@reventlessdev/reventless-aws 3.0.0-alpha.298 → 3.0.0-alpha.300

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.300 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
+# 3.0.0-alpha.299 (2026-08-14)
+
+### Features
+
+* **aws:** refuse to push an AppSync schema that cannot be gated ([18e9279](https://github.com/ReventlessDev/reventless-core/commit/18e92793b1b42b4b94dc61e9e285918c67e62e8a))
+
+
 # 3.0.0-alpha.298 (2026-08-14)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.298",
+  "version": "3.0.0-alpha.300",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.141",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.98",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.234",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -335,7 +335,7 @@ module MakeWithConfig = (
           {
             userPoolId,
             ?awsRegion,
-            defaultAction: PulumiAws.AppSync.GraphQLApi.DENY,
+            defaultAction: PulumiAws.AppSync.GraphQLApi.ALLOW,
           }: PulumiAws.AppSync.GraphQLApi.userPoolConfig
         )
       })

package/src/Platform.res.mjs

@@ -220,7 +220,7 @@ function MakeWithConfig(Config) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "DENY",
+        defaultAction: "ALLOW",
         awsRegion: awsRegion
       };
     });
@@ -1523,7 +1523,7 @@ function Make($star) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "DENY",
+        defaultAction: "ALLOW",
         awsRegion: awsRegion
       };
     });

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -68,7 +68,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   ~subIdField,
   ~idResolverConfigs: array<idResolverConfig>,
   ~idsResolverConfigs: array<idsResolverConfig>,
-  // AWS path enforces authorization via `@aws_auth(cognito_groups: …)` on the
+  // AWS path enforces authorization via `@aws_cognito_user_pools(cognito_groups: …)` on the
   // SDL fields (see Stage E in docs/plans/host-ui-login-core.md). Accepted but
   // ignored here so the in-memory and AWS resolver maker signatures stay aligned.
   ~authorization as _: Reventless.Authorization.permission,

package/src/components/Api/AppSync_Adapter.res

@@ -185,10 +185,13 @@ let rec waitForMergeSuccess = async (
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
 // `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
-// `AllowAuthenticated` / `AllowAnonymous` emit no directive (with Cognito as
-// primary auth, any reaching request is already authenticated). `AllowGroups([])`
-// and `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
-// belong to — effectively blocking the field at the API layer.
+// `AllowAuthenticated` / `AllowAnonymous` emit the group-less
+// `@aws_cognito_user_pools` — same reachability (with Cognito as primary auth
+// any reaching request is already authenticated), but stated rather than left
+// implicit, so `assertGateable` can tell "deliberately open" from "nobody
+// stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
+// group that no Cognito user can belong to — effectively blocking the field at
+// the API layer.
 //
 // NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
 // multi-auth API — which every API this adapter provisions is. See
@@ -422,14 +425,14 @@ let injectAwsAuth = (
   })
 }
 
-// Injects @aws_auth with the given group on ALL mutation, query, and subscription
+// Injects the Cognito group directive on ALL mutation, query, and subscription
 // fields in a fragment. Used for the base fragment where all fields share the
 // same authorization group.
 //
 // `~iamFieldNames` opts the named mutation/query fields into deploy-time IAM
 // (dual-auth): those fields emit `@aws_cognito_user_pools(cognito_groups:
-// ["<group>"]) @aws_iam` instead of the single-mode `@aws_auth(...)`, keeping
-// the same Cognito group gating while also admitting the SigV4 system caller.
+// ["<group>"]) @aws_iam`, keeping the same Cognito group gating while also
+// admitting the SigV4 system caller.
 // Subscriptions are never IAM-marked (the deploy caller does not subscribe).
 // Canonical definition lives in the runtime-pure AppSync_SdlDecorate so the
 // bundled AdminEventCollector Lambda's reactive push decorates the admin base
@@ -470,6 +473,13 @@ let stitchStandaloneWithAwsDirectives = (
   // Last: every remaining undirectived type takes the group-less Cognito arm.
   // After stampSharedIamTypes so the shared traversal types keep `@aws_iam`.
   ->AppSync_SdlDecorate.stampAllTypesCognito
+  // Fields the stitcher injects during assembly (`_noop`) are invisible to the
+  // fragment sweep above, so sweep the assembled document too.
+  ->AppSync_SdlDecorate.stampUndirectivedRootFields
+  // Then refuse to hand back a schema that cannot be gated. `defaultAction: DENY`
+  // is unavailable on a multi-auth API, so this deploy-time check is the only
+  // fail-closed step there is — everything downstream trusts what it returns.
+  ->AppSync_SdlDecorate.assertGateable
 }
 
 // ── Provider implementation ────────────────────────────────────────────────
@@ -534,16 +544,21 @@ let _makeApiResourceWith = (
   // site — DomainApi, PlatformApi — is safe). A single Output yielding the
   // {userPoolId, awsRegion, defaultAction} record AppSync expects.
   //
-  // `DENY`, not `ALLOW`: an undirectived field or type is refused rather than
-  // served to any authenticated Cognito caller. This is what makes a missing
-  // directive fail closed — under `ALLOW` the group gate that was inert for the
-  // whole of `@aws_auth`'s life produced no symptom at all, because "no
-  // effective directive" and "open to everyone" were the same thing.
+  // `ALLOW` is forced, not chosen. `DENY` would make a missing directive fail
+  // closed, which is what we want — but AWS refuses the combination outright:
   //
-  // Safe only because every field and type now carries an explicit directive
-  // (`stampUndirectivedFields` + `stampAllTypesCognito` at the assembly choke
-  // point). Verify with `scripts/check-appsync-directive-coverage.mjs` against a
-  // DEPLOYED api — it must report zero before this value is trusted.
+  //   BadRequestException: Additional authentication providers cannot be
+  //   specified when setting DENY for top level user pool authentication type.
+  //
+  // Every API here configures AWS_IAM as an additional provider (the
+  // server-to-server lambdas need it), so DENY is unavailable for as long as
+  // that is true. Tried on a deploy 2026-08-14; all four APIs rejected it.
+  //
+  // The protection therefore rests entirely on every field and type carrying an
+  // explicit directive — `stampUndirectivedFields` + `stampAllTypesCognito` at
+  // the assembly choke point — with no backstop underneath. That makes
+  // `scripts/check-appsync-directive-coverage.mjs` load-bearing rather than
+  // advisory: run it against a DEPLOYED api after any change to the decoration.
   let userPoolConfigOut = switch userPoolConfig {
   | Some(config) => config
   | None =>
@@ -552,7 +567,7 @@ let _makeApiResourceWith = (
         {
           userPoolId: c.userPoolId,
           awsRegion: c.region,
-          defaultAction: AppSync.GraphQLApi.DENY,
+          defaultAction: AppSync.GraphQLApi.ALLOW,
         }: AppSync.GraphQLApi.userPoolConfig
       )
     )

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -265,7 +265,7 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
   let fragment$1 = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(fragment);
-  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)));
+  return AppSync_SdlDecorate$ReventlessAws.assertGateable(AppSync_SdlDecorate$ReventlessAws.stampUndirectivedRootFields(AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)))));
 }
 
 function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
@@ -288,7 +288,7 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   };
   let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
       userPoolId: c.userPoolId,
-      defaultAction: "DENY",
+      defaultAction: "ALLOW",
       awsRegion: c.region
     }));
   let apiArgs_schema = Stdlib_Option.map(schema, prim => prim);

package/src/components/Api/AppSync_MergedApi.res

@@ -100,7 +100,7 @@ let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
     ): AppSync.GraphQLApi.userPoolConfig => {
       userPoolId: c.userPoolId,
       awsRegion: c.region,
-      defaultAction: AppSync.GraphQLApi.DENY,
+      defaultAction: AppSync.GraphQLApi.ALLOW,
     })
 
   let mergedApi = AppSync.GraphQLApi.make(

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -55,7 +55,7 @@ function make(name, opts) {
   let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
   let userPoolConfigOut = authConfigOut.apply(c => ({
     userPoolId: c.userPoolId,
-    defaultAction: "DENY",
+    defaultAction: "ALLOW",
     awsRegion: c.region
   }));
   let mergedApi = new (Aws.appsync.GraphQLApi)(name, {

package/src/components/Api/AppSync_SdlDecorate.res

@@ -93,10 +93,10 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
 //
 // Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
 // field is already reachable by any authenticated caller, so stamping it changes
-// nothing. It exists so the default can be flipped to DENY, where "no directive"
-// stops meaning "open" and starts meaning "refused" — at which point anything
-// left unstamped breaks. Stamping first and flipping second is what keeps that
-// flip from being a guess.
+// nothing. It exists so that "carries no directive" becomes a state we can
+// detect and refuse at deploy time (`assertGateable`), rather than one that
+// silently means "open to everyone" — which is exactly how the `@aws_auth`
+// outage stayed invisible for as long as it did.
 let cognitoOpenDirective = "@aws_cognito_user_pools"
 
 // Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
@@ -171,9 +171,12 @@ let stampSharedIamTypes = (sdl: string): string =>
 // several surfaces never reach it at all: the domain base document
 // (`Platform_ping`), event-history queries, event-log `…_eventAppended`
 // subscriptions, the upload presign/release mutations, `Platform_SetActiveRole`,
-// and `geocode`. Those deployed with no directive — invisible under
-// `defaultAction: ALLOW`, refused under DENY. Sweeping here rather than at each
-// emission site means a future injected field cannot silently miss the net.
+// and `geocode`. Those deployed with no directive at all — reachable by any
+// authenticated Cognito caller, and invisible, since `defaultAction: ALLOW` makes
+// "no directive" and "open" the same thing. Sweeping here rather than at each
+// emission site means a future injected field cannot silently miss the net;
+// `assertGateable` below turns a miss into a failed deploy rather than an open
+// field.
 //
 // Idempotent, and deliberately does not second-guess gating: it only fills in
 // "open to any authenticated Cognito caller", which is what an undirectived
@@ -198,11 +201,10 @@ let stampUndirectivedFields = (
 // stampSharedIamTypes so the shared traversal types keep their `@aws_iam` arm
 // (this pass skips anything already carrying an `@aws_` directive).
 //
-// Types, not just fields: on a multi-auth API with `defaultAction: DENY`,
-// AppSync refuses an undirectived TYPE even when the caller passed the field's
-// own gate — response shaping walks `…Connection` → `…Edge` → node → nested
-// state types and dies one level in. Entry gating stays on the fields; a type
-// stamp only restores the accessibility an undirectived type has today.
+// Types, not just fields: response shaping walks `…Connection` → `…Edge` → node
+// → nested state types, so a type that cannot be traversed fails a request that
+// passed the field's own gate. Entry gating stays on the fields; a type stamp
+// only restores the accessibility an undirectived type has today.
 //
 // Only `type` declarations take auth directives — `input`, `enum`, `union` and
 // `interface` do not, and stamping them is a schema error.
@@ -225,6 +227,202 @@ let stampAllTypesCognito = (sdl: string): string =>
   )
   ->Array.join("\n")
 
+// ── Deploy-time gate invariant ──────────────────────────────────────────────
+//
+// Refuse to push a schema that cannot be gated. This is the fail-closed
+// property `userPoolConfig.defaultAction: DENY` would have provided at REQUEST
+// time — AWS rejects DENY alongside an additional auth provider
+// ("Additional authentication providers cannot be specified when setting DENY
+// for top level user pool authentication type", reproduced on create and
+// update alike), and every API here configures AWS_IAM unconditionally. So the
+// check moves one layer earlier, into our own deploy, where nothing can veto it.
+//
+// Two conditions, and the second is the one that matters:
+//
+//   1. A root field or object type carrying NO directive AppSync honours here
+//      is reachable by any authenticated Cognito caller under `ALLOW`.
+//   2. ANY `@aws_auth` at all. It is the single-mode form, silently ignored on
+//      a multi-auth API — so its presence means something believes it is gated
+//      and is not.
+//
+// Condition 2 is why this is not merely "does it have a directive?". The
+// original outage had `@aws_auth(cognito_groups: ["Admin"])` present on all 18
+// admin fields for its entire life; a presence check would have passed it every
+// single time. Only a check that knows WHICH directive the service honours
+// would have failed that deploy.
+let enforcedDirectives = ["@aws_cognito_user_pools", "@aws_iam"]
+
+let hasEnforcedDirective = (s: string): bool =>
+  enforcedDirectives->Array.some(d => s->String.includes(d))
+
+let rootOperationTypes = ["Query", "Mutation", "Subscription"]
+
+let typeDeclNameOf = (line: string): option<string> =>
+  if line->String.startsWith("type ") {
+    let rest = line->String.slice(~start=5, ~end=line->String.length)
+    switch rest->String.search(%re("/[\s{]/")) {
+    | -1 => Some(rest)
+    | i => Some(rest->String.slice(~start=0, ~end=i))
+    }
+  } else {
+    None
+  }
+
+// A root-operation field line: exactly two spaces of indent then a name. Deeper
+// indents are directive continuations of the field above.
+let fieldNameOf = (line: string): option<string> =>
+  switch line->String.match(%re("/^ {2}(\w+)/")) {
+  | Some(groups) => groups->Array.get(1)->Option.flatMap(x => x)
+  | None => None
+  }
+
+// Field sweep on the ASSEMBLED SDL, for fields the fragment sweep cannot see
+// because the stitcher injects them during assembly — `_noop`, the placeholder
+// mutation added to keep a mutation-less schema valid, is the standing example
+// and was live on three deployed APIs.
+//
+// Groups continuation lines into field entries the way `assertGateable` does, so
+// a directive already sitting on the following line counts as present.
+let stampUndirectivedRootFields = (sdl: string): string => {
+  let out = []
+  let currentRoot = ref(None)
+  let buffer = ref([])
+
+  let flush = () => {
+    let entry = buffer.contents
+    if entry->Array.length > 0 {
+      entry->Array.forEach(l => out->Array.push(l))
+      if !hasEnforcedDirective(entry->Array.join("\n")) {
+        out->Array.push(`    ${cognitoOpenDirective}`)
+      }
+      buffer.contents = []
+    }
+  }
+
+  sdl
+  ->String.split("\n")
+  ->Array.forEach(line =>
+    switch typeDeclNameOf(line) {
+    | Some(name) =>
+      flush()
+      currentRoot.contents = rootOperationTypes->Array.includes(name) ? Some(name) : None
+      out->Array.push(line)
+    | None =>
+      if line->String.startsWith("}") {
+        flush()
+        currentRoot.contents = None
+        out->Array.push(line)
+      } else if currentRoot.contents->Option.isSome {
+        switch fieldNameOf(line) {
+        | Some(_) =>
+          flush()
+          buffer.contents = [line]
+        | None =>
+          if buffer.contents->Array.length > 0 {
+            buffer.contents = buffer.contents->Array.concat([line])
+          } else {
+            out->Array.push(line)
+          }
+        }
+      } else {
+        out->Array.push(line)
+      }
+    }
+  )
+  flush()
+  out->Array.join("\n")
+}
+
+let assertGateable = (sdl: string): string => {
+  let bareFields = []
+  let bareTypes = []
+  let inertDirectives = []
+
+  let currentRoot = ref(None)
+  // (fieldName, accumulated text incl. continuation lines)
+  let pending = ref(None)
+
+  let flush = () =>
+    switch pending.contents {
+    | Some((name, text)) =>
+      if !hasEnforcedDirective(text) {
+        bareFields->Array.push(name)
+      }
+      pending.contents = None
+    | None => ()
+    }
+
+  sdl
+  ->String.split("\n")
+  ->Array.forEach(line => {
+    if line->String.includes("@aws_auth") {
+      inertDirectives->Array.push(line->String.trim)
+    }
+    switch typeDeclNameOf(line) {
+    | Some(name) =>
+      flush()
+      if !hasEnforcedDirective(line) {
+        bareTypes->Array.push(name)
+      }
+      currentRoot.contents = rootOperationTypes->Array.includes(name) ? Some(name) : None
+    | None =>
+      if line->String.startsWith("}") {
+        flush()
+        currentRoot.contents = None
+      } else if currentRoot.contents->Option.isSome {
+        switch fieldNameOf(line) {
+        | Some(fieldName) =>
+          flush()
+          pending.contents = Some((fieldName, line))
+        | None =>
+          switch pending.contents {
+          | Some((n, text)) => pending.contents = Some((n, text ++ "\n" ++ line))
+          | None => ()
+          }
+        }
+      }
+    }
+  })
+  flush()
+
+  let problems = []
+  if inertDirectives->Array.length > 0 {
+    problems->Array.push(
+      `  ${inertDirectives->Array.length->Int.toString} field(s) carry @aws_auth, which AppSync IGNORES on a\n` ++
+      `  multi-auth API (this adapter always adds AWS_IAM as an additional provider).\n` ++
+      `  They are gated by nothing. Emit @aws_cognito_user_pools(cognito_groups: [...])\n` ++
+      `  instead — see AppSync_SdlDecorate.formatCognitoGroupsDirective.\n` ++
+      `    ${inertDirectives->Array.slice(~start=0, ~end=8)->Array.join("\n    ")}`,
+    )
+  }
+  if bareFields->Array.length > 0 {
+    problems->Array.push(
+      `  ${bareFields->Array.length->Int.toString} root field(s) carry no enforced auth directive, so they are\n` ++
+      `  reachable by ANY authenticated Cognito caller:\n` ++
+      `    ${bareFields->Array.join(", ")}`,
+    )
+  }
+  if bareTypes->Array.length > 0 {
+    problems->Array.push(
+      `  ${bareTypes->Array.length->Int.toString} object type(s) carry no enforced auth directive:\n` ++
+      `    ${bareTypes->Array.join(", ")}`,
+    )
+  }
+
+  if problems->Array.length > 0 {
+    JsError.throwWithMessage(
+      `Refusing to push an AppSync schema that cannot be gated.\n\n` ++
+      problems->Array.join("\n\n") ++
+      `\n\nEvery field and type must carry @aws_cognito_user_pools (optionally with\n` ++
+      `cognito_groups) and/or @aws_iam. The sweep in stampUndirectivedFields /\n` ++
+      `stampAllTypesCognito should have covered this — a failure here means a schema\n` ++
+      `reached assembly by a path that bypasses them.\n` ++
+      `See docs/plans/appsync-group-authorization-unenforced.md.`,
+    )
+  }
+  sdl
+}
+
 // ── Merged-API canonical stamping ─────────────────────────────────────────────
 // Under AppSync Merged APIs the admin source API owns the shared traversal
 // types; `@canonical` makes its definition win over every plugin source's copy

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -1,7 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 
 function injectAwsSubscribe(sdl, sources) {
@@ -120,6 +122,170 @@ function stampAllTypesCognito(sdl) {
   }).join("\n");
 }
 
+let enforcedDirectives = [
+  "@aws_cognito_user_pools",
+  "@aws_iam"
+];
+
+function hasEnforcedDirective(s) {
+  return enforcedDirectives.some(d => s.includes(d));
+}
+
+let rootOperationTypes = [
+  "Query",
+  "Mutation",
+  "Subscription"
+];
+
+function typeDeclNameOf(line) {
+  if (!line.startsWith("type ")) {
+    return;
+  }
+  let rest = line.slice(5, line.length);
+  let i = rest.search(/[\s{]/);
+  if (i !== -1) {
+    return rest.slice(0, i);
+  } else {
+    return rest;
+  }
+}
+
+function fieldNameOf(line) {
+  let groups = line.match(/^ {2}(\w+)/);
+  if (!(groups == null)) {
+    return Stdlib_Option.flatMap(groups[1], x => x);
+  }
+}
+
+function stampUndirectivedRootFields(sdl) {
+  let out = [];
+  let currentRoot = {
+    contents: undefined
+  };
+  let buffer = {
+    contents: []
+  };
+  let flush = () => {
+    let entry = buffer.contents;
+    if (entry.length !== 0) {
+      entry.forEach(l => {
+        out.push(l);
+      });
+      if (!hasEnforcedDirective(entry.join("\n"))) {
+        out.push(`    ` + cognitoOpenDirective);
+      }
+      buffer.contents = [];
+      return;
+    }
+  };
+  sdl.split("\n").forEach(line => {
+    let name = typeDeclNameOf(line);
+    if (name !== undefined) {
+      flush();
+      currentRoot.contents = rootOperationTypes.includes(name) ? name : undefined;
+      out.push(line);
+      return;
+    }
+    if (line.startsWith("}")) {
+      flush();
+      currentRoot.contents = undefined;
+      out.push(line);
+      return;
+    }
+    if (Stdlib_Option.isSome(currentRoot.contents)) {
+      let match = fieldNameOf(line);
+      if (match !== undefined) {
+        flush();
+        buffer.contents = [line];
+      } else if (buffer.contents.length !== 0) {
+        buffer.contents = buffer.contents.concat([line]);
+      } else {
+        out.push(line);
+      }
+      return;
+    }
+    out.push(line);
+  });
+  flush();
+  return out.join("\n");
+}
+
+function assertGateable(sdl) {
+  let bareFields = [];
+  let bareTypes = [];
+  let inertDirectives = [];
+  let currentRoot = {
+    contents: undefined
+  };
+  let pending = {
+    contents: undefined
+  };
+  let flush = () => {
+    let match = pending.contents;
+    if (match !== undefined) {
+      if (!hasEnforcedDirective(match[1])) {
+        bareFields.push(match[0]);
+      }
+      pending.contents = undefined;
+      return;
+    }
+  };
+  sdl.split("\n").forEach(line => {
+    if (line.includes("@aws_auth")) {
+      inertDirectives.push(line.trim());
+    }
+    let name = typeDeclNameOf(line);
+    if (name !== undefined) {
+      flush();
+      if (!hasEnforcedDirective(line)) {
+        bareTypes.push(name);
+      }
+      currentRoot.contents = rootOperationTypes.includes(name) ? name : undefined;
+      return;
+    }
+    if (line.startsWith("}")) {
+      flush();
+      currentRoot.contents = undefined;
+      return;
+    }
+    if (!Stdlib_Option.isSome(currentRoot.contents)) {
+      return;
+    }
+    let fieldName = fieldNameOf(line);
+    if (fieldName !== undefined) {
+      flush();
+      pending.contents = [
+        fieldName,
+        line
+      ];
+      return;
+    }
+    let match = pending.contents;
+    if (match !== undefined) {
+      pending.contents = [
+        match[0],
+        match[1] + "\n" + line
+      ];
+      return;
+    }
+  });
+  flush();
+  let problems = [];
+  if (inertDirectives.length !== 0) {
+    problems.push(`  ` + inertDirectives.length.toString() + ` field(s) carry @aws_auth, which AppSync IGNORES on a\n  multi-auth API (this adapter always adds AWS_IAM as an additional provider).\n  They are gated by nothing. Emit @aws_cognito_user_pools(cognito_groups: [...])\n  instead — see AppSync_SdlDecorate.formatCognitoGroupsDirective.\n    ` + inertDirectives.slice(0, 8).join("\n    "));
+  }
+  if (bareFields.length !== 0) {
+    problems.push(`  ` + bareFields.length.toString() + ` root field(s) carry no enforced auth directive, so they are\n  reachable by ANY authenticated Cognito caller:\n    ` + bareFields.join(", "));
+  }
+  if (bareTypes.length !== 0) {
+    problems.push(`  ` + bareTypes.length.toString() + ` object type(s) carry no enforced auth directive:\n    ` + bareTypes.join(", "));
+  }
+  if (problems.length !== 0) {
+    Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot be gated.\n\n` + problems.join("\n\n") + `\n\nEvery field and type must carry @aws_cognito_user_pools (optionally with\ncognito_groups) and/or @aws_iam. The sweep in stampUndirectivedFields /\nstampAllTypesCognito should have covered this — a failure here means a schema\nreached assembly by a path that bypasses them.\nSee docs/plans/appsync-group-authorization-unenforced.md.`);
+  }
+  return sdl;
+}
+
 let canonicalTypeNames = [
   "PageInfo",
   "CommandAccepted",
@@ -167,6 +333,13 @@ export {
   stampSharedIamTypes,
   stampUndirectivedFields,
   stampAllTypesCognito,
+  enforcedDirectives,
+  hasEnforcedDirective,
+  rootOperationTypes,
+  typeDeclNameOf,
+  fieldNameOf,
+  stampUndirectivedRootFields,
+  assertGateable,
   canonicalTypeNames,
   stampCanonicalTypes,
 }

package/tests/AppSync_SdlDecorateTest.res

@@ -249,3 +249,58 @@ describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
     )
   })
 })
+
+// ── Deploy-time gate invariant ──────────────────────────────────────────────
+//
+// `defaultAction: DENY` — the request-time fail-closed switch — is unavailable:
+// AWS refuses it alongside an additional auth provider, and every API here has
+// AWS_IAM. So this check moves fail-closed into the deploy, where nothing can
+// veto it: a schema that cannot be gated is never pushed.
+
+describe("AppSync_SdlDecorate.assertGateable", () => {
+  let refuses = (sdl: string): bool =>
+    switch AppSync_SdlDecorate.assertGateable(sdl) {
+    | _ => false
+    | exception _ => true
+    }
+
+  // The original outage, exactly. A "does it have a directive?" check passes
+  // this — @aws_auth was present on all 18 admin fields the whole time it was
+  // inert. Only knowing WHICH directive the service honours catches it.
+  testSync("refuses @aws_auth, the directive AppSync ignores here", () => {
+    let sdl = `type Query @aws_cognito_user_pools {\n  Admin_Thing: String @aws_auth(cognito_groups: ["Admin"])\n}`
+    expect(refuses(sdl))->toBe(true)
+  })
+
+  testSync("refuses a root field carrying no enforced directive", () => {
+    expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n}"))->toBe(true)
+  })
+
+  testSync("refuses an object type carrying no enforced directive", () => {
+    let sdl =
+      "type Query @aws_cognito_user_pools {\n  a: String @aws_cognito_user_pools\n}\ntype Product {\n  id: ID!\n}"
+    expect(refuses(sdl))->toBe(true)
+  })
+
+  // Our real emission shape puts a mutation's directive on the FOLLOWING line.
+  testSync("accepts a directive on the line after the field", () => {
+    let sdl = "type Query @aws_cognito_user_pools {\n  Platform_ping: String\n    @aws_cognito_user_pools\n}"
+    expect(refuses(sdl))->toBe(false)
+  })
+
+  testSync("accepts a group-gated field and an @aws_iam-only field", () => {
+    let sdl =
+      `type Mutation @aws_cognito_user_pools {\n  Gated: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])\n  Sys: String\n    @aws_cognito_user_pools @aws_iam\n}`
+    expect(refuses(sdl))->toBe(false)
+  })
+
+  // The whole pipeline must satisfy its own invariant on the real admin base.
+  testSync("the assembled admin base passes", () => {
+    let decorated = AppSync_Adapter.injectAwsAuthAll(
+      ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true),
+      ~group="Admin",
+    )
+    let sdl = AppSync_Adapter.stitchStandaloneWithAwsDirectives(~fragment=decorated)
+    expect(sdl->String.includes("@aws_cognito_user_pools"))->toBe(true)
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 
 let sources = [
@@ -192,6 +193,37 @@ globalThis.describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.assertGateable", () => {
+  let refuses = sdl => {
+    try {
+      AppSync_SdlDecorate$ReventlessAws.assertGateable(sdl);
+      return false;
+    } catch (exn) {
+      return true;
+    }
+  };
+  globalThis.test("refuses @aws_auth, the directive AppSync ignores here", () => {
+    globalThis.expect(refuses(`type Query @aws_cognito_user_pools {\n  Admin_Thing: String @aws_auth(cognito_groups: ["Admin"])\n}`)).toBe(true);
+  });
+  globalThis.test("refuses a root field carrying no enforced directive", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n}")).toBe(true);
+  });
+  globalThis.test("refuses an object type carrying no enforced directive", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  a: String @aws_cognito_user_pools\n}\ntype Product {\n  id: ID!\n}")).toBe(true);
+  });
+  globalThis.test("accepts a directive on the line after the field", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n    @aws_cognito_user_pools\n}")).toBe(false);
+  });
+  globalThis.test("accepts a group-gated field and an @aws_iam-only field", () => {
+    globalThis.expect(refuses(`type Mutation @aws_cognito_user_pools {\n  Gated: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])\n  Sys: String\n    @aws_cognito_user_pools @aws_iam\n}`)).toBe(false);
+  });
+  globalThis.test("the assembled admin base passes", () => {
+    let decorated = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(true), "Admin", undefined);
+    let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(decorated);
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools")).toBe(true);
+  });
+});
+
 export {
   sources,
   stitchedSdl,