@reventlessdev/reventless-aws 3.0.0-alpha.299 → 3.0.0-alpha.300

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.300 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
 # 3.0.0-alpha.299 (2026-08-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.299",
+  "version": "3.0.0-alpha.300",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,17 +12,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.141",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.98",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.234",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
   },
   "devDependencies": {

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -68,7 +68,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   ~subIdField,
   ~idResolverConfigs: array<idResolverConfig>,
   ~idsResolverConfigs: array<idsResolverConfig>,
-  // AWS path enforces authorization via `@aws_auth(cognito_groups: …)` on the
+  // AWS path enforces authorization via `@aws_cognito_user_pools(cognito_groups: …)` on the
   // SDL fields (see Stage E in docs/plans/host-ui-login-core.md). Accepted but
   // ignored here so the in-memory and AWS resolver maker signatures stay aligned.
   ~authorization as _: Reventless.Authorization.permission,

package/src/components/Api/AppSync_Adapter.res

@@ -185,10 +185,13 @@ let rec waitForMergeSuccess = async (
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
 // `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
-// `AllowAuthenticated` / `AllowAnonymous` emit no directive (with Cognito as
-// primary auth, any reaching request is already authenticated). `AllowGroups([])`
-// and `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
-// belong to — effectively blocking the field at the API layer.
+// `AllowAuthenticated` / `AllowAnonymous` emit the group-less
+// `@aws_cognito_user_pools` — same reachability (with Cognito as primary auth
+// any reaching request is already authenticated), but stated rather than left
+// implicit, so `assertGateable` can tell "deliberately open" from "nobody
+// stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
+// group that no Cognito user can belong to — effectively blocking the field at
+// the API layer.
 //
 // NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
 // multi-auth API — which every API this adapter provisions is. See
@@ -422,14 +425,14 @@ let injectAwsAuth = (
   })
 }
 
-// Injects @aws_auth with the given group on ALL mutation, query, and subscription
+// Injects the Cognito group directive on ALL mutation, query, and subscription
 // fields in a fragment. Used for the base fragment where all fields share the
 // same authorization group.
 //
 // `~iamFieldNames` opts the named mutation/query fields into deploy-time IAM
 // (dual-auth): those fields emit `@aws_cognito_user_pools(cognito_groups:
-// ["<group>"]) @aws_iam` instead of the single-mode `@aws_auth(...)`, keeping
-// the same Cognito group gating while also admitting the SigV4 system caller.
+// ["<group>"]) @aws_iam`, keeping the same Cognito group gating while also
+// admitting the SigV4 system caller.
 // Subscriptions are never IAM-marked (the deploy caller does not subscribe).
 // Canonical definition lives in the runtime-pure AppSync_SdlDecorate so the
 // bundled AdminEventCollector Lambda's reactive push decorates the admin base