@reventlessdev/reventless-aws 3.0.0-alpha.392 → 3.0.0-alpha.394

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.394 (2026-10-22)
+
+### Features
+
+* **local:** the local platform provisions an identity provider over the accounts file ([1a46867](https://github.com/ReventlessDev/reventless-core/commit/1a46867ac391b3b4a2d6973606d782547190dcb8))
+
+
+# 3.0.0-alpha.393 (2026-10-21)
+
+### Bug Fixes
+
+* **aws:** a failed AppSync schema push names the API and AWS's message ([01f662a](https://github.com/ReventlessDev/reventless-core/commit/01f662a7c664807808c15933f6234b6b6588addd))
+
+
 # 3.0.0-alpha.392 (2026-10-21)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.392",
+  "version": "3.0.0-alpha.394",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -23,18 +23,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.33",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.31",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.303",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.200",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.8",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.202",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.305",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.169",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.167",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.172"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.174"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -1287,6 +1287,10 @@ module MakeWithConfig = (
     // door: unlike geocoding, a browser has no business sending mail from the
     // deployment's identity. Unset ⇒ no export, no grant.
     messagingSender?: ReventlessInfra.Platform.messagingSender,
+    // Ignored here: an in-process provider cannot reach a Lambda, and no
+    // pool-backed handle exists yet. The deploy gate refuses a plugin that
+    // declares the need, naming this.
+    identityProvider?: Reventless.IdentityProvider.t,
     // Optional object store for direct-to-S3 uploads, as returned by
     // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
     // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
@@ -2375,7 +2379,7 @@ module MakeWithConfig = (
         ->Pulumi.Output.apply((((domainEp, platformEp, poolId, clientId), eventsEpOpt)) => {
           // `authMode` stays `"cognito"`: it is a value naming which provider
           // authenticates this deployment, and that is true. The identity *keys*
-          // travel under both spellings — see [Util_ShellConfig.identityFields].
+          // are provider-neutral — see [Util_ShellConfig.identityFields].
           let computed =
             [
               ("apiEndpoint", JSON.Encode.string(domainEp)),

package/src/components/Api/AppSync_Adapter.res

@@ -45,6 +45,15 @@ let startSchemaCreation = (client: appSyncClient, input: startSchemaCreationInpu
 // jittered exponential backoff so a losing call can wait for the in-progress
 // schema to finish and try again. Permanent errors (e.g. invalid SDL) are not
 // retried — see AppSync_Error.classify.
+// What the deploy reports when the push gives up. Carries AWS's own message: the classified
+// error is a variant, which a rejected promise prints as `[object Object]`.
+let schemaPushFailure = (~apiId: string, err: AppSync_Error.t): string =>
+  switch err {
+  | Transient(msg) =>
+    `StartSchemaCreation for AppSync API ${apiId} still failed after its retries: ${msg}`
+  | Permanent(msg) => `StartSchemaCreation for AppSync API ${apiId} failed: ${msg}`
+  }
+
 let startSchemaCreationRetrying = (client: appSyncClient, input: startSchemaCreationInput): promise<
   unit,
 > => {
@@ -52,6 +61,7 @@ let startSchemaCreationRetrying = (client: appSyncClient, input: startSchemaCrea
     startSchemaCreation(client, input)->Promise.then(_ => Promise.resolve())
   )
   ->Effect.retry(AppSync_Error.retrySchedule)
+  ->Effect.catchAll(err => Effect.fail(schemaPushFailure(~apiId=input.apiId, err)))
   ->Effect.runPromise
 }
 

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -33,8 +33,16 @@ function startSchemaCreation(client, input) {
   return client.send(new ClientAppsync.StartSchemaCreationCommand(input));
 }
 
+function schemaPushFailure(apiId, err) {
+  if (err.TAG === "Transient") {
+    return `StartSchemaCreation for AppSync API ` + apiId + ` still failed after its retries: ` + err._0;
+  } else {
+    return `StartSchemaCreation for AppSync API ` + apiId + ` failed: ` + err._0;
+  }
+}
+
 function startSchemaCreationRetrying(client, input) {
-  return Effect$1.runPromise(Effect$1.retry(Effect.tryPromise(AppSync_Error$ReventlessAws.classify, () => client.send(new ClientAppsync.StartSchemaCreationCommand(input)).then(param => Promise.resolve())), AppSync_Error$ReventlessAws.retrySchedule));
+  return Effect$1.runPromise(Effect$1.catchAll(Effect$1.retry(Effect.tryPromise(AppSync_Error$ReventlessAws.classify, () => client.send(new ClientAppsync.StartSchemaCreationCommand(input)).then(param => Promise.resolve())), AppSync_Error$ReventlessAws.retrySchedule), err => Effect$1.fail(schemaPushFailure(input.apiId, err))));
 }
 
 async function waitForSchemaActive(client, apiId, maxAttemptsOpt, attemptOpt) {
@@ -326,6 +334,7 @@ export {
   log,
   sha256Hex,
   startSchemaCreation,
+  schemaPushFailure,
   startSchemaCreationRetrying,
   waitForSchemaActive,
   _client,

package/src/util/Util_ShellConfig.res

@@ -32,31 +32,20 @@ let modeOptions = (mode: Platform.viewMode): array<(string, JSON.t)> =>
   }
 
 /**
-The identity fields a shell reads, under **both** spellings.
+The identity fields a shell reads. The concept is not AWS-specific, so a second
+cloud's adapter meets the same names.
 
-🚨 **Both, and not as a sequenced rename.** `identityProvider*` is what these
-become — the concept is not AWS-specific, so a second cloud's adapter should meet
-the same names. `cognito*` is what every shipped shell reads today.
+The `cognitoUserPoolId` / `cognitoClientId` pair travelled beside these through
+the rename, because a shell reads `config.json` at runtime and a bundle that
+cannot find its client id gets `None` and a login that silently fails. It went
+once every pinned shell read these names (host shell 3.0.0-alpha.122 and later).
 
-A shell reads `config.json` at runtime and CloudFront serves the previous bundle
-until someone invalidates it, so switching the keys in one deploy leaves a window
-where the served bundle and the served config disagree. `cognitoClientId` is read
-into an `option`: a bundle that cannot find its key does not error, it gets
-`None`, and login, silent refresh and token refresh all quietly fall through —
-the window is a total auth outage that reports nothing.
-
-Writing both removes the ordering dependency rather than managing it: any bundle,
-old or new or stale in a CDN, finds one it understands. The `cognito*` pair goes
-once the shell that prefers the other is the pinned one.
-
-Here rather than inline at the call site so the pairing is one fact in one place,
-and so the property can be asserted without a deploy.
+Here rather than inline at the call site so the key set is one fact in one place,
+and so it can be asserted without a deploy.
 */
 let identityFields = (~providerId: string, ~clientId: string): array<(string, JSON.t)> => [
   ("identityProviderId", JSON.Encode.string(providerId)),
   ("identityProviderClientId", JSON.Encode.string(clientId)),
-  ("cognitoUserPoolId", JSON.Encode.string(providerId)),
-  ("cognitoClientId", JSON.Encode.string(clientId)),
 ]
 
 /**

package/src/util/Util_ShellConfig.res.mjs

@@ -43,14 +43,6 @@ function identityFields(providerId, clientId) {
     [
       "identityProviderClientId",
       clientId
-    ],
-    [
-      "cognitoUserPoolId",
-      providerId
-    ],
-    [
-      "cognitoClientId",
-      clientId
     ]
   ];
 }

package/tests/AppSync_AdapterTest.res

@@ -1080,3 +1080,36 @@ describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
     expect(decodeFragment(aug).subscriptions->Array.length)->toBe(2)
   })
 })
+
+// ── A failed schema push says why ────────────────────────────────────────────
+
+describe("AppSync_Adapter.startSchemaCreationRetrying", () => {
+  // A client whose every call rejects the way the SDK does, with an Error.
+  let rejectingClient: string => AppSync_Adapter.appSyncClient = %raw(`
+    message => ({send: () => Promise.reject(new Error(message))})
+  `)
+
+  test("fails with the API and AWS's message, not [object Object]", async () => {
+    let message = ref("")
+    try {
+      await AppSync_Adapter.startSchemaCreationRetrying(
+        rejectingClient("BadRequestException: Failed to parse schema document"),
+        {apiId: "api-1", definition: "type Query"},
+      )
+    } catch {
+    | exn => message := exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("")
+    }
+    expect(message.contents)->toContain("api-1")
+    expect(message.contents)->toContain("Failed to parse schema document")
+    expect(message.contents)->not_->toContain("[object Object]")
+  })
+
+  testSync("says when the retries ran out", () =>
+    expect(
+      AppSync_Adapter.schemaPushFailure(
+        ~apiId="api-1",
+        Transient("ConcurrentModificationException: Schema is currently being altered"),
+      ),
+    )->toContain("still failed after its retries")
+  )
+})

package/tests/AppSync_AdapterTest.res.mjs

@@ -953,6 +953,31 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
   });
 });
 
+globalThis.describe("AppSync_Adapter.startSchemaCreationRetrying", () => {
+  let rejectingClient = (message => ({send: () => Promise.reject(new Error(message))}));
+  globalThis.test("fails with the API and AWS's message, not [object Object]", async () => {
+    let message = "";
+    try {
+      await AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(rejectingClient("BadRequestException: Failed to parse schema document"), {
+        apiId: "api-1",
+        definition: "type Query"
+      });
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      message = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "");
+    }
+    globalThis.expect(message).toContain("api-1");
+    globalThis.expect(message).toContain("Failed to parse schema document");
+    globalThis.expect(message).not.toContain("[object Object]");
+  });
+  globalThis.test("says when the retries ran out", () => {
+    globalThis.expect(AppSync_Adapter$ReventlessAws.schemaPushFailure("api-1", {
+      TAG: "Transient",
+      _0: "ConcurrentModificationException: Schema is currently being altered"
+    })).toContain("still failed after its retries");
+  });
+});
+
 export {
   decodeFragment,
   TwoRuleFeed,

package/tests/Util_ShellConfigTest.res

@@ -298,50 +298,25 @@ describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   })
 })
 
-// 🚨 The identity keys travel under both spellings through the rename. A shell
-// reads config.json at runtime and CloudFront serves the previous bundle until
-// someone invalidates it, so switching them in one deploy leaves a window where
-// the served bundle and the served config disagree — and `cognitoClientId` is
-// read into an option, so a bundle that cannot find its key does not error, it
-// gets `None` and login silently stops working.
-//
-// These assert the property that removes that window, not the spelling.
+// A shell reads config.json at runtime, and `identityProviderClientId` is read
+// into an option: a bundle that cannot find it gets `None` and a login that
+// silently stops working. These assert the key set, so a rename cannot slip out
+// in a refactor without a test naming it.
 describe("Util_ShellConfig.identityFields", () => {
   let fields = Util_ShellConfig.identityFields(~providerId="eu-west-1_x", ~clientId="7cl13nt")
   let get = key => fields->Array.find(((k, _)) => k == key)->Option.map(((_, v)) => v)
 
-  testSync("the new spelling is present", () =>
+  testSync("the identity keys carry the pool and the client", () =>
     expect((get("identityProviderId"), get("identityProviderClientId")))->toEqual((
       Some(JSON.Encode.string("eu-west-1_x")),
       Some(JSON.Encode.string("7cl13nt")),
     ))
   )
 
-  // Not "still" — deliberately. Every shipped shell reads these, and dropping
-  // them is a later release gated on the pinned bundle, not on this one.
-  testSync("the deprecated spelling is present too", () =>
-    expect((get("cognitoUserPoolId"), get("cognitoClientId")))->toEqual((
-      Some(JSON.Encode.string("eu-west-1_x")),
-      Some(JSON.Encode.string("7cl13nt")),
-    ))
-  )
-
-  // The whole point: a bundle reading either name gets the same answer. Two keys
-  // carrying different values would be worse than one key, not better.
-  testSync("both spellings carry identical values", () =>
-    expect((
-      get("identityProviderId") == get("cognitoUserPoolId"),
-      get("identityProviderClientId") == get("cognitoClientId"),
-    ))->toEqual((true, true))
-  )
-
-  // The client id is the load-bearing one — it is what the shell's auth provider
-  // branches on. The pool id is currently discarded by the shell, which is
-  // exactly why a `cognito*` sweep is dangerous: the safe one gives no warning.
+  // The transitional `cognito*` pair is gone: every pinned shell reads the
+  // names above, and a reader that still wants the old ones is the defect.
   testSync("nothing else sneaks into the identity field set", () =>
     expect(fields->Array.map(((k, _)) => k)->Array.toSorted(String.compare))->toEqual([
-      "cognitoClientId",
-      "cognitoUserPoolId",
       "identityProviderClientId",
       "identityProviderId",
     ])