@reventlessdev/reventless-aws 3.0.0-alpha.210 → 3.0.0-alpha.212

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -5,8 +5,11 @@
 // field. The persisted structure is sury-encoded with the exact same shape
 // the in-memory adapter's `Platform_ComponentDefinitionsApi.encodePluginStructureEntry`
 // produces (literal-string `commandLevel`, `null`-encoded options), so the
-// handler simply wraps each persisted structure with `pluginId` — no decoding
-// or re-encoding needed.
+// handler wraps each persisted structure with `pluginId` without decoding.
+// One caveat: the persisted structure is PRE-filter — it still carries Internal
+// ReadModels / StateViewSlices for developer tooling. The handler re-applies the
+// `isPublicQueryable` filter (mirroring `encodePluginStructureEntry`) so Internal
+// components stay out of the deployed AutoUI, matching the in-memory adapter.
 
 open PulumiAws
 
@@ -64,6 +67,16 @@ export async function handler() {
     }
     return 0;
   };
+  // The persisted structure carries Internal ReadModels / StateViewSlices for
+  // developer tooling; they must stay out of the deployed AutoUI. Mirror
+  // ReventlessCore.Platform_ComponentDefinitionsApi.isPublicQueryable here on the
+  // read path (the persisted structure is pre-filter — it is NOT re-encoded).
+  const isPublicQueryable = (q) => q?.visibility !== "Internal";
+  const filterStructure = (s) => ({
+    ...s,
+    readModels: (s.readModels ?? []).filter(isPublicQueryable),
+    stateViewSlices: (s.stateViewSlices ?? []).filter(isPublicQueryable),
+  });
   const latestByName = new Map();
   for (const item of items) {
     if (!item || !item.structure) continue;
@@ -71,7 +84,7 @@ export async function handler() {
     const version = String(item.name).split("@")[1] ?? "";
     const prev = latestByName.get(name);
     if (!prev || cmpVer(version, prev.version) > 0) {
-      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+      latestByName.set(name, { version, entry: { pluginId: name, ...filterStructure(item.structure) } });
     }
   }
   const userEntries = [...latestByName.values()].map(v => v.entry);

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -65,6 +65,16 @@ export async function handler() {
     }
     return 0;
   };
+  // The persisted structure carries Internal ReadModels / StateViewSlices for
+  // developer tooling; they must stay out of the deployed AutoUI. Mirror
+  // ReventlessCore.Platform_ComponentDefinitionsApi.isPublicQueryable here on the
+  // read path (the persisted structure is pre-filter — it is NOT re-encoded).
+  const isPublicQueryable = (q) => q?.visibility !== "Internal";
+  const filterStructure = (s) => ({
+    ...s,
+    readModels: (s.readModels ?? []).filter(isPublicQueryable),
+    stateViewSlices: (s.stateViewSlices ?? []).filter(isPublicQueryable),
+  });
   const latestByName = new Map();
   for (const item of items) {
     if (!item || !item.structure) continue;
@@ -72,7 +82,7 @@ export async function handler() {
     const version = String(item.name).split("@")[1] ?? "";
     const prev = latestByName.get(name);
     if (!prev || cmpVer(version, prev.version) > 0) {
-      latestByName.set(name, { version, entry: { pluginId: name, ...item.structure } });
+      latestByName.set(name, { version, entry: { pluginId: name, ...filterStructure(item.structure) } });
     }
   }
   const userEntries = [...latestByName.values()].map(v => v.entry);

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -53,30 +53,10 @@ let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
 // -- Provision --------------------------------------------------------------
 let bool = b => b ? "true" : "false"
 
-// One `node(id: ID!)` resolver on the shared data source → Invoke {kind:"node"}.
-let nodeResolverCode =
-  `import { util } from '@aws-appsync/utils';
-export function request(ctx) {
-  const id = ctx.identity;
-  return {
-    operation: 'Invoke',
-    payload: {
-      readModelName: '',
-      kind: 'node',
-      arguments: ctx.args,
-      identity: id != null && id.sub != null
-        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
-        : id != null
-          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
-          : null
-    }
-  };
-}
-export function response(ctx) {
-  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
-  return ctx.result;
-}
-`->Pulumi.Input.make
+// (The shared `node(id: ID!)` resolver was removed with the Relay-node
+// resolution of the merged-api plan: the root field is no longer emitted on
+// AWS. The Pg Lambda's runtime `handleNode` + the nodeTypes env plumbing stay
+// inert pending a future consumer.)
 
 // Serialize the shared connection config into the env-config JSON (same shape
 // EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
@@ -87,13 +67,6 @@ let provision = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~selection: QueryDbBackend.selection,
   ~opts: Pulumi.ComponentResource.options,
-  // The shared node(id) resolver is a single resolver on the API's Query.node
-  // field. In plugin-stack mode each plugin stack deploys independently onto one
-  // shared API, so only ONE stack may own that field — and a per-plugin node
-  // resolver only knows its own plugin's types anyway. So node is provisioned in
-  // monolithic mode only; plugin stacks pass false. (Node is not wired on the
-  // DynamoDB path either — it stays a monolithic-only capability for now.)
-  ~createNodeResolver: bool=true,
 ): unit => {
   // Join the resolver-binding registry (labelField/includeIdParam) with the
   // ReadModel runtime registry (specModulePath, pgBacked). Only read models
@@ -257,22 +230,6 @@ let provision = (
       ~opts=Some(customOpts),
     )
 
-    // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
-    // typeName in the Lambda. Only when some entity registered a node type
-    // (else the `node` field isn't in the schema) AND in monolithic mode
-    // (plugin stacks would collide on the single Query.node field).
-    if createNodeResolver && nodeTypes->Dict.toArray->Array.length > 0 {
-      let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
-        ~name=name ++ "NodeResolver",
-        ~api,
-        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
-        ~type_="Query"->Pulumi.Input.make,
-        ~field="node"->Pulumi.Input.make,
-        ~code=nodeResolverCode,
-        ~opts=customOpts,
-      )
-    }
-
     // Fulfil the deferred name the Postgres storage maker handed to resolvers.
     let _ = dataSource.name->Pulumi.Output.apply(n => resolveDataSourceName.contents(n))
     log.info(~comp="PgQueryResolver_Builder", `provisioned for ${handlers->Array.length->Int.toString} read model(s)`)

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -13,7 +13,6 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
-import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
 import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "../Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
 
@@ -47,35 +46,11 @@ function bool(b) {
   }
 }
 
-let nodeResolverCode = `import { util } from '@aws-appsync/utils';
-export function request(ctx) {
-  const id = ctx.identity;
-  return {
-    operation: 'Invoke',
-    payload: {
-      readModelName: '',
-      kind: 'node',
-      arguments: ctx.args,
-      identity: id != null && id.sub != null
-        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
-        : id != null
-          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
-          : null
-    }
-  };
-}
-export function response(ctx) {
-  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
-  return ctx.result;
-}
-`;
-
 function pgConnectionJson(cc) {
   return JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc));
 }
 
-function provision(api, selection, opts, createNodeResolverOpt) {
-  let createNodeResolver = createNodeResolverOpt !== undefined ? createNodeResolverOpt : true;
+function provision(api, selection, opts) {
   let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
     let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
     if (info !== undefined && info.pgBacked) {
@@ -147,9 +122,6 @@ function provision(api, selection, opts, createNodeResolverOpt) {
     },
     serviceRoleArn: dataSourceRole.arn
   }, customOpts);
-  if (createNodeResolver && Object.entries(nodeTypes).length !== 0) {
-    AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
-  }
   dataSource.name.apply(n => resolveDataSourceName.contents(n));
   log.info("PgQueryResolver_Builder", undefined, `provisioned for ` + handlers.length.toString() + ` read model(s)`);
 }
@@ -166,7 +138,6 @@ export {
   nodeTypes,
   registerNodeType,
   bool,
-  nodeResolverCode,
   pgConnectionJson,
   provision,
 }

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -105,17 +105,6 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   | None => true
   }
 
-  // Resolve returnTypeName for Relay Node type registry
-  let returnTypeName = switch registryEntry {
-  | Some({returnTypeName: rt}) => rt
-  | None => name
-  }
-
-  // Register entity type in the Relay Node type registry for node(id: ID!) resolution
-  if includeIdParam {
-    NodeResolver_AppSync.registerNodeType(~typeName=returnTypeName, ~dataSourceName)
-  }
-
   // Creates either a unit resolver (no interceptor) or a pipeline resolver
   // (interceptor Lambda → DynamoDB query) depending on queryInterceptorConfig.
   let makeQueryResolver = (~resolverName, ~field, ~code) =>

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -11,7 +11,6 @@ import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
 import * as Util_QueryDb$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_QueryDb.res.mjs";
 import * as AppSync_DataSource$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_DataSource.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
-import * as NodeResolver_AppSync$ReventlessAws from "./NodeResolver_AppSync.res.mjs";
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
@@ -70,10 +69,6 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
   let fieldNameForSingle = registryEntry !== undefined ? registryEntry.singleFieldName : AppSync_Resolver_Functions$PulumiAws.uncapitalize(name$1);
   let includeIdParam = registryEntry !== undefined ? registryEntry.includeIdParam : true;
   let connectionSpec = registryEntry !== undefined ? registryEntry.connectionSpec : true;
-  let returnTypeName = registryEntry !== undefined ? registryEntry.returnTypeName : name$1;
-  if (includeIdParam) {
-    NodeResolver_AppSync$ReventlessAws.registerNodeType(returnTypeName, dataSourceName);
-  }
   let makeQueryResolver = (resolverName, field, code) => {
     let match = queryInterceptorConfig.contents;
     if (match === undefined) {

package/src/adapter/Runtime/SideEffectHandlerRuntime_Builder_Single.res

@@ -15,7 +15,7 @@ let sideEffectInfos: dict<sideEffectInfo> = Dict.make()
 let registerSideEffectHandler = (~sideEffectHandlerName, ~sideEffectModulePaths) =>
   sideEffectInfos->Dict.set(sideEffectHandlerName, {sideEffectModulePaths: sideEffectModulePaths})
 
-// Extra Lambda env vars contributed by bespoke side effects (e.g. admin ApiSchemaPush).
+// Extra Lambda env vars contributed by bespoke side effects.
 // The shared "AllSideEffectHandlers" Lambda is built once in finish(); all registered
 // entries are merged onto its env there. Deploy-derived config only — never overrides
 // HANDLER_CONFIG.
@@ -176,12 +176,11 @@ let finish = () =>
           ~opts,
         )
 
-        // The admin ApiSchemaPush side effect (the only extra-env contributor) pushes the
-        // stitched schema to AppSync via StartSchemaCreation and reads the live schema for
-        // the shrink guard. Grant those AppSync perms to the shared side-effect-handler
-        // Lambda role ONLY when a bespoke side effect registered config — Task-only
-        // deployments keep the narrow default perimeter. Mirrors the admin EventCollector's
-        // AllowAdminStartSchemaCreation grant (PluginRuntime_Builder).
+        // Grant AppSync schema perms to the shared side-effect-handler Lambda
+        // role ONLY when a bespoke side effect registered extra-env config —
+        // Task-only deployments keep the narrow default perimeter. (The last
+        // such contributor, the admin ApiSchemaPush, was retired with the
+        // merged-API cutover; the mechanism stays for future bespoke effects.)
         if extraEnvVarsAll->Dict.keysToArray->Array.length > 0 {
           let _ = PulumiAws.IAM.RolePolicy.make(
             ~name="AllSideEffectHandlers-appsyncSchemaPush",

package/src/adapter/Runtime/StateViewSliceEntryPoint.mjs

@@ -91,7 +91,10 @@ export function buildJsonEventsHandler(specModule, projectionModule, queryDbTabl
       // every such action hit the `MissingSubIdConfig` guard and silently write nothing,
       // while the test-harness callback path (which threads it) stayed green. `undefined`
       // for slices without an `@subId` is correct — those never emit sub-id actions.
-      Effect.promise(() => handleAction(action, queryDbOps, specModule.subIdConfig)),
+      // First positional arg is the compiled `~comp=` optional (attribution
+      // for Projection.handleAction's debug-lazy action log) — the slice's
+      // spec name. Compiled shape: (comp, action, operations, subIdConfig).
+      Effect.promise(() => handleAction(specModule.name, action, queryDbOps, specModule.subIdConfig)),
       _ => {}
     )
   );

package/src/components/Api/AppSync_Adapter.res

@@ -94,58 +94,6 @@ let rec waitForSchemaActive = async (client, apiId, ~maxAttempts=30, ~attempt=0)
   }
 }
 
-// GetIntrospectionSchema — fetch the live schema as an SDL string. Used by the
-// deploy-time drift check in preResolversSchemaHook to detect a live schema that
-// was clobbered out-of-band by a runtime re-stitch (the stored deploy hash does
-// not reflect such clobbers). Returns "" when the API has no schema or when
-// introspection fails — the caller decides how to treat an empty result.
-type getIntrospectionSchemaInput = {apiId: string, format: string}
-type getIntrospectionSchemaCommand
-type schemaBlob
-type getIntrospectionSchemaResult = {schema: option<schemaBlob>}
-
-@module("@aws-sdk/client-appsync") @new
-external makeGetIntrospectionSchemaCommand: getIntrospectionSchemaInput => getIntrospectionSchemaCommand =
-  "GetIntrospectionSchemaCommand"
-
-@send
-external sendGetIntrospection: (
-  appSyncClient,
-  getIntrospectionSchemaCommand,
-) => promise<getIntrospectionSchemaResult> = "send"
-
-// resp.schema is a Uint8Array of the SDL text; decode it to UTF-8.
-type nodeBuffer
-@val @scope("Buffer") external bufferFrom: schemaBlob => nodeBuffer = "from"
-@send external bufferToString: (nodeBuffer, string) => string = "toString"
-
-let getIntrospectionSdl = async (client: appSyncClient, apiId: string): string => {
-  try {
-    let resp = await client->sendGetIntrospection(
-      {apiId, format: "SDL"}->makeGetIntrospectionSchemaCommand,
-    )
-    switch resp.schema {
-    | Some(blob) => bufferFrom(blob)->bufferToString("utf-8")
-    | None => ""
-    }
-  } catch {
-  | exn =>
-    let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
-    log.warn(~comp="AppSync_Adapter", `getIntrospectionSdl failed for ${apiId}: ${msg}`)
-    ""
-  }
-}
-
-let deploySchemaWithRetry = (
-  client: appSyncClient,
-  apiId: string,
-  definition: string,
-): Effect.t<unit, AppSync_Error.t, unit> =>
-  Effect.tryPromise(
-    ~catch=AppSync_Error.classify,
-    () => startSchemaCreation(client, {apiId, definition})->Promise.then(_ => Promise.resolve()),
-  )->Effect.retry(AppSync_Error.retrySchedule)
-
 // Lazy singleton AppSync client (runtime only)
 let _client: ref<option<appSyncClient>> = ref(None)
 let getClient = () =>
@@ -484,32 +432,16 @@ let injectAwsAuthAll = (
   AppSync_SdlDecorate.injectAwsAuthAll(fragment, ~group, ~iamFieldNames)
 
 /**
-Stitch base + plugin fragments and decorate the assembled SDL with the AppSync
-dialect: `@aws_subscribe` on mutation-sourced subscription fields (from the
-fragments' neutral `subscriptionSources` metadata — core no longer emits the
-directive) and `@aws_cognito_user_pools @aws_iam` on the shared traversal
-types. Every AWS schema push assembles its SDL through here so the dialect is
-applied uniformly.
-*/
-let stitchWithAwsDirectives = (
-  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
-  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
-): string => {
-  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
-    ~baseFragment,
-    ~pluginFragments,
-  )
-  ReventlessCore.GraphQL_Stitcher.stitch(~baseFragment, ~pluginFragments)
-  ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
-  ->stampSharedIamTypes
-}
-
-/**
-Merged-mode plugin subgraph document: one fragment rendered standalone
-(relay base types included, global `node` omitted — only the platform's
-canonical base document carries `node`), with the same AppSync dialect as
-`stitchWithAwsDirectives`. No `@canonical` stamps — plugin subgraphs stay
-unstamped; the admin source's canonical definitions win on merge.
+One source-API document rendered standalone (relay base types included; the
+global `node` query is not emitted on AWS — see the merged-api plan's "Relay
+node resolution" section), decorated with the AppSync dialect:
+`@aws_subscribe` on mutation-sourced subscription fields (from the fragment's
+neutral `subscriptionSources` metadata) and `@aws_cognito_user_pools @aws_iam`
+on the shared traversal types. Every AWS source-API document — the platform's
+canonical documents and each plugin's subgraph — assembles through here so the
+dialect is applied uniformly. No `@canonical` stamps here — the platform adds
+them to its canonical documents only; plugin subgraphs stay unstamped and the
+canonical definitions win on merge.
 */
 let stitchStandaloneWithAwsDirectives = (
   ~fragment: Reventless.Plugin.apiSchemaFragment,
@@ -554,6 +486,24 @@ let _makeApiResourceWith = (
     ~opts=Some(customOpts),
   )
 
+  // Let AppSync push field-resolver errors to CloudWatch. The API's own service
+  // role is already assumable by appsync.amazonaws.com, so attach the AWS-managed
+  // push policy to it and reuse it as the logging role. `fieldLogLevel = ERROR`
+  // (below) then captures resolver failures AppSync otherwise swallows into the
+  // client's `errors[]` — e.g. a non-null coercion on a stale read-model row.
+  let _appsyncCwLogsAttachment = IAM.RolePolicyAttachment.make(
+    ~name=`${name}-appsync-cwlogs`,
+    ~args={
+      role: iamRole.name->Pulumi.Output.asInput,
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"->Pulumi.Input.make,
+    },
+    ~opts=Some(customOpts),
+  )
+  let appsyncLogConfig: AppSync.GraphQLApi.logConfig = {
+    cloudwatchLogsRoleArn: iamRole.arn->Pulumi.Output.asInput,
+    fieldLogLevel: AppSync.GraphQLApi.ERROR->Pulumi.Input.make,
+  }
+
   // Resolve the Cognito UserPool — either supplied by the caller (plugin-stack
   // source APIs read it from the platform's StackReference exports so they
   // never provision pool/client resources of their own) or resolved via
@@ -588,6 +538,7 @@ let _makeApiResourceWith = (
       )->Pulumi.Input.make,
     ]->Pulumi.Input.make,
     schema: ?(schema->Option.map(Pulumi.Input.make)),
+    logConfig: appsyncLogConfig->Pulumi.Input.make,
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
@@ -634,30 +585,6 @@ let generateFragment = (
   injectAwsAuth(fragment, ~mutationEntries, ~queryEntries)
 }
 
-let updateSchema = (
-  ~api: Pulumi.Output.t<api>,
-  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
-  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
-): promise<unit> => {
-  // Inject @aws_auth(cognito_groups: ["Admin"]) into all base fragment fields.
-  // The base fragment contains core Plugin aggregate queries/mutations — all Admin-only.
-  // Plugin fragments already have @aws_auth injected via generateFragment.
-  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, ~group="Admin")
-  // Shared traversal types + @aws_subscribe are stamped once on the assembled
-  // SDL (post-stitch, post-dedupe) — see stitchWithAwsDirectives.
-  let sdl = stitchWithAwsDirectives(~baseFragment=augmentedBaseFragment, ~pluginFragments)
-  // Resolve the API ID from the Output chain. In mock mode (tests) and in Lambda runtime
-  // (where the Output is backed by already-known values), this completes synchronously.
-  // The resulting promise wraps the AppSync SDK call.
-  let resultPromise: ref<promise<unit>> = ref(Promise.resolve())
-  let _ =
-    api
-    ->Pulumi.Output.apply(graphQLApi =>
-      graphQLApi.id->Pulumi.Output.apply(apiId => {
-        let effect = deploySchemaWithRetry(getClient(), apiId, sdl)
-        let p = effect->Effect.runPromise
-        resultPromise.contents = p
-      })
-    )
-  resultPromise.contents
-}
+// (updateSchema — the whole-replace stitched-schema push — was retired with
+// the merged-API cutover; every source API owns its schema declaratively or
+// via its own single-writer subgraph push in preResolversSchemaHook.)

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -4,14 +4,12 @@ import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
-import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Effect$1 from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
-import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as ClientAppsync from "@aws-sdk/client-appsync";
 import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
@@ -60,33 +58,6 @@ async function waitForSchemaActive(client, apiId, maxAttemptsOpt, attemptOpt) {
   }
 }
 
-async function getIntrospectionSdl(client, apiId) {
-  try {
-    let resp = await client.send(new ClientAppsync.GetIntrospectionSchemaCommand({
-      apiId: apiId,
-      format: "SDL"
-    }));
-    let blob = resp.schema;
-    if (blob !== undefined) {
-      return Buffer.from(Primitive_option.valFromOption(blob)).toString("utf-8");
-    } else {
-      return "";
-    }
-  } catch (raw_exn) {
-    let exn = Primitive_exceptions.internalToException(raw_exn);
-    let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
-    log.warn("AppSync_Adapter", undefined, `getIntrospectionSdl failed for ` + apiId + `: ` + msg);
-    return "";
-  }
-}
-
-function deploySchemaWithRetry(client, apiId, definition) {
-  return Effect$1.retry(Effect.tryPromise(AppSync_Error$ReventlessAws.classify, () => client.send(new ClientAppsync.StartSchemaCreationCommand({
-    apiId: apiId,
-    definition: definition
-  })).then(param => Promise.resolve())), AppSync_Error$ReventlessAws.retrySchedule);
-}
-
 let _client = {
   contents: undefined
 };
@@ -292,11 +263,6 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   return AppSync_SdlDecorate$ReventlessAws.injectAwsAuthAll(fragment, group, iamFieldNames);
 }
 
-function stitchWithAwsDirectives(baseFragment, pluginFragments) {
-  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(baseFragment, pluginFragments);
-  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitch(baseFragment, pluginFragments), sources));
-}
-
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
   return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources));
@@ -310,6 +276,15 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let iamRole = new (Aws.iam.Role)(name + `-appsync-role`, {
     assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
   }, customOpts);
+  new (Aws.iam.RolePolicyAttachment)(name + `-appsync-cwlogs`, {
+    policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
+    role: iamRole.name
+  }, customOpts);
+  let appsyncLogConfig_cloudwatchLogsRoleArn = iamRole.arn;
+  let appsyncLogConfig = {
+    cloudwatchLogsRoleArn: appsyncLogConfig_cloudwatchLogsRoleArn,
+    fieldLogLevel: "ERROR"
+  };
   let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
       userPoolId: c.userPoolId,
       defaultAction: "ALLOW",
@@ -320,11 +295,13 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let apiArgs_additionalAuthenticationProviders = [{
       authenticationType: "AWS_IAM"
     }];
+  let apiArgs_logConfig = appsyncLogConfig;
   let apiArgs = {
     authenticationType: "AMAZON_COGNITO_USER_POOLS",
     schema: apiArgs_schema,
     userPoolConfig: apiArgs_userPoolConfig,
-    additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders
+    additionalAuthenticationProviders: apiArgs_additionalAuthenticationProviders,
+    logConfig: apiArgs_logConfig
   };
   let graphQLApi = new (Aws.appsync.GraphQLApi)(name, apiArgs, customOpts);
   return [
@@ -350,20 +327,6 @@ function generateFragment(mutationEntries, queryEntries) {
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
-function updateSchema(api, baseFragment, pluginFragments) {
-  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin", undefined);
-  let sdl = stitchWithAwsDirectives(augmentedBaseFragment, pluginFragments);
-  let resultPromise = {
-    contents: Promise.resolve()
-  };
-  api.apply(graphQLApi => graphQLApi.id.apply(apiId => {
-    let effect = deploySchemaWithRetry(getClient(), apiId, sdl);
-    let p = Effect$1.runPromise(effect);
-    resultPromise.contents = p;
-  }));
-  return resultPromise.contents;
-}
-
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
 let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";
@@ -374,8 +337,6 @@ export {
   startSchemaCreation,
   startSchemaCreationRetrying,
   waitForSchemaActive,
-  getIntrospectionSdl,
-  deploySchemaWithRetry,
   _client,
   getClient,
   waitForMergeSuccess,
@@ -387,7 +348,6 @@ export {
   stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,
-  stitchWithAwsDirectives,
   stitchStandaloneWithAwsDirectives,
   primaryAuthenticationType,
   _makeApiResourceWith,
@@ -395,6 +355,5 @@ export {
   makeSourceApiResource,
   makePluginSourceApiResource,
   generateFragment,
-  updateSchema,
 }
 /* log Not a pure module */

package/src/components/Api/AppSync_MergedApi.res

@@ -1,5 +1,5 @@
 // AppSync_MergedApi — merged-API construction for the push-free composition
-// path (docs/plans/merged-api-push-free-composition.md, Phase 3).
+// path (docs/plans/done/merged-api-push-free-composition.md, Phase 3).
 //
 // A merged API carries no schema of its own: source APIs contribute theirs via
 // SourceApiAssociation and AWS composes the merged endpoint. The platform