@reventlessdev/reventless-aws 3.0.0-alpha.222 → 3.0.0-alpha.224

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res

@@ -114,38 +114,40 @@ let make = (
 
   // SQS queue policy — allow SNS to send messages
   let snsResource = eventTopicOutputs.resources->Array.getUnsafe(0)
-  let _ =
-    (queue.arn, queue.id, snsResource.urn)
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, snsUrn)) => {
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, snsResource.urn)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, snsUrn)) => {
       open PolicyDocument
-      let _queuePolicy = SQS.QueuePolicy.make(
-        ~name=name ++ "EventLogSubQueuePolicy",
-        ~args={
-          queueUrl: queueId->Pulumi.Input.make,
-          policy: PolicyDocument.make(
-            ~id=name ++ "EventLogSubQueuePolicy",
-            ~statements=[
-              {
-                sid: "AllowSNSSend",
-                principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
-                effect: Allow,
-                actions: Actions(["sqs:SendMessage"]),
-                resources: Resource(queueArn),
-                conditions: {
-                  arnEquals: [
-                    ("aws:SourceArn", ConditionValues([snsUrn])),
-                  ]->Dict.fromArray,
-                },
-              },
-            ],
-          )
-          ->PolicyDocument.toJsonString
-          ->Pulumi.Input.make,
-        },
-        ~opts=Some(opts),
-      )
+      PolicyDocument.make(
+        ~id=name ++ "EventLogSubQueuePolicy",
+        ~statements=[
+          {
+            sid: "AllowSNSSend",
+            principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
+            effect: Allow,
+            actions: Actions(["sqs:SendMessage"]),
+            resources: Resource(queueArn),
+            conditions: {
+              arnEquals: [("aws:SourceArn", ConditionValues([snsUrn]))]->Dict.fromArray,
+            },
+          },
+        ],
+      )->PolicyDocument.toJsonString
     })
+  let _queuePolicy = SQS.QueuePolicy.make(
+    ~name=name ++ "EventLogSubQueuePolicy",
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 
   // SNS → SQS subscription (raw delivery so body IS the event JSON)
   let _subscription = Util_SQS.subscribeToSnsTopic(

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res.mjs

@@ -85,30 +85,28 @@ function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
     sqsManagedSseEnabled: false
   }, opts);
   let snsResource = eventTopicOutputs.resources[0];
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     snsResource.urn
-  ]).apply(param => {
-    new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
-          Sid: "AllowSNSSend",
-          Principal: {
-            Service: [AWS$ReventlessAws.SNS.principal]
-          },
-          Effect: "Allow",
-          Action: ["sqs:SendMessage"],
-          Resource: param[0],
-          Condition: {
-            ArnEquals: Object.fromEntries([[
-                "aws:SourceArn",
-                [param[2]]
-              ]])
-          }
-        }])),
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
+      Sid: "AllowSNSSend",
+      Principal: {
+        Service: [AWS$ReventlessAws.SNS.principal]
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: param[0],
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "aws:SourceArn",
+            [param[1]]
+          ]])
+      }
+    }])));
+  new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
   Util_SQS$ReventlessAws.subscribeToSnsTopic(queue, name + "EventLogSub", name, snsResource, opts);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "EventLogSubRole", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "EventLogSubRole", EventTopic$ReventlessCore.componentType, "Identity", undefined, name, undefined, undefined, undefined), opts);
   Pulumi.all([

package/src/adapter/Mcp/MCP_Lambda.res

@@ -119,8 +119,10 @@ let generateAdminConfig = (
   generateConfig(
     ~serverName=`${serverName}-admin`,
     ~serverVersion,
-    ~pluginName="Admin",
-    ~mutationEntries=ReventlessCore.AdminApi.mutationEntries(~cloner),
+    // Must match what Platform_Admin.construct registers — it forms the resource URI
+    // templates (`<pluginName>/<field>/{id}`) that MCP clients address.
+    ~pluginName=ReventlessCore.Platform_Admin_Structure.pluginId,
+    ~mutationEntries=ReventlessCore.Platform_AdminApi.mutationEntries(~cloner),
     ~queryEntries=ReventlessCore.PluginBaseFragment.queryEntries,
     ~commandTopicArns,
     ~queryDbTableNames,

package/src/adapter/Mcp/MCP_Lambda.res.mjs

@@ -11,11 +11,12 @@ import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Runtime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Runtime/Runtime.res.mjs";
-import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
 import * as MCP_SchemaGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/MCP_SchemaGenerator.res.mjs";
 import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
+import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
 import * as CommandTopicChannel_SQS_RuntimeResMjs from "@reventlessdev/reventless-aws/src/adapter/CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import * as CommandGenerator_CallbackResMjs from "@reventlessdev/reventless-core/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
@@ -69,7 +70,7 @@ function generateAdminConfig(serverName, serverVersion, clonerOpt, commandTopicA
   let cloner = clonerOpt !== undefined ? clonerOpt : false;
   let commandTopicArns = commandTopicArnsOpt !== undefined ? commandTopicArnsOpt : ({});
   let queryDbTableNames = queryDbTableNamesOpt !== undefined ? queryDbTableNamesOpt : ({});
-  return generateConfig(serverName + `-admin`, serverVersion, "Admin", AdminApi$ReventlessCore.mutationEntries(cloner), PluginBaseFragment$ReventlessCore.queryEntries, undefined, commandTopicArns, queryDbTableNames, undefined);
+  return generateConfig(serverName + `-admin`, serverVersion, Platform_Admin_Structure$ReventlessCore.pluginId, Platform_AdminApi$ReventlessCore.mutationEntries(cloner), PluginBaseFragment$ReventlessCore.queryEntries, undefined, commandTopicArns, queryDbTableNames, undefined);
 }
 
 function extractEntityId(uri) {

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -2,7 +2,7 @@
 //
 // Drains a Postgres DCB log via `PgChangeFeed` and pushes each event — transformed
 // into the `{id, meta, event}` shape the plugin EventCollector SQS handler
-// consumes — onto that queue. The plugin EventCollector (`AdminEventCollectorEntryPoint`)
+// consumes — onto that queue. The plugin EventCollector (`EventCollectorEntryPoint`)
 // then drives the full fan-out: read-model projections, aggregate command topics,
 // and the cross-plugin SNS EventTopic. See
 // docs/plans/aws-postgres-change-feed-bridge.md.

package/src/adapter/Runtime/{AdminEventCollectorEntryPoint.mjs → EventCollectorEntryPoint.mjs}

@@ -1,6 +1,6 @@
-// Plugin EventCollector Lambda entry point — shared between the admin and every
-// per-plugin EventCollector Lambda. Despite the historical "Admin" filename, this
-// module is plugin-agnostic: behaviour is driven entirely by HANDLER_CONFIG.
+// Plugin EventCollector Lambda entry point — shared between the platform and every
+// per-plugin EventCollector Lambda. This module is plugin-agnostic: behaviour is
+// driven entirely by HANDLER_CONFIG.
 //
 // HANDLER_CONFIG schema (JSON in env var "HANDLER_CONFIG"):
 //
@@ -411,7 +411,7 @@ function loadUiFragments() {
 // Cross-plugin spec packages (e.g. "@reventlessdev/online-shop-hybrid-catalog-spec")
 // are bundled into the function asset under /var/task/node_modules/ by
 // PluginRuntime_Builder.forPluginEventCollector. This entry-point file, however,
-// lives in the Lambda LAYER at /opt/nodejs/node_modules/.../AdminEventCollectorEntryPoint.mjs,
+// lives in the Lambda LAYER at /opt/nodejs/node_modules/.../EventCollectorEntryPoint.mjs,
 // so a bare `await import("@reventlessdev/online-shop-hybrid-catalog-spec/...")`
 // from here resolves through /opt/nodejs/node_modules/ and never reaches the
 // function asset. Anchoring createRequire at file:///var/task/index.mjs makes
@@ -585,7 +585,7 @@ async function buildHandler() {
   // it through ExtensionMapping.Make, and build per-extension Extension_Operations.
   const userExtensionHandlers = await Promise.all(config.extensions.map(async (ext) => {
     if (!ext.specModule || !ext.mappingsModule || !ext.delegateModule) {
-      log.warn("extension '" + ext.name + "' missing module specifier(s); skipping. specModule=" + ext.specModule + ", mappingsModule=" + ext.mappingsModule + ", delegateModule=" + ext.delegateModule, { comp: "AdminEventCollectorEntryPoint" });
+      log.warn("extension '" + ext.name + "' missing module specifier(s); skipping. specModule=" + ext.specModule + ", mappingsModule=" + ext.mappingsModule + ", delegateModule=" + ext.delegateModule, { comp: "EventCollectorEntryPoint" });
       return null;
     }
     const epSpec = patchSpecId(await importFromAsset(ext.specModule));

package/src/components/Api/AppSync_SdlDecorate.res

@@ -7,7 +7,7 @@
 // STITCHED schema at push time — the additive counterpart of the neutral
 // emission, mirroring how `injectAwsAuthAll`/`stampSharedIamTypes` decorate
 // auth. Runtime-pure so the bundled Lambda entry points
-// (AdminEventCollectorEntryPoint.mjs) can import it without dragging
+// (EventCollectorEntryPoint.mjs) can import it without dragging
 // deploy-time dependencies into the runtime module graph.
 
 /**

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -375,7 +375,7 @@ export function response(ctx) {
 }
 `->Pulumi.Input.make
 
-      let field = ReventlessCore.AdminApi.cloneMutationEntry.fieldNames->Array.getUnsafe(0)
+      let field = ReventlessCore.Platform_AdminApi.cloneMutationEntry.fieldNames->Array.getUnsafe(0)
       let resolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
         ~name=field,
         ~api,

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -11,11 +11,11 @@ import * as AWS$ReventlessAws from "../../adapter/AWS.res.mjs";
 import * as Cloner$ReventlessCore from "@reventlessdev/reventless-core/src/components/Cloner.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as Util_Vpc$ReventlessAws from "../../util/Util_Vpc.res.mjs";
-import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as GetSecretVersion$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/SecretsManager/GetSecretVersion.res.mjs";
 import * as Util_AppSync$ReventlessAws from "../../util/Util_AppSync.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../../adapter/Api/AppSync_Resolver_Retrying.res.mjs";
 
 function make(name, api, fullQualifiedStackName, reventlessCiSecretUrn, secretUrns, opts) {
@@ -226,7 +226,7 @@ export const handler = async (event) => {
       },
       serviceRoleArn: dataSourceRole.arn
     }, opts);
-    let field = AdminApi$ReventlessCore.cloneMutationEntry.fieldNames[0];
+    let field = Platform_AdminApi$ReventlessCore.cloneMutationEntry.fieldNames[0];
     let resolver = AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(field, api, dataSource.name, "Mutation", field, `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   return {

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -118,7 +118,7 @@ let registerConfig = (
 
 // PluginRuntime_Builder is a functor so that the caller can inject the EventCollectorChannel
 // implementation. All other runtime builders hardcode EventCollectorChannel.DynamoDbStream, but
-// the Plugin admin handler (AdminEventCollectorEntryPoint) is shared across DCB and aggregate
+// the Plugin admin handler (EventCollectorEntryPoint) is shared across DCB and aggregate
 // plugins which may use different event log backends. The functor keeps the builder generic
 // while the concrete instantiation picks the right channel at the platform level.
 module Make = (
@@ -151,9 +151,11 @@ module Make = (
   let synthesizeAdminContext = (): ReventlessCore.Plugin_Helpers.eventCollectorContext => {
     let config = configRef.contents
     // Stable JSON literal — matches Reventless.Plugin.pluginDefinitionSchema
-    // (optional fields encoded as null via js_nullable).
+    // (optional fields encoded as null via js_nullable). Must stay byte-aligned with
+    // the ReScript-built twin in `Platform_Admin.construct`'s `fakePluginDefinition`.
+    let platformId = ReventlessCore.Platform_Admin_Structure.pluginId
     let fakePluginDefinitionJson =
-      `{"id":"Admin@INTERNAL","name":"Admin","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"structure":null}`->Pulumi.Output.make
+      `{"id":"${platformId}@INTERNAL","name":"${platformId}","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"structure":null}`->Pulumi.Output.make
     let adminEpEventTopicArn = switch config.eventTopicArn {
     | Some(arn) => arn
     | None => Pulumi.Output.make("NOT_AVAILABLE")
@@ -436,7 +438,7 @@ module Make = (
       [ext.specModule, ext.mappingsModule, ext.delegateModule]->Array.forEach(addPackageFor)
     })
     // Outgoing EPs: the entry point dynamic-imports ep.specModule and
-    // ep.mappingsModule at cold start (AdminEventCollectorEntryPoint.mjs).
+    // ep.mappingsModule at cold start (EventCollectorEntryPoint.mjs).
     // Without this walk the EP spec package (e.g. <plugin>-spec) is missing
     // from the asset zip even though HANDLER_CONFIG references it, and the
     // Lambda crashes with MODULE_NOT_FOUND before any event is processed.
@@ -484,7 +486,9 @@ module Make = (
         // extension can emit RegisterUiFragment in the handshake answer.
         extraStringAssets->Dict.set("uiFragments.json", uiFragmentsJson)
         Util_Bundle.buildCodeArchive(
-          ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/AdminEventCollectorEntryPoint.mjs",
+          // Path string, not a module reference — a rename that misses this stays green
+          // at build time and fails at bundle time or Lambda cold start.
+          ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/EventCollectorEntryPoint.mjs",
           ~packageDirs,
           ~extraStringAssets,
         )

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -15,6 +15,7 @@ import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/sr
 import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as EventLogBackend$ReventlessAws from "../../adapter/EventLog/EventLogBackend.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../../adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
 import * as StateChangeSliceRuntime_Builder_Single$ReventlessAws from "../../adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs";
 
@@ -132,7 +133,7 @@ function Make(EventCollectorChannel) {
   };
   let synthesizeAdminContext = () => {
     let config = configRef.contents;
-    let fakePluginDefinitionJson = Pulumi.output(`{"id":"Admin@INTERNAL","name":"Admin","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"structure":null}`);
+    let fakePluginDefinitionJson = Pulumi.output(`{"id":"` + Platform_Admin_Structure$ReventlessCore.pluginId + `@INTERNAL","name":"` + Platform_Admin_Structure$ReventlessCore.pluginId + `","version":"INTERNAL","extensionPoints":[],"extensions":[],"eventCollector":"NOT-SET","extensionProtocols":[],"apiSchemaFragment":null,"apiTarget":null,"structure":null}`);
     let arn = config.eventTopicArn;
     let adminEpEventTopicArn = arn !== undefined ? arn : Pulumi.output("NOT_AVAILABLE");
     return {
@@ -306,7 +307,7 @@ function Make(EventCollectorChannel) {
       let extraStringAssets = {};
       extraStringAssets["pluginDefinition.json"] = param[0];
       extraStringAssets["uiFragments.json"] = param[1];
-      return Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AdminEventCollectorEntryPoint.mjs", packageDirs, extraStringAssets);
+      return Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/EventCollectorEntryPoint.mjs", packageDirs, extraStringAssets);
     });
     let codeOutput = bundleOutput.apply(b => b.code);
     let sourceCodeHashOutput = bundleOutput.apply(b => b.sourceCodeHash);

package/src/util/Util_DeadLetterQueue.res

@@ -122,7 +122,7 @@ let createQueuePolicyDocument = (name, queueArn: string, handlerArn: string) =>
 let _ =
   (queue.id, queue.arn, fifoQueue.id, fifoQueue.arn, handler.arn)
   ->Pulumi.Output.all5
-  ->Pulumi.Output.apply(((queueId, queueArn, fifoQueueId, fifoQueueArn, handlerArn)) => {
+  ->Pulumi.Output.apply(((_queueId, queueArn, _fifoQueueId, fifoQueueArn, handlerArn)) => {
     let lambdaPolicyDocument = PulumiAws.PolicyDocument.make(
       ~id=name ++ "SQSPolicy",
       ~statements=[
@@ -152,10 +152,20 @@ let _ =
       ~opts,
     )
 
+    // `queueUrl` takes the queue's Output, not the resolved `queueId` string:
+    // that is what registers the policy -> queue dependency, without which
+    // Pulumi has no ordering constraint and can delete the queue first on a
+    // replacement, leaving the policy's delete polling a queue that is gone.
+    //
+    // Unlike the channel helpers, these two stay inside the apply. This module
+    // creates its resources at import time and this apply resolves late enough
+    // to race Jest's teardown; reshaping it (dropping the now-unused ids to
+    // narrow the tuple) shifts that timing and crashes the AWS unit suites, so
+    // `_queueId` / `_fifoQueueId` are deliberately kept.
     let _attachQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name,
       ~args={
-        queueUrl: queueId->Pulumi.Input.make,
+        queueUrl: queue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(name, queueArn, handlerArn),
       },
       ~opts=Some(opts),
@@ -163,7 +173,7 @@ let _ =
     let _attachFifoQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name=nameFifo,
       ~args={
-        queueUrl: fifoQueueId->Pulumi.Input.make,
+        queueUrl: fifoQueue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
       },
       ~opts=Some(opts),

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -132,11 +132,11 @@ Pulumi.all([
   }, opts);
   new (Aws.sqs.QueuePolicy)(name, {
     policy: createQueuePolicyDocument(name, queueArn, handlerArn),
-    queueUrl: param[0]
+    queueUrl: queue.id
   }, opts);
   new (Aws.sqs.QueuePolicy)(nameFifo, {
     policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
-    queueUrl: param[2]
+    queueUrl: fifoQueue.id
   }, opts);
 });
 

package/tests/AppSync_AdapterTest.res

@@ -23,7 +23,7 @@ let decodeFragment = (fragment: Reventless.Plugin.apiSchemaFragment) =>
   ReventlessCore.GraphQL_Stitcher.decode(fragment)
 
 describe("AppSync_Adapter.injectAwsAuthAll", () => {
-  let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=true)
+  let baseFragment = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true)
 
   testSync("adds @aws_auth directive to all mutation fields", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
@@ -86,10 +86,10 @@ describe("AppSync_Adapter.injectAwsAuth", () => {
   testSync("injects auth only on entries with authorization", () => {
     // Build a fragment with known entries
     let mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry> =
-      ReventlessCore.AdminApi.mutationEntries(~cloner=false)
+      ReventlessCore.Platform_AdminApi.mutationEntries(~cloner=false)
     let queryEntries = ReventlessCore.PluginBaseFragment.queryEntries
 
-    let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=false)
+    let baseFragment = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=false)
     let augmented = AppSync_Adapter.injectAwsAuth(
       baseFragment,
       ~mutationEntries,
@@ -111,7 +111,7 @@ describe("AppSync_Adapter.injectAwsAuth", () => {
 
 describe("AppSync_Adapter.generateFragment", () => {
   testSync("produces fragment with auth directives from entries", () => {
-    let mutationEntries = ReventlessCore.AdminApi.mutationEntries(~cloner=false)
+    let mutationEntries = ReventlessCore.Platform_AdminApi.mutationEntries(~cloner=false)
     let queryEntries = ReventlessCore.PluginBaseFragment.queryEntries
 
     let fragment = AppSync_Adapter.generateFragment(~mutationEntries, ~queryEntries)
@@ -570,7 +570,7 @@ describe("AppSync_Adapter — type-level dual-auth", () => {
 })
 
 describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
-  let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=true)
+  let baseFragment = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true)
 
   testSync("marks only the named field dual-auth, leaving others single-mode", () => {
     // Pick a real mutation field name from the admin base fragment.
@@ -644,7 +644,7 @@ describe("Split mode — empty base fragment", () => {
   })
 
   testSync("stitching admin base without plugins produces only admin fields", () => {
-    let adminBase = ReventlessCore.AdminApi.baseFragment(~cloner=false)
+    let adminBase = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=false)
     let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
       ~baseFragment=adminBase,
       ~pluginFragments=[],
@@ -678,7 +678,7 @@ describe("Merged mode — canonical source documents", () => {
 
   let adminSourceSdl = assembleCanonicalSourceSdl(
     ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
-      ReventlessCore.AdminApi.baseFragment(~cloner=false),
+      ReventlessCore.Platform_AdminApi.baseFragment(~cloner=false),
       ~group="Admin",
     ),
   )

package/tests/AppSync_AdapterTest.res.mjs

@@ -5,9 +5,9 @@ import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
-import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
 
@@ -28,7 +28,7 @@ globalThis.describe("AppSync_Adapter.sha256Hex", () => {
 let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
-  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  let baseFragment = Platform_AdminApi$ReventlessCore.baseFragment(true);
   globalThis.test("adds @aws_auth directive to all mutation fields", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
@@ -77,8 +77,8 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
 
 globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
   globalThis.test("injects auth only on entries with authorization", () => {
-    let mutationEntries = AdminApi$ReventlessCore.mutationEntries(false);
-    let baseFragment = AdminApi$ReventlessCore.baseFragment(false);
+    let mutationEntries = Platform_AdminApi$ReventlessCore.mutationEntries(false);
+    let baseFragment = Platform_AdminApi$ReventlessCore.baseFragment(false);
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuth(baseFragment, mutationEntries, PluginBaseFragment$ReventlessCore.queryEntries);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     let queryWithAuth = PluginBaseFragment$ReventlessCore.queryEntries.some(entry => Stdlib_Option.isSome(entry.authorization));
@@ -92,7 +92,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
 
 globalThis.describe("AppSync_Adapter.generateFragment", () => {
   globalThis.test("produces fragment with auth directives from entries", () => {
-    let mutationEntries = AdminApi$ReventlessCore.mutationEntries(false);
+    let mutationEntries = Platform_AdminApi$ReventlessCore.mutationEntries(false);
     let fragment = AppSync_Adapter$ReventlessAws.generateFragment(mutationEntries, PluginBaseFragment$ReventlessCore.queryEntries);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
     globalThis.expect(parts.types.length).toBeGreaterThan(0);
@@ -536,7 +536,7 @@ globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {
 });
 
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
-  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  let baseFragment = Platform_AdminApi$ReventlessCore.baseFragment(true);
   globalThis.test("marks only the named field dual-auth, leaving others single-mode", () => {
     let firstMutationName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(GraphQL_Stitcher$ReventlessCore.decode(baseFragment).mutations[0]);
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", [firstMutationName]);
@@ -600,7 +600,7 @@ globalThis.describe("Split mode — empty base fragment", () => {
     globalThis.expect(sdl).not.toContain("Platform_Plugin");
   });
   globalThis.test("stitching admin base without plugins produces only admin fields", () => {
-    let adminBase = AdminApi$ReventlessCore.baseFragment(false);
+    let adminBase = Platform_AdminApi$ReventlessCore.baseFragment(false);
     let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBase, []);
     globalThis.expect(sdl).toContain("Platform_Plugin");
   });
@@ -614,7 +614,7 @@ globalThis.describe("Merged mode — canonical source documents", () => {
     subscriptions: [],
     subscriptionSources: []
   });
-  let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+  let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
   let adminSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   let domainBaseSourceSdl = AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(domainBaseFragment));
   globalThis.test("no AWS source document carries the global node query (dropped — see plan)", () => {

package/tests/CommandTopicQueuePolicyTest.res

@@ -0,0 +1,65 @@
+open JestGlobals
+
+// Guards the CommandTopic queue policy's service-principal scoping. The
+// EventBridge grant cannot name a single rule ARN — ScheduledPublisher creates
+// rules at runtime and EventBridge authorises SQS targets against the queue's
+// resource policy — so the condition keys are the only bound on who may send
+// into a command topic. A dropped condition is invisible at deploy time.
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050"
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4"
+
+let policy =
+  CommandTopicChannel_Helpers.createQueuePolicyDocument(
+    ~name="CatalogAggrCmdTopic",
+    ~queueArn,
+    ~lambdaArn,
+  )->JSON.parseOrThrow
+
+let field = (json, key) =>
+  json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(key))
+
+let statement = sid =>
+  policy
+  ->field("Statement")
+  ->Option.flatMap(JSON.Decode.array)
+  ->Option.getOr([])
+  ->Array.find(s => s->field("Sid")->Option.flatMap(JSON.Decode.string) == Some(sid))
+
+let condition = (sid, operator, key) =>
+  statement(sid)
+  ->Option.flatMap(s => s->field("Condition"))
+  ->Option.flatMap(c => c->field(operator))
+  ->Option.flatMap(o => o->field(key))
+  ->Option.flatMap(JSON.Decode.string)
+
+describe("CommandTopic queue policy — EventBridge grant", () => {
+  testSync("is scoped to this account", () => {
+    expect(
+      condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount"),
+    )->toEqual(Some("123456789012"))
+  })
+
+  testSync("is scoped to EventBridge rule ARNs in this account", () => {
+    expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn"))->toEqual(
+      Some("arn:aws:events:*:123456789012:rule/*"),
+    )
+  })
+
+  testSync("names the EventBridge service principal", () => {
+    let principal =
+      statement("AllowCloudWatchEventsToSendToQueue")
+      ->Option.flatMap(s => s->field("Principal"))
+      ->Option.flatMap(p => p->field("Service"))
+      ->Option.flatMap(JSON.Decode.string)
+    expect(principal)->toEqual(Some("events.amazonaws.com"))
+  })
+})
+
+describe("CommandTopic queue policy — Lambda grant", () => {
+  testSync("stays pinned to the consuming function ARN", () => {
+    expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn"))->toEqual(
+      Some(lambdaArn),
+    )
+  })
+})

package/tests/CommandTopicQueuePolicyTest.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as CommandTopicChannel_Helpers$ReventlessAws from "../src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs";
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050";
+
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4";
+
+let policy = JSON.parse(CommandTopicChannel_Helpers$ReventlessAws.createQueuePolicyDocument("CatalogAggrCmdTopic", queueArn, lambdaArn));
+
+function field(json, key) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[key]);
+}
+
+function statement(sid) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), []).find(s => Primitive_object.equal(Stdlib_Option.flatMap(field(s, "Sid"), Stdlib_JSON.Decode.string), sid));
+}
+
+function condition(sid, operator, key) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement(sid), s => field(s, "Condition")), c => field(c, operator)), o => field(o, key)), Stdlib_JSON.Decode.string);
+}
+
+globalThis.describe("CommandTopic queue policy — EventBridge grant", () => {
+  globalThis.test("is scoped to this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount")).toEqual("123456789012");
+  });
+  globalThis.test("is scoped to EventBridge rule ARNs in this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn")).toEqual("arn:aws:events:*:123456789012:rule/*");
+  });
+  globalThis.test("names the EventBridge service principal", () => {
+    let principal = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement("AllowCloudWatchEventsToSendToQueue"), s => field(s, "Principal")), p => field(p, "Service")), Stdlib_JSON.Decode.string);
+    globalThis.expect(principal).toEqual("events.amazonaws.com");
+  });
+});
+
+globalThis.describe("CommandTopic queue policy — Lambda grant", () => {
+  globalThis.test("stays pinned to the consuming function ARN", () => {
+    globalThis.expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn")).toEqual(lambdaArn);
+  });
+});
+
+export {
+  queueArn,
+  lambdaArn,
+  policy,
+  field,
+  statement,
+  condition,
+}
+/* policy Not a pure module */

package/tests/MCP_LambdaTest.res

@@ -73,7 +73,7 @@ describe("MCP_Lambda.generateAdminConfig", () => {
     let arns = Dict.make()
     // Use a tool name that matches the first mutation field
     let firstEntry: ReventlessInfra.Api.mutationSchemaEntry =
-      ReventlessCore.AdminApi.mutationEntries(~cloner=false)->Array.getUnsafe(0)
+      ReventlessCore.Platform_AdminApi.mutationEntries(~cloner=false)->Array.getUnsafe(0)
     let firstFieldName = firstEntry.fieldNames->Array.getUnsafe(0)
     arns->Dict.set(firstFieldName, "arn:aws:sqs:us-east-1:123:queue")