-stack deploys need
+    retry-with-backoff (Phase 4). */
+let associateSource = (
+  ~name: string,
+  ~mergedApi: t,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiId: mergedApi.api
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Associate a source API against a merged API referenced by ARN — the
+    plugin-stack form, where the merged API is not a resource in this stack
+    but the platform's `domainMergedApiArn` / `platformMergedApiArn`
+    StackReference export. Same AUTO_MERGE + create-time 409 caveat as
+    `associateSource`. */
+let associateSourceWithMergedArn = (
+  ~name: string,
+  ~mergedApiArn: Pulumi.Output.t<string>,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiArn: mergedApiArn->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Deploy-time merge gate: resolves once the association reports
+    MERGE_SUCCESS, fails the deploy loudly (with AWS's status detail) on
+    MERGE_FAILED. Fold the returned Output into an exported value so it is
+    consumed — a MERGE_FAILED then fails `pulumi up` instead of silently
+    serving the last-good merged schema (Phase-0 operational finding).
+    `mergedApiIdentifier` accepts the merged API's id or ARN. */
+let mergeStatusGateWith = (
+  ~mergedApiIdentifier: Pulumi.Output.t<string>,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  (mergedApiIdentifier, association.associationId)
+  ->Pulumi.Output.all2
+  ->Pulumi.Output.flatMap(((identifier, associationId)) =>
+    AppSync_Adapter.waitForMergeSuccess(
+      AppSync_Adapter.getClient(),
+      ~associationId,
+      ~mergedApiIdentifier=identifier,
+    )->Pulumi.Output.fromPromise
+  )
+
+let mergeStatusGate = (
+  ~mergedApi: t,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  mergeStatusGateWith(
+    ~mergedApiIdentifier=mergedApi.api->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id),
+    ~association,
+  )

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -0,0 +1,122 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Pulumi from "@pulumi/pulumi";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
+import * as AppSync_Adapter$ReventlessAws from "./AppSync_Adapter.res.mjs";
+
+function authenticationTypeName(t) {
+  switch (t) {
+    case "API_KEY" :
+      return "API_KEY";
+    case "AWS_IAM" :
+      return "AWS_IAM";
+    case "AMAZON_COGNITO_USER_POOLS" :
+      return "AMAZON_COGNITO_USER_POOLS";
+    case "OPENID_CONNECT" :
+      return "OPENID_CONNECT";
+  }
+}
+
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter$ReventlessAws.primaryAuthenticationType);
+
+function assertCompatiblePrimaryAuth(sourceMode, mergedMode) {
+  if (sourceMode !== mergedMode) {
+    return Pervasives.failwith(`Merged-API primary-auth mismatch: the source API uses ` + sourceMode + ` but the merged API ` + (`expects ` + mergedMode + `. A source API must share the merged API's primary authentication `) + `mode — align the source API's authenticationType with the platform's \`mergedApiPrimaryAuth\` export before associating.`);
+  }
+}
+
+function make(name, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  let executionRole = new (Aws.iam.Role)(name + `-merge-exec-role`, {
+    assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
+  }, customOpts);
+  new (Aws.iam.RolePolicy)(name + `-merge-exec-policy`, {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-merge-exec-policy`, [{
+        Sid: "AllowSourceGraphQLAndMerge",
+        Effect: "Allow",
+        Action: [
+          "appsync:SourceGraphQL",
+          "appsync:StartSchemaMerge"
+        ],
+        Resource: "*"
+      }])),
+    role: executionRole.id
+  }, customOpts);
+  let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
+  let userPoolConfigOut = authConfigOut.apply(c => ({
+    userPoolId: c.userPoolId,
+    defaultAction: "ALLOW",
+    awsRegion: c.region
+  }));
+  let mergedApi = new (Aws.appsync.GraphQLApi)(name, {
+    authenticationType: AppSync_Adapter$ReventlessAws.primaryAuthenticationType,
+    userPoolConfig: userPoolConfigOut,
+    additionalAuthenticationProviders: [{
+        authenticationType: "AWS_IAM"
+      }],
+    apiType: "MERGED",
+    mergedApiExecutionRoleArn: executionRole.arn
+  }, customOpts);
+  return {
+    api: Pulumi.output(mergedApi),
+    executionRole: executionRole
+  };
+}
+
+function associateSource(name, mergedApi, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiId: Output$Pulumi.flatMap(mergedApi.api, a => a.id),
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function associateSourceWithMergedArn(name, mergedApiArn, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiArn: mergedApiArn,
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function mergeStatusGateWith(mergedApiIdentifier, association) {
+  return Output$Pulumi.flatMap(Pulumi.all([
+    mergedApiIdentifier,
+    association.associationId
+  ]), param => AppSync_Adapter$ReventlessAws.waitForMergeSuccess(AppSync_Adapter$ReventlessAws.getClient(), param[1], param[0], undefined, undefined, undefined));
+}
+
+function mergeStatusGate(mergedApi, association) {
+  return mergeStatusGateWith(Output$Pulumi.flatMap(mergedApi.api, a => a.id), association);
+}
+
+export {
+  authenticationTypeName,
+  primaryAuthMode,
+  assertCompatiblePrimaryAuth,
+  make,
+  associateSource,
+  associateSourceWithMergedArn,
+  mergeStatusGateWith,
+  mergeStatusGate,
+}
+/* primaryAuthMode Not a pure module */

package/src/components/Api/AppSync_SdlDecorate.res

@@ -139,6 +139,53 @@ let stampSharedIamTypes = (sdl: string): string =>
     acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
   )
 
+// ── Merged-API canonical stamping ─────────────────────────────────────────────
+// Under AppSync Merged APIs the admin source API owns the shared traversal
+// types; `@canonical` makes its definition win over every plugin source's copy
+// (plugin copies must still exist — a source schema has to be valid standalone).
+// Spike-validated (plan Phase 0): a divergent non-canonical copy is SHADOWED by
+// the canonical definition, not a MERGE_FAILED — so this stamp is what keeps
+// shared-type evolution single-owner. Applied only to the ADMIN source SDL on
+// the merge path; plugin subgraph documents stay unstamped.
+
+// Object types the admin source owns canonically. `interface Node` and
+// `union CommandResult` are handled structurally below (their def lines don't
+// start with `type `).
+let canonicalTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
+
+let stampCanonicalTypes = (sdl: string): string =>
+  sdl
+  ->String.split("\n")
+  ->Array.map(line => {
+    let isObjectDef = canonicalTypeNames->Array.some(name => line->String.startsWith(`type ${name} `))
+    let isNodeDef = line->String.startsWith("interface Node ") || line->String.startsWith("interface Node{")
+    let isUnionDef = line->String.startsWith("union CommandResult ") || line->String.startsWith("union CommandResult=")
+    if line->String.includes("@canonical") {
+      line
+    } else if isObjectDef || isNodeDef {
+      // Insert before the opening brace so it composes with earlier stamps
+      // (e.g. `type PageInfo @aws_cognito_user_pools @aws_iam {`).
+      switch line->String.indexOfOpt("{") {
+      | Some(braceIdx) =>
+        let head = line->String.slice(~start=0, ~end=braceIdx)->String.trimEnd
+        let tail = line->String.slice(~start=braceIdx)
+        `${head} @canonical ${tail}`
+      | None => line
+      }
+    } else if isUnionDef {
+      switch line->String.indexOfOpt("=") {
+      | Some(eqIdx) =>
+        let head = line->String.slice(~start=0, ~end=eqIdx)->String.trimEnd
+        let tail = line->String.slice(~start=eqIdx)
+        `${head} @canonical ${tail}`
+      | None => line
+      }
+    } else {
+      line
+    }
+  })
+  ->Array.join("\n")
+
 // ── Reactive push planner (runtime-pure) ─────────────────────────────────────
 // The AWS-decorated counterpart of core `GraphQL_PushPlanner.planPushes`: given
 // the fragments currently in the ApiFragmentRegistry (each tagged with its target

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -88,6 +88,43 @@ function stampSharedIamTypes(sdl) {
   return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
 }
 
+let canonicalTypeNames = [
+  "PageInfo",
+  "CommandAccepted",
+  "CommandRejected",
+  "CommandPending"
+];
+
+function stampCanonicalTypes(sdl) {
+  return sdl.split("\n").map(line => {
+    let isObjectDef = canonicalTypeNames.some(name => line.startsWith(`type ` + name + ` `));
+    let isNodeDef = line.startsWith("interface Node ") || line.startsWith("interface Node{");
+    let isUnionDef = line.startsWith("union CommandResult ") || line.startsWith("union CommandResult=");
+    if (line.includes("@canonical")) {
+      return line;
+    }
+    if (isObjectDef || isNodeDef) {
+      let braceIdx = Stdlib_String.indexOfOpt(line, "{");
+      if (braceIdx === undefined) {
+        return line;
+      }
+      let head = line.slice(0, braceIdx).trimEnd();
+      let tail = line.slice(braceIdx);
+      return head + ` @canonical ` + tail;
+    }
+    if (!isUnionDef) {
+      return line;
+    }
+    let eqIdx = Stdlib_String.indexOfOpt(line, "=");
+    if (eqIdx === undefined) {
+      return line;
+    }
+    let head$1 = line.slice(0, eqIdx).trimEnd();
+    let tail$1 = line.slice(eqIdx);
+    return head$1 + ` @canonical ` + tail$1;
+  }).join("\n");
+}
+
 function planAwsPushes(rawAdminBase, iamFieldNames, fragments, splitApi) {
   let authBase = injectAwsAuthAll(rawAdminBase, "Admin", iamFieldNames);
   let targeted = fragments.map(f => {
@@ -121,6 +158,8 @@ export {
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
+  canonicalTypeNames,
+  stampCanonicalTypes,
   planAwsPushes,
 }
 /* GraphQL_Stitcher-ReventlessCore Not a pure module */

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -3,38 +3,21 @@ let log = ReventlessCore.Logger.fromEnv()
 type adminConfig = {
   eventTopicArn: option<Pulumi.Output.t<string>>,
   pluginReadModelTableName: option<Pulumi.Output.t<string>>,
-  // Dedicated PluginSchemaPersistence table holding deploy-time SDL fragments
-  // (rows keyed "deploy-schema:<name>"). The runtime schema stitch reads this
-  // durable source instead of the lifecycle-volatile Plugin RM Connected rows.
-  pluginSchemaPersistenceTableName: option<Pulumi.Output.t<string>>,
   schedulerRoleArn: option<Pulumi.Output.t<string>>,
   schedulerQueueArn: option<Pulumi.Output.t<string>>,
   schedulerQueueName: option<Pulumi.Output.t<string>>,
   appSyncApiId: option<Pulumi.Output.t<string>>,
   clonerEnabled: bool,
-  // Reactive ApiFragmentRegistry single writer (2e), admin EventCollector only:
-  // the Platform AppSync id (split mode; unified → same as appSyncApiId), the
-  // ApiFragments StateViewSlice table it scans, the admin DCB command-topic FIFO
-  // URL it dispatches RecordApiFragmentPush to, and the split/unified mode flag.
-  platformApiId: option<Pulumi.Output.t<string>>,
-  apiFragmentRegistryTableName: option<Pulumi.Output.t<string>>,
-  adminDcbCmdTopicUrl: option<Pulumi.Output.t<string>>,
-  splitApi: bool,
 }
 
 let configRef: ref<adminConfig> = ref({
   eventTopicArn: None,
   pluginReadModelTableName: None,
-  pluginSchemaPersistenceTableName: None,
   schedulerRoleArn: None,
   schedulerQueueArn: None,
   schedulerQueueName: None,
   appSyncApiId: None,
   clonerEnabled: false,
-  platformApiId: None,
-  apiFragmentRegistryTableName: None,
-  adminDcbCmdTopicUrl: None,
-  splitApi: false,
 })
 
 type sliceModulePaths = {
@@ -111,31 +94,21 @@ let setStateChangesConfig = (~sync=?, ~async=?, ()) => {
 let registerConfig = (
   ~eventTopicArn=?,
   ~pluginReadModelTableName=?,
-  ~pluginSchemaPersistenceTableName=?,
   ~schedulerRoleArn=?,
   ~schedulerQueueArn=?,
   ~schedulerQueueName=?,
   ~appSyncApiId=?,
   ~clonerEnabled=false,
-  ~platformApiId=?,
-  ~apiFragmentRegistryTableName=?,
-  ~adminDcbCmdTopicUrl=?,
-  ~splitApi=false,
   (),
 ) =>
   configRef := {
     eventTopicArn,
     pluginReadModelTableName,
-    pluginSchemaPersistenceTableName,
     schedulerRoleArn,
     schedulerQueueArn,
     schedulerQueueName,
     appSyncApiId,
     clonerEnabled,
-    platformApiId,
-    apiFragmentRegistryTableName,
-    adminDcbCmdTopicUrl,
-    splitApi,
   }
 
 // PluginRuntime_Builder is a functor so that the caller can inject the EventCollectorChannel
@@ -318,10 +291,6 @@ module Make = (
         config.schedulerQueueName->outputOrPlaceholder->Obj.magic,
         config.appSyncApiId->outputOrPlaceholder->Obj.magic,
         epEventTopicArnsOutput->Pulumi.Output.asInput->Obj.magic,
-        config.pluginSchemaPersistenceTableName->outputOrPlaceholder->Obj.magic,
-        config.platformApiId->outputOrPlaceholder->Obj.magic,
-        config.apiFragmentRegistryTableName->outputOrPlaceholder->Obj.magic,
-        config.adminDcbCmdTopicUrl->outputOrPlaceholder->Obj.magic,
       ])
       ->Pulumi.Output.apply(values => {
         let queueUrl = values->Array.getUnsafe(0)
@@ -333,27 +302,13 @@ module Make = (
         let schedQueueName = values->Array.getUnsafe(6)
         let appSyncApiId = values->Array.getUnsafe(7)
         let epEventTopicArns: array<string> = Obj.magic(values->Array.getUnsafe(8))
-        let schemaPersistenceTable = values->Array.getUnsafe(9)
-        let platformApiId = values->Array.getUnsafe(10)
-        let apiFragmentRegistryTable = values->Array.getUnsafe(11)
-        let adminDcbCmdTopicUrl = values->Array.getUnsafe(12)
 
         let dict = Dict.make()
         dict->Dict.set("queueUrl", JSON.Encode.string(queueUrl))
         dict->Dict.set("pluginExtensionPointCmdTopicUrl", JSON.Encode.string(pluginEpCmdTopicUrl))
         dict->Dict.set("eventTopicArn", JSON.Encode.string(topLevelEventTopicArn))
         dict->Dict.set("pluginReadModelTableName", JSON.Encode.string(rmTable))
-        dict->Dict.set(
-          "pluginSchemaPersistenceTableName",
-          JSON.Encode.string(schemaPersistenceTable),
-        )
         dict->Dict.set("appSyncApiId", JSON.Encode.string(appSyncApiId))
-        // Reactive ApiFragmentRegistry single writer (2e) — placeholders for
-        // plugin ECs / all-at-once platforms disable it in the mjs.
-        dict->Dict.set("platformApiId", JSON.Encode.string(platformApiId))
-        dict->Dict.set("apiFragmentRegistryTableName", JSON.Encode.string(apiFragmentRegistryTable))
-        dict->Dict.set("adminDcbCmdTopicUrl", JSON.Encode.string(adminDcbCmdTopicUrl))
-        dict->Dict.set("splitApi", JSON.Encode.bool(config.splitApi))
         dict->Dict.set("clonerEnabled", JSON.Encode.bool(config.clonerEnabled))
         dict->Dict.set("schedulerRoleArn", JSON.Encode.string(schedRoleArn))
         dict->Dict.set("schedulerQueueArn", JSON.Encode.string(schedQueueArn))
@@ -643,100 +598,6 @@ module Make = (
       | None => ()
       }
 
-      // mkUpdateApiSchema reads each plugin's deploy-time SDL fragment from the
-      // dedicated PluginSchemaPersistence table (deploy-schema:<name> rows) to
-      // re-stitch the live schema. Grant Scan on that table too — it is owned by
-      // Platform.res, so the admin EC's default policy includes no perms on it.
-      switch config.pluginSchemaPersistenceTableName {
-      | Some(schemaTableOutput) =>
-        let policyJson =
-          schemaTableOutput->Pulumi.Output.apply(tableName =>
-            PulumiAws.PolicyDocument.make(
-              ~id=`${name}PluginSchemaScanPolicy`,
-              ~statements=[
-                {
-                  sid: "AllowAdminScanPluginSchemaPersistence",
-                  effect: Allow,
-                  actions: Actions(["dynamodb:Scan"]),
-                  resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
-                },
-              ],
-            )->PulumiAws.PolicyDocument.toJsonString
-          )
-        let _ = PulumiAws.IAM.RolePolicy.make(
-          ~name=`${name}-pluginSchemaScan`,
-          ~args={
-            policy: policyJson->Pulumi.Output.asInput,
-            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
-          },
-        )
-      | None => ()
-      }
-
-      // 2e: the reactive ApiFragmentRegistry single writer scans the ApiFragments
-      // StateViewSlice table to re-fold the registry on each ApiFragment* event.
-      // The table is owned by the admin DcbBuilder, so grant Scan explicitly.
-      switch config.apiFragmentRegistryTableName {
-      | Some(tableOutput) =>
-        let policyJson =
-          tableOutput->Pulumi.Output.apply(tableName =>
-            PulumiAws.PolicyDocument.make(
-              ~id=`${name}ApiFragmentsScanPolicy`,
-              ~statements=[
-                {
-                  sid: "AllowAdminScanApiFragments",
-                  effect: Allow,
-                  actions: Actions(["dynamodb:Scan"]),
-                  resources: Resource("arn:aws:dynamodb:*:*:table/" ++ tableName),
-                },
-              ],
-            )->PulumiAws.PolicyDocument.toJsonString
-          )
-        let _ = PulumiAws.IAM.RolePolicy.make(
-          ~name=`${name}-apiFragmentsScan`,
-          ~args={
-            policy: policyJson->Pulumi.Output.asInput,
-            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
-          },
-        )
-      | None => ()
-      }
-
-      // 2e: the reactive push writes the outcome back with RecordApiFragmentPush,
-      // dispatched onto the admin DCB command-topic FIFO queue — grant
-      // sqs:SendMessage on it (queue URL → ARN, same derivation as
-      // publishToAggregates below).
-      switch config.adminDcbCmdTopicUrl {
-      | Some(urlOutput) =>
-        let policyJson =
-          urlOutput->Pulumi.Output.apply(url => {
-            let arn = switch url->String.split("/") {
-            | [_, _, host, acct, qn] =>
-              let region = host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
-              `arn:aws:sqs:${region}:${acct}:${qn}`
-            | _ => url
-            }
-            PulumiAws.PolicyDocument.make(
-              ~id=`${name}AdminDcbSendPolicy`,
-              ~statements=[
-                {
-                  sid: "AllowAdminDispatchRecordApiFragmentPush",
-                  effect: Allow,
-                  actions: Actions(["sqs:SendMessage"]),
-                  resources: Resource(arn),
-                },
-              ],
-            )->PulumiAws.PolicyDocument.toJsonString
-          })
-        let _ = PulumiAws.IAM.RolePolicy.make(
-          ~name=`${name}-adminDcbSend`,
-          ~args={
-            policy: policyJson->Pulumi.Output.asInput,
-            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
-          },
-        )
-      | None => ()
-      }
     }
 
     // Plugin EC sqs:SendMessage grants on the aggregate / StateChangeSlice