@reventlessdev/reventless-aws 3.0.0-alpha.294 → 3.0.0-alpha.296

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.296 (2026-08-14)
+
+### Features
+
+* **aws:** give every field and type an explicit Cognito directive ([37c1063](https://github.com/ReventlessDev/reventless-core/commit/37c1063560aaa6ee200e74d58b9de4d6881441fd))
+
+
+# 3.0.0-alpha.295 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** enforce Cognito group gates that AppSync was silently ignoring ([1392638](https://github.com/ReventlessDev/reventless-core/commit/13926388c097500606f75c387630a19ee1a3aa71))
+
+
 # 3.0.0-alpha.294 (2026-08-14)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.294",
+  "version": "3.0.0-alpha.296",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -6,13 +6,20 @@
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
 //
 // The narrowing has to happen here rather than in our own enforcement code
-// because `@authorize(AllowGroups([...]))` compiles to `@aws_auth`, which AppSync
+// because `@authorize(AllowGroups([...]))` compiles to a field directive AppSync
 // evaluates against `cognito:groups` **before any of our code executes**. A
 // request header we invent could scope reads correctly and still leave every
 // group-gated mutation callable — right about the data, wrong about the writes.
 // Overriding the group claim is the one place every enforcement point already
 // looks.
 //
+// That premise was false for as long as the directive was emitted as the
+// single-mode `@aws_auth(...)`, which AppSync ignores on a multi-auth API — the
+// gate was open and this trigger narrowed a claim nothing read for authorization.
+// The directive is now `@aws_cognito_user_pools(...)`, which the service does
+// enforce, so the reasoning above holds again. See
+// `AppSync_SdlDecorate.formatCognitoGroupsDirective`.
+//
 // **Version 1 of the trigger, deliberately.** Group override and added ID-token
 // claims are `V1_0` capabilities; `V2_0`/`V3_0` buy access-token customisation
 // this does not need and are gated behind the Essentials and Plus feature plans.

package/src/components/Api/AppSync_Adapter.res

@@ -171,9 +171,9 @@ let rec waitForMergeSuccess = async (
   }
 }
 
-// ── @aws_auth directive injection ─────────────────────────────────────────
-// Injects @aws_auth(cognito_groups: [...]) directives into SDL field strings
-// based on authorization metadata from schema entries.
+// ── Cognito group directive injection ─────────────────────────────────────
+// Injects @aws_cognito_user_pools(cognito_groups: [...]) directives into SDL
+// field strings based on authorization metadata from schema entries.
 //
 // Two sources are merged:
 //   1. The legacy `authorization?: {tableName, group}` field — single group
@@ -184,19 +184,22 @@ let rec waitForMergeSuccess = async (
 //
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
-// `@aws_auth(cognito_groups: ["g1", "g2", ...])`. `AllowAuthenticated` /
-// `AllowAnonymous` emit no directive (with Cognito as primary auth, any
-// reaching request is already authenticated). `AllowGroups([])` and
-// `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
+// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
+// `AllowAuthenticated` / `AllowAnonymous` emit no directive (with Cognito as
+// primary auth, any reaching request is already authenticated). `AllowGroups([])`
+// and `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
 // belong to — effectively blocking the field at the API layer.
 //
+// NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
+// multi-auth API — which every API this adapter provisions is. See
+// `AppSync_SdlDecorate.formatCognitoGroupsDirective` for the full rationale and
+// the observation that established it.
+//
 // ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
 // A field flagged `systemCallable` (via `mutationSchemaEntry`/`querySchemaEntry`)
 // must be reachable by BOTH the console UI (Cognito) and a deploy-time system
 // caller signing SigV4 with ambient AWS credentials (`Util_AppSync_Caller`,
-// the AWS_IAM additional auth provider). `@aws_auth(...)` is the single-mode
-// directive form and does not admit IAM on a multi-auth API. For these fields
-// we emit the multi-auth form instead:
+// the AWS_IAM additional auth provider). For these fields we append the IAM arm:
 //   @aws_cognito_user_pools(cognito_groups: [...]) @aws_iam
 // The Cognito arm preserves the field's existing group gating (or, when the
 // field carries no Cognito group restriction, a bare `@aws_cognito_user_pools`
@@ -215,24 +218,17 @@ let _permissionToCognitoGroups = (
   | AllowAuthenticated | AllowAnonymous => None
   }
 
-let _formatGroupsDirective = (groups: array<string>): string => {
-  let quoted = groups->Array.map(g => `"${g}"`)->Array.join(", ")
-  `@aws_auth(cognito_groups: [${quoted}])`
-}
+// Both directive forms are defined once in the runtime-pure AppSync_SdlDecorate
+// so this deploy path and the bundled AdminEventCollector Lambda's reactive push
+// cannot drift. The Cognito-only arm carries the rationale for why it is
+// `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
+let _formatGroupsDirective = AppSync_SdlDecorate.formatCognitoGroupsDirective
 
 // Multi-auth directive for a field that must accept BOTH Cognito and IAM.
 // `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps the
 // field open to any authenticated Cognito user. `@aws_iam` admits the
 // deploy-time SigV4 system caller. See the dual-auth note above.
-let _formatDualAuthDirective = (groups: option<array<string>>): string => {
-  let cognito = switch groups {
-  | Some(g) =>
-    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
-    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
-  | None => `@aws_cognito_user_pools`
-  }
-  `${cognito} @aws_iam`
-}
+let _formatDualAuthDirective = AppSync_SdlDecorate.formatDualAuthDirective
 
 // ── Type-level dual-auth ─────────────────────────────────────────────────────
 // On a multi-auth API, object TYPES without auth directives are accessible only
@@ -359,6 +355,12 @@ let injectAwsAuth = (
     }
   })
 
+  // A field with no group restriction gets the group-less Cognito directive
+  // rather than no directive at all. Same reachability under `defaultAction:
+  // ALLOW`; the difference only shows once the default is DENY, where an
+  // unstamped field is refused. See AppSync_SdlDecorate.cognitoOpenDirective.
+  let openDirective = AppSync_SdlDecorate.cognitoOpenDirective
+
   let augmentedMutations = parts.mutations->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     let groups = mutationAuthMap->Dict.get(fieldName)
@@ -367,7 +369,7 @@ let injectAwsAuth = (
     } else {
       switch groups {
       | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
-      | None => field
+      | None => `${field}\n    ${openDirective}`
       }
     }
   })
@@ -383,11 +385,23 @@ let injectAwsAuth = (
     } else {
       switch groups {
       | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
-      | None => field
+      | None => `${field} ${openDirective}`
       }
     }
   })
 
+  // Subscriptions carried no directive at all on this path — they are reads and
+  // need one for the same reason queries do. A subscription is never IAM-marked
+  // (the deploy caller does not subscribe), so it takes the Cognito arm only:
+  // the mutation's groups where the subscribed field has them, otherwise open.
+  let augmentedSubscriptions = parts.subscriptions->Array.map(field => {
+    let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
+    switch mutationAuthMap->Dict.get(fieldName) {
+    | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+    | None => `${field}\n    ${openDirective}`
+    }
+  })
+
   // Type-level dual-auth for every type the callable entries' responses reach —
   // the node type, its Connection/Edge wrappers, and nested state types all
   // share the entry's returnTypeName prefix.
@@ -404,6 +418,7 @@ let injectAwsAuth = (
     types: augmentedTypes,
     mutations: augmentedMutations,
     queries: augmentedQueries,
+    subscriptions: augmentedSubscriptions,
   })
 }
 
@@ -448,6 +463,9 @@ let stitchStandaloneWithAwsDirectives = (
   ReventlessCore.GraphQL_Stitcher.stitchStandalone(~fragment)
   ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
   ->stampSharedIamTypes
+  // Last: every remaining undirectived type takes the group-less Cognito arm.
+  // After stampSharedIamTypes so the shared traversal types keep `@aws_iam`.
+  ->AppSync_SdlDecorate.stampAllTypesCognito
 }
 
 // ── Provider implementation ────────────────────────────────────────────────

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -126,22 +126,6 @@ function _permissionToCognitoGroups(permission) {
   }
 }
 
-function _formatGroupsDirective(groups) {
-  let quoted = groups.map(g => `"` + g + `"`).join(", ");
-  return `@aws_auth(cognito_groups: [` + quoted + `])`;
-}
-
-function _formatDualAuthDirective(groups) {
-  let cognito;
-  if (groups !== undefined) {
-    let quoted = groups.map(x => `"` + x + `"`).join(", ");
-    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
-  } else {
-    cognito = `@aws_cognito_user_pools`;
-  }
-  return cognito + ` @aws_iam`;
-}
-
 function _typeDeclName(decl) {
   if (!decl.startsWith("type ")) {
     return;
@@ -228,11 +212,11 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = mutationAuthMap[fieldName];
     if (Stdlib_Option.getOr(iamFields[fieldName], false)) {
-      return field + `\n    ` + _formatDualAuthDirective(groups);
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective(groups);
     } else if (groups !== undefined) {
-      return field + `\n    ` + _formatGroupsDirective(groups);
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
-      return field;
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
     }
   });
   let augmentedQueries = parts.queries.map(field => {
@@ -240,11 +224,20 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let groups = queryAuthMap[fieldName];
     let isIam = Stdlib_Option.getOr(iamFields[fieldName], false) || iamQueryFieldPrefixes.some(p => fieldName.startsWith(p));
     if (isIam) {
-      return field + ` ` + _formatDualAuthDirective(groups);
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective(groups);
     } else if (groups !== undefined) {
-      return field + ` ` + _formatGroupsDirective(groups);
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
+    } else {
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
+    }
+  });
+  let augmentedSubscriptions = parts.subscriptions.map(field => {
+    let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
+    let groups = mutationAuthMap[fieldName];
+    if (groups !== undefined) {
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
-      return field;
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
     }
   });
   let augmentedTypes = parts.types.map(decl => {
@@ -259,7 +252,7 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     types: augmentedTypes,
     mutations: augmentedMutations,
     queries: augmentedQueries,
-    subscriptions: parts.subscriptions,
+    subscriptions: augmentedSubscriptions,
     subscriptionSources: parts.subscriptionSources
   });
 }
@@ -271,7 +264,7 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
 
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
-  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources));
+  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources)));
 }
 
 function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
@@ -346,6 +339,10 @@ function generateFragment(mutationEntries, queryEntries) {
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
+let _formatGroupsDirective = AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective;
+
+let _formatDualAuthDirective = AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective;
+
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
 let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";

package/src/components/Api/AppSync_SdlDecorate.res

@@ -67,26 +67,55 @@ let injectAwsSubscribe = (
 // the deploy path without dragging Pulumi into the runtime graph. AppSync_Adapter
 // delegates its `injectAwsAuthAll` / `stampSharedIamTypes` to these definitions.
 
+// Cognito group gate. `@aws_cognito_user_pools(cognito_groups: [...])` — NOT the
+// single-mode `@aws_auth(cognito_groups: [...])`.
+//
+// `@aws_auth` is honoured only on an API whose sole authorization mode is
+// AMAZON_COGNITO_USER_POOLS. This adapter always configures AWS_IAM as an
+// additional provider (see AppSync_Adapter's api args — the server-to-server
+// lambdas need it), so every API we provision is multi-auth and the service
+// **silently ignores** `@aws_auth`: the schema deploys, the directive shows up
+// in the deployed SDL, and it gates nothing. What is left is
+// `userPoolConfig.defaultAction: ALLOW`, which admits every authenticated
+// Cognito user — a group gate that fails open.
+//
+// Confirmed by observation against a deployed API: a user in no groups read
+// every `@aws_auth`-gated field and reached a gated mutation's handler. See
+// docs/plans/appsync-group-authorization-unenforced.md.
+let formatCognitoGroupsDirective = (groups: array<string>): string => {
+  let quoted = groups->Array.map(g => `"${g}"`)->Array.join(", ")
+  `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
+}
+
+// The group-less Cognito directive: reachable by any authenticated Cognito
+// caller. Emitted where a field or type is deliberately open — `AllowAuthenticated`,
+// `AllowAnonymous`, a field carrying no permission at all, and every object type.
+//
+// Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
+// field is already reachable by any authenticated caller, so stamping it changes
+// nothing. It exists so the default can be flipped to DENY, where "no directive"
+// stops meaning "open" and starts meaning "refused" — at which point anything
+// left unstamped breaks. Stamping first and flipping second is what keeps that
+// flip from being a guess.
+let cognitoOpenDirective = "@aws_cognito_user_pools"
+
 // Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
 // `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps it
 // open to any authenticated Cognito user. `@aws_iam` admits the deploy-time
 // SigV4 system caller.
 let formatDualAuthDirective = (groups: option<array<string>>): string => {
   let cognito = switch groups {
-  | Some(g) =>
-    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
-    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
-  | None => `@aws_cognito_user_pools`
+  | Some(g) => formatCognitoGroupsDirective(g)
+  | None => cognitoOpenDirective
   }
   `${cognito} @aws_iam`
 }
 
-// Injects @aws_auth with the given group on ALL mutation, query, and subscription
-// fields in a fragment. `~iamFieldNames` opts the named mutation/query fields into
-// deploy-time IAM (dual-auth): those fields emit
-// `@aws_cognito_user_pools(cognito_groups: ["<group>"]) @aws_iam` instead of the
-// single-mode `@aws_auth(...)`, keeping the same Cognito gating while also admitting
-// the SigV4 system caller. Subscriptions are never IAM-marked.
+// Injects the Cognito group gate on ALL mutation, query, and subscription fields
+// in a fragment. `~iamFieldNames` opts the named mutation/query fields into
+// deploy-time IAM as well, appending the `@aws_iam` arm. Subscriptions are never
+// IAM-marked (the deploy caller does not subscribe) but still carry the Cognito
+// gate — a subscription is a read.
 let injectAwsAuthAll = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~group: string,
@@ -95,19 +124,18 @@ let injectAwsAuthAll = (
   let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
   let isIam = (field: string): bool =>
     iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
+  let cognitoOnly = formatCognitoGroupsDirective([group])
 
   let augmentedMutations = parts.mutations->Array.map(field =>
     isIam(field)
       ? `${field}\n    ${formatDualAuthDirective(Some([group]))}`
-      : `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+      : `${field}\n    ${cognitoOnly}`
   )
   let augmentedQueries = parts.queries->Array.map(field =>
-    isIam(field)
-      ? `${field} ${formatDualAuthDirective(Some([group]))}`
-      : `${field} @aws_auth(cognito_groups: ["${group}"])`
+    isIam(field) ? `${field} ${formatDualAuthDirective(Some([group]))}` : `${field} ${cognitoOnly}`
   )
   let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
-    `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+    `${field}\n    ${cognitoOnly}`
   )
 
   ReventlessCore.GraphQL_Stitcher.encode({
@@ -134,6 +162,38 @@ let stampSharedIamTypes = (sdl: string): string =>
     acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
   )
 
+// Stamp every object `type` declaration that does not already carry an auth
+// directive with the group-less Cognito arm. Run on the ASSEMBLED SDL, AFTER
+// stampSharedIamTypes so the shared traversal types keep their `@aws_iam` arm
+// (this pass skips anything already carrying an `@aws_` directive).
+//
+// Types, not just fields: on a multi-auth API with `defaultAction: DENY`,
+// AppSync refuses an undirectived TYPE even when the caller passed the field's
+// own gate — response shaping walks `…Connection` → `…Edge` → node → nested
+// state types and dies one level in. Entry gating stays on the fields; a type
+// stamp only restores the accessibility an undirectived type has today.
+//
+// Only `type` declarations take auth directives — `input`, `enum`, `union` and
+// `interface` do not, and stamping them is a schema error.
+let stampAllTypesCognito = (sdl: string): string =>
+  sdl
+  ->String.split("\n")
+  ->Array.map(line =>
+    if line->String.startsWith("type ") && !(line->String.includes("@aws_")) {
+      switch line->String.indexOfOpt("{") {
+      | Some(i) =>
+        line->String.slice(~start=0, ~end=i) ++
+        cognitoOpenDirective ++
+        " " ++
+        line->String.slice(~start=i, ~end=line->String.length)
+      | None => line
+      }
+    } else {
+      line
+    }
+  )
+  ->Array.join("\n")
+
 // ── Merged-API canonical stamping ─────────────────────────────────────────────
 // Under AppSync Merged APIs the admin source API owns the shared traversal
 // types; `@canonical` makes its definition win over every plugin source's copy

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -37,35 +37,37 @@ function injectAwsSubscribe(sdl, sources) {
   return before + decorated + after;
 }
 
+function formatCognitoGroupsDirective(groups) {
+  let quoted = groups.map(g => `"` + g + `"`).join(", ");
+  return `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
+}
+
+let cognitoOpenDirective = "@aws_cognito_user_pools";
+
 function formatDualAuthDirective(groups) {
-  let cognito;
-  if (groups !== undefined) {
-    let quoted = groups.map(x => `"` + x + `"`).join(", ");
-    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
-  } else {
-    cognito = `@aws_cognito_user_pools`;
-  }
+  let cognito = groups !== undefined ? formatCognitoGroupsDirective(groups) : cognitoOpenDirective;
   return cognito + ` @aws_iam`;
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let cognitoOnly = formatCognitoGroupsDirective([group]);
   let augmentedMutations = parts.mutations.map(field => {
     if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
       return field + `\n    ` + formatDualAuthDirective([group]);
     } else {
-      return field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`;
+      return field + `\n    ` + cognitoOnly;
     }
   });
   let augmentedQueries = parts.queries.map(field => {
     if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
       return field + ` ` + formatDualAuthDirective([group]);
     } else {
-      return field + ` @aws_auth(cognito_groups: ["` + group + `"])`;
+      return field + ` ` + cognitoOnly;
     }
   });
-  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
+  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    ` + cognitoOnly);
   return GraphQL_Stitcher$ReventlessCore.encode({
     types: parts.types,
     mutations: augmentedMutations,
@@ -86,6 +88,20 @@ function stampSharedIamTypes(sdl) {
   return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
 }
 
+function stampAllTypesCognito(sdl) {
+  return sdl.split("\n").map(line => {
+    if (!(line.startsWith("type ") && !line.includes("@aws_"))) {
+      return line;
+    }
+    let i = Stdlib_String.indexOfOpt(line, "{");
+    if (i !== undefined) {
+      return line.slice(0, i) + cognitoOpenDirective + " " + line.slice(i, line.length);
+    } else {
+      return line;
+    }
+  }).join("\n");
+}
+
 let canonicalTypeNames = [
   "PageInfo",
   "CommandAccepted",
@@ -125,10 +141,13 @@ function stampCanonicalTypes(sdl) {
 
 export {
   injectAwsSubscribe,
+  formatCognitoGroupsDirective,
+  cognitoOpenDirective,
   formatDualAuthDirective,
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
+  stampAllTypesCognito,
   canonicalTypeNames,
   stampCanonicalTypes,
 }

package/tests/AppSync_AdapterTest.res

@@ -25,19 +25,19 @@ let decodeFragment = (fragment: Reventless.Plugin.apiSchemaFragment) =>
 describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true)
 
-  testSync("adds @aws_auth directive to all mutation fields", () => {
+  testSync("adds the Cognito group directive to all mutation fields", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.mutations->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
-  testSync("adds @aws_auth directive to all query fields", () => {
+  testSync("adds the Cognito group directive to all query fields", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.queries->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
@@ -61,15 +61,15 @@ describe("AppSync_Adapter.injectAwsAuthAll", () => {
   // admin base. That caused AppSync to reject the auto-generated resolver for
   // `Subscription.onPlatform_Plugin_Activate` (and Deactivate) with "Type not
   // found" at deploy time. The subscription fields must survive the round-trip
-  // and pick up the same @aws_auth group as mutations/queries.
-  testSync("preserves subscription fields with @aws_auth directive", () => {
+  // and pick up the same Cognito group directive as mutations/queries.
+  testSync("preserves subscription fields with the Cognito group directive", () => {
     let original = decodeFragment(baseFragment)
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     expect(parts.subscriptions->Array.length)->toBe(original.subscriptions->Array.length)
     expect(parts.subscriptions->Array.length)->toBeGreaterThan(0)
     parts.subscriptions->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
@@ -80,6 +80,21 @@ describe("AppSync_Adapter.injectAwsAuthAll", () => {
     expect(joined)->toContain("onPlatform_Plugin_Activate")
     expect(joined)->toContain("onPlatform_Plugin_Deactivate")
   })
+
+  // Regression: the admin base was stamped with the single-mode
+  // `@aws_auth(cognito_groups: [...])`, which AppSync IGNORES on a multi-auth API
+  // — and every API this adapter provisions is multi-auth. A deployed probe found
+  // a Cognito user in no groups reading every admin field. The directive must be
+  // `@aws_cognito_user_pools(...)`, the form the service actually enforces.
+  // See docs/plans/appsync-group-authorization-unenforced.md.
+  testSync("never emits the single-mode @aws_auth form on any field", () => {
+    let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
+    let parts = decodeFragment(augmented)
+    let everyField =
+      Array.concatMany(parts.mutations, [parts.queries, parts.subscriptions])->Array.join("\n")
+    expect(everyField)->not_->toContain("@aws_auth")
+    expect(everyField)->toContain("@aws_cognito_user_pools")
+  })
 })
 
 describe("AppSync_Adapter.injectAwsAuth", () => {
@@ -97,12 +112,12 @@ describe("AppSync_Adapter.injectAwsAuth", () => {
     )
     let parts = decodeFragment(augmented)
 
-    // Query entries have authorization → should have @aws_auth
+    // Query entries have authorization → should carry the directive
     let queryWithAuth =
       queryEntries->Array.some(entry => entry.authorization->Option.isSome)
     if queryWithAuth {
       let hasAuthQuery = parts.queries->Array.some(field =>
-        field->String.includes("@aws_auth")
+        field->String.includes("@aws_cognito_user_pools")
       )
       expect(hasAuthQuery)->toBe(true)
     }
@@ -124,11 +139,11 @@ describe("AppSync_Adapter.generateFragment", () => {
   })
 })
 
-// ── Stage E2: spec-level permission → @aws_auth directive ───────────────
+// ── Stage E2: spec-level permission → Cognito group directive ───────────────
 //
 // Verifies that `injectAwsAuth` lifts the `Authorization.permission` values
 // (set by Plugin_Builder / Dcb_Builder from `@@reventless.authorize` /
-// `@authorize` PPX annotations) into `@aws_auth(cognito_groups: [...])`
+// `@authorize` PPX annotations) into `@aws_cognito_user_pools(cognito_groups: [...])`
 // directives on the corresponding SDL fields.
 
 describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () => {
@@ -182,7 +197,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )
     let parts = decodeFragment(aug)
     let m = parts.mutations->Array.getUnsafe(0)
-    expect(m)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
   })
 
   testSync("AllowGroups multi-group emits comma-separated groups", () => {
@@ -199,11 +214,11 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )
     let parts = decodeFragment(aug)
     expect(parts.mutations->Array.getUnsafe(0))->toContain(
-      `@aws_auth(cognito_groups: ["Admin", "Editor"])`,
+      `@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`,
     )
   })
 
-  testSync("AllowAuthenticated emits no directive", () => {
+  testSync("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Dict.fromArray([(
       "p_Add",
       Reventless.Authorization.AllowAuthenticated,
@@ -216,7 +231,11 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_auth")
+    // Open, not ungated: the field carries the group-less directive so it stays
+    // reachable once defaultAction flips to DENY, but names no group.
+    let m = parts.mutations->Array.getUnsafe(0)
+    expect(m)->toContain("@aws_cognito_user_pools")
+    expect(m)->not_->toContain("cognito_groups")
   })
 
   testSync("DenyAll emits sentinel __deny_all__ group", () => {
@@ -258,7 +277,9 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     | None => JsError.throwWithMessage("missing archive field")
     }
     switch add {
-    | Some(f) => expect(f)->not_->toContain("@aws_auth")
+    | Some(f) =>
+      expect(f)->toContain("@aws_cognito_user_pools")
+      expect(f)->not_->toContain("cognito_groups")
     | None => JsError.throwWithMessage("missing add field")
     }
   })
@@ -323,7 +344,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     expect(m)->not_->toContain(`"Admin"`)
   })
 
-  testSync("AllowAuthenticated on a field overrides the legacy authorization (removes directive)", () => {
+  testSync("AllowAuthenticated on a field overrides the legacy authorization (drops the group)", () => {
     let fp = Dict.fromArray([(
       "p_X",
       Reventless.Authorization.AllowAuthenticated,
@@ -344,7 +365,11 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_auth")
+    // The spec-level AllowAuthenticated wins over the legacy `authorization.group`:
+    // the field keeps a directive, but no longer names a group.
+    let m = parts.mutations->Array.getUnsafe(0)
+    expect(m)->toContain("@aws_cognito_user_pools")
+    expect(m)->not_->toContain("cognito_groups")
   })
 })
 
@@ -397,7 +422,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
     expect(m)->not_->toContain("@aws_auth")
   })
 
-  testSync("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+  testSync("a non-systemCallable sibling stays Cognito-only (no @aws_iam)", () => {
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync", "p_Other"],
       commandSchema: S.unknown,
@@ -420,7 +445,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
     let parts = decodeFragment(aug)
     switch parts.mutations->Array.find(f => f->String.includes("p_Other")) {
     | Some(other) =>
-      expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(other)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
       expect(other)->not_->toContain("@aws_iam")
     | None => JsError.throwWithMessage("missing p_Other field")
     }
@@ -588,13 +613,13 @@ describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
         expect(field)->toContain("@aws_iam")
         expect(field)->not_->toContain("@aws_auth")
       } else {
-        expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+        expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
         expect(field)->not_->toContain("@aws_iam")
       }
     })
   })
 
-  testSync("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+  testSync("default (no ~iamFieldNames) leaves every field Cognito-only", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.mutations->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
@@ -836,3 +861,56 @@ describe("AppSync_Adapter.waitForMergeSuccess", () => {
     expect(message.contents)->toContain("MERGE_IN_PROGRESS")
   })
 })
+
+// ── Subscription stamping ───────────────────────────────────────────────────
+//
+// `injectAwsAuth` re-encoded `subscriptions` untouched, so every plugin
+// subscription reached the deployed SDL with no auth directive at all — 22 of
+// them on the hybrid domain API. Harmless under `defaultAction: ALLOW`, refused
+// under DENY. A subscription is a read and takes the Cognito arm; it is never
+// IAM-marked, because the deploy-time caller does not subscribe.
+
+describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
+  let makeFragment = subscriptionFields =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: ["p_Ship(id: ID!): CommandResult!"],
+      queries: [],
+      subscriptions: subscriptionFields,
+      subscriptionSources: [],
+    })
+
+  let entry = (~fieldNames, ~fieldPermissions): ReventlessInfra.Api.mutationSchemaEntry => {
+    fieldNames,
+    commandSchema: S.unknown,
+    fieldPermissions,
+  }
+
+  testSync("an unannotated subscription gets the group-less Cognito directive", () => {
+    let frag = makeFragment(["onSomething: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[])
+    let s = decodeFragment(aug).subscriptions->Array.getUnsafe(0)
+    expect(s)->toContain("@aws_cognito_user_pools")
+    expect(s)->not_->toContain("cognito_groups")
+    expect(s)->not_->toContain("@aws_iam")
+  })
+
+  testSync("a subscription named like a gated mutation inherits its groups", () => {
+    let fp = Dict.fromArray([("p_Ship", Reventless.Authorization.AllowGroups(["Fulfilment"]))])
+    let frag = makeFragment(["p_Ship: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(
+      frag,
+      ~mutationEntries=[entry(~fieldNames=["p_Ship"], ~fieldPermissions=fp)],
+      ~queryEntries=[],
+    )
+    let s = decodeFragment(aug).subscriptions->Array.getUnsafe(0)
+    expect(s)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Fulfilment"])`)
+    expect(s)->not_->toContain("@aws_iam")
+  })
+
+  testSync("subscription fields survive the round-trip", () => {
+    let frag = makeFragment(["onA: CommandResult", "onB: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[])
+    expect(decodeFragment(aug).subscriptions->Array.length)->toBe(2)
+  })
+})

package/tests/AppSync_AdapterTest.res.mjs

@@ -29,18 +29,18 @@ let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = Platform_AdminApi$ReventlessCore.baseFragment(true);
-  globalThis.test("adds @aws_auth directive to all mutation fields", () => {
+  globalThis.test("adds the Cognito group directive to all mutation fields", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
-  globalThis.test("adds @aws_auth directive to all query fields", () => {
+  globalThis.test("adds the Cognito group directive to all query fields", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.queries.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("preserves type definitions unchanged", () => {
@@ -56,14 +56,14 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
       globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
     });
   });
-  globalThis.test("preserves subscription fields with @aws_auth directive", () => {
+  globalThis.test("preserves subscription fields with the Cognito group directive", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
     globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
     parts.subscriptions.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
@@ -73,6 +73,13 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
     globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
     globalThis.expect(joined).toContain("onPlatform_Plugin_Deactivate");
   });
+  globalThis.test("never emits the single-mode @aws_auth form on any field", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    let everyField = parts.mutations.concat(parts.queries, parts.subscriptions).join("\n");
+    globalThis.expect(everyField).not.toContain("@aws_auth");
+    globalThis.expect(everyField).toContain("@aws_cognito_user_pools");
+  });
 });
 
 globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
@@ -85,7 +92,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
     if (!queryWithAuth) {
       return;
     }
-    let hasAuthQuery = parts.queries.some(field => field.includes("@aws_auth"));
+    let hasAuthQuery = parts.queries.some(field => field.includes("@aws_cognito_user_pools"));
     globalThis.expect(hasAuthQuery).toBe(true);
   });
 });
@@ -135,7 +142,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
     let m = parts.mutations[0];
-    globalThis.expect(m).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
   });
   globalThis.test("AllowGroups multi-group emits comma-separated groups", () => {
     let fp = Object.fromEntries([[
@@ -152,9 +159,9 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).toContain(`@aws_auth(cognito_groups: ["Admin", "Editor"])`);
+    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
   });
-  globalThis.test("AllowAuthenticated emits no directive", () => {
+  globalThis.test("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Object.fromEntries([[
         "p_Add",
         "AllowAuthenticated"
@@ -163,7 +170,9 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_Add(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools");
+    globalThis.expect(m).not.toContain("cognito_groups");
   });
   globalThis.test("DenyAll emits sentinel __deny_all__ group", () => {
     let fp = Object.fromEntries([[
@@ -208,7 +217,8 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       Stdlib_JsError.throwWithMessage("missing archive field");
     }
     if (add !== undefined) {
-      globalThis.expect(add).not.toContain("@aws_auth");
+      globalThis.expect(add).toContain("@aws_cognito_user_pools");
+      globalThis.expect(add).not.toContain("cognito_groups");
       return;
     } else {
       return Stdlib_JsError.throwWithMessage("missing add field");
@@ -262,7 +272,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     globalThis.expect(m).toContain(`cognito_groups: ["Manager"]`);
     globalThis.expect(m).not.toContain(`"Admin"`);
   });
-  globalThis.test("AllowAuthenticated on a field overrides the legacy authorization (removes directive)", () => {
+  globalThis.test("AllowAuthenticated on a field overrides the legacy authorization (drops the group)", () => {
     let fp = Object.fromEntries([[
         "p_X",
         "AllowAuthenticated"
@@ -282,7 +292,9 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools");
+    globalThis.expect(m).not.toContain("cognito_groups");
   });
 });
 
@@ -337,7 +349,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     globalThis.expect(m).not.toContain("cognito_groups");
     globalThis.expect(m).not.toContain("@aws_auth");
   });
-  globalThis.test("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+  globalThis.test("a non-systemCallable sibling stays Cognito-only (no @aws_iam)", () => {
     let entry_fieldNames = [
       "p_Sync",
       "p_Other"
@@ -391,7 +403,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
     let other = parts.mutations.find(f => f.includes("p_Other"));
     if (other !== undefined) {
-      globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(other).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
       globalThis.expect(other).not.toContain("@aws_iam");
       return;
     } else {
@@ -548,12 +560,12 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () =>
         globalThis.expect(field).toContain("@aws_iam");
         globalThis.expect(field).not.toContain("@aws_auth");
       } else {
-        globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
         globalThis.expect(field).not.toContain("@aws_iam");
       }
     });
   });
-  globalThis.test("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+  globalThis.test("default (no ~iamFieldNames) leaves every field Cognito-only", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
@@ -739,6 +751,51 @@ globalThis.describe("AppSync_Adapter.waitForMergeSuccess", () => {
   });
 });
 
+globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
+  let makeFragment = subscriptionFields => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: ["p_Ship(id: ID!): CommandResult!"],
+    queries: [],
+    subscriptions: subscriptionFields,
+    subscriptionSources: []
+  });
+  let entry = (fieldNames, fieldPermissions) => ({
+    fieldNames: fieldNames,
+    commandSchema: S.unknown,
+    fieldPermissions: fieldPermissions
+  });
+  globalThis.test("an unannotated subscription gets the group-less Cognito directive", () => {
+    let frag = makeFragment(["onSomething: CommandResult"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], []);
+    let s = GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions[0];
+    globalThis.expect(s).toContain("@aws_cognito_user_pools");
+    globalThis.expect(s).not.toContain("cognito_groups");
+    globalThis.expect(s).not.toContain("@aws_iam");
+  });
+  globalThis.test("a subscription named like a gated mutation inherits its groups", () => {
+    let fp = Object.fromEntries([[
+        "p_Ship",
+        {
+          TAG: "AllowGroups",
+          _0: ["Fulfilment"]
+        }
+      ]]);
+    let frag = makeFragment(["p_Ship: CommandResult"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry(["p_Ship"], fp)], []);
+    let s = GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions[0];
+    globalThis.expect(s).toContain(`@aws_cognito_user_pools(cognito_groups: ["Fulfilment"])`);
+    globalThis.expect(s).not.toContain("@aws_iam");
+  });
+  globalThis.test("subscription fields survive the round-trip", () => {
+    let frag = makeFragment([
+      "onA: CommandResult",
+      "onB: CommandResult"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], []);
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions.length).toBe(2);
+  });
+});
+
 export {
   decodeFragment,
 }

package/tests/AppSync_SdlDecorateTest.res

@@ -31,7 +31,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`
 
@@ -43,13 +43,13 @@ describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     )
   })
 
-  testSync("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  testSync("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate.injectAwsSubscribe(stitchedSdl, ~sources)
     expect(sdl)->toContain(
       `onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`,
     )
     // The auth directive line appended by injectAwsAuthAll survives.
-    expect(sdl)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(sdl)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
   })
 
   testSync("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
@@ -113,7 +113,7 @@ describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     expect(parts.mutations->Array.getUnsafe(0))->toContain("@aws_iam")
     // A query NOT in iamFieldNames stays Cognito-only.
     let other = queryField("Other_Query")
-    expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(other)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     expect(other->String.includes("@aws_iam"))->toBe(false)
   })
 })
@@ -152,3 +152,39 @@ describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
     expect(AppSync_SdlDecorate.stampCanonicalTypes(once))->toBe(once)
   })
 })
+
+// ── Type-level Cognito stamping (defaultAction: DENY groundwork) ─────────────
+//
+// With `defaultAction: ALLOW` an undirectived type is reachable by any
+// authenticated Cognito caller, so this pass changes nothing observable. It
+// exists so the default can be flipped to DENY, where an undirectived type is
+// refused mid-traversal even for a caller who passed the field's own gate.
+
+describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
+  testSync("stamps an undirectived object type", () => {
+    let sdl = AppSync_SdlDecorate.stampAllTypesCognito("type Product {\n  id: ID!\n}")
+    expect(sdl)->toContain("type Product @aws_cognito_user_pools {")
+  })
+
+  testSync("leaves an already-directived type alone, keeping its @aws_iam arm", () => {
+    let sdl =
+      AppSync_SdlDecorate.stampSharedIamTypes(
+        "type PageInfo {\n  hasNextPage: Boolean!\n}",
+      )->AppSync_SdlDecorate.stampAllTypesCognito
+    expect(sdl)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam {")
+    // Not double-stamped.
+    expect(sdl->String.includes("@aws_cognito_user_pools @aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("does not stamp input, enum, union or interface declarations", () => {
+    let sdl = AppSync_SdlDecorate.stampAllTypesCognito(
+      "input ProductFilter {\n  id: ID\n}\n\nenum Status {\n  Active\n}\n\nunion CommandResult = CommandAccepted | CommandRejected\n\ninterface Node {\n  id: ID!\n}",
+    )
+    expect(sdl->String.includes("@aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("is idempotent", () => {
+    let once = AppSync_SdlDecorate.stampAllTypesCognito("type Product {\n  id: ID!\n}")
+    expect(AppSync_SdlDecorate.stampAllTypesCognito(once))->toBe(once)
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -35,7 +35,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`;
 
@@ -44,10 +44,10 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onCatalog_AddProduct(id: ID): CommandResult\n    @aws_subscribe(mutations: ["Catalog_AddProduct"])`);
   });
-  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`);
-    globalThis.expect(sdl).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(sdl).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
   });
   globalThis.test("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
@@ -100,7 +100,7 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     globalThis.expect(queryField("Platform_ApiFragments")).toContain("@aws_iam");
     globalThis.expect(parts.mutations[0]).toContain("@aws_iam");
     let other = queryField("Other_Query");
-    globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(other).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     globalThis.expect(other.includes("@aws_iam")).toBe(false);
   });
 });
@@ -132,6 +132,26 @@ globalThis.describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
+  globalThis.test("stamps an undirectived object type", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("type Product {\n  id: ID!\n}");
+    globalThis.expect(sdl).toContain("type Product @aws_cognito_user_pools {");
+  });
+  globalThis.test("leaves an already-directived type alone, keeping its @aws_iam arm", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes("type PageInfo {\n  hasNextPage: Boolean!\n}"));
+    globalThis.expect(sdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools @aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("does not stamp input, enum, union or interface declarations", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("input ProductFilter {\n  id: ID\n}\n\nenum Status {\n  Active\n}\n\nunion CommandResult = CommandAccepted | CommandRejected\n\ninterface Node {\n  id: ID!\n}");
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("is idempotent", () => {
+    let once = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("type Product {\n  id: ID!\n}");
+    globalThis.expect(AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(once)).toBe(once);
+  });
+});
+
 export {
   sources,
   stitchedSdl,