@reventlessdev/reventless-aws 3.0.0-alpha.330 → 3.0.0-alpha.331

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.331 (2026-09-01)
+
+### Bug Fixes
+
+* **capabilities:** a plugin's geocoding need was declared nowhere and failed silently ([67917dd](https://github.com/ReventlessDev/reventless-core/commit/67917dd504b43fa78b7c6a51644c9eae656b7f6b))
+### Features
+
+* **capabilities:** a plugin can send a message without naming a provider ([b001a1e](https://github.com/ReventlessDev/reventless-core/commit/b001a1e9361a0f4d0affe228cb4c08c38a5a995e))
+* **spec:** a command declares its lifecycle edge as a value ([40eee9f](https://github.com/ReventlessDev/reventless-core/commit/40eee9f7723dc05e418be680528f01967d074da4))
+* **spec:** a graft leaves a trace the deployed plugin can read ([c08ff6c](https://github.com/ReventlessDev/reventless-core/commit/c08ff6c0f6177d58603e7ae1e5cec392d9bac16a))
+
+
 # 3.0.0-alpha.330 (2026-08-27)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.330",
+  "version": "3.0.0-alpha.331",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -17,16 +17,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.14",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.7",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.251",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.152",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.252",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.153",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.125",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.34",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.115",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.124"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.116"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -99,6 +99,10 @@ let getObjectStoreEndpoints = () => objectStoreEndpointsRef.contents
     the same sentinel, as `PluginRuntime_Builder.inboundSliceReg.auditTableName`. */
 let geocoderPlaceIndexRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** The verified sender address, for the same single-program case and with the
+    same `""` sentinel and the same reason. */
+let messagingEmailSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -1174,6 +1178,12 @@ module MakeWithConfig = (
     // on the domain API (`Geocoder_AwsLocation_Resolver`, split mode) — and exports
     // the index name for the unattended slice path. Unset ⇒ no resolver, no export.
     geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
+    // Optional messaging sender, as returned by `Capability_Messaging_Ses.make`.
+    // When set, the deploy exports the verified `From:` address for the
+    // unattended slice path and grants those Lambdas `ses:SendEmail`. No client
+    // door: unlike geocoding, a browser has no business sending mail from the
+    // deployment's identity. Unset ⇒ no export, no grant.
+    messagingSender?: ReventlessInfra.Platform.messagingSender,
     // Optional object store for direct-to-S3 uploads, as returned by
     // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
     // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
@@ -1726,7 +1736,8 @@ module MakeWithConfig = (
       ->Array.filterMap(c =>
         switch c {
         | ObjectStore({plugin, store}) => Some((plugin, store))
-        | Geocoding => None
+        | Geocoding
+        | Messaging => None
         }
       )
       ->Array.reduce([], (acc, (plugin, store)) =>
@@ -2141,6 +2152,47 @@ module MakeWithConfig = (
       Pulumi.Pulumi.export("geocoderPlaceIndex", geocoderPlaceIndexFlat)
       geocoderPlaceIndexRef := geocoderPlaceIndexFlat
 
+      // The generated capability list says a plugin of this deployment declared it
+      // needs geocoding. Provisioning it is a hand-written line in this root —
+      // `Capability_Geocoding_AwsLocation.make`, passed as `~geocoderPlaceIndex` —
+      // so the list and the handle can disagree, and the way they disagree is
+      // silent: the slice retries, exhausts, and writes a permanent verdict.
+      // Caught here rather than only in the plugin stack because this is the stack
+      // that can fix it, and it deploys first.
+      if capabilities->Array.includes(Geocoding) && cfg.geocoderPlaceIndex->Option.isNone {
+        JsError.throwWithMessage(
+          `A plugin of this deployment declares the Geocoding capability, but this platform ` ++
+          `provisions no place index.\n` ++
+          `  Add \`let placeIndex = ReventlessAws.Capability_Geocoding_AwsLocation.make(~name=…)\` ` ++
+          `and pass \`~geocoderPlaceIndex=placeIndex\` in \`~hostUiBundle\`.\n` ++
+          `  The declaration is generated from the plugins' capabilities.json — regenerate with ` ++
+          `\`pnpm run generate:platform\` if it is stale.`,
+        )
+      }
+
+      // The verified sender, exported for the same reason and read the same way.
+      let messagingEmailSenderFlat = switch cfg.messagingSender {
+      | Some({emailSender: ?Some(sender)}) => sender->Pulumi.Output.fromInput
+      | _ => Pulumi.Output.make("")
+      }
+      Pulumi.Pulumi.export("messagingEmailSender", messagingEmailSenderFlat)
+      messagingEmailSenderRef := messagingEmailSenderFlat
+
+      // Same gate as geocoding's, and the failure it prevents is worse: an
+      // unprovisioned mailer answers `Unavailable` on every send, so the messages
+      // queue and retry and are eventually abandoned — a notification nobody
+      // receives and no error names.
+      if capabilities->Array.includes(Messaging) && cfg.messagingSender->Option.isNone {
+        JsError.throwWithMessage(
+          `A plugin of this deployment declares the Messaging capability, but this platform ` ++
+          `provisions no sender.\n` ++
+          `  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` ` ++
+          `and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n` ++
+          `  The declaration is generated from the plugins' capabilities.json — regenerate with ` ++
+          `\`pnpm run generate:platform\` if it is stale.`,
+        )
+      }
+
       // Presign endpoints are no longer written to config.json: under route B the
       // client calls the platform API's `Upload_Presign` mutation (reachable from
       // `platformApiEndpoint`, already present) with the store it declares, so there
@@ -2449,6 +2501,21 @@ module MakeWithConfig = (
     PluginRuntime_Builder.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex)
     PluginRuntime_Builder.registerGeocoderPlaceIndex(geocoderPlaceIndex)
 
+    // The verified `From:` address, read across the same two halves and carrying
+    // the same `""`-means-unprovisioned convention. Registered twice for the same
+    // reason the place index is: the Lambda reads the address, and its role has to
+    // be allowed to send from the identity that address names.
+    let messagingEmailSender: Pulumi.Output.t<string> = switch platformStackRef {
+    | Some(stackRef) =>
+      (
+        stackRef->Pulumi.StackReference.getOutput("messagingEmailSender"):
+          Pulumi.Output.t<option<string>>
+      )->Pulumi.Output.apply(o => o->Option.getOr(""))
+    | None => messagingEmailSenderRef.contents
+    }
+    PluginRuntime_Builder.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender)
+    PluginRuntime_Builder.registerMessagingSender(messagingEmailSender)
+
     module P = unpack(plugin)
     let pluginComponent = P.make()
     ReventlessCore.Plugin_Helpers.clearOffload()
@@ -2580,9 +2647,69 @@ module MakeWithConfig = (
       // is: a dangling `apply` is not guaranteed to be evaluated, and a check
       // that might not run is not a check.
       let capabilityGate: Pulumi.Output.t<unit> =
-        (pluginOutputs.pluginStructure, stackRef->Pulumi.StackReference.getOutput("objectStores"))
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply((((structure, objectStores): (_, option<JSON.t>))) => {
+        (
+          pluginOutputs.pluginStructure,
+          stackRef->Pulumi.StackReference.getOutput("objectStores"),
+          geocoderPlaceIndex,
+          messagingEmailSender,
+        )
+        ->Pulumi.Output.all4
+        ->Pulumi.Output.apply((((structure, objectStores, placeIndex, emailSender): (
+          _,
+          option<JSON.t>,
+          string,
+          string,
+        ))) => {
+          // ── Declared capabilities ──────────────────────────────────────────
+          //
+          // A slice that names `Geocoding` in `capabilityNeeds` says its
+          // `translate` will reach `capabilities.geocode`. A platform that
+          // provisioned no place index hands it an empty endpoint, and the client
+          // reports `Unavailable` — retried three times, then `onExhausted` fires
+          // and every address the slice ever sees is recorded as permanently
+          // unresolvable. A silent data outcome with no error anywhere, which is
+          // why a *declared* need fails the deploy.
+          //
+          // Only a declared need. A plugin that says nothing still degrades
+          // exactly as before: the empty endpoint is a modelled outcome for a
+          // deployment that simply has no geocoder, and failing those would break
+          // deployments that work.
+          switch Reventless.CapabilityNeed.unmet(
+            ~declared=structure
+            ->Option.flatMap(s => s.requiredCapabilities)
+            ->Option.getOr([])
+            ->Array.map(d => (d.capability, d.component)),
+            // The values the slice Lambdas are actually handed, so this reads
+            // what decides the outcome rather than a second record of the same
+            // intent. `""` is what an unprovisioned platform exports.
+            ~provisioned=Array.concat(
+              placeIndex == "" ? [] : [Reventless.CapabilityNeed.Geocoding],
+              emailSender == "" ? [] : [Reventless.CapabilityNeed.Messaging],
+            ),
+          ) {
+          | [] => ()
+          | missing =>
+            JsError.throwWithMessage(
+              Reventless.CapabilityNeed.unmetMessage(missing) ++
+              missing
+              ->Array.map(u =>
+                switch u.need {
+                | Geocoding =>
+                  `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the ` ++
+                  `platform as \`~geocoderPlaceIndex\`.`
+                | Messaging =>
+                  `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform ` ++
+                  `as \`~messagingSender\`.`
+                }
+              )
+              // One line per capability, not per declaring component: two slices
+              // missing the same provider need telling once.
+              ->Belt.Set.String.fromArray
+              ->Belt.Set.String.toArray
+              ->Array.join(""),
+            )
+          }
+
           let required =
             structure->Option.flatMap(s => s.requiredStores)->Option.getOr([])
           let provisioned =

package/src/Platform.res.mjs

@@ -11,6 +11,7 @@ import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
@@ -25,6 +26,7 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as DcbBackend$ReventlessAws from "./adapter/DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
+import * as CapabilityNeed$Reventless from "@reventlessdev/reventless-spec/src/semantic/CapabilityNeed.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
 import * as Plugin_Stack$ReventlessAws from "./plugin/stack/Plugin_Stack.res.mjs";
@@ -138,6 +140,10 @@ let geocoderPlaceIndexRef = {
   contents: Pulumi.output("")
 };
 
+let messagingEmailSenderRef = {
+  contents: Pulumi.output("")
+};
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -451,6 +457,8 @@ function MakeWithConfig(Config) {
     eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema,
     commandSchema: UiFragmentRegistry$ReventlessCore.commandSchema,
     commandAuthorization: UiFragmentRegistry$ReventlessCore.commandAuthorization,
+    commandTransition: UiFragmentRegistry$ReventlessCore.commandTransition,
+    traits: UiFragmentRegistry$ReventlessCore.traits,
     readConsistency: UiFragmentRegistry$ReventlessCore.readConsistency
   };
   let UiFragmentRegistrySlice = StateChangeSlice_Builder$ReventlessAws.Make(Spec)({
@@ -638,7 +646,9 @@ function MakeWithConfig(Config) {
     errorSchema: PluginSpec$ReventlessCore.errorSchema,
     commandSchema: PluginSpec$ReventlessCore.commandSchema,
     moduleUrl: PluginSpec$ReventlessCore.moduleUrl,
-    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
+    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization,
+    commandTransition: PluginSpec$ReventlessCore.commandTransition,
+    traits: PluginSpec$ReventlessCore.traits
   })({
     initialState: PluginBehavior$ReventlessCore.initialState,
     evolve: PluginBehavior$ReventlessCore.evolve,
@@ -1145,6 +1155,22 @@ function MakeWithConfig(Config) {
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
       geocoderPlaceIndexRef.contents = geocoderPlaceIndexFlat;
+      if (capabilities.includes("Geocoding") && Stdlib_Option.isNone(hostUiBundle.geocoderPlaceIndex)) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Geocoding capability, but this platform provisions no place index.\n  Add \`let placeIndex = ReventlessAws.Capability_Geocoding_AwsLocation.make(~name=…)\` and pass \`~geocoderPlaceIndex=placeIndex\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      }
+      let match$5 = hostUiBundle.messagingSender;
+      let messagingEmailSenderFlat;
+      if (match$5 !== undefined) {
+        let sender = match$5.emailSender;
+        messagingEmailSenderFlat = sender !== undefined ? sender : Pulumi.output("");
+      } else {
+        messagingEmailSenderFlat = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingEmailSender", messagingEmailSenderFlat);
+      messagingEmailSenderRef.contents = messagingEmailSenderFlat;
+      if (capabilities.includes("Messaging") && Stdlib_Option.isNone(hostUiBundle.messagingSender)) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no sender.\n  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      }
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -1214,9 +1240,9 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
-      let match$5 = hostUiBundle.bakedManifest;
-      if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+      let match$6 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$6 !== undefined) {
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$6).map(param => param[0]);
         let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
@@ -1297,6 +1323,9 @@ function MakeWithConfig(Config) {
     let geocoderPlaceIndex = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderPlaceIndex").apply(o => Stdlib_Option.getOr(o, "")) : geocoderPlaceIndexRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex);
     PluginRuntime_Builder$ReventlessAws.registerGeocoderPlaceIndex(geocoderPlaceIndex);
+    let messagingEmailSender = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailSender").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailSenderRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender);
+    PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -1352,17 +1381,36 @@ function MakeWithConfig(Config) {
       let mergeGate = AppSync_MergedApi$ReventlessAws.mergeStatusGateWith(checkedMergedApiArn, association);
       let capabilityGate = Pulumi.all([
         pluginOutputs.pluginStructure,
-        stackRef.getOutput("objectStores")
+        stackRef.getOutput("objectStores"),
+        geocoderPlaceIndex,
+        messagingEmailSender
       ]).apply(param => {
-        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(param[0], s => s.requiredStores), []);
+        let structure = param[0];
+        let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
+          d.capability,
+          d.component
+        ]), (
+          param[2] === "" ? [] : ["Geocoding"]
+        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        if (missing.length !== 0) {
+          Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
+            let match = u.need;
+            if (match === "Geocoding") {
+              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+            } else {
+              return `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform as \`~messagingSender\`.`;
+            }
+          }))).join(""));
+        }
+        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredStores), []);
         let provisioned = Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(param[1], Stdlib_JSON.Decode.object), prim => Object.keys(prim)), []);
-        let missing = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
-        if (typeof missing !== "object") {
+        let missing$1 = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
+        if (typeof missing$1 !== "object") {
           return;
-        } else if (missing.TAG === "NotAdopted") {
-          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
+        } else if (missing$1.TAG === "NotAdopted") {
+          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing$1._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
         } else {
-          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
+          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing$1.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing$1.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
         }
       });
       Pulumi$Pulumi.$$export("sourceApiAssociationId", Pulumi.all([
@@ -1770,6 +1818,8 @@ function Make($star) {
     eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema,
     commandSchema: UiFragmentRegistry$ReventlessCore.commandSchema,
     commandAuthorization: UiFragmentRegistry$ReventlessCore.commandAuthorization,
+    commandTransition: UiFragmentRegistry$ReventlessCore.commandTransition,
+    traits: UiFragmentRegistry$ReventlessCore.traits,
     readConsistency: UiFragmentRegistry$ReventlessCore.readConsistency
   };
   let UiFragmentRegistrySlice = StateChangeSlice_Builder$ReventlessAws.Make(Spec)({
@@ -1957,7 +2007,9 @@ function Make($star) {
     errorSchema: PluginSpec$ReventlessCore.errorSchema,
     commandSchema: PluginSpec$ReventlessCore.commandSchema,
     moduleUrl: PluginSpec$ReventlessCore.moduleUrl,
-    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
+    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization,
+    commandTransition: PluginSpec$ReventlessCore.commandTransition,
+    traits: PluginSpec$ReventlessCore.traits
   })({
     initialState: PluginBehavior$ReventlessCore.initialState,
     evolve: PluginBehavior$ReventlessCore.evolve,
@@ -2441,6 +2493,22 @@ function Make($star) {
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
       geocoderPlaceIndexRef.contents = geocoderPlaceIndexFlat;
+      if (capabilities.includes("Geocoding") && Stdlib_Option.isNone(hostUiBundle.geocoderPlaceIndex)) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Geocoding capability, but this platform provisions no place index.\n  Add \`let placeIndex = ReventlessAws.Capability_Geocoding_AwsLocation.make(~name=…)\` and pass \`~geocoderPlaceIndex=placeIndex\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      }
+      let match$5 = hostUiBundle.messagingSender;
+      let messagingEmailSenderFlat;
+      if (match$5 !== undefined) {
+        let sender = match$5.emailSender;
+        messagingEmailSenderFlat = sender !== undefined ? sender : Pulumi.output("");
+      } else {
+        messagingEmailSenderFlat = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingEmailSender", messagingEmailSenderFlat);
+      messagingEmailSenderRef.contents = messagingEmailSenderFlat;
+      if (capabilities.includes("Messaging") && Stdlib_Option.isNone(hostUiBundle.messagingSender)) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no sender.\n  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      }
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -2510,9 +2578,9 @@ function Make($star) {
           contentType: "application/json"
         });
       }
-      let match$5 = hostUiBundle.bakedManifest;
-      if (componentDefinitions !== undefined && match$5 !== undefined) {
-        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$5).map(param => param[0]);
+      let match$6 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$6 !== undefined) {
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$6).map(param => param[0]);
         let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
@@ -2591,6 +2659,9 @@ function Make($star) {
     let geocoderPlaceIndex = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("geocoderPlaceIndex").apply(o => Stdlib_Option.getOr(o, "")) : geocoderPlaceIndexRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("PLACE_INDEX_NAME", geocoderPlaceIndex);
     PluginRuntime_Builder$ReventlessAws.registerGeocoderPlaceIndex(geocoderPlaceIndex);
+    let messagingEmailSender = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailSender").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailSenderRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender);
+    PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2646,17 +2717,36 @@ function Make($star) {
       let mergeGate = AppSync_MergedApi$ReventlessAws.mergeStatusGateWith(checkedMergedApiArn, association);
       let capabilityGate = Pulumi.all([
         pluginOutputs.pluginStructure,
-        stackRef.getOutput("objectStores")
+        stackRef.getOutput("objectStores"),
+        geocoderPlaceIndex,
+        messagingEmailSender
       ]).apply(param => {
-        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(param[0], s => s.requiredStores), []);
+        let structure = param[0];
+        let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
+          d.capability,
+          d.component
+        ]), (
+          param[2] === "" ? [] : ["Geocoding"]
+        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        if (missing.length !== 0) {
+          Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
+            let match = u.need;
+            if (match === "Geocoding") {
+              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+            } else {
+              return `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform as \`~messagingSender\`.`;
+            }
+          }))).join(""));
+        }
+        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredStores), []);
         let provisioned = Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(param[1], Stdlib_JSON.Decode.object), prim => Object.keys(prim)), []);
-        let missing = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
-        if (typeof missing !== "object") {
+        let missing$1 = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
+        if (typeof missing$1 !== "object") {
           return;
-        } else if (missing.TAG === "NotAdopted") {
-          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
+        } else if (missing$1.TAG === "NotAdopted") {
+          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing$1._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
         } else {
-          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
+          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing$1.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing$1.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
         }
       });
       Pulumi$Pulumi.$$export("sourceApiAssociationId", Pulumi.all([
@@ -2764,6 +2854,7 @@ export {
   objectStoreEndpointsRef,
   getObjectStoreEndpoints,
   geocoderPlaceIndexRef,
+  messagingEmailSenderRef,
   MakeWithConfig,
   Make,
 }

package/src/adapter/Messaging/Messaging_Ses_Backend.res

@@ -0,0 +1,84 @@
+// Amazon SES as a messaging transport for unattended callers.
+//
+// Policy — who a message can be addressed to, what a send can answer, and which
+// failures are worth retrying — lives in `Reventless.Messaging`, shared with
+// every other transport. This module only knows how to ask SES and how to turn
+// its answer into that vocabulary.
+//
+// Runtime-pure: no Pulumi import, so it can be bundled into a Lambda entry point
+// without dragging deploy-time modules into the cold-start graph.
+
+module Send = AwsSdk.SES.SendEmailCommand
+
+/**
+The channels this transport can attempt, given what the deployment provisioned.
+
+Derived from the sender address rather than declared beside it: SES sends from a
+verified identity, so no address means no email channel, and a list that claimed
+one anyway would be a promise the first send breaks. SMS and push are not wired
+here — `Messaging.UnsupportedChannel` is what a caller gets, which is settled
+rather than retried, so a preference for a channel this deployment does not run
+costs one refusal and not a retry budget.
+*/
+let channels = (~sender: string): array<Reventless.Messaging.channel> =>
+  sender == "" ? [] : [Email]
+
+/**
+Send one message.
+
+`Refused` rather than a blank subject line for a message that carries none: SES
+requires one, retrying will not produce one, and a delivered email with an empty
+header is the outcome nobody wanted. The other two arms follow the port's retry
+rule — an unset sender is the deployment's gap (`Unavailable`, retried and swept)
+and anything SES itself refuses is settled.
+*/
+let send = async (
+  ~sender: string,
+  ~recipient: Reventless.Messaging.recipient,
+  ~message: Reventless.Messaging.message,
+): result<Reventless.Messaging.receipt, Reventless.Messaging.failure> =>
+  switch recipient {
+  | ToSms(_) => Error(UnsupportedChannel(Sms))
+  | ToPush(_) => Error(UnsupportedChannel(Push))
+  | ToEmail(address) =>
+    if sender == "" {
+      Error(Unavailable("no messaging sender configured (MESSAGING_EMAIL_SENDER unset)"))
+    } else {
+      switch message.subject {
+      | None | Some("") => Error(Refused("an email needs a subject, and this message carries none"))
+      | Some(subject) =>
+        switch await Send.send(
+          Send.make({
+            fromEmailAddress: sender,
+            destination: {toAddresses: [address->Reventless.Email.toString]},
+            content: {
+              simple: {
+                subject: {data: subject},
+                body: {text: {data: message.body}},
+              },
+            },
+          }),
+        ) {
+        // SES answers 200 with no MessageId only if the shape changed under us;
+        // an accepted message without an id is still accepted, and inventing one
+        // would put a value in a receipt that no support conversation resolves.
+        | resp => Ok({ref: resp.messageId->Option.getOr("")})
+        | exception exn =>
+          let msg = exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
+          // Every SES error is treated as transient. The permanent ones it does
+          // raise — an unverified identity, an address on the suppression list —
+          // are deployment or recipient state that a sweep should keep surfacing,
+          // and reading them apart means matching on message text, which is a
+          // provider's prose and not a contract.
+          Error(Unavailable(msg))
+        }
+      }
+    }
+  }
+
+/** The port, closed over the deployment's sender. What a Lambda entry point puts
+    on `Capabilities.messaging`. */
+let provider = (~sender: string): Reventless.Messaging.provider => {
+  channels: channels(~sender),
+  send: (~recipient, ~message) => send(~sender, ~recipient, ~message),
+}

package/src/adapter/Messaging/Messaging_Ses_Backend.res.mjs

@@ -0,0 +1,120 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as SES$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/SES.res.mjs";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as ClientSesv2 from "@aws-sdk/client-sesv2";
+
+function channels(sender) {
+  if (sender === "") {
+    return [];
+  } else {
+    return ["Email"];
+  }
+}
+
+async function send(sender, recipient, message) {
+  switch (recipient.TAG) {
+    case "ToEmail" :
+      if (sender === "") {
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Unavailable",
+            _0: "no messaging sender configured (MESSAGING_EMAIL_SENDER unset)"
+          }
+        };
+      }
+      let subject = message.subject;
+      if (subject === undefined) {
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Refused",
+            _0: "an email needs a subject, and this message carries none"
+          }
+        };
+      }
+      if (subject === "") {
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Refused",
+            _0: "an email needs a subject, and this message carries none"
+          }
+        };
+      }
+      let resp;
+      try {
+        resp = await SES$AwsSdk.SendEmailCommand.send(new ClientSesv2.SendEmailCommand({
+          Content: {
+            Simple: {
+              Body: {
+                Text: {
+                  Data: message.body
+                }
+              },
+              Subject: {
+                Data: subject
+              }
+            }
+          },
+          Destination: {
+            ToAddresses: [recipient._0]
+          },
+          FromEmailAddress: sender
+        }));
+      } catch (raw_exn) {
+        let exn = Primitive_exceptions.internalToException(raw_exn);
+        let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Unavailable",
+            _0: msg
+          }
+        };
+      }
+      return {
+        TAG: "Ok",
+        _0: {
+          ref: Stdlib_Option.getOr(resp.MessageId, "")
+        }
+      };
+      break;
+    case "ToSms" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Sms"
+        }
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Push"
+        }
+      };
+  }
+}
+
+function provider(sender) {
+  return {
+    channels: channels(sender),
+    send: (recipient, message) => send(sender, recipient, message)
+  };
+}
+
+let Send;
+
+export {
+  Send,
+  channels,
+  send,
+  provider,
+}
+/* SES-AwsSdk Not a pure module */

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -226,7 +226,9 @@ public unauthenticated endpoint for an unattended path.
 Resolved per call rather than captured once, so a Lambda whose configuration is
 updated does not need a cold start to see it. An unset `PLACE_INDEX_NAME` reaches
 `Geocoder_AwsLocation_Backend` as `""`, which answers `Unavailable` — a retryable
-outcome, not a verdict on the address.
+outcome, not a verdict on the address. `MESSAGING_EMAIL_SENDER` is read the same
+way, and empty yields a provider with no channels rather than one that claims a
+channel it cannot send on.
 */
 let capabilities = (): Reventless.Capabilities.t => {
   geocode: (~text) =>
@@ -234,6 +236,9 @@ let capabilities = (): Reventless.Capabilities.t => {
       ~indexName=NodeProcess.env->Dict.get("PLACE_INDEX_NAME")->Option.getOr(""),
       ~text,
     ),
+  messaging: Messaging_Ses_Backend.provider(
+    ~sender=NodeProcess.env->Dict.get("MESSAGING_EMAIL_SENDER")->Option.getOr(""),
+  ),
 }
 
 // ── Phase-1/phase-2 pipelines ───────────────────────────────────────────────

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -14,6 +14,7 @@ import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/U
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
+import * as Messaging_Ses_Backend$ReventlessAws from "../Messaging/Messaging_Ses_Backend.res.mjs";
 import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
 import * as AutomationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/AutomationSlice/AutomationSlice_Callback.res.mjs";
 import * as StreamRoutedEntryPoint_Ops$ReventlessAws from "./StreamRoutedEntryPoint_Ops.res.mjs";
@@ -151,7 +152,8 @@ function makeLoadTodoItems(queryDbTableName, todoItems, rowSchema, comp) {
 
 function capabilities() {
   return {
-    geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
+    geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined),
+    messaging: Messaging_Ses_Backend$ReventlessAws.provider(Stdlib_Option.getOr(process.env["MESSAGING_EMAIL_SENDER"], ""))
   };
 }
 
@@ -185,9 +187,7 @@ function makeOutboundJsonEventsHandler(consumedEventSchema, callback, publishJso
     await loadTodoItems();
     callback.phase1(events);
     await syncTodoItems();
-    await callback.phase2(publishJsons, {
-      geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
-    });
+    await callback.phase2(publishJsons, capabilities());
     return await syncTodoItems();
   }));
 }
@@ -223,9 +223,7 @@ function makeOutboundRegisteredHandler(entry, sliceName, consumedEventSchema, ca
     },
     sweep: async () => {
       await loadTodoItems();
-      await callback.phase2(publishJsons, {
-        geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined)
-      });
+      await callback.phase2(publishJsons, capabilities());
       return await syncTodoItems();
     },
     comp: comp

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -296,6 +296,43 @@ let makeGeocoderGrant = (~runtime: ReventlessCore.Runtime.environment<runtimePar
     )
   }
 
+// Least-privilege `ses:SendEmail` on the platform's verified sender identity,
+// for the slices that send through the injected messaging capability. Built the
+// same way as the geocoder grant above, and for the same three reasons: the
+// provisioned bit is a plain bool, the address is an Output, and the RolePolicy
+// is created at top level rather than inside an `apply`.
+let makeMessagingGrant = (~runtime: ReventlessCore.Runtime.environment<runtimeParts>, ~opts) =>
+  if PluginRuntime_Builder.messagingProvisioned() {
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let policyJson =
+      PluginRuntime_Builder.messagingSender()->Pulumi.Output.apply(sender => {
+        open PulumiAws.PolicyDocument
+        PulumiAws.PolicyDocument.make(
+          ~id="AllAutomationSlicesSendEmail",
+          ~statements=[
+            {
+              sid: "AllowSendEmail",
+              effect: Allow,
+              // SESv2's SendEmail authorizes against the v1 action name, and the
+              // resource is the identity the message is sent FROM — not the
+              // recipient, which is why one grant covers every destination.
+              actions: Action("ses:SendEmail"),
+              resources: Resource(`arn:aws:ses:*:*:identity/${sender}`),
+            },
+          ],
+        )->PulumiAws.PolicyDocument.toJsonString
+      })
+    let _ = PulumiAws.IAM.RolePolicy.make(
+      ~name="AllAutomationSlicesSendEmail",
+      ~args={
+        policy: policyJson->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
 let finished = ref(false)
 
 // Legacy finalizer, kept only to satisfy `EventCollectorRuntime_Builder.T`.
@@ -619,6 +656,7 @@ let finishWithDcbEventLog = (dcbEventLog: ReventlessCore.DcbEventLog.component)
 
         makeSweepSchedule(~runtime, ~opts)
         makeGeocoderGrant(~runtime, ~opts)
+        makeMessagingGrant(~runtime, ~opts)
       | None =>
         log.warn(
           ~comp="AutomationSliceRuntime_Builder_Single",

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -150,6 +150,23 @@ function makeGeocoderGrant(runtime, opts) {
   }, customOpts);
 }
 
+function makeMessagingGrant(runtime, opts) {
+  if (!PluginRuntime_Builder$ReventlessAws.messagingProvisioned()) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let policyJson = PluginRuntime_Builder$ReventlessAws.messagingSender().apply(sender => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAutomationSlicesSendEmail", [{
+      Sid: "AllowSendEmail",
+      Effect: "Allow",
+      Action: "ses:SendEmail",
+      Resource: `arn:aws:ses:*:*:identity/` + sender
+    }])));
+  new (Aws.iam.RolePolicy)("AllAutomationSlicesSendEmail", {
+    policy: policyJson,
+    role: runtime.parts.lambdaRole.id
+  }, customOpts);
+}
+
 let finished = {
   contents: false
 };
@@ -327,6 +344,7 @@ function finishWithDcbEventLog(dcbEventLog) {
         }], runtime, opts);
       makeSweepSchedule(runtime, opts);
       makeGeocoderGrant(runtime, opts);
+      makeMessagingGrant(runtime, opts);
     } else {
       log.warn("AutomationSliceRuntime_Builder_Single", undefined, "finishWithDcbEventLog: DCB EventLog has no parent");
     }
@@ -357,6 +375,7 @@ export {
   sweepIntervalMinutes,
   makeSweepSchedule,
   makeGeocoderGrant,
+  makeMessagingGrant,
   finished,
   finish,
   finishWithDcbEventLog,

package/src/capability/Capability_Messaging_Ses.res

@@ -0,0 +1,31 @@
+// A verified SES sender identity, provisioned with the framework's house
+// conventions applied — the backing for the messaging capability's email channel.
+//
+// The identity is the whole of the provisioning: SES sends from a verified
+// address, and everything else a send needs travels on the message. So this
+// helper exists to make the sender a deploy-time decision with one owner rather
+// than an environment variable each stack spells for itself.
+//
+// **Verification is not instant and not automatic.** Creating the identity asks
+// AWS to send a confirmation mail to the address; until somebody follows it, SES
+// refuses every send. That is a deployment step this code cannot perform, and a
+// deploy that "succeeded" is not evidence mail flows — which is why the runtime
+// treats an SES refusal as retryable, so the first sends queue rather than being
+// written off while the address is still pending.
+//
+// A deployment in the SES sandbox may also only send *to* verified addresses.
+// Leaving the sandbox is an account-level request, not a resource.
+
+open PulumiAws
+
+/** Declare the sender address and hand back the platform's messaging handle.
+    `~email` is the `From:` every message this deployment sends carries. */
+let make = (
+  ~name: string,
+  ~email: string,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+): ReventlessInfra.Platform.messagingSender => {
+  let identity = SES.EmailIdentity.make(~name, ~args={email: email}, ~opts?)
+
+  {emailSender: identity.email->Pulumi.Output.asInput}
+}

package/src/capability/Capability_Messaging_Ses.res.mjs

@@ -0,0 +1,18 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+
+function make(name, email, opts) {
+  let identity = new (Aws.ses.EmailIdentity)(name, {
+    email: email
+  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+  return {
+    emailSender: identity.email
+  };
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -77,6 +77,20 @@ let registerGeocoderPlaceIndex = (indexName: Pulumi.Output.t<string>) => {
 let geocoderPlaceIndex = () => geocoderPlaceIndexRef.contents
 let geocoderProvisioned = () => geocoderProvisionedRef.contents
 
+/** The messaging sender, carried for the same reason and in the same shape: a
+    slice Lambda sending mail needs `ses:SendEmail` on the identity, and the
+    identity is what the address names. */
+let messagingSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+let messagingProvisionedRef = ref(false)
+
+let registerMessagingSender = (sender: Pulumi.Output.t<string>) => {
+  messagingSenderRef := sender
+  messagingProvisionedRef := true
+}
+
+let messagingSender = () => messagingSenderRef.contents
+let messagingProvisioned = () => messagingProvisionedRef.contents
+
 type sliceModulePaths = {
   specPath: string,
   behaviorPath: string,

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -68,6 +68,27 @@ function geocoderProvisioned() {
   return geocoderProvisionedRef.contents;
 }
 
+let messagingSenderRef = {
+  contents: Pulumi.output("")
+};
+
+let messagingProvisionedRef = {
+  contents: false
+};
+
+function registerMessagingSender(sender) {
+  messagingSenderRef.contents = sender;
+  messagingProvisionedRef.contents = true;
+}
+
+function messagingSender() {
+  return messagingSenderRef.contents;
+}
+
+function messagingProvisioned() {
+  return messagingProvisionedRef.contents;
+}
+
 let dcbConfigRef = {
   contents: {
     pluginName: "",
@@ -544,6 +565,11 @@ export {
   registerGeocoderPlaceIndex,
   geocoderPlaceIndex,
   geocoderProvisioned,
+  messagingSenderRef,
+  messagingProvisionedRef,
+  registerMessagingSender,
+  messagingSender,
+  messagingProvisioned,
   dcbConfigRef,
   registeredSliceModulePaths,
   registerStateChangeSliceSpec,

package/tests/BakeConvergenceTest.res

@@ -50,6 +50,8 @@ let emptyStructure: Reventless.Plugin.pluginStructure = {
   extensionPoints: None,
   requiredStores: None,
   requiredStoreDeclarations: None,
+  requiredCapabilities: None,
+  traitDeclarations: None,
 }
 
 let definition = (~structure): Reventless.Plugin.pluginDefinition => {

package/tests/BakeConvergenceTest.res.mjs

@@ -63,7 +63,9 @@ let emptyStructure = {
   extensions: emptyStructure_extensions,
   extensionPoints: undefined,
   requiredStores: undefined,
-  requiredStoreDeclarations: undefined
+  requiredStoreDeclarations: undefined,
+  requiredCapabilities: undefined,
+  traitDeclarations: undefined
 };
 
 function definition(structure) {
@@ -134,7 +136,9 @@ globalThis.describe("the bake converges when a plugin's structure changes", () =
     extensions: emptyStructure_extensions,
     extensionPoints: undefined,
     requiredStores: ["Ordering.receipts"],
-    requiredStoreDeclarations: undefined
+    requiredStoreDeclarations: undefined,
+    requiredCapabilities: undefined,
+    traitDeclarations: undefined
   });
   let keyB = match$1[0];
   let defA = definition(match[1]);

package/tests/integration/AggTestAggregate.res

@@ -19,3 +19,5 @@ type error = AlreadyExists
 let name = "AggTestAggregate"
 let moduleUrl = "agg-test://AggTestAggregate"
 let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type lifecycleState = unit
+let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted

package/tests/integration/AggTestAggregate.res.mjs

@@ -18,6 +18,10 @@ function commandAuthorization(param) {
   return "AllowAnonymous";
 }
 
+function commandTransition(param) {
+  return "Unrestricted";
+}
+
 let name = "AggTestAggregate";
 
 let moduleUrl = "agg-test://AggTestAggregate";
@@ -29,5 +33,6 @@ export {
   name,
   moduleUrl,
   commandAuthorization,
+  commandTransition,
 }
 /* commandSchema Not a pure module */

package/tests/integration/EpCompositeSlice.res

@@ -56,6 +56,8 @@ type event =
 let name = "EpCompositeSlice"
 let moduleUrl = "ep-test://EpCompositeSlice"
 let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type lifecycleState = unit
+let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry
 
 // `module Id = Reventless.Id.String` — patched in by `patchSpecId` at runtime.

package/tests/integration/EpCompositeSlice.res.mjs

@@ -51,6 +51,10 @@ function commandAuthorization(param) {
   return "AllowAnonymous";
 }
 
+function commandTransition(param) {
+  return "Unrestricted";
+}
+
 let name = "EpCompositeSlice";
 
 let moduleUrl = "ep-test://EpCompositeSlice";
@@ -65,6 +69,7 @@ export {
   name,
   moduleUrl,
   commandAuthorization,
+  commandTransition,
   readConsistency,
 }
 /* consumedEventSchema Not a pure module */

package/tests/integration/EpTestSlice.res

@@ -22,6 +22,8 @@ type event = WidgetAdded({widgetId: @s.matches(Reventless.DcbTag.partition) stri
 let name = "EpTestSlice"
 let moduleUrl = "ep-test://EpTestSlice"
 let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type lifecycleState = unit
+let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry
 
 // `module Id = Reventless.Id.String` — patched in by `patchSpecId` at runtime,

package/tests/integration/EpTestSlice.res.mjs

@@ -24,6 +24,10 @@ function commandAuthorization(param) {
   return "AllowAnonymous";
 }
 
+function commandTransition(param) {
+  return "Unrestricted";
+}
+
 let name = "EpTestSlice";
 
 let moduleUrl = "ep-test://EpTestSlice";
@@ -38,6 +42,7 @@ export {
   name,
   moduleUrl,
   commandAuthorization,
+  commandTransition,
   readConsistency,
 }
 /* consumedEventSchema Not a pure module */