@reventlessdev/reventless-aws 3.0.0-alpha.209 → 3.0.0-alpha.211

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -4,14 +4,12 @@ import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
-import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Effect$1 from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
-import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as ClientAppsync from "@aws-sdk/client-appsync";
 import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
@@ -60,33 +58,6 @@ async function waitForSchemaActive(client, apiId, maxAttemptsOpt, attemptOpt) {
   }
 }
 
-async function getIntrospectionSdl(client, apiId) {
-  try {
-    let resp = await client.send(new ClientAppsync.GetIntrospectionSchemaCommand({
-      apiId: apiId,
-      format: "SDL"
-    }));
-    let blob = resp.schema;
-    if (blob !== undefined) {
-      return Buffer.from(Primitive_option.valFromOption(blob)).toString("utf-8");
-    } else {
-      return "";
-    }
-  } catch (raw_exn) {
-    let exn = Primitive_exceptions.internalToException(raw_exn);
-    let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
-    log.warn("AppSync_Adapter", undefined, `getIntrospectionSdl failed for ` + apiId + `: ` + msg);
-    return "";
-  }
-}
-
-function deploySchemaWithRetry(client, apiId, definition) {
-  return Effect$1.retry(Effect.tryPromise(AppSync_Error$ReventlessAws.classify, () => client.send(new ClientAppsync.StartSchemaCreationCommand({
-    apiId: apiId,
-    definition: definition
-  })).then(param => Promise.resolve())), AppSync_Error$ReventlessAws.retrySchedule);
-}
-
 let _client = {
   contents: undefined
 };
@@ -101,6 +72,35 @@ function getClient() {
   return c$1;
 }
 
+async function waitForMergeSuccess(client, associationId, mergedApiIdentifier, maxAttemptsOpt, attemptOpt, delayMsOpt) {
+  let maxAttempts = maxAttemptsOpt !== undefined ? maxAttemptsOpt : 60;
+  let attempt = attemptOpt !== undefined ? attemptOpt : 0;
+  let delayMs = delayMsOpt !== undefined ? delayMsOpt : 2000;
+  let result = await client.send(new ClientAppsync.GetSourceApiAssociationCommand({
+    associationId: associationId,
+    mergedApiIdentifier: mergedApiIdentifier
+  }));
+  let status = Stdlib_Option.getOr(Stdlib_Option.flatMap(result.sourceApiAssociation, a => a.sourceApiAssociationStatus), "(no status)");
+  let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(result.sourceApiAssociation, a => a.sourceApiAssociationStatusDetail), "(no details)");
+  switch (status) {
+    case "AUTO_MERGE_SCHEDULE_FAILED" :
+    case "MERGE_FAILED" :
+      break;
+    case "MERGE_SUCCESS" :
+      return;
+    default:
+      if (attempt >= maxAttempts) {
+        return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` merge timed out after ` + maxAttempts.toString() + ` attempts (status: ` + status + `)`);
+      } else {
+        await new Promise((resolve, param) => {
+          setTimeout(resolve, delayMs);
+        });
+        return await waitForMergeSuccess(client, associationId, mergedApiIdentifier, maxAttempts, attempt + 1 | 0, delayMs);
+      }
+  }
+  return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` on ` + mergedApiIdentifier + ` failed to merge (` + status + `): ` + detail);
+}
+
 function _permissionToCognitoGroups(permission) {
   if (typeof permission !== "object") {
     switch (permission) {
@@ -263,12 +263,12 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   return AppSync_SdlDecorate$ReventlessAws.injectAwsAuthAll(fragment, group, iamFieldNames);
 }
 
-function stitchWithAwsDirectives(baseFragment, pluginFragments) {
-  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(baseFragment, pluginFragments);
-  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, pluginFragments), sources));
+function stitchStandaloneWithAwsDirectives(fragment) {
+  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
+  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources));
 }
 
-function makeApiResource(name, opts) {
+function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let customOpts_parent = opts.parent;
   let customOpts = {
     parent: customOpts_parent
@@ -276,18 +276,19 @@ function makeApiResource(name, opts) {
   let iamRole = new (Aws.iam.Role)(name + `-appsync-role`, {
     assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
   }, customOpts);
-  let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
-  let userPoolConfigOut = authConfigOut.apply(c => ({
-    userPoolId: c.userPoolId,
-    defaultAction: "ALLOW",
-    awsRegion: c.region
-  }));
+  let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
+      userPoolId: c.userPoolId,
+      defaultAction: "ALLOW",
+      awsRegion: c.region
+    }));
+  let apiArgs_schema = Stdlib_Option.map(schema, prim => prim);
   let apiArgs_userPoolConfig = userPoolConfigOut;
   let apiArgs_additionalAuthenticationProviders = [{
       authenticationType: "AWS_IAM"
     }];
   let apiArgs = {
     authenticationType: "AMAZON_COGNITO_USER_POOLS",
+    schema: apiArgs_schema,
     userPoolConfig: apiArgs_userPoolConfig,
     additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders
   };
@@ -298,37 +299,36 @@ function makeApiResource(name, opts) {
   ];
 }
 
+function makeApiResource(name, opts) {
+  return _makeApiResourceWith(name, undefined, undefined, opts);
+}
+
+function makeSourceApiResource(name, schema, opts) {
+  return _makeApiResourceWith(name, schema, undefined, opts);
+}
+
+function makePluginSourceApiResource(name, userPoolConfig, opts) {
+  return _makeApiResourceWith(name, undefined, userPoolConfig, opts);
+}
+
 function generateFragment(mutationEntries, queryEntries) {
   let fragment = GraphQL_FragmentGenerator$ReventlessCore.generate(mutationEntries, queryEntries);
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
-function updateSchema(api, baseFragment, pluginFragments) {
-  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin", undefined);
-  let sdl = stitchWithAwsDirectives(augmentedBaseFragment, pluginFragments);
-  let resultPromise = {
-    contents: Promise.resolve()
-  };
-  api.apply(graphQLApi => graphQLApi.id.apply(apiId => {
-    let effect = deploySchemaWithRetry(getClient(), apiId, sdl);
-    let p = Effect$1.runPromise(effect);
-    resultPromise.contents = p;
-  }));
-  return resultPromise.contents;
-}
-
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
+let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";
+
 export {
   log,
   sha256Hex,
   startSchemaCreation,
   startSchemaCreationRetrying,
   waitForSchemaActive,
-  getIntrospectionSdl,
-  deploySchemaWithRetry,
   _client,
   getClient,
+  waitForMergeSuccess,
   _permissionToCognitoGroups,
   _formatGroupsDirective,
   _formatDualAuthDirective,
@@ -337,9 +337,12 @@ export {
   stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,
-  stitchWithAwsDirectives,
+  stitchStandaloneWithAwsDirectives,
+  primaryAuthenticationType,
+  _makeApiResourceWith,
   makeApiResource,
+  makeSourceApiResource,
+  makePluginSourceApiResource,
   generateFragment,
-  updateSchema,
 }
 /* log Not a pure module */

package/src/components/Api/AppSync_MergedApi.res

@@ -0,0 +1,218 @@
+// AppSync_MergedApi — merged-API construction for the push-free composition
+// path (docs/plans/done/merged-api-push-free-composition.md, Phase 3).
+//
+// A merged API carries no schema of its own: source APIs contribute theirs via
+// SourceApiAssociation and AWS composes the merged endpoint. The platform
+// stack creates the merged API(s) plus the association(s) for its own
+// source(s) (the admin/base canonical source); plugin stacks associate their
+// source APIs against the exported merged-API ARN (Phase 4).
+
+open PulumiAws
+
+// ── Primary-auth contract ───────────────────────────────────────────────────
+// A merged API and every associated source API must share the same PRIMARY
+// authentication mode (AWS rejects incompatible associations). The platform
+// exports the merged API's mode via StackReference (`mergedApiPrimaryAuth`);
+// stacks creating a source API assert against it before associating.
+
+let authenticationTypeName = (t: AppSync.GraphQLApi.authenticationType): string =>
+  switch t {
+  | API_KEY => "API_KEY"
+  | AWS_IAM => "AWS_IAM"
+  | AMAZON_COGNITO_USER_POOLS => "AMAZON_COGNITO_USER_POOLS"
+  | OPENID_CONNECT => "OPENID_CONNECT"
+  }
+
+// The merged APIs share the platform-wide primary mode (Cognito primary,
+// IAM secondary) — same shape the Phase-0 spike validated end-to-end.
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter.primaryAuthenticationType)
+
+let assertCompatiblePrimaryAuth = (~sourceMode: string, ~mergedMode: string): unit =>
+  if sourceMode != mergedMode {
+    failwith(
+      `Merged-API primary-auth mismatch: the source API uses ${sourceMode} but the merged API ` ++
+      `expects ${mergedMode}. A source API must share the merged API's primary authentication ` ++
+      `mode — align the source API's authenticationType with the platform's ` ++ `\`mergedApiPrimaryAuth\` export before associating.`,
+    )
+  }
+
+// ── Merged API + execution role ─────────────────────────────────────────────
+
+type t = {
+  api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  executionRole: IAM.Role.t,
+}
+
+let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+
+  // Execution role AWS assumes to proxy merged-endpoint requests to the source
+  // APIs (appsync:SourceGraphQL) and to run schema merges
+  // (appsync:StartSchemaMerge — required for MANUAL_MERGE, harmless under
+  // AUTO_MERGE). Source APIs associate later from independent plugin stacks,
+  // so their ARNs cannot be enumerated here — the policy stays unscoped.
+  let executionRole = IAM.Role.make(
+    ~name=`${name}-merge-exec-role`,
+    ~args={
+      assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+  let _ = {
+    open PolicyDocument
+    IAM.RolePolicy.make(
+      ~name=`${name}-merge-exec-policy`,
+      ~args={
+        policy: PolicyDocument.make(
+          ~id=`${name}-merge-exec-policy`,
+          ~statements=[
+            {
+              sid: "AllowSourceGraphQLAndMerge",
+              effect: Allow,
+              actions: Actions(["appsync:SourceGraphQL", "appsync:StartSchemaMerge"]),
+              resources: AllResources,
+            },
+          ],
+        )
+        ->PolicyDocument.toJsonString
+        ->Pulumi.Input.make,
+        role: executionRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
+  // Same auth shape as the source APIs (AppSync_Adapter.makeApiResource):
+  // Cognito primary + AWS_IAM secondary. Per-field multi-auth directives on
+  // the source schemas survive the merge verbatim (Phase-0 finding 4).
+  let authConfigOut = Auth_Cognito.make(~name=`${name}-auth`)
+  let userPoolConfigOut =
+    authConfigOut->Pulumi.Output.apply((
+      c: Auth_Cognito.authConfig,
+    ): AppSync.GraphQLApi.userPoolConfig => {
+      userPoolId: c.userPoolId,
+      awsRegion: c.region,
+      defaultAction: AppSync.GraphQLApi.ALLOW,
+    })
+
+  let mergedApi = AppSync.GraphQLApi.make(
+    ~name,
+    ~args={
+      authenticationType: AppSync_Adapter.primaryAuthenticationType->Pulumi.Input.make,
+      userPoolConfig: userPoolConfigOut->Pulumi.Output.asInput,
+      additionalAuthenticationProviders: [
+        (
+          {
+            authenticationType: AppSync.GraphQLApi.AWS_IAM->Pulumi.Input.make,
+          }: AppSync.GraphQLApi.additionalAuthenticationProvider
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+      apiType: AppSync.GraphQLApi.MERGED->Pulumi.Input.make,
+      mergedApiExecutionRoleArn: executionRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(customOpts),
+  )
+
+  {api: mergedApi->Pulumi.Output.make, executionRole}
+}
+
+// ── Source association ──────────────────────────────────────────────────────
+
+/** Associate a source API with the merged API under AUTO_MERGE. AWS
+    serializes association CREATES per merged API (409
+    ConcurrentModificationException) — the platform stack's own associations
+    are inherently sequential; concurrent first-time plugin-stack deploys need
+    retry-with-backoff (Phase 4). */
+let associateSource = (
+  ~name: string,
+  ~mergedApi: t,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiId: mergedApi.api
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Associate a source API against a merged API referenced by ARN — the
+    plugin-stack form, where the merged API is not a resource in this stack
+    but the platform's `domainMergedApiArn` / `platformMergedApiArn`
+    StackReference export. Same AUTO_MERGE + create-time 409 caveat as
+    `associateSource`. */
+let associateSourceWithMergedArn = (
+  ~name: string,
+  ~mergedApiArn: Pulumi.Output.t<string>,
+  ~sourceApi: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~opts: Pulumi.ComponentResource.options,
+): AppSync.SourceApiAssociation.t => {
+  let customOpts: Pulumi.CustomResourceOptions.t = {
+    parent: ?opts.parent,
+  }
+  AppSync.SourceApiAssociation.make(
+    ~name,
+    ~args={
+      mergedApiArn: mergedApiArn->Pulumi.Output.asInput,
+      sourceApiId: sourceApi
+      ->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id)
+      ->Pulumi.Output.asInput,
+      sourceApiAssociationConfigs: [
+        (
+          {
+            mergeType: AppSync.SourceApiAssociation.AUTO_MERGE->Pulumi.Input.make,
+          }: AppSync.SourceApiAssociation.sourceApiAssociationConfig
+        )->Pulumi.Input.make,
+      ]->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+}
+
+/** Deploy-time merge gate: resolves once the association reports
+    MERGE_SUCCESS, fails the deploy loudly (with AWS's status detail) on
+    MERGE_FAILED. Fold the returned Output into an exported value so it is
+    consumed — a MERGE_FAILED then fails `pulumi up` instead of silently
+    serving the last-good merged schema (Phase-0 operational finding).
+    `mergedApiIdentifier` accepts the merged API's id or ARN. */
+let mergeStatusGateWith = (
+  ~mergedApiIdentifier: Pulumi.Output.t<string>,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  (mergedApiIdentifier, association.associationId)
+  ->Pulumi.Output.all2
+  ->Pulumi.Output.flatMap(((identifier, associationId)) =>
+    AppSync_Adapter.waitForMergeSuccess(
+      AppSync_Adapter.getClient(),
+      ~associationId,
+      ~mergedApiIdentifier=identifier,
+    )->Pulumi.Output.fromPromise
+  )
+
+let mergeStatusGate = (
+  ~mergedApi: t,
+  ~association: AppSync.SourceApiAssociation.t,
+): Pulumi.Output.t<unit> =>
+  mergeStatusGateWith(
+    ~mergedApiIdentifier=mergedApi.api->Pulumi.Output.flatMap((a: AppSync.GraphQLApi.t) => a.id),
+    ~association,
+  )

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -0,0 +1,122 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pervasives from "@rescript/runtime/lib/es6/Pervasives.js";
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Pulumi from "@pulumi/pulumi";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
+import * as AppSync_Adapter$ReventlessAws from "./AppSync_Adapter.res.mjs";
+
+function authenticationTypeName(t) {
+  switch (t) {
+    case "API_KEY" :
+      return "API_KEY";
+    case "AWS_IAM" :
+      return "AWS_IAM";
+    case "AMAZON_COGNITO_USER_POOLS" :
+      return "AMAZON_COGNITO_USER_POOLS";
+    case "OPENID_CONNECT" :
+      return "OPENID_CONNECT";
+  }
+}
+
+let primaryAuthMode = authenticationTypeName(AppSync_Adapter$ReventlessAws.primaryAuthenticationType);
+
+function assertCompatiblePrimaryAuth(sourceMode, mergedMode) {
+  if (sourceMode !== mergedMode) {
+    return Pervasives.failwith(`Merged-API primary-auth mismatch: the source API uses ` + sourceMode + ` but the merged API ` + (`expects ` + mergedMode + `. A source API must share the merged API's primary authentication `) + `mode — align the source API's authenticationType with the platform's \`mergedApiPrimaryAuth\` export before associating.`);
+  }
+}
+
+function make(name, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  let executionRole = new (Aws.iam.Role)(name + `-merge-exec-role`, {
+    assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
+  }, customOpts);
+  new (Aws.iam.RolePolicy)(name + `-merge-exec-policy`, {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `-merge-exec-policy`, [{
+        Sid: "AllowSourceGraphQLAndMerge",
+        Effect: "Allow",
+        Action: [
+          "appsync:SourceGraphQL",
+          "appsync:StartSchemaMerge"
+        ],
+        Resource: "*"
+      }])),
+    role: executionRole.id
+  }, customOpts);
+  let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
+  let userPoolConfigOut = authConfigOut.apply(c => ({
+    userPoolId: c.userPoolId,
+    defaultAction: "ALLOW",
+    awsRegion: c.region
+  }));
+  let mergedApi = new (Aws.appsync.GraphQLApi)(name, {
+    authenticationType: AppSync_Adapter$ReventlessAws.primaryAuthenticationType,
+    userPoolConfig: userPoolConfigOut,
+    additionalAuthenticationProviders: [{
+        authenticationType: "AWS_IAM"
+      }],
+    apiType: "MERGED",
+    mergedApiExecutionRoleArn: executionRole.arn
+  }, customOpts);
+  return {
+    api: Pulumi.output(mergedApi),
+    executionRole: executionRole
+  };
+}
+
+function associateSource(name, mergedApi, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiId: Output$Pulumi.flatMap(mergedApi.api, a => a.id),
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function associateSourceWithMergedArn(name, mergedApiArn, sourceApi, opts) {
+  let customOpts_parent = opts.parent;
+  let customOpts = {
+    parent: customOpts_parent
+  };
+  return new (Aws.appsync.SourceApiAssociation)(name, {
+    mergedApiArn: mergedApiArn,
+    sourceApiId: Output$Pulumi.flatMap(sourceApi, a => a.id),
+    sourceApiAssociationConfigs: [{
+        mergeType: "AUTO_MERGE"
+      }]
+  }, customOpts);
+}
+
+function mergeStatusGateWith(mergedApiIdentifier, association) {
+  return Output$Pulumi.flatMap(Pulumi.all([
+    mergedApiIdentifier,
+    association.associationId
+  ]), param => AppSync_Adapter$ReventlessAws.waitForMergeSuccess(AppSync_Adapter$ReventlessAws.getClient(), param[1], param[0], undefined, undefined, undefined));
+}
+
+function mergeStatusGate(mergedApi, association) {
+  return mergeStatusGateWith(Output$Pulumi.flatMap(mergedApi.api, a => a.id), association);
+}
+
+export {
+  authenticationTypeName,
+  primaryAuthMode,
+  assertCompatiblePrimaryAuth,
+  make,
+  associateSource,
+  associateSourceWithMergedArn,
+  mergeStatusGateWith,
+  mergeStatusGate,
+}
+/* primaryAuthMode Not a pure module */

package/src/components/Api/AppSync_SdlDecorate.res

@@ -119,19 +119,14 @@ let injectAwsAuthAll = (
 }
 
 // Shared traversal types every callable surface reaches — `PageInfo` (relay
-// connections, injected by the stitcher), the `CommandResult` members (mutation
-// returns, deduped across fragments by the stitcher), and `Platform_ApiFragmentEntry`
-// (the return type of the IAM-callable `Platform_ApiFragments` status query the deploy
-// waiter polls via SigV4 — without the type-level `@aws_iam` the SigV4 caller reaches the
-// query field but is "Not Authorized to access <field> on type Platform_ApiFragmentEntry").
-// Stamped once on the ASSEMBLED SDL: per-fragment stamping would race the stitcher's
-// first-wins dedupe against unstamped sibling copies.
+// connections, injected by the stitcher) and the `CommandResult` members
+// (mutation returns). Stamped once on the ASSEMBLED SDL so an IAM system
+// caller (`@@reventless.systemCallable` fields) can traverse them.
 let sharedIamTypeNames = [
   "PageInfo",
   "CommandAccepted",
   "CommandRejected",
   "CommandPending",
-  "Platform_ApiFragmentEntry",
 ]
 
 let stampSharedIamTypes = (sdl: string): string =>
@@ -139,60 +134,53 @@ let stampSharedIamTypes = (sdl: string): string =>
     acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
   )
 
-// ── Reactive push planner (runtime-pure) ─────────────────────────────────────
-// The AWS-decorated counterpart of core `GraphQL_PushPlanner.planPushes`: given
-// the fragments currently in the ApiFragmentRegistry (each tagged with its target
-// API, as the bare string "Domain" / "Platform"), it produces one fully
-// AppSync-decorated SDL push plan per API. It reuses the core planner for the
-// neutral base-selection + stitch, then applies the AppSync dialect exactly as the
-// deploy path's `stitchWithAwsDirectives`:
-//   - the admin base is auth-decorated (group "Admin" + dual-auth on the system-
-//     caller field names) BEFORE stitching, so the Platform/unified base carries
-//     @aws_auth/@aws_iam (the empty Domain-split base needs none);
-//   - @aws_subscribe is injected from the neutral subscriptionSources metadata;
-//   - the shared traversal types are stamped once on the assembled SDL.
-// Plugin fragments already carry their own per-field @aws_auth (baked at
-// generateFragment time), so they stitch in as-is. `api` comes back as the bare
-// string "PlatformApi" / "DomainApi" for the mjs to map onto the AppSync ids.
-type targetedFragmentInput = {
-  encoded: string,
-  protocol: string,
-  // "Domain" | "Platform" — the bare-string runtime form of Reventless.Plugin.apiTarget.
-  target: string,
-}
+// ── Merged-API canonical stamping ─────────────────────────────────────────────
+// Under AppSync Merged APIs the admin source API owns the shared traversal
+// types; `@canonical` makes its definition win over every plugin source's copy
+// (plugin copies must still exist — a source schema has to be valid standalone).
+// Spike-validated (plan Phase 0): a divergent non-canonical copy is SHADOWED by
+// the canonical definition, not a MERGE_FAILED — so this stamp is what keeps
+// shared-type evolution single-owner. Applied only to the ADMIN source SDL on
+// the merge path; plugin subgraph documents stay unstamped.
 
-type awsPushPlan = {
-  // "PlatformApi" | "DomainApi" — the bare-string runtime form of GraphQL_PushPlanner.planTarget.
-  api: string,
-  sdl: string,
-}
+// Object types the admin source owns canonically. `interface Node` and
+// `union CommandResult` are handled structurally below (their def lines don't
+// start with `type `).
+let canonicalTypeNames = ["PageInfo", "CommandAccepted", "CommandRejected", "CommandPending"]
 
-let planAwsPushes = (
-  ~rawAdminBase: Reventless.Plugin.apiSchemaFragment,
-  ~iamFieldNames: array<string>,
-  ~fragments: array<targetedFragmentInput>,
-  ~splitApi: bool,
-): array<awsPushPlan> => {
-  let authBase = injectAwsAuthAll(rawAdminBase, ~group="Admin", ~iamFieldNames)
-  let targeted = fragments->Array.map((f): ReventlessCore.GraphQL_PushPlanner.targetedFragment => {
-    fragment: {encoded: f.encoded, protocol: f.protocol},
-    target: switch f.target {
-    | "Platform" => Platform
-    | _ => Domain
-    },
-  })
-  let allFrags = targeted->Array.map(t => t.fragment)
-  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
-    ~baseFragment=rawAdminBase,
-    ~pluginFragments=allFrags,
-  )
-  ReventlessCore.GraphQL_PushPlanner.planPushes(~adminBase=authBase, ~fragments=targeted, ~splitApi)
-  ->Array.map(plan => {
-    let sdl = plan.sdl->injectAwsSubscribe(~sources)->stampSharedIamTypes
-    let api = switch plan.api {
-    | PlatformApi => "PlatformApi"
-    | DomainApi => "DomainApi"
+let stampCanonicalTypes = (sdl: string): string =>
+  sdl
+  ->String.split("\n")
+  ->Array.map(line => {
+    let isObjectDef = canonicalTypeNames->Array.some(name => line->String.startsWith(`type ${name} `))
+    let isNodeDef = line->String.startsWith("interface Node ") || line->String.startsWith("interface Node{")
+    let isUnionDef = line->String.startsWith("union CommandResult ") || line->String.startsWith("union CommandResult=")
+    if line->String.includes("@canonical") {
+      line
+    } else if isObjectDef || isNodeDef {
+      // Insert before the opening brace so it composes with earlier stamps
+      // (e.g. `type PageInfo @aws_cognito_user_pools @aws_iam {`).
+      switch line->String.indexOfOpt("{") {
+      | Some(braceIdx) =>
+        let head = line->String.slice(~start=0, ~end=braceIdx)->String.trimEnd
+        let tail = line->String.slice(~start=braceIdx)
+        `${head} @canonical ${tail}`
+      | None => line
+      }
+    } else if isUnionDef {
+      switch line->String.indexOfOpt("=") {
+      | Some(eqIdx) =>
+        let head = line->String.slice(~start=0, ~end=eqIdx)->String.trimEnd
+        let tail = line->String.slice(~start=eqIdx)
+        `${head} @canonical ${tail}`
+      | None => line
+      }
+    } else {
+      line
     }
-    {api, sdl}
   })
-}
+  ->Array.join("\n")
+
+// (The reactive push planner — planAwsPushes, the AWS counterpart of core
+// GraphQL_PushPlanner — was retired with the merged-API cutover: source APIs
+// are single writers, AWS composes the merged endpoint, nothing re-stitches.)