@reventlessdev/reventless-aws 3.0.0-alpha.208 → 3.0.0-alpha.210

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -25,16 +25,11 @@ let configRef = {
   contents: {
     eventTopicArn: undefined,
     pluginReadModelTableName: undefined,
-    pluginSchemaPersistenceTableName: undefined,
     schedulerRoleArn: undefined,
     schedulerQueueArn: undefined,
     schedulerQueueName: undefined,
     appSyncApiId: undefined,
-    clonerEnabled: false,
-    platformApiId: undefined,
-    apiFragmentRegistryTableName: undefined,
-    adminDcbCmdTopicUrl: undefined,
-    splitApi: false
+    clonerEnabled: false
   }
 };
 
@@ -108,22 +103,16 @@ function setStateChangesConfig(sync, async, param) {
   });
 }
 
-function registerConfig(eventTopicArn, pluginReadModelTableName, pluginSchemaPersistenceTableName, schedulerRoleArn, schedulerQueueArn, schedulerQueueName, appSyncApiId, clonerEnabledOpt, platformApiId, apiFragmentRegistryTableName, adminDcbCmdTopicUrl, splitApiOpt, param) {
+function registerConfig(eventTopicArn, pluginReadModelTableName, schedulerRoleArn, schedulerQueueArn, schedulerQueueName, appSyncApiId, clonerEnabledOpt, param) {
   let clonerEnabled = clonerEnabledOpt !== undefined ? clonerEnabledOpt : false;
-  let splitApi = splitApiOpt !== undefined ? splitApiOpt : false;
   configRef.contents = {
     eventTopicArn: eventTopicArn,
     pluginReadModelTableName: pluginReadModelTableName,
-    pluginSchemaPersistenceTableName: pluginSchemaPersistenceTableName,
     schedulerRoleArn: schedulerRoleArn,
     schedulerQueueArn: schedulerQueueArn,
     schedulerQueueName: schedulerQueueName,
     appSyncApiId: appSyncApiId,
-    clonerEnabled: clonerEnabled,
-    platformApiId: platformApiId,
-    apiFragmentRegistryTableName: apiFragmentRegistryTableName,
-    adminDcbCmdTopicUrl: adminDcbCmdTopicUrl,
-    splitApi: splitApi
+    clonerEnabled: clonerEnabled
   };
 }
 
@@ -209,11 +198,7 @@ function Make(EventCollectorChannel) {
       outputOrPlaceholder(config.schedulerQueueArn),
       outputOrPlaceholder(config.schedulerQueueName),
       outputOrPlaceholder(config.appSyncApiId),
-      epEventTopicArnsOutput,
-      outputOrPlaceholder(config.pluginSchemaPersistenceTableName),
-      outputOrPlaceholder(config.platformApiId),
-      outputOrPlaceholder(config.apiFragmentRegistryTableName),
-      outputOrPlaceholder(config.adminDcbCmdTopicUrl)
+      epEventTopicArnsOutput
     ]).apply(values => {
       let queueUrl = values[0];
       let pluginEpCmdTopicUrl = values[1];
@@ -224,21 +209,12 @@ function Make(EventCollectorChannel) {
       let schedQueueName = values[6];
       let appSyncApiId = values[7];
       let epEventTopicArns = values[8];
-      let schemaPersistenceTable = values[9];
-      let platformApiId = values[10];
-      let apiFragmentRegistryTable = values[11];
-      let adminDcbCmdTopicUrl = values[12];
       let dict = {};
       dict["queueUrl"] = queueUrl;
       dict["pluginExtensionPointCmdTopicUrl"] = pluginEpCmdTopicUrl;
       dict["eventTopicArn"] = topLevelEventTopicArn;
       dict["pluginReadModelTableName"] = rmTable;
-      dict["pluginSchemaPersistenceTableName"] = schemaPersistenceTable;
       dict["appSyncApiId"] = appSyncApiId;
-      dict["platformApiId"] = platformApiId;
-      dict["apiFragmentRegistryTableName"] = apiFragmentRegistryTable;
-      dict["adminDcbCmdTopicUrl"] = adminDcbCmdTopicUrl;
-      dict["splitApi"] = config.splitApi;
       dict["clonerEnabled"] = config.clonerEnabled;
       dict["schedulerRoleArn"] = schedRoleArn;
       dict["schedulerQueueArn"] = schedQueueArn;
@@ -383,58 +359,6 @@ function Make(EventCollectorChannel) {
           role: runtime.parts.lambdaRole.id
         });
       }
-      let schemaTableOutput = config.pluginSchemaPersistenceTableName;
-      if (schemaTableOutput !== undefined) {
-        let policyJson$1 = schemaTableOutput.apply(tableName => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `PluginSchemaScanPolicy`, [{
-            Sid: "AllowAdminScanPluginSchemaPersistence",
-            Effect: "Allow",
-            Action: ["dynamodb:Scan"],
-            Resource: "arn:aws:dynamodb:*:*:table/" + tableName
-          }])));
-        new (Aws.iam.RolePolicy)(name + `-pluginSchemaScan`, {
-          policy: policyJson$1,
-          role: runtime.parts.lambdaRole.id
-        });
-      }
-      let tableOutput = config.apiFragmentRegistryTableName;
-      if (tableOutput !== undefined) {
-        let policyJson$2 = tableOutput.apply(tableName => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `ApiFragmentsScanPolicy`, [{
-            Sid: "AllowAdminScanApiFragments",
-            Effect: "Allow",
-            Action: ["dynamodb:Scan"],
-            Resource: "arn:aws:dynamodb:*:*:table/" + tableName
-          }])));
-        new (Aws.iam.RolePolicy)(name + `-apiFragmentsScan`, {
-          policy: policyJson$2,
-          role: runtime.parts.lambdaRole.id
-        });
-      }
-      let urlOutput = config.adminDcbCmdTopicUrl;
-      if (urlOutput !== undefined) {
-        let policyJson$3 = urlOutput.apply(url => {
-          let match = url.split("/");
-          let arn;
-          if (match.length !== 5) {
-            arn = url;
-          } else {
-            let host = match[2];
-            let acct = match[3];
-            let qn = match[4];
-            let region = Stdlib_Option.getOr(host.split(".")[1], "eu-west-1");
-            arn = `arn:aws:sqs:` + region + `:` + acct + `:` + qn;
-          }
-          return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `AdminDcbSendPolicy`, [{
-              Sid: "AllowAdminDispatchRecordApiFragmentPush",
-              Effect: "Allow",
-              Action: ["sqs:SendMessage"],
-              Resource: arn
-            }]));
-        });
-        new (Aws.iam.RolePolicy)(name + `-adminDcbSend`, {
-          policy: policyJson$3,
-          role: runtime.parts.lambdaRole.id
-        });
-      }
     }
     let aggregateNameSet = {};
     context.extensions.forEach(ext => {

package/tests/AppSync_AdapterTest.res

@@ -652,3 +652,179 @@ describe("Split mode — empty base fragment", () => {
     expect(sdl)->toContain("Platform_Plugin")
   })
 })
+
+// ── Merged mode — canonical source documents ─────────────────────────────────
+//
+// On the merge path (merged-api-push-free-composition, Phase 3) the platform-
+// owned source APIs carry their schemas DECLARATIVELY: the admin base (or, in
+// split mode, the bare relay base) stitched with an empty plugin list and
+// stamped @canonical. These tests pin the assembled documents' load-bearing
+// properties; Platform.res composes exactly this pipeline.
+
+describe("Merged mode — canonical source documents", () => {
+  let assembleCanonicalSourceSdl = (~baseFragment) =>
+    AppSync_Adapter.stitchWithAwsDirectives(~baseFragment, ~pluginFragments=[])
+    ->AppSync_SdlDecorate.stampCanonicalTypes
+
+  let emptyBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
+    types: [],
+    mutations: [],
+    queries: [],
+    subscriptions: [],
+    subscriptionSources: [],
+  })
+
+  let adminSourceSdl = assembleCanonicalSourceSdl(
+    ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
+      ReventlessCore.AdminApi.baseFragment(~cloner=false),
+      ~group="Admin",
+      ~iamFieldNames=ReventlessCore.AdminApi.systemCallerFieldNames,
+    ),
+  )
+
+  let relayBaseSourceSdl = assembleCanonicalSourceSdl(~baseFragment=emptyBaseFragment)
+
+  testSync("admin source document carries the global node query", () => {
+    expect(adminSourceSdl)->toContain("node(id: ID!): Node")
+  })
+
+  testSync("admin source document stamps @canonical on the shared traversal types", () => {
+    expect(adminSourceSdl)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam @canonical {")
+    expect(adminSourceSdl)->toContain("interface Node @canonical {")
+    expect(adminSourceSdl)->toContain("union CommandResult @canonical =")
+    expect(adminSourceSdl)->toContain(
+      "type CommandAccepted @aws_cognito_user_pools @aws_iam @canonical {",
+    )
+  })
+
+  testSync("admin source document keeps admin fields and dual-auth stamps", () => {
+    expect(adminSourceSdl)->toContain("Platform_Plugin")
+    expect(adminSourceSdl)->toContain("@aws_iam")
+  })
+
+  testSync("relay-base source document (split-mode Domain source) is node + relay types only", () => {
+    expect(relayBaseSourceSdl)->toContain("node(id: ID!): Node")
+    expect(relayBaseSourceSdl)->toContain("interface Node @canonical {")
+    expect(relayBaseSourceSdl)->toContain("type PageInfo")
+    // No admin or plugin fields on the split-mode Domain source.
+    expect(relayBaseSourceSdl)->not_->toContain("Platform_Plugin")
+    // No mutations → no CommandResult family on this source.
+    expect(relayBaseSourceSdl)->not_->toContain("union CommandResult")
+  })
+
+  // Phase 4: the plugin-stack subgraph document pushed to the plugin's own
+  // source API.
+  let pluginFragment = ReventlessCore.GraphQL_Stitcher.encode({
+    types: [
+      "type MyPlugin_Item implements Node {\n  id: ID!\n  name: String!\n}",
+      "type CommandAccepted {\n  msgId: ID!\n  eventCount: Int!\n}",
+    ],
+    mutations: ["MyPlugin_Item_Create(name: String!): CommandResult"],
+    queries: ["MyPlugin_Item(id: ID!): MyPlugin_Item"],
+    subscriptions: ["onMyPlugin_Item_Create(id: ID): CommandResult"],
+    subscriptionSources: [
+      {field: "onMyPlugin_Item_Create", mutations: ["MyPlugin_Item_Create"]},
+    ],
+  })
+
+  testSync("plugin subgraph document is standalone: relay types included, node omitted", () => {
+    let sdl = AppSync_Adapter.stitchStandaloneWithAwsDirectives(~fragment=pluginFragment)
+    expect(sdl)->toContain("interface Node")
+    expect(sdl)->toContain("type PageInfo")
+    expect(sdl)->toContain("MyPlugin_Item_Create")
+    expect(sdl)->not_->toContain("node(id: ID!): Node")
+  })
+
+  testSync("plugin subgraph document carries @aws_subscribe + shared-type IAM stamps, no @canonical", () => {
+    let sdl = AppSync_Adapter.stitchStandaloneWithAwsDirectives(~fragment=pluginFragment)
+    expect(sdl)->toContain(`@aws_subscribe(mutations: ["MyPlugin_Item_Create"])`)
+    expect(sdl)->toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {")
+    // Plugin subgraphs stay unstamped — the admin source's canonical defs win.
+    expect(sdl)->not_->toContain("@canonical")
+  })
+})
+
+// ── waitForMergeSuccess — association merge-status poll ─────────────────────
+
+describe("AppSync_Adapter.waitForMergeSuccess", () => {
+  // Fake AppSync client: `send` yields the canned responses in order and
+  // repeats the last one when the poll outruns the script.
+  let makeFakeClient = (
+    responses: array<AppSync_Adapter.getSourceApiAssociationResult>,
+  ): AppSync_Adapter.appSyncClient => {
+    let i = ref(0)
+    let fake = {
+      "send": _cmd => {
+        let idx = Math.Int.min(i.contents, responses->Array.length - 1)
+        i := i.contents + 1
+        Promise.resolve(responses->Array.getUnsafe(idx))
+      },
+    }
+    fake->Obj.magic
+  }
+
+  let response = (~status, ~detail=?): AppSync_Adapter.getSourceApiAssociationResult => {
+    sourceApiAssociation: Some({
+      sourceApiAssociationStatus: Some(status),
+      sourceApiAssociationStatusDetail: detail,
+    }),
+  }
+
+  test("resolves once the association reports MERGE_SUCCESS", async () => {
+    let client = makeFakeClient([
+      response(~status="MERGE_SCHEDULED"),
+      response(~status="MERGE_IN_PROGRESS"),
+      response(~status="MERGE_SUCCESS"),
+    ])
+    await AppSync_Adapter.waitForMergeSuccess(
+      client,
+      ~associationId="assoc-1",
+      ~mergedApiIdentifier="merged-1",
+      ~delayMs=1,
+    )
+  })
+
+  test("throws with the AWS status detail on MERGE_FAILED", async () => {
+    let client = makeFakeClient([
+      response(
+        ~status="MERGE_FAILED",
+        ~detail="Unable to resolve conflict on object with name SharedThing.x",
+      ),
+    ])
+    let message = ref("")
+    try {
+      await AppSync_Adapter.waitForMergeSuccess(
+        client,
+        ~associationId="assoc-1",
+        ~mergedApiIdentifier="merged-1",
+        ~delayMs=1,
+      )
+    } catch {
+    | exn =>
+      message :=
+        exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("(no message)")
+    }
+    expect(message.contents)->toContain("MERGE_FAILED")
+    expect(message.contents)->toContain("SharedThing.x")
+  })
+
+  test("times out after maxAttempts on a status that never settles", async () => {
+    let client = makeFakeClient([response(~status="MERGE_IN_PROGRESS")])
+    let message = ref("")
+    try {
+      await AppSync_Adapter.waitForMergeSuccess(
+        client,
+        ~associationId="assoc-1",
+        ~mergedApiIdentifier="merged-1",
+        ~maxAttempts=2,
+        ~delayMs=1,
+      )
+    } catch {
+    | exn =>
+      message :=
+        exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("(no message)")
+    }
+    expect(message.contents)->toContain("timed out")
+    expect(message.contents)->toContain("MERGE_IN_PROGRESS")
+  })
+})

package/tests/AppSync_AdapterTest.res.mjs

@@ -1,11 +1,14 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
 
 globalThis.describe("AppSync_Adapter.sha256Hex", () => {
@@ -603,6 +606,137 @@ globalThis.describe("Split mode — empty base fragment", () => {
   });
 });
 
+globalThis.describe("Merged mode — canonical source documents", () => {
+  let emptyBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: [],
+    queries: [],
+    subscriptions: [],
+    subscriptionSources: []
+  });
+  let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", AdminApi$ReventlessCore.systemCallerFieldNames);
+  let adminSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchWithAwsDirectives(baseFragment, []));
+  let relayBaseSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchWithAwsDirectives(emptyBaseFragment, []));
+  globalThis.test("admin source document carries the global node query", () => {
+    globalThis.expect(adminSourceSdl).toContain("node(id: ID!): Node");
+  });
+  globalThis.test("admin source document stamps @canonical on the shared traversal types", () => {
+    globalThis.expect(adminSourceSdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam @canonical {");
+    globalThis.expect(adminSourceSdl).toContain("interface Node @canonical {");
+    globalThis.expect(adminSourceSdl).toContain("union CommandResult @canonical =");
+    globalThis.expect(adminSourceSdl).toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam @canonical {");
+  });
+  globalThis.test("admin source document keeps admin fields and dual-auth stamps", () => {
+    globalThis.expect(adminSourceSdl).toContain("Platform_Plugin");
+    globalThis.expect(adminSourceSdl).toContain("@aws_iam");
+  });
+  globalThis.test("relay-base source document (split-mode Domain source) is node + relay types only", () => {
+    globalThis.expect(relayBaseSourceSdl).toContain("node(id: ID!): Node");
+    globalThis.expect(relayBaseSourceSdl).toContain("interface Node @canonical {");
+    globalThis.expect(relayBaseSourceSdl).toContain("type PageInfo");
+    globalThis.expect(relayBaseSourceSdl).not.toContain("Platform_Plugin");
+    globalThis.expect(relayBaseSourceSdl).not.toContain("union CommandResult");
+  });
+  let pluginFragment = GraphQL_Stitcher$ReventlessCore.encode({
+    types: [
+      "type MyPlugin_Item implements Node {\n  id: ID!\n  name: String!\n}",
+      "type CommandAccepted {\n  msgId: ID!\n  eventCount: Int!\n}"
+    ],
+    mutations: ["MyPlugin_Item_Create(name: String!): CommandResult"],
+    queries: ["MyPlugin_Item(id: ID!): MyPlugin_Item"],
+    subscriptions: ["onMyPlugin_Item_Create(id: ID): CommandResult"],
+    subscriptionSources: [{
+        field: "onMyPlugin_Item_Create",
+        mutations: ["MyPlugin_Item_Create"]
+      }]
+  });
+  globalThis.test("plugin subgraph document is standalone: relay types included, node omitted", () => {
+    let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
+    globalThis.expect(sdl).toContain("interface Node");
+    globalThis.expect(sdl).toContain("type PageInfo");
+    globalThis.expect(sdl).toContain("MyPlugin_Item_Create");
+    globalThis.expect(sdl).not.toContain("node(id: ID!): Node");
+  });
+  globalThis.test("plugin subgraph document carries @aws_subscribe + shared-type IAM stamps, no @canonical", () => {
+    let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
+    globalThis.expect(sdl).toContain(`@aws_subscribe(mutations: ["MyPlugin_Item_Create"])`);
+    globalThis.expect(sdl).toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(sdl).not.toContain("@canonical");
+  });
+});
+
+globalThis.describe("AppSync_Adapter.waitForMergeSuccess", () => {
+  let makeFakeClient = responses => {
+    let i = {
+      contents: 0
+    };
+    return {
+      send: _cmd => {
+        let idx = Math.min(i.contents, responses.length - 1 | 0);
+        i.contents = i.contents + 1 | 0;
+        return Promise.resolve(responses[idx]);
+      }
+    };
+  };
+  globalThis.test("resolves once the association reports MERGE_SUCCESS", async () => {
+    let client = makeFakeClient([
+      {
+        sourceApiAssociation: {
+          sourceApiAssociationStatus: "MERGE_SCHEDULED",
+          sourceApiAssociationStatusDetail: undefined
+        }
+      },
+      {
+        sourceApiAssociation: {
+          sourceApiAssociationStatus: "MERGE_IN_PROGRESS",
+          sourceApiAssociationStatusDetail: undefined
+        }
+      },
+      {
+        sourceApiAssociation: {
+          sourceApiAssociationStatus: "MERGE_SUCCESS",
+          sourceApiAssociationStatusDetail: undefined
+        }
+      }
+    ]);
+    return await AppSync_Adapter$ReventlessAws.waitForMergeSuccess(client, "assoc-1", "merged-1", undefined, undefined, 1);
+  });
+  globalThis.test("throws with the AWS status detail on MERGE_FAILED", async () => {
+    let client = makeFakeClient([{
+        sourceApiAssociation: {
+          sourceApiAssociationStatus: "MERGE_FAILED",
+          sourceApiAssociationStatusDetail: "Unable to resolve conflict on object with name SharedThing.x"
+        }
+      }]);
+    let message = "";
+    try {
+      await AppSync_Adapter$ReventlessAws.waitForMergeSuccess(client, "assoc-1", "merged-1", undefined, undefined, 1);
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      message = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "(no message)");
+    }
+    globalThis.expect(message).toContain("MERGE_FAILED");
+    globalThis.expect(message).toContain("SharedThing.x");
+  });
+  globalThis.test("times out after maxAttempts on a status that never settles", async () => {
+    let client = makeFakeClient([{
+        sourceApiAssociation: {
+          sourceApiAssociationStatus: "MERGE_IN_PROGRESS",
+          sourceApiAssociationStatusDetail: undefined
+        }
+      }]);
+    let message = "";
+    try {
+      await AppSync_Adapter$ReventlessAws.waitForMergeSuccess(client, "assoc-1", "merged-1", 2, undefined, 1);
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      message = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "(no message)");
+    }
+    globalThis.expect(message).toContain("timed out");
+    globalThis.expect(message).toContain("MERGE_IN_PROGRESS");
+  });
+});
+
 export {
   decodeFragment,
 }

package/tests/AppSync_SdlDecorateTest.res

@@ -205,3 +205,30 @@ describe("AppSync_SdlDecorate.stampSharedIamTypes", () => {
     expect(sdl)->toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam {")
   })
 })
+
+describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
+  testSync("stamps shared object types, the Node interface, and the CommandResult union", () => {
+    let sdl = AppSync_SdlDecorate.stampCanonicalTypes(
+      "interface Node {\n  id: ID!\n}\n\ntype PageInfo {\n  hasNextPage: Boolean!\n}\n\nunion CommandResult = CommandAccepted | CommandRejected | CommandPending\n\ntype CommandAccepted {\n  msgId: ID!\n}",
+    )
+    expect(sdl)->toContain("interface Node @canonical {")
+    expect(sdl)->toContain("type PageInfo @canonical {")
+    expect(sdl)->toContain("union CommandResult @canonical = CommandAccepted")
+    expect(sdl)->toContain("type CommandAccepted @canonical {")
+  })
+
+  testSync("composes after stampSharedIamTypes and leaves other types alone", () => {
+    let sdl =
+      AppSync_SdlDecorate.stampSharedIamTypes(
+        "type PageInfo {\n  hasNextPage: Boolean!\n}\n\ntype Product {\n  id: ID!\n}",
+      )->AppSync_SdlDecorate.stampCanonicalTypes
+    expect(sdl)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam @canonical {")
+    expect(sdl)->toContain("type Product {")
+    expect(sdl->String.includes("type Product @canonical"))->toBe(false)
+  })
+
+  testSync("is idempotent", () => {
+    let once = AppSync_SdlDecorate.stampCanonicalTypes("type PageInfo {\n  x: Int\n}")
+    expect(AppSync_SdlDecorate.stampCanonicalTypes(once))->toBe(once)
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -177,6 +177,26 @@ globalThis.describe("AppSync_SdlDecorate.stampSharedIamTypes", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
+  globalThis.test("stamps shared object types, the Node interface, and the CommandResult union", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes("interface Node {\n  id: ID!\n}\n\ntype PageInfo {\n  hasNextPage: Boolean!\n}\n\nunion CommandResult = CommandAccepted | CommandRejected | CommandPending\n\ntype CommandAccepted {\n  msgId: ID!\n}");
+    globalThis.expect(sdl).toContain("interface Node @canonical {");
+    globalThis.expect(sdl).toContain("type PageInfo @canonical {");
+    globalThis.expect(sdl).toContain("union CommandResult @canonical = CommandAccepted");
+    globalThis.expect(sdl).toContain("type CommandAccepted @canonical {");
+  });
+  globalThis.test("composes after stampSharedIamTypes and leaves other types alone", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes("type PageInfo {\n  hasNextPage: Boolean!\n}\n\ntype Product {\n  id: ID!\n}"));
+    globalThis.expect(sdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam @canonical {");
+    globalThis.expect(sdl).toContain("type Product {");
+    globalThis.expect(sdl.includes("type Product @canonical")).toBe(false);
+  });
+  globalThis.test("is idempotent", () => {
+    let once = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes("type PageInfo {\n  x: Int\n}");
+    globalThis.expect(AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(once)).toBe(once);
+  });
+});
+
 export {
   sources,
   stitchedSdl,

package/tests/MCP_LambdaTest.res

@@ -7,8 +7,9 @@ describe("MCP_Lambda.generateAdminConfig", () => {
       ~serverVersion="1.0.0",
       ~cloner=false,
     )
-    // Admin has Plugin_Activate, Plugin_Deactivate, Plugin_Retire mutations
-    expect(config.tools)->toHaveLength(3)
+    // Admin has Plugin_Activate, Plugin_Deactivate, Plugin_Retire +
+    // ApiFragmentRegistry_Register/DeregisterApiFragment mutations
+    expect(config.tools)->toHaveLength(5)
   })
 
   testSync("produces additional clone tool when cloner=true", () => {
@@ -17,8 +18,9 @@ describe("MCP_Lambda.generateAdminConfig", () => {
       ~serverVersion="1.0.0",
       ~cloner=true,
     )
-    // Plugin_Activate, Plugin_Deactivate, Plugin_Retire, Clone
-    expect(config.tools)->toHaveLength(4)
+    // Plugin_Activate, Plugin_Deactivate, Plugin_Retire,
+    // ApiFragmentRegistry_Register/DeregisterApiFragment, Clone
+    expect(config.tools)->toHaveLength(6)
   })
 
   testSync("produces resources from admin query entries", () => {

package/tests/MCP_LambdaTest.res.mjs

@@ -6,11 +6,11 @@ import * as MCP_Lambda$ReventlessAws from "../src/adapter/Mcp/MCP_Lambda.res.mjs
 globalThis.describe("MCP_Lambda.generateAdminConfig", () => {
   globalThis.test("produces tools from admin mutation entries (no cloner)", () => {
     let config = MCP_Lambda$ReventlessAws.generateAdminConfig("test", "1.0.0", false, undefined, undefined);
-    globalThis.expect(config.tools).toHaveLength(3);
+    globalThis.expect(config.tools).toHaveLength(5);
   });
   globalThis.test("produces additional clone tool when cloner=true", () => {
     let config = MCP_Lambda$ReventlessAws.generateAdminConfig("test", "1.0.0", true, undefined, undefined);
-    globalThis.expect(config.tools).toHaveLength(4);
+    globalThis.expect(config.tools).toHaveLength(6);
   });
   globalThis.test("produces resources from admin query entries", () => {
     let config = MCP_Lambda$ReventlessAws.generateAdminConfig("test", "1.0.0", undefined, undefined, undefined);