@reventlessdev/reventless-aws 3.0.0-alpha.209 → 3.0.0-alpha.211

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -53,30 +53,10 @@ let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
 // -- Provision --------------------------------------------------------------
 let bool = b => b ? "true" : "false"
 
-// One `node(id: ID!)` resolver on the shared data source → Invoke {kind:"node"}.
-let nodeResolverCode =
-  `import { util } from '@aws-appsync/utils';
-export function request(ctx) {
-  const id = ctx.identity;
-  return {
-    operation: 'Invoke',
-    payload: {
-      readModelName: '',
-      kind: 'node',
-      arguments: ctx.args,
-      identity: id != null && id.sub != null
-        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
-        : id != null
-          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
-          : null
-    }
-  };
-}
-export function response(ctx) {
-  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
-  return ctx.result;
-}
-`->Pulumi.Input.make
+// (The shared `node(id: ID!)` resolver was removed with the Relay-node
+// resolution of the merged-api plan: the root field is no longer emitted on
+// AWS. The Pg Lambda's runtime `handleNode` + the nodeTypes env plumbing stay
+// inert pending a future consumer.)
 
 // Serialize the shared connection config into the env-config JSON (same shape
 // EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
@@ -87,13 +67,6 @@ let provision = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~selection: QueryDbBackend.selection,
   ~opts: Pulumi.ComponentResource.options,
-  // The shared node(id) resolver is a single resolver on the API's Query.node
-  // field. In plugin-stack mode each plugin stack deploys independently onto one
-  // shared API, so only ONE stack may own that field — and a per-plugin node
-  // resolver only knows its own plugin's types anyway. So node is provisioned in
-  // monolithic mode only; plugin stacks pass false. (Node is not wired on the
-  // DynamoDB path either — it stays a monolithic-only capability for now.)
-  ~createNodeResolver: bool=true,
 ): unit => {
   // Join the resolver-binding registry (labelField/includeIdParam) with the
   // ReadModel runtime registry (specModulePath, pgBacked). Only read models
@@ -257,22 +230,6 @@ let provision = (
       ~opts=Some(customOpts),
     )
 
-    // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
-    // typeName in the Lambda. Only when some entity registered a node type
-    // (else the `node` field isn't in the schema) AND in monolithic mode
-    // (plugin stacks would collide on the single Query.node field).
-    if createNodeResolver && nodeTypes->Dict.toArray->Array.length > 0 {
-      let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
-        ~name=name ++ "NodeResolver",
-        ~api,
-        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
-        ~type_="Query"->Pulumi.Input.make,
-        ~field="node"->Pulumi.Input.make,
-        ~code=nodeResolverCode,
-        ~opts=customOpts,
-      )
-    }
-
     // Fulfil the deferred name the Postgres storage maker handed to resolvers.
     let _ = dataSource.name->Pulumi.Output.apply(n => resolveDataSourceName.contents(n))
     log.info(~comp="PgQueryResolver_Builder", `provisioned for ${handlers->Array.length->Int.toString} read model(s)`)

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -13,7 +13,6 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
-import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "../Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
 
@@ -47,35 +46,11 @@ function bool(b) {
   }
 }
 
-let nodeResolverCode = `import { util } from '@aws-appsync/utils';
-export function request(ctx) {
-  const id = ctx.identity;
-  return {
-    operation: 'Invoke',
-    payload: {
-      readModelName: '',
-      kind: 'node',
-      arguments: ctx.args,
-      identity: id != null && id.sub != null
-        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
-        : id != null
-          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
-          : null
-    }
-  };
-}
-export function response(ctx) {
-  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
-  return ctx.result;
-}
-`;
-
 function pgConnectionJson(cc) {
   return JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc));
 }
 
-function provision(api, selection, opts, createNodeResolverOpt) {
-  let createNodeResolver = createNodeResolverOpt !== undefined ? createNodeResolverOpt : true;
+function provision(api, selection, opts) {
   let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
     let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
     if (info !== undefined && info.pgBacked) {
@@ -147,9 +122,6 @@ function provision(api, selection, opts, createNodeResolverOpt) {
     },
     serviceRoleArn: dataSourceRole.arn
   }, customOpts);
-  if (createNodeResolver && Object.entries(nodeTypes).length !== 0) {
-    AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
-  }
   dataSource.name.apply(n => resolveDataSourceName.contents(n));
   log.info("PgQueryResolver_Builder", undefined, `provisioned for ` + handlers.length.toString() + ` read model(s)`);
 }
@@ -166,7 +138,6 @@ export {
   nodeTypes,
   registerNodeType,
   bool,
-  nodeResolverCode,
   pgConnectionJson,
   provision,
 }

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -105,17 +105,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   | None => true
   }
 
-  // Resolve returnTypeName for Relay Node type registry
-  let returnTypeName = switch registryEntry {
-  | Some({returnTypeName: rt}) => rt
-  | None => name
-  }
-
-  // Register entity type in the Relay Node type registry for node(id: ID!) resolution
-  if includeIdParam {
-    NodeResolver_AppSync.registerNodeType(~typeName=returnTypeName, ~dataSourceName)
-  }
-
   // Creates either a unit resolver (no interceptor) or a pipeline resolver
   // (interceptor Lambda → DynamoDB query) depending on queryInterceptorConfig.
   let makeQueryResolver = (~resolverName, ~field, ~code) =>

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -11,7 +11,6 @@ import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
 import * as Util_QueryDb$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_QueryDb.res.mjs";
 import * as AppSync_DataSource$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_DataSource.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
-import * as NodeResolver_AppSync$ReventlessAws from "./NodeResolver_AppSync.res.mjs";
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
@@ -70,10 +69,6 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   let fieldNameForSingle = registryEntry !== undefined ? registryEntry.singleFieldName : AppSync_Resolver_Functions$PulumiAws.uncapitalize(name$1);
   let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
   let connectionSpec = registryEntry !== undefined ? registryEntry.connectionSpec : true;
-  let returnTypeName = registryEntry !== undefined ? registryEntry.returnTypeName : name$1;
-  if (includeIdParam) {
-    NodeResolver_AppSync$ReventlessAws.registerNodeType(returnTypeName, dataSourceName);
-  }
   let makeQueryResolver = (resolverName, field, code) => {
     let match = queryInterceptorConfig.contents;
     if (match === undefined) {

package/src/adapter/Runtime/SideEffectHandlerRuntime_Builder_Single.res

@@ -15,7 +15,7 @@ let sideEffectInfos: dict<sideEffectInfo> = Dict.make()
 let registerSideEffectHandler = (~sideEffectHandlerName, ~sideEffectModulePaths) =>
   sideEffectInfos->Dict.set(sideEffectHandlerName, {sideEffectModulePaths: sideEffectModulePaths})
 
-// Extra Lambda env vars contributed by bespoke side effects (e.g. admin ApiSchemaPush).
+// Extra Lambda env vars contributed by bespoke side effects.
 // The shared "AllSideEffectHandlers" Lambda is built once in finish(); all registered
 // entries are merged onto its env there. Deploy-derived config only — never overrides
 // HANDLER_CONFIG.
@@ -176,12 +176,11 @@ let finish = () =>
           ~opts,
         )
 
-        // The admin ApiSchemaPush side effect (the only extra-env contributor) pushes the
-        // stitched schema to AppSync via StartSchemaCreation and reads the live schema for
-        // the shrink guard. Grant those AppSync perms to the shared side-effect-handler
-        // Lambda role ONLY when a bespoke side effect registered config — Task-only
-        // deployments keep the narrow default perimeter. Mirrors the admin EventCollector's
-        // AllowAdminStartSchemaCreation grant (PluginRuntime_Builder).
+        // Grant AppSync schema perms to the shared side-effect-handler Lambda
+        // role ONLY when a bespoke side effect registered extra-env config —
+        // Task-only deployments keep the narrow default perimeter. (The last
+        // such contributor, the admin ApiSchemaPush, was retired with the
+        // merged-API cutover; the mechanism stays for future bespoke effects.)
         if extraEnvVarsAll->Dict.keysToArray->Array.length > 0 {
           let _ = PulumiAws.IAM.RolePolicy.make(
             ~name="AllSideEffectHandlers-appsyncSchemaPush",

package/src/components/Api/AppSync_Adapter.res

@@ -94,58 +94,6 @@ let rec waitForSchemaActive = async (client, apiId, ~maxAttempts=30, ~attempt=0)
   }
 }
 
-// GetIntrospectionSchema — fetch the live schema as an SDL string. Used by the
-// deploy-time drift check in preResolversSchemaHook to detect a live schema that
-// was clobbered out-of-band by a runtime re-stitch (the stored deploy hash does
-// not reflect such clobbers). Returns "" when the API has no schema or when
-// introspection fails — the caller decides how to treat an empty result.
-type getIntrospectionSchemaInput = {apiId: string, format: string}
-type getIntrospectionSchemaCommand
-type schemaBlob
-type getIntrospectionSchemaResult = {schema: option<schemaBlob>}
-
-@module("@aws-sdk/client-appsync") @new
-external makeGetIntrospectionSchemaCommand: getIntrospectionSchemaInput => getIntrospectionSchemaCommand =
-  "GetIntrospectionSchemaCommand"
-
-@send
-external sendGetIntrospection: (
-  appSyncClient,
-  getIntrospectionSchemaCommand,
-) => promise<getIntrospectionSchemaResult> = "send"
-
-// resp.schema is a Uint8Array of the SDL text; decode it to UTF-8.
-type nodeBuffer
-@val @scope("Buffer") external bufferFrom: schemaBlob => nodeBuffer = "from"
-@send external bufferToString: (nodeBuffer, string) => string = "toString"
-
-let getIntrospectionSdl = async (client: appSyncClient, apiId: string): string => {
-  try {
-    let resp = await client->sendGetIntrospection(
-      {apiId, format: "SDL"}->makeGetIntrospectionSchemaCommand,
-    )
-    switch resp.schema {
-    | Some(blob) => bufferFrom(blob)->bufferToString("utf-8")
-    | None => ""
-    }
-  } catch {
-  | exn =>
-    let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
-    log.warn(~comp="AppSync_Adapter", `getIntrospectionSdl failed for ${apiId}: ${msg}`)
-    ""
-  }
-}
-
-let deploySchemaWithRetry = (
-  client: appSyncClient,
-  apiId: string,
-  definition: string,
-): Effect.t<unit, AppSync_Error.t, unit> =>
-  Effect.tryPromise(
-    ~catch=AppSync_Error.classify,
-    () => startSchemaCreation(client, {apiId, definition})->Promise.then(_ => Promise.resolve()),
-  )->Effect.retry(AppSync_Error.retrySchedule)
-
 // Lazy singleton AppSync client (runtime only)
 let _client: ref<option<appSyncClient>> = ref(None)
 let getClient = () =>
@@ -157,6 +105,77 @@ let getClient = () =>
     c
   }
 
+// ── GetSourceApiAssociation — merged-API association status poll ──────────
+// Merged-API deploys must fail loudly on MERGE_FAILED (plan
+// merged-api-push-free-composition, Phase 0 finding: a failed merge silently
+// keeps the last-good merged schema serving). After creating a
+// SourceApiAssociation, poll until the initial merge lands.
+type getSourceApiAssociationInput = {
+  associationId: string,
+  mergedApiIdentifier: string,
+}
+type getSourceApiAssociationCommand
+type sourceApiAssociationSummary = {
+  sourceApiAssociationStatus: option<string>,
+  sourceApiAssociationStatusDetail: option<string>,
+}
+type getSourceApiAssociationResult = {sourceApiAssociation: option<sourceApiAssociationSummary>}
+
+@module("@aws-sdk/client-appsync") @new
+external makeGetSourceApiAssociationCommand: getSourceApiAssociationInput => getSourceApiAssociationCommand =
+  "GetSourceApiAssociationCommand"
+
+@send
+external sendGetSourceApiAssociation: (
+  appSyncClient,
+  getSourceApiAssociationCommand,
+) => promise<getSourceApiAssociationResult> = "send"
+
+// Poll until the association reports MERGE_SUCCESS; throw with the AWS status
+// detail on MERGE_FAILED / AUTO_MERGE_SCHEDULE_FAILED. Auto-merge lands in
+// ~12 s (spike-measured), so 60 × 2 s bounds the wait at two minutes.
+let rec waitForMergeSuccess = async (
+  client: appSyncClient,
+  ~associationId: string,
+  ~mergedApiIdentifier: string,
+  ~maxAttempts=60,
+  ~attempt=0,
+  ~delayMs=2000,
+) => {
+  let result = await client->sendGetSourceApiAssociation(
+    {associationId, mergedApiIdentifier}->makeGetSourceApiAssociationCommand,
+  )
+  let status =
+    result.sourceApiAssociation
+    ->Option.flatMap(a => a.sourceApiAssociationStatus)
+    ->Option.getOr("(no status)")
+  let detail =
+    result.sourceApiAssociation
+    ->Option.flatMap(a => a.sourceApiAssociationStatusDetail)
+    ->Option.getOr("(no details)")
+  switch status {
+  | "MERGE_SUCCESS" => ()
+  | "MERGE_FAILED" | "AUTO_MERGE_SCHEDULE_FAILED" =>
+    JsError.throwWithMessage(
+      `Source API association ${associationId} on ${mergedApiIdentifier} failed to merge (${status}): ${detail}`,
+    )
+  | _ if attempt >= maxAttempts =>
+    JsError.throwWithMessage(
+      `Source API association ${associationId} merge timed out after ${maxAttempts->Int.toString} attempts (status: ${status})`,
+    )
+  | _ =>
+    await Promise.make((resolve, _) => setTimeout(resolve, delayMs)->ignore)
+    await waitForMergeSuccess(
+      client,
+      ~associationId,
+      ~mergedApiIdentifier,
+      ~maxAttempts,
+      ~attempt=attempt + 1,
+      ~delayMs,
+    )
+  }
+}
+
 // ── @aws_auth directive injection ─────────────────────────────────────────
 // Injects @aws_auth(cognito_groups: [...]) directives into SDL field strings
 // based on authorization metadata from schema entries.
@@ -413,22 +432,25 @@ let injectAwsAuthAll = (
   AppSync_SdlDecorate.injectAwsAuthAll(fragment, ~group, ~iamFieldNames)
 
 /**
-Stitch base + plugin fragments and decorate the assembled SDL with the AppSync
-dialect: `@aws_subscribe` on mutation-sourced subscription fields (from the
-fragments' neutral `subscriptionSources` metadata — core no longer emits the
-directive) and `@aws_cognito_user_pools @aws_iam` on the shared traversal
-types. Every AWS schema push assembles its SDL through here so the dialect is
-applied uniformly.
+One source-API document rendered standalone (relay base types included; the
+global `node` query is not emitted on AWS — see the merged-api plan's "Relay
+node resolution" section), decorated with the AppSync dialect:
+`@aws_subscribe` on mutation-sourced subscription fields (from the fragment's
+neutral `subscriptionSources` metadata) and `@aws_cognito_user_pools @aws_iam`
+on the shared traversal types. Every AWS source-API document — the platform's
+canonical documents and each plugin's subgraph — assembles through here so the
+dialect is applied uniformly. No `@canonical` stamps here — the platform adds
+them to its canonical documents only; plugin subgraphs stay unstamped and the
+canonical definitions win on merge.
 */
-let stitchWithAwsDirectives = (
-  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
-  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
+let stitchStandaloneWithAwsDirectives = (
+  ~fragment: Reventless.Plugin.apiSchemaFragment,
 ): string => {
   let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
-    ~baseFragment,
-    ~pluginFragments,
+    ~baseFragment=fragment,
+    ~pluginFragments=[],
   )
-  ReventlessCore.GraphQL_Stitcher.stitch(~baseFragment, ~pluginFragments)
+  ReventlessCore.GraphQL_Stitcher.stitchStandalone(~fragment)
   ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
   ->stampSharedIamTypes
 }
@@ -438,8 +460,16 @@ let stitchWithAwsDirectives = (
 type api = AppSync.GraphQLApi.t
 type role = IAM.Role.t
 
-let makeApiResource = (
+// Primary authentication mode every platform-created AppSync API uses. A
+// merged API and its source APIs must share this primary mode — exported via
+// StackReference (`mergedApiPrimaryAuth`) and asserted where associations are
+// created (AppSync_MergedApi.assertCompatiblePrimaryAuth).
+let primaryAuthenticationType = AppSync.GraphQLApi.AMAZON_COGNITO_USER_POOLS
+
+let _makeApiResourceWith = (
   ~name: string,
+  ~schema: option<string>,
+  ~userPoolConfig: option<Pulumi.Output.t<AppSync.GraphQLApi.userPoolConfig>>,
   ~opts: Pulumi.ComponentResource.options,
 ): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) => {
   let customOpts: Pulumi.CustomResourceOptions.t = {
@@ -456,13 +486,16 @@ let makeApiResource = (
     ~opts=Some(customOpts),
   )
 
-  // Resolve the Cognito UserPool — cached inside Platform_Stack, so calling
-  // from each API call site (DomainApi, PlatformApi) is safe. Returned as a
-  // single Output that yields the {userPoolId, awsRegion, defaultAction}
-  // record AppSync expects.
-  let authConfigOut = Auth_Cognito.make(~name=`${name}-auth`)
-  let userPoolConfigOut =
-    authConfigOut->Pulumi.Output.apply((c: Auth_Cognito.authConfig) =>
+  // Resolve the Cognito UserPool — either supplied by the caller (plugin-stack
+  // source APIs read it from the platform's StackReference exports so they
+  // never provision pool/client resources of their own) or resolved via
+  // Auth_Cognito (cached inside Platform_Stack, so calling from each API call
+  // site — DomainApi, PlatformApi — is safe). A single Output yielding the
+  // {userPoolId, awsRegion, defaultAction} record AppSync expects.
+  let userPoolConfigOut = switch userPoolConfig {
+  | Some(config) => config
+  | None =>
+    Auth_Cognito.make(~name=`${name}-auth`)->Pulumi.Output.apply((c: Auth_Cognito.authConfig) =>
       (
         {
           userPoolId: c.userPoolId,
@@ -471,13 +504,13 @@ let makeApiResource = (
         }: AppSync.GraphQLApi.userPoolConfig
       )
     )
+  }
 
   // Cognito as primary auth, AWS_IAM as additional provider for
   // server-to-server lambdas (heartbeat, Plugin_Connected emission) signed via
   // the existing IAM role.
   let apiArgs: AppSync.GraphQLApi.args = {
-    authenticationType: AppSync.GraphQLApi
-    .AMAZON_COGNITO_USER_POOLS->Pulumi.Input.make,
+    authenticationType: primaryAuthenticationType->Pulumi.Input.make,
     userPoolConfig: userPoolConfigOut->Pulumi.Output.asInput,
     additionalAuthenticationProviders: [
       (
@@ -486,12 +519,45 @@ let makeApiResource = (
         }: AppSync.GraphQLApi.additionalAuthenticationProvider
       )->Pulumi.Input.make,
     ]->Pulumi.Input.make,
+    schema: ?(schema->Option.map(Pulumi.Input.make)),
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
   (graphQLApi->Pulumi.Output.make, iamRole->Pulumi.Output.make)
 }
 
+let makeApiResource = (
+  ~name: string,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=None, ~opts)
+
+// Merged-mode source API: same auth shape as makeApiResource but with a
+// DECLARATIVE inline schema — the provider runs StartSchemaCreation + poll
+// before the resource resolves, so resolvers chained on the API are ordered
+// after the schema is ACTIVE without the push-path hook machinery. Not part
+// of the Api_Adapter.Provider interface (Platform.res calls it directly on
+// the merge path).
+let makeSourceApiResource = (
+  ~name: string,
+  ~schema: string,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=Some(schema), ~userPoolConfig=None, ~opts)
+
+// Merged-mode PLUGIN source API: schema-less at creation (the plugin's
+// standalone subgraph document is only computable during P.make(), so
+// preResolversSchemaHook pushes it — the plugin's own API is a single writer
+// by construction). The user pool comes from the platform's StackReference
+// exports so the merged endpoint's Cognito primary auth matches across every
+// source API without the plugin stack provisioning pool/client resources.
+let makePluginSourceApiResource = (
+  ~name: string,
+  ~userPoolConfig: Pulumi.Output.t<AppSync.GraphQLApi.userPoolConfig>,
+  ~opts: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
+  _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=Some(userPoolConfig), ~opts)
+
 let generateFragment = (
   ~mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry>,
   ~queryEntries: array<ReventlessInfra.Api.querySchemaEntry>,
@@ -500,30 +566,6 @@ let generateFragment = (
   injectAwsAuth(fragment, ~mutationEntries, ~queryEntries)
 }
 
-let updateSchema = (
-  ~api: Pulumi.Output.t<api>,
-  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
-  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
-): promise<unit> => {
-  // Inject @aws_auth(cognito_groups: ["Admin"]) into all base fragment fields.
-  // The base fragment contains core Plugin aggregate queries/mutations — all Admin-only.
-  // Plugin fragments already have @aws_auth injected via generateFragment.
-  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, ~group="Admin")
-  // Shared traversal types + @aws_subscribe are stamped once on the assembled
-  // SDL (post-stitch, post-dedupe) — see stitchWithAwsDirectives.
-  let sdl = stitchWithAwsDirectives(~baseFragment=augmentedBaseFragment, ~pluginFragments)
-  // Resolve the API ID from the Output chain. In mock mode (tests) and in Lambda runtime
-  // (where the Output is backed by already-known values), this completes synchronously.
-  // The resulting promise wraps the AppSync SDK call.
-  let resultPromise: ref<promise<unit>> = ref(Promise.resolve())
-  let _ =
-    api
-    ->Pulumi.Output.apply(graphQLApi =>
-      graphQLApi.id->Pulumi.Output.apply(apiId => {
-        let effect = deploySchemaWithRetry(getClient(), apiId, sdl)
-        let p = effect->Effect.runPromise
-        resultPromise.contents = p
-      })
-    )
-  resultPromise.contents
-}
+// (updateSchema — the whole-replace stitched-schema push — was retired with
+// the merged-API cutover; every source API owns its schema declaratively or
+// via its own single-writer subgraph push in preResolversSchemaHook.)