@reventlessdev/reventless-aws 3.0.0-alpha.209 → 3.0.0-alpha.210

package/src/components/Api/AppSync_Adapter.res

@@ -157,6 +157,77 @@ let getClient = () =>
     c
   }
 
+// ── GetSourceApiAssociation — merged-API association status poll ──────────
+// Merged-API deploys must fail loudly on MERGE_FAILED (plan
+// merged-api-push-free-composition, Phase 0 finding: a failed merge silently
+// keeps the last-good merged schema serving). After creating a
+// SourceApiAssociation, poll until the initial merge lands.
+type getSourceApiAssociationInput = {
+  associationId: string,
+  mergedApiIdentifier: string,
+}
+type getSourceApiAssociationCommand
+type sourceApiAssociationSummary = {
+  sourceApiAssociationStatus: option<string>,
+  sourceApiAssociationStatusDetail: option<string>,
+}
+type getSourceApiAssociationResult = {sourceApiAssociation: option<sourceApiAssociationSummary>}
+
+@module("@aws-sdk/client-appsync") @new
+external makeGetSourceApiAssociationCommand: getSourceApiAssociationInput => getSourceApiAssociationCommand =
+  "GetSourceApiAssociationCommand"
+
+@send
+external sendGetSourceApiAssociation: (
+  appSyncClient,
+  getSourceApiAssociationCommand,
+) => promise<getSourceApiAssociationResult> = "send"
+
+// Poll until the association reports MERGE_SUCCESS; throw with the AWS status
+// detail on MERGE_FAILED / AUTO_MERGE_SCHEDULE_FAILED. Auto-merge lands in
+// ~12 s (spike-measured), so 60 × 2 s bounds the wait at two minutes.
+let rec waitForMergeSuccess = async (
+  client: appSyncClient,
+  ~associationId: string,
+  ~mergedApiIdentifier: string,
+  ~maxAttempts=60,
+  ~attempt=0,
+  ~delayMs=2000,
+) => {
+  let result = await client->sendGetSourceApiAssociation(
+    {associationId, mergedApiIdentifier}->makeGetSourceApiAssociationCommand,
+  )
+  let status =
+    result.sourceApiAssociation
+    ->Option.flatMap(a => a.sourceApiAssociationStatus)
+    ->Option.getOr("(no status)")
+  let detail =
+    result.sourceApiAssociation
+    ->Option.flatMap(a => a.sourceApiAssociationStatusDetail)
+    ->Option.getOr("(no details)")
+  switch status {
+  | "MERGE_SUCCESS" => ()
+  | "MERGE_FAILED" | "AUTO_MERGE_SCHEDULE_FAILED" =>
+    JsError.throwWithMessage(
+      `Source API association ${associationId} on ${mergedApiIdentifier} failed to merge (${status}): ${detail}`,
+    )
+  | _ if attempt >= maxAttempts =>
+    JsError.throwWithMessage(
+      `Source API association ${associationId} merge timed out after ${maxAttempts->Int.toString} attempts (status: ${status})`,
+    )
+  | _ =>
+    await Promise.make((resolve, _) => setTimeout(resolve, delayMs)->ignore)
+    await waitForMergeSuccess(
+      client,
+      ~associationId,
+      ~mergedApiIdentifier,
+      ~maxAttempts,
+      ~attempt=attempt + 1,
+      ~delayMs,
+    )
+  }
+}
+
 // ── @aws_auth directive injection ─────────────────────────────────────────
 // Injects @aws_auth(cognito_groups: [...]) directives into SDL field strings
 // based on authorization metadata from schema entries.
@@ -433,13 +504,40 @@ let stitchWithAwsDirectives = (
   ->stampSharedIamTypes
 }
 
+/**
+Merged-mode plugin subgraph document: one fragment rendered standalone
+(relay base types included, global `node` omitted — only the platform's
+canonical base document carries `node`), with the same AppSync dialect as
+`stitchWithAwsDirectives`. No `@canonical` stamps — plugin subgraphs stay
+unstamped; the admin source's canonical definitions win on merge.
+*/
+let stitchStandaloneWithAwsDirectives = (
+  ~fragment: Reventless.Plugin.apiSchemaFragment,
+): string => {
+  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
+    ~baseFragment=fragment,
+    ~pluginFragments=[],
+  )
+  ReventlessCore.GraphQL_Stitcher.stitchStandalone(~fragment)
+  ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
+  ->stampSharedIamTypes
+}
+
 // ── Provider implementation ────────────────────────────────────────────────
 
 type api = AppSync.GraphQLApi.t
 type role = IAM.Role.t
 
-let makeApiResource = (
+// Primary authentication mode every platform-created AppSync API uses. A
+// merged API and its source APIs must share this primary mode — exported via
+// StackReference (`mergedApiPrimaryAuth`) and asserted where associations are
+// created (AppSync_MergedApi.assertCompatiblePrimaryAuth).
+let primaryAuthenticationType = AppSync.GraphQLApi.AMAZON_COGNITO_USER_POOLS
+
+let _makeApiResourceWith = (
   ~name: string,
+  ~schema: option<string>,
+  ~userPoolConfig: option<Pulumi.Output.t<AppSync.GraphQLApi.userPoolConfig>>,
   ~opts: Pulumi.ComponentResource.options,
 ): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) => {
   let customOpts: Pulumi.CustomResourceOptions.t = {
@@ -456,13 +554,16 @@ let makeApiResource = (
     ~opts=Some(customOpts),
   )
 
-  // Resolve the Cognito UserPool — cached inside Platform_Stack, so calling
-  // from each API call site (DomainApi, PlatformApi) is safe. Returned as a
-  // single Output that yields the {userPoolId, awsRegion, defaultAction}
-  // record AppSync expects.
-  let authConfigOut = Auth_Cognito.make(~name=`${name}-auth`)
-  let userPoolConfigOut =
-    authConfigOut->Pulumi.Output.apply((c: Auth_Cognito.authConfig) =>
+  // Resolve the Cognito UserPool — either supplied by the caller (plugin-stack
+  // source APIs read it from the platform's StackReference exports so they
+  // never provision pool/client resources of their own) or resolved via
+  // Auth_Cognito (cached inside Platform_Stack, so calling from each API call
+  // site — DomainApi, PlatformApi — is safe). A single Output yielding the
+  // {userPoolId, awsRegion, defaultAction} record AppSync expects.
+  let userPoolConfigOut = switch userPoolConfig {
+  | Some(config) => config
+  | None =>
+    Auth_Cognito.make(~name=`${name}-auth`)->Pulumi.Output.apply((c: Auth_Cognito.authConfig) =>
       (
         {
           userPoolId: c.userPoolId,
@@ -471,13 +572,13 @@ let makeApiResource = (
         }: AppSync.GraphQLApi.userPoolConfig
       )
     )
+  }
 
   // Cognito as primary auth, AWS_IAM as additional provider for
   // server-to-server lambdas (heartbeat, Plugin_Connected emission) signed via
   // the existing IAM role.
   let apiArgs: AppSync.GraphQLApi.args = {
-    authenticationType: AppSync.GraphQLApi
-    .AMAZON_COGNITO_USER_POOLS->Pulumi.Input.make,
+    authenticationType: primaryAuthenticationType->Pulumi.Input.make,
     userPoolConfig: userPoolConfigOut->Pulumi.Output.asInput,
     additionalAuthenticationProviders: [
       (
@@ -486,12 +587,45 @@ let makeApiResource = (
         }: AppSync.GraphQLApi.additionalAuthenticationProvider
       )->Pulumi.Input.make,
     ]->Pulumi.Input.make,
+    schema: ?(schema->Option.map(Pulumi.Input.make)),
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
   (graphQLApi->Pulumi.Output.make, iamRole->Pulumi.Output.make)
 }
 
+let makeApiResource = (
+  ~name: string,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=None, ~opts)
+
+// Merged-mode source API: same auth shape as makeApiResource but with a
+// DECLARATIVE inline schema — the provider runs StartSchemaCreation + poll
+// before the resource resolves, so resolvers chained on the API are ordered
+// after the schema is ACTIVE without the push-path hook machinery. Not part
+// of the Api_Adapter.Provider interface (Platform.res calls it directly on
+// the merge path).
+let makeSourceApiResource = (
+  ~name: string,
+  ~schema: string,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=Some(schema), ~userPoolConfig=None, ~opts)
+
+// Merged-mode PLUGIN source API: schema-less at creation (the plugin's
+// standalone subgraph document is only computable during P.make(), so
+// preResolversSchemaHook pushes it — the plugin's own API is a single writer
+// by construction). The user pool comes from the platform's StackReference
+// exports so the merged endpoint's Cognito primary auth matches across every
+// source API without the plugin stack provisioning pool/client resources.
+let makePluginSourceApiResource = (
+  ~name: string,
+  ~userPoolConfig: Pulumi.Output.t<AppSync.GraphQLApi.userPoolConfig>,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=Some(userPoolConfig), ~opts)
+
 let generateFragment = (
   ~mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry>,
   ~queryEntries: array<ReventlessInfra.Api.querySchemaEntry>,

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -101,6 +101,35 @@ function getClient() {
   return c$1;
 }
 
+async function waitForMergeSuccess(client, associationId, mergedApiIdentifier, maxAttemptsOpt, attemptOpt, delayMsOpt) {
+  let maxAttempts = maxAttemptsOpt !== undefined ? maxAttemptsOpt : 60;
+  let attempt = attemptOpt !== undefined ? attemptOpt : 0;
+  let delayMs = delayMsOpt !== undefined ? delayMsOpt : 2000;
+  let result = await client.send(new ClientAppsync.GetSourceApiAssociationCommand({
+    associationId: associationId,
+    mergedApiIdentifier: mergedApiIdentifier
+  }));
+  let status = Stdlib_Option.getOr(Stdlib_Option.flatMap(result.sourceApiAssociation, a => a.sourceApiAssociationStatus), "(no status)");
+  let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(result.sourceApiAssociation, a => a.sourceApiAssociationStatusDetail), "(no details)");
+  switch (status) {
+    case "AUTO_MERGE_SCHEDULE_FAILED" :
+    case "MERGE_FAILED" :
+      break;
+    case "MERGE_SUCCESS" :
+      return;
+    default:
+      if (attempt >= maxAttempts) {
+        return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` merge timed out after ` + maxAttempts.toString() + ` attempts (status: ` + status + `)`);
+      } else {
+        await new Promise((resolve, param) => {
+          setTimeout(resolve, delayMs);
+        });
+        return await waitForMergeSuccess(client, associationId, mergedApiIdentifier, maxAttempts, attempt + 1 | 0, delayMs);
+      }
+  }
+  return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` on ` + mergedApiIdentifier + ` failed to merge (` + status + `): ` + detail);
+}
+
 function _permissionToCognitoGroups(permission) {
   if (typeof permission !== "object") {
     switch (permission) {
@@ -268,7 +297,12 @@ function stitchWithAwsDirectives(baseFragment, pluginFragments) {
   return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, pluginFragments), sources));
 }
 
-function makeApiResource(name, opts) {
+function stitchStandaloneWithAwsDirectives(fragment) {
+  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
+  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources));
+}
+
+function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let customOpts_parent = opts.parent;
   let customOpts = {
     parent: customOpts_parent
@@ -276,18 +310,19 @@ function makeApiResource(name, opts) {
   let iamRole = new (Aws.iam.Role)(name + `-appsync-role`, {
     assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
   }, customOpts);
-  let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
-  let userPoolConfigOut = authConfigOut.apply(c => ({
-    userPoolId: c.userPoolId,
-    defaultAction: "ALLOW",
-    awsRegion: c.region
-  }));
+  let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
+      userPoolId: c.userPoolId,
+      defaultAction: "ALLOW",
+      awsRegion: c.region
+    }));
+  let apiArgs_schema = Stdlib_Option.map(schema, prim => prim);
   let apiArgs_userPoolConfig = userPoolConfigOut;
   let apiArgs_additionalAuthenticationProviders = [{
       authenticationType: "AWS_IAM"
     }];
   let apiArgs = {
     authenticationType: "AMAZON_COGNITO_USER_POOLS",
+    schema: apiArgs_schema,
     userPoolConfig: apiArgs_userPoolConfig,
     additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders
   };
@@ -298,6 +333,18 @@ function makeApiResource(name, opts) {
   ];
 }
 
+function makeApiResource(name, opts) {
+  return _makeApiResourceWith(name, undefined, undefined, opts);
+}
+
+function makeSourceApiResource(name, schema, opts) {
+  return _makeApiResourceWith(name, schema, undefined, opts);
+}
+
+function makePluginSourceApiResource(name, userPoolConfig, opts) {
+  return _makeApiResourceWith(name, undefined, userPoolConfig, opts);
+}
+
 function generateFragment(mutationEntries, queryEntries) {
   let fragment = GraphQL_FragmentGenerator$ReventlessCore.generate(mutationEntries, queryEntries);
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
@@ -319,6 +366,8 @@ function updateSchema(api, baseFragment, pluginFragments) {
 
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
+let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";
+
 export {
   log,
   sha256Hex,
@@ -329,6 +378,7 @@ export {
   deploySchemaWithRetry,
   _client,
   getClient,
+  waitForMergeSuccess,
   _permissionToCognitoGroups,
   _formatGroupsDirective,
   _formatDualAuthDirective,
@@ -338,7 +388,12 @@ export {
   injectAwsAuth,
   injectAwsAuthAll,
   stitchWithAwsDirectives,
+  stitchStandaloneWithAwsDirectives,
+  primaryAuthenticationType,
+  _makeApiResourceWith,
   makeApiResource,
+  makeSourceApiResource,
+  makePluginSourceApiResource,
   generateFragment,
   updateSchema,
 }

package/src/components/Api/AppSync_MergedApi.res

@@ -0,0 +1,218 @@
+// AppSync_MergedApi — merged-API construction for the push-free composition
+// path (docs/plans/merged-api-push-free-composition.md, Phase 3).
+//
+// A merged API carries no schema of its own: source APIs contribute theirs via
+// SourceApiAssociation and AWS composes the merged endpoint. The platform
+// stack creates the merged API(s) plus the association(s) for its own
+// source(s) (the admin/base canonical source); plugin stacks associate their
+// source APIs against the exported merged-API ARN (Phase 4).
+
+open PulumiAws
+
+// ── Primary-auth contract ───────────────────────────────────────────────────
+// A merged API and every associated source API must share the same PRIMARY
+// authentication mode (AWS rejects incompatible associations). The platform
+// exports the merged API's mode via StackReference (`mergedApiPrimaryAuth`);
+// stacks creating a source API assert against it before associating.
+
+let authenticationTypeName = (t: AppSync.GraphQLApi.authenticationType): string =>
+  switch t {
+  | API_KEY => "API_KEY"
+  | AWS_IAM => "AWS_IAM"
+  | AMAZON_COGNITO_USER_POOLS => "AMAZON_COGNITO_USER_POOLS"
+  | OPENID_CONNECT => "OPENID_CONNECT"
+  }
+
+// The merged APIs share the platform-wide primary mode (Cognito primary,
+// IAM secondary) — same shape the Phase-0 spike validated end-to-end.
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter.primaryAuthenticationType)
+
+let assertCompatiblePrimaryAuth = (~sourceMode: string, ~mergedMode: string): unit =>
+  if sourceMode != mergedMode {
+    failwith(
+      `Merged-API primary-auth mismatch: the source API uses ${sourceMode} but the merged API ` ++
+      `expects ${mergedMode}. A source API must share the merged API's primary authentication ` ++
+      `mode — align the source API's authenticationType with the platform's ` ++ `\`mergedApiPrimaryAuth\` export before associating.`,
+    )
+  }
+
+// ── Merged API + execution role ─────────────────────────────────────────────
+
+type t = {
+  api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  executionRole: IAM.Role.t,
+}
+
+let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+
+  // Execution role AWS assumes to proxy merged-endpoint requests to the source
+  // APIs (appsync:SourceGraphQL) and to run schema merges
+  // (appsync:StartSchemaMerge — required for MANUAL_MERGE, harmless under
+  // AUTO_MERGE). Source APIs associate later from independent plugin stacks,
+  // so their ARNs cannot be enumerated here — the policy stays unscoped.
+  let executionRole = IAM.Role.make(
+    ~name=`${name}-merge-exec-role`,
+    ~args={
+      assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+  let _ = {
+    open PolicyDocument
+    IAM.RolePolicy.make(
+      ~name=`${name}-merge-exec-policy`,
+      ~args={
+        policy: PolicyDocument.make(
+          ~id=`${name}-merge-exec-policy`,
+          ~statements=[
+            {
+              sid: "AllowSourceGraphQLAndMerge",
+              effect: Allow,
+              actions: Actions(["appsync:SourceGraphQL", "appsync:StartSchemaMerge"]),
+              resources: AllResources,
+            },
+          ],
+        )
+        ->PolicyDocument.toJsonString
+        ->Pulumi.Input.make,
+        role: executionRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
+  // Same auth shape as the source APIs (AppSync_Adapter.makeApiResource):
+  // Cognito primary + AWS_IAM secondary. Per-field multi-auth directives on
+  // the source schemas survive the merge verbatim (Phase-0 finding 4).
+  let authConfigOut = Auth_Cognito.make(~name=`${name}-auth`)
+  let userPoolConfigOut =
+    authConfigOut->Pulumi.Output.apply((
+      c: Auth_Cognito.authConfig,
+    ): AppSync.GraphQLApi.userPoolConfig => {
+      userPoolId: c.userPoolId,
+      awsRegion: c.region,
+      defaultAction: AppSync.GraphQLApi.ALLOW,
+    })
+
+  let mergedApi = AppSync.GraphQLApi.make(
+    ~name,
+    ~args={
+      authenticationType: AppSync_Adapter.primaryAuthenticationType->Pulumi.Input.make,
+      userPoolConfig: userPoolConfigOut->Pulumi.Output.asInput,
+      additionalAuthenticationProviders: [
+        (
+          {
+            authenticationType: AppSync.GraphQLApi.AWS_IAM->Pulumi.Input.make,
+          }: AppSync.GraphQLApi.additionalAuthenticationProvider
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+      apiType: AppSync.GraphQLApi.MERGED->Pulumi.Input.make,
+      mergedApiExecutionRoleArn: executionRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(customOpts),
+  )
+
+  {api: mergedApi->Pulumi.Output.make, executionRole}
+}
+
+// ── Source association ──────────────────────────────────────────────────────
+
+/** Associate a source API with the merged API under AUTO_MERGE. AWS
+    serializes association CREATES per merged API (409
+    ConcurrentModificationException) — the platform stack's own associations
+    are inherently sequential; concurrent first-time plugin-stack deploys need
+    retry-with-backoff (Phase 4). */
+let associateSource = (
+  ~name: string,
+  ~mergedApi: t,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiId: mergedApi.api
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Associate a source API against a merged API referenced by ARN — the
+    plugin-stack form, where the merged API is not a resource in this stack
+    but the platform's `domainMergedApiArn` / `platformMergedApiArn`
+    StackReference export. Same AUTO_MERGE + create-time 409 caveat as
+    `associateSource`. */
+let associateSourceWithMergedArn = (
+  ~name: string,
+  ~mergedApiArn: Pulumi.Output.t<string>,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiArn: mergedApiArn->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Deploy-time merge gate: resolves once the association reports
+    MERGE_SUCCESS, fails the deploy loudly (with AWS's status detail) on
+    MERGE_FAILED. Fold the returned Output into an exported value so it is
+    consumed — a MERGE_FAILED then fails `pulumi up` instead of silently
+    serving the last-good merged schema (Phase-0 operational finding).
+    `mergedApiIdentifier` accepts the merged API's id or ARN. */
+let mergeStatusGateWith = (
+  ~mergedApiIdentifier: Pulumi.Output.t<string>,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  (mergedApiIdentifier, association.associationId)
+  ->Pulumi.Output.all2
+  ->Pulumi.Output.flatMap(((identifier, associationId)) =>
+    AppSync_Adapter.waitForMergeSuccess(
+      AppSync_Adapter.getClient(),
+      ~associationId,
+      ~mergedApiIdentifier=identifier,
+    )->Pulumi.Output.fromPromise
+  )
+
+let mergeStatusGate = (
+  ~mergedApi: t,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  mergeStatusGateWith(
+    ~mergedApiIdentifier=mergedApi.api->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id),
+    ~association,
+  )

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -0,0 +1,122 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Pulumi from "@pulumi/pulumi";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
+import * as AppSync_Adapter$ReventlessAws from "./AppSync_Adapter.res.mjs";
+
+function authenticationTypeName(t) {
+  switch (t) {
+    case "API_KEY" :
+      return "API_KEY";
+    case "AWS_IAM" :
+      return "AWS_IAM";
+    case "AMAZON_COGNITO_USER_POOLS" :
+      return "AMAZON_COGNITO_USER_POOLS";
+    case "OPENID_CONNECT" :
+      return "OPENID_CONNECT";
+  }
+}
+
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter$ReventlessAws.primaryAuthenticationType);
+
+function assertCompatiblePrimaryAuth(sourceMode, mergedMode) {
+  if (sourceMode !== mergedMode) {
+    return Pervasives.failwith(`Merged-API primary-auth mismatch: the source API uses ` + sourceMode + ` but the merged API ` + (`expects ` + mergedMode + `. A source API must share the merged API's primary authentication `) + `mode — align the source API's authenticationType with the platform's \`mergedApiPrimaryAuth\` export before associating.`);
+  }
+}
+
+function make(name, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  let executionRole = new (Aws.iam.Role)(name + `-merge-exec-role`, {
+    assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
+  }, customOpts);
+  new (Aws.iam.RolePolicy)(name + `-merge-exec-policy`, {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-merge-exec-policy`, [{
+        Sid: "AllowSourceGraphQLAndMerge",
+        Effect: "Allow",
+        Action: [
+          "appsync:SourceGraphQL",
+          "appsync:StartSchemaMerge"
+        ],
+        Resource: "*"
+      }])),
+    role: executionRole.id
+  }, customOpts);
+  let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
+  let userPoolConfigOut = authConfigOut.apply(c => ({
+    userPoolId: c.userPoolId,
+    defaultAction: "ALLOW",
+    awsRegion: c.region
+  }));
+  let mergedApi = new (Aws.appsync.GraphQLApi)(name, {
+    authenticationType: AppSync_Adapter$ReventlessAws.primaryAuthenticationType,
+    userPoolConfig: userPoolConfigOut,
+    additionalAuthenticationProviders: [{
+        authenticationType: "AWS_IAM"
+      }],
+    apiType: "MERGED",
+    mergedApiExecutionRoleArn: executionRole.arn
+  }, customOpts);
+  return {
+    api: Pulumi.output(mergedApi),
+    executionRole: executionRole
+  };
+}
+
+function associateSource(name, mergedApi, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiId: Output$Pulumi.flatMap(mergedApi.api, a => a.id),
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function associateSourceWithMergedArn(name, mergedApiArn, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiArn: mergedApiArn,
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function mergeStatusGateWith(mergedApiIdentifier, association) {
+  return Output$Pulumi.flatMap(Pulumi.all([
+    mergedApiIdentifier,
+    association.associationId
+  ]), param => AppSync_Adapter$ReventlessAws.waitForMergeSuccess(AppSync_Adapter$ReventlessAws.getClient(), param[1], param[0], undefined, undefined, undefined));
+}
+
+function mergeStatusGate(mergedApi, association) {
+  return mergeStatusGateWith(Output$Pulumi.flatMap(mergedApi.api, a => a.id), association);
+}
+
+export {
+  authenticationTypeName,
+  primaryAuthMode,
+  assertCompatiblePrimaryAuth,
+  make,
+  associateSource,
+  associateSourceWithMergedArn,
+  mergeStatusGateWith,
+  mergeStatusGate,
+}
+/* primaryAuthMode Not a pure module */