@reventlessdev/reventless-aws 3.0.0-alpha.210 → 3.0.0-alpha.212

package/src/components/Api/AppSync_SdlDecorate.res

@@ -119,19 +119,14 @@ let injectAwsAuthAll = (
 }
 
 // Shared traversal types every callable surface reaches — `PageInfo` (relay
-// connections, injected by the stitcher), the `CommandResult` members (mutation
-// returns, deduped across fragments by the stitcher), and `Platform_ApiFragmentEntry`
-// (the return type of the IAM-callable `Platform_ApiFragments` status query the deploy
-// waiter polls via SigV4 — without the type-level `@aws_iam` the SigV4 caller reaches the
-// query field but is "Not Authorized to access <field> on type Platform_ApiFragmentEntry").
-// Stamped once on the ASSEMBLED SDL: per-fragment stamping would race the stitcher's
-// first-wins dedupe against unstamped sibling copies.
+// connections, injected by the stitcher) and the `CommandResult` members
+// (mutation returns). Stamped once on the ASSEMBLED SDL so an IAM system
+// caller (`@@reventless.systemCallable` fields) can traverse them.
 let sharedIamTypeNames = [
   "PageInfo",
   "CommandAccepted",
   "CommandRejected",
   "CommandPending",
-  "Platform_ApiFragmentEntry",
 ]
 
 let stampSharedIamTypes = (sdl: string): string =>
@@ -186,60 +181,6 @@ let stampCanonicalTypes = (sdl: string): string =>
   })
   ->Array.join("\n")
 
-// ── Reactive push planner (runtime-pure) ─────────────────────────────────────
-// The AWS-decorated counterpart of core `GraphQL_PushPlanner.planPushes`: given
-// the fragments currently in the ApiFragmentRegistry (each tagged with its target
-// API, as the bare string "Domain" / "Platform"), it produces one fully
-// AppSync-decorated SDL push plan per API. It reuses the core planner for the
-// neutral base-selection + stitch, then applies the AppSync dialect exactly as the
-// deploy path's `stitchWithAwsDirectives`:
-//   - the admin base is auth-decorated (group "Admin" + dual-auth on the system-
-//     caller field names) BEFORE stitching, so the Platform/unified base carries
-//     @aws_auth/@aws_iam (the empty Domain-split base needs none);
-//   - @aws_subscribe is injected from the neutral subscriptionSources metadata;
-//   - the shared traversal types are stamped once on the assembled SDL.
-// Plugin fragments already carry their own per-field @aws_auth (baked at
-// generateFragment time), so they stitch in as-is. `api` comes back as the bare
-// string "PlatformApi" / "DomainApi" for the mjs to map onto the AppSync ids.
-type targetedFragmentInput = {
-  encoded: string,
-  protocol: string,
-  // "Domain" | "Platform" — the bare-string runtime form of Reventless.Plugin.apiTarget.
-  target: string,
-}
-
-type awsPushPlan = {
-  // "PlatformApi" | "DomainApi" — the bare-string runtime form of GraphQL_PushPlanner.planTarget.
-  api: string,
-  sdl: string,
-}
-
-let planAwsPushes = (
-  ~rawAdminBase: Reventless.Plugin.apiSchemaFragment,
-  ~iamFieldNames: array<string>,
-  ~fragments: array<targetedFragmentInput>,
-  ~splitApi: bool,
-): array<awsPushPlan> => {
-  let authBase = injectAwsAuthAll(rawAdminBase, ~group="Admin", ~iamFieldNames)
-  let targeted = fragments->Array.map((f): ReventlessCore.GraphQL_PushPlanner.targetedFragment => {
-    fragment: {encoded: f.encoded, protocol: f.protocol},
-    target: switch f.target {
-    | "Platform" => Platform
-    | _ => Domain
-    },
-  })
-  let allFrags = targeted->Array.map(t => t.fragment)
-  let sources = ReventlessCore.GraphQL_Stitcher.collectSubscriptionSources(
-    ~baseFragment=rawAdminBase,
-    ~pluginFragments=allFrags,
-  )
-  ReventlessCore.GraphQL_PushPlanner.planPushes(~adminBase=authBase, ~fragments=targeted, ~splitApi)
-  ->Array.map(plan => {
-    let sdl = plan.sdl->injectAwsSubscribe(~sources)->stampSharedIamTypes
-    let api = switch plan.api {
-    | PlatformApi => "PlatformApi"
-    | DomainApi => "DomainApi"
-    }
-    {api, sdl}
-  })
-}
+// (The reactive push planner — planAwsPushes, the AWS counterpart of core
+// GraphQL_PushPlanner — was retired with the merged-API cutover: source APIs
+// are single writers, AWS composes the merged endpoint, nothing re-stitches.)

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -3,7 +3,6 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
-import * as GraphQL_PushPlanner$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_PushPlanner.res.mjs";
 
 function injectAwsSubscribe(sdl, sources) {
   if (sources.length === 0) {
@@ -80,8 +79,7 @@ let sharedIamTypeNames = [
   "PageInfo",
   "CommandAccepted",
   "CommandRejected",
-  "CommandPending",
-  "Platform_ApiFragmentEntry"
+  "CommandPending"
 ];
 
 function stampSharedIamTypes(sdl) {
@@ -125,33 +123,6 @@ function stampCanonicalTypes(sdl) {
   }).join("\n");
 }
 
-function planAwsPushes(rawAdminBase, iamFieldNames, fragments, splitApi) {
-  let authBase = injectAwsAuthAll(rawAdminBase, "Admin", iamFieldNames);
-  let targeted = fragments.map(f => {
-    let match = f.target;
-    let tmp = match === "Platform" ? "Platform" : "Domain";
-    return {
-      fragment: {
-        encoded: f.encoded,
-        protocol: f.protocol
-      },
-      target: tmp
-    };
-  });
-  let allFrags = targeted.map(t => t.fragment);
-  let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(rawAdminBase, allFrags);
-  return GraphQL_PushPlanner$ReventlessCore.planPushes(authBase, targeted, splitApi).map(plan => {
-    let sdl = stampSharedIamTypes(injectAwsSubscribe(plan.sdl, sources));
-    let match = plan.api;
-    let api;
-    api = match === "DomainApi" ? "DomainApi" : "PlatformApi";
-    return {
-      api: api,
-      sdl: sdl
-    };
-  });
-}
-
 export {
   injectAwsSubscribe,
   formatDualAuthDirective,
@@ -160,6 +131,5 @@ export {
   stampSharedIamTypes,
   canonicalTypeNames,
   stampCanonicalTypes,
-  planAwsPushes,
 }
 /* GraphQL_Stitcher-ReventlessCore Not a pure module */

package/src/components/Plugin.res.mjs

@@ -28,8 +28,7 @@ function Make(HooksConfig) {
     hooks: HooksConfig.hooks
   })({})({
     makeApiResource: AppSync_Adapter$ReventlessAws.makeApiResource,
-    generateFragment: AppSync_Adapter$ReventlessAws.generateFragment,
-    updateSchema: AppSync_Adapter$ReventlessAws.updateSchema
+    generateFragment: AppSync_Adapter$ReventlessAws.generateFragment
   })({
     make: RuntimeEnvironment_Lambda$ReventlessAws.make,
     groupBySource: RuntimeEnvironment_Lambda$ReventlessAws.groupBySource,

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res

@@ -25,16 +25,48 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
   let lambdaRole = runtime.parts.lambdaRole
   let coreSqsQueue = remoteChannel.resources->Util_SQS.findResolvedResource
 
-  let _attachPoliciesAndSetEventTarget =
-    (
-      lambda->Pulumi.Output.flatMap(lambda => lambda.arn),
-      lambda->Pulumi.Output.flatMap(lambda => lambda.name),
-      lambdaRole.id,
+  // Grant sqs:SendMessage on the Core Plugin ExtensionPoint command topic at
+  // TOP LEVEL. Previously this RolePolicy was created inside the
+  // `Pulumi.Output.apply` below — and a resource created inside an apply
+  // callback does not reliably register with the engine, which intermittently
+  // left the heartbeat Lambda without this grant (IAM AccessDenied:
+  // `sqs:sendmessage on CorePluginExtPointCmdTopic`). `coreSqsQueue.urn` is an
+  // already-resolved ARN string from the remote channel and `lambdaRole.id` an
+  // Output, so neither needs an apply. Mirrors the EC `pta` grant fix — see
+  // docs/analysis/ec-publish-to-aggregates-grant-broken.md.
+  let _attachHeartbeatLambdaPolicy = {
+    open PulumiAws.PolicyDocument
+    let heartbeatLambdaSendMessagePolicyDocument = PulumiAws.PolicyDocument.make(
+      ~statements=[
+        {
+          sid: "AllowLambdaToSendSQS",
+          effect: Allow,
+          actions: Action("sqs:SendMessage"),
+          resources: Resource(coreSqsQueue.urn),
+        },
+      ],
     )
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((lambdaArn, lambdaName, heartbeatRoleId)) => {
-      open PulumiAws.PolicyDocument
+    PulumiAws.IAM.RolePolicy.make(
+      ~name=name ++ "RolePolicy",
+      ~args={
+        policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
+          name ++ "Policy",
+          [
+            PulumiAws.Lambda.defaultLoggingPolicyDocument,
+            heartbeatLambdaSendMessagePolicyDocument,
+          ],
+        )->Pulumi.Output.asInput,
+        role: lambdaRole.id->Pulumi.Output.asInput,
+      },
+    )
+  }
 
+  // The Lambda permission and CloudWatch event target genuinely need the
+  // Lambda's resolved arn/name, so they stay inside an apply.
+  let _permissionAndEventTarget =
+    (lambda->Pulumi.Output.flatMap(lambda => lambda.arn), lambda->Pulumi.Output.flatMap(lambda => lambda.name))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, lambdaName)) => {
       let _addHeartbeatLambdaPermission = PulumiAws.Lambda.Permission.make(
         ~name,
         ~args={
@@ -45,33 +77,6 @@ let make: ReventlessCore.Heartbeat_Adapter.runnerMaker<runtimeParts> = (
         ~opts,
       )
 
-      let heartbeatLambdaSendMessagePolicyDocument = {
-        PulumiAws.PolicyDocument.make(
-          ~statements=[
-            {
-              sid: "AllowLambdaToSendSQS",
-              effect: Allow,
-              actions: Action("sqs:SendMessage"),
-              resources: Resource(coreSqsQueue.urn),
-            },
-          ],
-        )
-      }
-
-      let _attachHeartbeatLambdaPolicy = PulumiAws.IAM.RolePolicy.make(
-        ~name=name ++ "RolePolicy",
-        ~args={
-          policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
-            name ++ "Policy",
-            [
-              PulumiAws.Lambda.defaultLoggingPolicyDocument,
-              heartbeatLambdaSendMessagePolicyDocument,
-            ],
-          )->Pulumi.Output.asInput,
-          role: heartbeatRoleId->Pulumi.Input.make,
-        },
-      )
-
       let _cloudwatchEventTarget = {
         open PulumiAws.Cloudwatch
         EventTarget.make(

package/src/plugin/heartbeat/HeartbeatRunner_CloudWatchEvents.res.mjs

@@ -27,29 +27,28 @@ function make(name, remoteChannel, timeout, runtime, opts) {
   let lambda = runtime.parts.lambda;
   let lambdaRole = runtime.parts.lambdaRole;
   let coreSqsQueue = Util_SQS$ReventlessAws.findResolvedResource(remoteChannel.resources);
+  let heartbeatLambdaSendMessagePolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
+      Sid: "AllowLambdaToSendSQS",
+      Effect: "Allow",
+      Action: "sqs:SendMessage",
+      Resource: coreSqsQueue.urn
+    }]);
+  new (Aws.iam.RolePolicy)(name + "RolePolicy", {
+    policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "Policy", [
+      Lambda$PulumiAws.defaultLoggingPolicyDocument,
+      heartbeatLambdaSendMessagePolicyDocument
+    ]),
+    role: lambdaRole.id
+  });
   Pulumi.all([
     Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
-    Output$Pulumi.flatMap(lambda, lambda => lambda.name),
-    lambdaRole.id
+    Output$Pulumi.flatMap(lambda, lambda => lambda.name)
   ]).apply(param => {
     new (Aws.lambda.Permission)(name, {
       action: "lambda:InvokeFunction",
       function: param[1],
       principal: AWS$ReventlessAws.CloudwatchEventRule.principal
     }, opts$1);
-    let heartbeatLambdaSendMessagePolicyDocument = PolicyDocument$PulumiAws.make(undefined, undefined, [{
-        Sid: "AllowLambdaToSendSQS",
-        Effect: "Allow",
-        Action: "sqs:SendMessage",
-        Resource: coreSqsQueue.urn
-      }]);
-    new (Aws.iam.RolePolicy)(name + "RolePolicy", {
-      policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "Policy", [
-        Lambda$PulumiAws.defaultLoggingPolicyDocument,
-        heartbeatLambdaSendMessagePolicyDocument
-      ]),
-      role: param[2]
-    });
     new (Aws.cloudwatch.EventTarget)(name, {
       rule: Cloudwatch_EventTarget$PulumiAws.Rule.ofEventRule(cloudwatchEventRule),
       arn: param[0]

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -622,79 +622,68 @@ module Make = (
         aggregateNameSet->Dict.set(aggName, ())
       )
     )
-    let queueUrlOutputs =
-      aggregateNameSet
-      ->Dict.keysToArray
-      ->Array.filterMap(aggName => context.publishToAggregates->Dict.get(aggName))
-    let _ = if queueUrlOutputs->Array.length > 0 {
-      // The dict is declared as `dict<Pulumi.Output.t<string>>` but the
-      // DCB slice path (Dcb_Builder.dcbCommandTopicQueueUrl) can leak the
-      // `{BS_PRIVATE_NESTED_SOME_NONE: 0}` nested-option sentinel as a
-      // value when the SQS Queue's .id is still unresolved during early
-      // CustomResource construction. Pulumi.all happily wraps & resolves
-      // it as Output<sentinel>, so .apply hands us a non-string. Drop
-      // anything that isn't actually a string — an extension targeting
-      // the affected slice will need a separate grant out-of-band until
-      // the resource is fully provisioned and a subsequent preview/up
-      // produces a real ARN. We build the policy document inline so an
-      // empty filtered ARN array skips RolePolicy creation entirely
-      // (PutRolePolicy rejects empty Resource arrays with
-      // MalformedPolicyDocument).
-      let policyJsonOutput =
-        queueUrlOutputs
-        ->Pulumi.Output.all
-        ->Pulumi.Output.apply(urls => {
-          let queueArns =
-            urls
-            ->Array.filter(url => typeof(url) === #string)
-            ->Array.map(url =>
-              // queue URL → ARN: https://sqs.<region>.amazonaws.com/<acct>/<name>
-              //                → arn:aws:sqs:<region>:<acct>:<name>
-              switch url->String.split("/") {
-              | [_, _, host, acct, name] =>
-                let region =
-                  host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
-                `arn:aws:sqs:${region}:${acct}:${name}`
-              | _ => url
-              }
-            )
-          if queueArns->Array.length == 0 {
-            None
+    // One RolePolicy per extension target, each derived through a SINGLE
+    // `.apply` on that target's queue-URL Output. `Pulumi.Output.all` is
+    // deliberately NOT used here: the DCB slice's URL is an `.apply`-lifted
+    // Output (Dcb_Builder reads the queue id via `operations.apply(_ =>
+    // resources[0].id)`), and `Pulumi.Output.all` mis-resolves such lifted
+    // Outputs to the `{BS_PRIVATE_NESTED_SOME_NONE: 0}` sentinel (both at
+    // preview and up) while a direct `.apply` on the same Output resolves the
+    // real URL — verified by deploying both variants. RolePolicy creation
+    // happens at TOP LEVEL: calling `RolePolicy.make` inside a
+    // `Pulumi.Output.apply` callback does not reliably register the resource
+    // (the previous inside-apply variant existed on no collector role in the
+    // account). Dict values are heterogeneous at runtime — plain resolved URL
+    // strings for aggregate targets, Outputs for DCB-slice targets; anything
+    // else is skipped. Inside the apply a non-string URL falls back to a
+    // benign placeholder ARN so the policy document stays valid (IAM rejects
+    // empty Resource entries with MalformedPolicyDocument).
+    // See docs/analysis/ec-publish-to-aggregates-grant-broken.md.
+    aggregateNameSet
+    ->Dict.keysToArray
+    ->Array.forEach(aggName => {
+      let urlOutput = switch context.publishToAggregates->Dict.get(aggName) {
+      | Some(o) if Pulumi.Output.isOutput(o) => Some(o)
+      | Some(o) if typeof(o) === #string => Some(Pulumi.Output.make((o->Obj.magic: string)))
+      | _ => None
+      }
+      switch urlOutput {
+      | Some(urlOutput) =>
+        let policyJson = urlOutput->Pulumi.Output.apply(url => {
+          let arn = if typeof(url) === #string {
+            // queue URL → ARN: https://sqs.<region>.amazonaws.com/<acct>/<name>
+            //                → arn:aws:sqs:<region>:<acct>:<name>
+            switch url->String.split("/") {
+            | [_, _, host, acct, name] =>
+              let region = host->String.split(".")->Array.get(1)->Option.getOr("eu-west-1")
+              `arn:aws:sqs:${region}:${acct}:${name}`
+            | _ => url
+            }
           } else {
-            Some(
-              PulumiAws.PolicyDocument.make(
-                ~id=`${name}PublishToAggregatesPolicy`,
-                ~statements=[
-                  {
-                    sid: "AllowEcPublishToAggregateCmdTopics",
-                    effect: Allow,
-                    actions: Action("sqs:SendMessage"),
-                    resources: Resources(queueArns),
-                  },
-                ],
-              )->PulumiAws.PolicyDocument.toJsonString,
-            )
+            "arn:aws:sqs:eu-west-1:000000000000:reventless-unresolved-cmd-topic"
           }
-        })
-      // Pulumi.all wraps a Some(string)/None and resolves to either the
-      // policy JSON or undefined — the latter makes PutRolePolicy a no-op
-      // by failing fast in the provider, so guard RolePolicy creation on
-      // the resolved value being Some.
-      let _ =
-        policyJsonOutput->Pulumi.Output.apply(policyOpt =>
-          switch policyOpt {
-          | Some(policyJson) =>
-            let _ = PulumiAws.IAM.RolePolicy.make(
-              ~name=`${name}-publishToAggregates`,
-              ~args={
-                policy: policyJson->Pulumi.Input.make,
-                role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          PulumiAws.PolicyDocument.make(
+            ~id=`${name}Pta${aggName}Policy`,
+            ~statements=[
+              {
+                sid: "AllowEcPublishToAggregateCmdTopic",
+                effect: Allow,
+                actions: Action("sqs:SendMessage"),
+                resources: Resource(arn),
               },
-            )
-          | None => ()
-          }
+            ],
+          )->PulumiAws.PolicyDocument.toJsonString
+        })
+        let _ = PulumiAws.IAM.RolePolicy.make(
+          ~name=`${name}-pta-${aggName}`,
+          ~args={
+            policy: policyJson->Pulumi.Output.asInput,
+            role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+          },
         )
-    }
+      | None => ()
+      }
+    })
   }
 
   let forPluginHeartbeat: ReventlessCore.Runtime.forComponent<

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -1,7 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Aws from "@pulumi/aws";
-import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
@@ -366,41 +365,44 @@ function Make(EventCollectorChannel) {
         aggregateNameSet[aggName] = undefined;
       });
     });
-    let queueUrlOutputs = Stdlib_Array.filterMap(Object.keys(aggregateNameSet), aggName => context.publishToAggregates[aggName]);
-    if (queueUrlOutputs.length !== 0) {
-      let policyJsonOutput = Pulumi.all(queueUrlOutputs).apply(urls => {
-        let queueArns = urls.filter(url => typeof url === "string").map(url => {
+    Object.keys(aggregateNameSet).forEach(aggName => {
+      let o = context.publishToAggregates[aggName];
+      let urlOutput = o !== undefined ? (
+          Pulumi.Output.isInstance(o) ? o : (
+              typeof o === "string" ? Pulumi.output(o) : undefined
+            )
+        ) : undefined;
+      if (urlOutput === undefined) {
+        return;
+      }
+      let policyJson = urlOutput.apply(url => {
+        let arn;
+        if (typeof url === "string") {
           let match = url.split("/");
           if (match.length !== 5) {
-            return url;
+            arn = url;
+          } else {
+            let host = match[2];
+            let acct = match[3];
+            let name$1 = match[4];
+            let region = Stdlib_Option.getOr(host.split(".")[1], "eu-west-1");
+            arn = `arn:aws:sqs:` + region + `:` + acct + `:` + name$1;
           }
-          let host = match[2];
-          let acct = match[3];
-          let name = match[4];
-          let region = Stdlib_Option.getOr(host.split(".")[1], "eu-west-1");
-          return `arn:aws:sqs:` + region + `:` + acct + `:` + name;
-        });
-        if (queueArns.length === 0) {
-          return;
         } else {
-          return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `PublishToAggregatesPolicy`, [{
-              Sid: "AllowEcPublishToAggregateCmdTopics",
-              Effect: "Allow",
-              Action: "sqs:SendMessage",
-              Resource: queueArns
-            }]));
+          arn = "arn:aws:sqs:eu-west-1:000000000000:reventless-unresolved-cmd-topic";
         }
+        return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `Pta` + aggName + `Policy`, [{
+            Sid: "AllowEcPublishToAggregateCmdTopic",
+            Effect: "Allow",
+            Action: "sqs:SendMessage",
+            Resource: arn
+          }]));
       });
-      policyJsonOutput.apply(policyOpt => {
-        if (policyOpt !== undefined) {
-          new (Aws.iam.RolePolicy)(name + `-publishToAggregates`, {
-            policy: policyOpt,
-            role: runtime.parts.lambdaRole.id
-          });
-          return;
-        }
+      new (Aws.iam.RolePolicy)(name + `-pta-` + aggName, {
+        policy: policyJson,
+        role: runtime.parts.lambdaRole.id
       });
-    }
+    });
   };
   let forPluginHeartbeat = (param, connect, memorySizeOpt, timeoutOpt, heartbeat) => {
     let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;

package/tests/AppSync_AdapterTest.res

@@ -663,13 +663,15 @@ describe("Split mode — empty base fragment", () => {
 
 describe("Merged mode — canonical source documents", () => {
   let assembleCanonicalSourceSdl = (~baseFragment) =>
-    AppSync_Adapter.stitchWithAwsDirectives(~baseFragment, ~pluginFragments=[])
+    AppSync_Adapter.stitchStandaloneWithAwsDirectives(~fragment=baseFragment)
     ->AppSync_SdlDecorate.stampCanonicalTypes
 
-  let emptyBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
+  // Mirrors Platform.res's domainBaseFragment: no component fields, one
+  // Platform_ping so the Query type is non-empty.
+  let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
     types: [],
     mutations: [],
-    queries: [],
+    queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: [],
   })
@@ -678,14 +680,17 @@ describe("Merged mode — canonical source documents", () => {
     ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
       ReventlessCore.AdminApi.baseFragment(~cloner=false),
       ~group="Admin",
-      ~iamFieldNames=ReventlessCore.AdminApi.systemCallerFieldNames,
     ),
   )
 
-  let relayBaseSourceSdl = assembleCanonicalSourceSdl(~baseFragment=emptyBaseFragment)
+  let domainBaseSourceSdl = assembleCanonicalSourceSdl(~baseFragment=domainBaseFragment)
 
-  testSync("admin source document carries the global node query", () => {
-    expect(adminSourceSdl)->toContain("node(id: ID!): Node")
+  testSync("no AWS source document carries the global node query (dropped — see plan)", () => {
+    expect(adminSourceSdl)->not_->toContain("node(id: ID!): Node")
+    expect(domainBaseSourceSdl)->not_->toContain("node(id: ID!): Node")
+    // The Node interface and global IDs stay — they are what makes a future
+    // node() possible without a schema migration.
+    expect(adminSourceSdl)->toContain("interface Node")
   })
 
   testSync("admin source document stamps @canonical on the shared traversal types", () => {
@@ -697,19 +702,22 @@ describe("Merged mode — canonical source documents", () => {
     )
   })
 
-  testSync("admin source document keeps admin fields and dual-auth stamps", () => {
+  testSync("admin source document keeps admin fields and shared-type IAM stamps", () => {
     expect(adminSourceSdl)->toContain("Platform_Plugin")
-    expect(adminSourceSdl)->toContain("@aws_iam")
+    // Type-level dual-auth on the shared traversal types (stampSharedIamTypes);
+    // no FIELD carries @aws_iam anymore — the SigV4 register/deregister surface
+    // died with the fragment registry.
+    expect(adminSourceSdl)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam")
   })
 
-  testSync("relay-base source document (split-mode Domain source) is node + relay types only", () => {
-    expect(relayBaseSourceSdl)->toContain("node(id: ID!): Node")
-    expect(relayBaseSourceSdl)->toContain("interface Node @canonical {")
-    expect(relayBaseSourceSdl)->toContain("type PageInfo")
+  testSync("Domain base source document (split mode) is relay types + Platform_ping only", () => {
+    expect(domainBaseSourceSdl)->toContain("Platform_ping: String")
+    expect(domainBaseSourceSdl)->toContain("interface Node @canonical {")
+    expect(domainBaseSourceSdl)->toContain("type PageInfo")
     // No admin or plugin fields on the split-mode Domain source.
-    expect(relayBaseSourceSdl)->not_->toContain("Platform_Plugin")
+    expect(domainBaseSourceSdl)->not_->toContain("Platform_Plugin")
     // No mutations → no CommandResult family on this source.
-    expect(relayBaseSourceSdl)->not_->toContain("union CommandResult")
+    expect(domainBaseSourceSdl)->not_->toContain("union CommandResult")
   })
 
   // Phase 4: the plugin-stack subgraph document pushed to the plugin's own

package/tests/AppSync_AdapterTest.res.mjs

@@ -607,18 +607,20 @@ globalThis.describe("Split mode — empty base fragment", () => {
 });
 
 globalThis.describe("Merged mode — canonical source documents", () => {
-  let emptyBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
+  let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: [],
     mutations: [],
-    queries: [],
+    queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: []
   });
-  let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", AdminApi$ReventlessCore.systemCallerFieldNames);
-  let adminSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchWithAwsDirectives(baseFragment, []));
-  let relayBaseSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchWithAwsDirectives(emptyBaseFragment, []));
-  globalThis.test("admin source document carries the global node query", () => {
-    globalThis.expect(adminSourceSdl).toContain("node(id: ID!): Node");
+  let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+  let adminSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
+  let domainBaseSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(domainBaseFragment));
+  globalThis.test("no AWS source document carries the global node query (dropped — see plan)", () => {
+    globalThis.expect(adminSourceSdl).not.toContain("node(id: ID!): Node");
+    globalThis.expect(domainBaseSourceSdl).not.toContain("node(id: ID!): Node");
+    globalThis.expect(adminSourceSdl).toContain("interface Node");
   });
   globalThis.test("admin source document stamps @canonical on the shared traversal types", () => {
     globalThis.expect(adminSourceSdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam @canonical {");
@@ -626,16 +628,16 @@ globalThis.describe("Merged mode — canonical source documents", () => {
     globalThis.expect(adminSourceSdl).toContain("union CommandResult @canonical =");
     globalThis.expect(adminSourceSdl).toContain("type CommandAccepted @aws_cognito_user_pools @aws_iam @canonical {");
   });
-  globalThis.test("admin source document keeps admin fields and dual-auth stamps", () => {
+  globalThis.test("admin source document keeps admin fields and shared-type IAM stamps", () => {
     globalThis.expect(adminSourceSdl).toContain("Platform_Plugin");
-    globalThis.expect(adminSourceSdl).toContain("@aws_iam");
-  });
-  globalThis.test("relay-base source document (split-mode Domain source) is node + relay types only", () => {
-    globalThis.expect(relayBaseSourceSdl).toContain("node(id: ID!): Node");
-    globalThis.expect(relayBaseSourceSdl).toContain("interface Node @canonical {");
-    globalThis.expect(relayBaseSourceSdl).toContain("type PageInfo");
-    globalThis.expect(relayBaseSourceSdl).not.toContain("Platform_Plugin");
-    globalThis.expect(relayBaseSourceSdl).not.toContain("union CommandResult");
+    globalThis.expect(adminSourceSdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam");
+  });
+  globalThis.test("Domain base source document (split mode) is relay types + Platform_ping only", () => {
+    globalThis.expect(domainBaseSourceSdl).toContain("Platform_ping: String");
+    globalThis.expect(domainBaseSourceSdl).toContain("interface Node @canonical {");
+    globalThis.expect(domainBaseSourceSdl).toContain("type PageInfo");
+    globalThis.expect(domainBaseSourceSdl).not.toContain("Platform_Plugin");
+    globalThis.expect(domainBaseSourceSdl).not.toContain("union CommandResult");
   });
   let pluginFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: [