@reventlessdev/reventless-aws 3.0.0-alpha.333 → 3.0.0-alpha.334

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.334 (2026-09-02)
+
+* feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))
+
+### BREAKING CHANGES
+
+* `Capability_Messaging_Ses.make` is replaced by
+`Capability_Messaging.make(~name)`, which reads the transport and the address
+from config; the SES module keeps only `emailSender`. A deployment that named its
+sender in code must move it to `platform:messagingEmailSender` or the deploy is
+refused.
+
+
+
 # 3.0.0-alpha.333 (2026-09-02)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.333",
+  "version": "3.0.0-alpha.334",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -15,18 +15,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.14",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.7",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.14",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.7",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.254",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.155",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.253",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.154",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.117",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.34",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.126"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.118",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.127"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -103,6 +103,10 @@ let geocoderPlaceIndexRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make
     same `""` sentinel and the same reason. */
 let messagingEmailSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** The email transport behind that address, carried the same way for the same case.
+    `""` means the platform named none, which the runtime reads as its default. */
+let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -2178,16 +2182,57 @@ module MakeWithConfig = (
       Pulumi.Pulumi.export("messagingEmailSender", messagingEmailSenderFlat)
       messagingEmailSenderRef := messagingEmailSenderFlat
 
+      // Which transport is behind that sender. Exported and threaded exactly like
+      // the address, because a plugin stack's Lambdas need both and read them the
+      // same way — the address alone would leave a runtime guessing what to send
+      // it with. `""` means "the platform did not say", which the runtime reads as
+      // the default rather than as an error.
+      let messagingEmailProviderFlat = switch cfg.messagingSender {
+      | Some({emailProvider: ?Some(name)}) => name->Pulumi.Output.fromInput
+      | _ => Pulumi.Output.make("")
+      }
+      Pulumi.Pulumi.export("messagingEmailProvider", messagingEmailProviderFlat)
+      messagingEmailProviderRef := messagingEmailProviderFlat
+
+      // Exported but not handed to a Lambda: nothing reads an SMS sender yet, and
+      // an env var no runtime consults is a setting that looks wired. The export
+      // is how a stack can see what it configured.
+      Pulumi.Pulumi.export(
+        "messagingSmsSender",
+        switch cfg.messagingSender {
+        | Some({smsSender: ?Some(sender)}) => sender->Pulumi.Output.fromInput
+        | _ => Pulumi.Output.make("")
+        },
+      )
+
       // Same gate as geocoding's, and the failure it prevents is worse: an
       // unprovisioned mailer answers `Unavailable` on every send, so the messages
       // queue and retry and are eventually abandoned — a notification nobody
       // receives and no error names.
-      if capabilities->Array.includes(Messaging) && cfg.messagingSender->Option.isNone {
+      //
+      // The test is the *sender*, not the handle. Since the address became
+      // configuration with no default, a root that calls the helper hands over a
+      // record either way — one carrying no sender when the stack named none — so
+      // a gate reading `Option.isNone` would pass a deployment with no mailer.
+      // Whether the field is present is known here, without resolving the Output
+      // behind it, which is what keeps this refusal at graph-construction time
+      // rather than in the `apply` further down: the same gap caught there fails
+      // the deploy midway, and is skipped entirely by `pulumi preview`.
+      let emailSenderProvisioned = switch cfg.messagingSender {
+      | Some({emailSender: ?Some(_)}) => true
+      | _ => false
+      }
+      if capabilities->Array.includes(Messaging) && !emailSenderProvisioned {
         JsError.throwWithMessage(
           `A plugin of this deployment declares the Messaging capability, but this platform ` ++
-          `provisions no sender.\n` ++
-          `  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` ` ++
-          `and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n` ++
+          `provisions no email sender.\n` ++
+          `  The sender is configuration and has no default: set ` ++
+          `\`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or the env var ` ++
+          `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES.\n` ++
+          `  A stack that should not mail anybody sets \`platform:messagingEmailProvider: log\` ` ++
+          `instead — every message is logged and none is sent, and the address is optional.\n` ++
+          `  The root must also pass \`~messagingSender\` in \`~hostUiBundle\`, from ` ++
+          `\`ReventlessAws.Capability_Messaging.make(~name=…)\`.\n` ++
           `  The declaration is generated from the plugins' capabilities.json — regenerate with ` ++
           `\`pnpm run generate:platform\` if it is stale.`,
         )
@@ -2516,6 +2561,23 @@ module MakeWithConfig = (
     PluginRuntime_Builder.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender)
     PluginRuntime_Builder.registerMessagingSender(messagingEmailSender)
 
+    // The transport, read across the same two halves. Only the env var: the IAM
+    // grant below keys off the address, and a log-transport deployment wants the same
+    // grant anyway — a stack that switches back to SES should not need its roles
+    // rebuilt.
+    let messagingEmailProvider: Pulumi.Output.t<string> = switch platformStackRef {
+    | Some(stackRef) =>
+      (
+        stackRef->Pulumi.StackReference.getOutput("messagingEmailProvider"):
+          Pulumi.Output.t<option<string>>
+      )->Pulumi.Output.apply(o => o->Option.getOr(""))
+    | None => messagingEmailProviderRef.contents
+    }
+    PluginRuntime_Builder.registerCapabilityEnv(
+      "MESSAGING_EMAIL_PROVIDER",
+      messagingEmailProvider,
+    )
+
     module P = unpack(plugin)
     let pluginComponent = P.make()
     ReventlessCore.Plugin_Helpers.clearOffload()
@@ -2698,8 +2760,11 @@ module MakeWithConfig = (
                   `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the ` ++
                   `platform as \`~geocoderPlaceIndex\`.`
                 | Messaging =>
-                  `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform ` ++
-                  `as \`~messagingSender\`.`
+                  `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform ` ++
+                  `as \`~messagingSender\`. The sender itself is configuration and has no ` ++
+                  `default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or ` ++
+                  `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++
+                  `\`platform:messagingEmailProvider: log\` to log every message and send none.`
                 }
               )
               // One line per capability, not per declaring component: two slices

package/src/Platform.res.mjs

@@ -144,6 +144,10 @@ let messagingEmailSenderRef = {
   contents: Pulumi.output("")
 };
 
+let messagingEmailProviderRef = {
+  contents: Pulumi.output("")
+};
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -1168,8 +1172,29 @@ function MakeWithConfig(Config) {
       }
       Pulumi$Pulumi.$$export("messagingEmailSender", messagingEmailSenderFlat);
       messagingEmailSenderRef.contents = messagingEmailSenderFlat;
-      if (capabilities.includes("Messaging") && Stdlib_Option.isNone(hostUiBundle.messagingSender)) {
-        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no sender.\n  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      let match$6 = hostUiBundle.messagingSender;
+      let messagingEmailProviderFlat;
+      if (match$6 !== undefined) {
+        let name = match$6.emailProvider;
+        messagingEmailProviderFlat = name !== undefined ? name : Pulumi.output("");
+      } else {
+        messagingEmailProviderFlat = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingEmailProvider", messagingEmailProviderFlat);
+      messagingEmailProviderRef.contents = messagingEmailProviderFlat;
+      let match$7 = hostUiBundle.messagingSender;
+      let tmp$2;
+      if (match$7 !== undefined) {
+        let sender$1 = match$7.smsSender;
+        tmp$2 = sender$1 !== undefined ? sender$1 : Pulumi.output("");
+      } else {
+        tmp$2 = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingSmsSender", tmp$2);
+      let match$8 = hostUiBundle.messagingSender;
+      let emailSenderProvisioned = match$8 !== undefined ? match$8.emailSender !== undefined : false;
+      if (capabilities.includes("Messaging") && !emailSenderProvisioned) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no email sender.\n  The sender is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or the env var REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES.\n  A stack that should not mail anybody sets \`platform:messagingEmailProvider: log\` instead — every message is logged and none is sent, and the address is optional.\n  The root must also pass \`~messagingSender\` in \`~hostUiBundle\`, from \`ReventlessAws.Capability_Messaging.make(~name=…)\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
       }
       let configJsonContent = Pulumi.all([
         Pulumi.all([
@@ -1240,9 +1265,9 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
-      let match$6 = hostUiBundle.bakedManifest;
-      if (componentDefinitions !== undefined && match$6 !== undefined) {
-        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$6).map(param => param[0]);
+      let match$9 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$9 !== undefined) {
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$9).map(param => param[0]);
         let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
@@ -1326,6 +1351,8 @@ function MakeWithConfig(Config) {
     let messagingEmailSender = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailSender").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailSenderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender);
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
+    let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -1398,7 +1425,7 @@ function MakeWithConfig(Config) {
             if (match === "Geocoding") {
               return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
             } else {
-              return `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform as \`~messagingSender\`.`;
+              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
             }
           }))).join(""));
         }
@@ -2506,8 +2533,29 @@ function Make($star) {
       }
       Pulumi$Pulumi.$$export("messagingEmailSender", messagingEmailSenderFlat);
       messagingEmailSenderRef.contents = messagingEmailSenderFlat;
-      if (capabilities.includes("Messaging") && Stdlib_Option.isNone(hostUiBundle.messagingSender)) {
-        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no sender.\n  Add \`let sender = ReventlessAws.Capability_Messaging_Ses.make(~name=…, ~email=…)\` and pass \`~messagingSender=sender\` in \`~hostUiBundle\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
+      let match$6 = hostUiBundle.messagingSender;
+      let messagingEmailProviderFlat;
+      if (match$6 !== undefined) {
+        let name = match$6.emailProvider;
+        messagingEmailProviderFlat = name !== undefined ? name : Pulumi.output("");
+      } else {
+        messagingEmailProviderFlat = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingEmailProvider", messagingEmailProviderFlat);
+      messagingEmailProviderRef.contents = messagingEmailProviderFlat;
+      let match$7 = hostUiBundle.messagingSender;
+      let tmp$2;
+      if (match$7 !== undefined) {
+        let sender$1 = match$7.smsSender;
+        tmp$2 = sender$1 !== undefined ? sender$1 : Pulumi.output("");
+      } else {
+        tmp$2 = Pulumi.output("");
+      }
+      Pulumi$Pulumi.$$export("messagingSmsSender", tmp$2);
+      let match$8 = hostUiBundle.messagingSender;
+      let emailSenderProvisioned = match$8 !== undefined ? match$8.emailSender !== undefined : false;
+      if (capabilities.includes("Messaging") && !emailSenderProvisioned) {
+        Stdlib_JsError.throwWithMessage(`A plugin of this deployment declares the Messaging capability, but this platform provisions no email sender.\n  The sender is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or the env var REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES.\n  A stack that should not mail anybody sets \`platform:messagingEmailProvider: log\` instead — every message is logged and none is sent, and the address is optional.\n  The root must also pass \`~messagingSender\` in \`~hostUiBundle\`, from \`ReventlessAws.Capability_Messaging.make(~name=…)\`.\n  The declaration is generated from the plugins' capabilities.json — regenerate with \`pnpm run generate:platform\` if it is stale.`);
       }
       let configJsonContent = Pulumi.all([
         Pulumi.all([
@@ -2578,9 +2626,9 @@ function Make($star) {
           contentType: "application/json"
         });
       }
-      let match$6 = hostUiBundle.bakedManifest;
-      if (componentDefinitions !== undefined && match$6 !== undefined) {
-        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$6).map(param => param[0]);
+      let match$9 = hostUiBundle.bakedManifest;
+      if (componentDefinitions !== undefined && match$9 !== undefined) {
+        let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$9).map(param => param[0]);
         let manifestKey = Stdlib_Option.getOr(manifestKeys[0], Platform_BakedManifest$ReventlessCore.defaultKey);
         Pulumi.all([
           componentDefinitions.roleId,
@@ -2662,6 +2710,8 @@ function Make($star) {
     let messagingEmailSender = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailSender").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailSenderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_SENDER", messagingEmailSender);
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
+    let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2734,7 +2784,7 @@ function Make($star) {
             if (match === "Geocoding") {
               return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
             } else {
-              return `\n  Messaging is \`Capability_Messaging_Ses.make\`, passed to the platform as \`~messagingSender\`.`;
+              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
             }
           }))).join(""));
         }
@@ -2855,6 +2905,7 @@ export {
   getObjectStoreEndpoints,
   geocoderPlaceIndexRef,
   messagingEmailSenderRef,
+  messagingEmailProviderRef,
   MakeWithConfig,
   Make,
 }

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -297,15 +297,30 @@ outcome, not a verdict on the address. `MESSAGING_EMAIL_SENDER` is read the same
 way, and empty yields a provider with no channels rather than one that claims a
 channel it cannot send on.
 */
+/** The email transport this deployment chose.
+
+    Read per call like the sender beside it, and defaulting to SES on anything it
+    does not recognise — including the empty string a platform that named nothing
+    exports. The deploy already refuses an unknown value (`Capability_Messaging`
+    parses it there, where a human is watching); defaulting again here is for the
+    case that cannot be refused, a Lambda whose variable was edited by hand. SES
+    is the safe direction: a message that should have been logged and was sent is
+    recoverable, a customer notification silently swallowed by a log line is not. */
+let messagingEmailProvider = (): Reventless.Messaging.provider => {
+  let sender = NodeProcess.env->Dict.get("MESSAGING_EMAIL_SENDER")->Option.getOr("")
+  switch NodeProcess.env->Dict.get("MESSAGING_EMAIL_PROVIDER")->Option.getOr("") {
+  | "log" => ReventlessCore.Messaging_Log_Backend.provider(~sender)
+  | _ => Messaging_Ses_Backend.provider(~sender)
+  }
+}
+
 let capabilities = (): Reventless.Capabilities.t => {
   geocode: (~text) =>
     Geocoder_AwsLocation_Backend.search(
       ~indexName=NodeProcess.env->Dict.get("PLACE_INDEX_NAME")->Option.getOr(""),
       ~text,
     ),
-  messaging: Messaging_Ses_Backend.provider(
-    ~sender=NodeProcess.env->Dict.get("MESSAGING_EMAIL_SENDER")->Option.getOr(""),
-  ),
+  messaging: messagingEmailProvider(),
 }
 
 // ── Phase-1/phase-2 pipelines ───────────────────────────────────────────────

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -16,6 +16,7 @@ import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
 import * as Messaging_Ses_Backend$ReventlessAws from "../Messaging/Messaging_Ses_Backend.res.mjs";
 import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
+import * as Messaging_Log_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Messaging/Messaging_Log_Backend.res.mjs";
 import * as AutomationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/AutomationSlice/AutomationSlice_Callback.res.mjs";
 import * as StreamRoutedEntryPoint_Ops$ReventlessAws from "./StreamRoutedEntryPoint_Ops.res.mjs";
 import * as Geocoder_AwsLocation_Backend$ReventlessAws from "../Geocoder/Geocoder_AwsLocation_Backend.res.mjs";
@@ -185,10 +186,20 @@ function makeLoadTodoItems(queryDbTableName, todoItems, rowSchema, comp) {
   };
 }
 
+function messagingEmailProvider() {
+  let sender = Stdlib_Option.getOr(process.env["MESSAGING_EMAIL_SENDER"], "");
+  let match = Stdlib_Option.getOr(process.env["MESSAGING_EMAIL_PROVIDER"], "");
+  if (match === "log") {
+    return Messaging_Log_Backend$ReventlessCore.provider(sender);
+  } else {
+    return Messaging_Ses_Backend$ReventlessAws.provider(sender);
+  }
+}
+
 function capabilities() {
   return {
     geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined),
-    messaging: Messaging_Ses_Backend$ReventlessAws.provider(Stdlib_Option.getOr(process.env["MESSAGING_EMAIL_SENDER"], ""))
+    messaging: messagingEmailProvider()
   };
 }
 
@@ -290,6 +301,7 @@ export {
   makePublishJsons,
   makeSyncTodoItems,
   makeLoadTodoItems,
+  messagingEmailProvider,
   capabilities,
   makeAutomationJsonEventsHandler,
   makeOutboundJsonEventsHandler,

package/src/capability/Capability_Messaging.res

@@ -0,0 +1,141 @@
+// The messaging capability a deployment provisions: which transport, sending as
+// whom. The entry point a platform root calls; the transports sit below it.
+//
+// **All of it is configuration, none of it is code.** Which transport is a
+// per-environment decision — a staging stack should not mail customers, and
+// nothing about the shop it deploys says so — and the address is a per-account
+// fact, since SES sends from one verified identity. A repository cannot know
+// either, and a placeholder default for the address is worse than none: it
+// provisions an identity nobody can verify, after which every send is refused at
+// the sender while reading like a delivery problem.
+//
+// Config keys, on the usual ladder — env var `REVENTLESS_<SCREAMING_SNAKE>`, then
+// `Pulumi.local.yaml`, then `platform:<key>` in `Pulumi.<stack>.yaml`:
+//
+//   - `messagingEmailProvider`   — "ses" (default) or "log". Per channel, like
+//                                  the senders: an SMS transport will bring its own.
+//   - `messagingEmailSender`     — the address messages are sent from. Under
+//                                  `ses` it is verified and required; under
+//                                  `log` it is only a header and defaults.
+//   - `messagingEmailSenderName` — optional display name for the `From:` header.
+//   - `messagingSmsSender`       — origination number or sender id. Carried only;
+//                                  no transport reads it yet.
+//
+// **Unset is a real answer, and the deploy still checks it.** A platform whose
+// plugins declare the Messaging capability and which provisions no sender is
+// refused at deploy time by `Platform.deployPlatform`, naming the key — so "no
+// mail configured" cannot reach production as silence.
+
+let emailProviderKey = "messagingEmailProvider"
+let emailSenderKey = "messagingEmailSender"
+let emailSenderNameKey = "messagingEmailSenderName"
+let smsSenderKey = "messagingSmsSender"
+
+/** One key off the ladder, trimmed, with blank read as absent.
+
+    Blank matters because the ways to write "nothing" must not differ: a stray
+    `REVENTLESS_MESSAGING_EMAIL_SENDER=` in CI, a blank line in
+    `Pulumi.local.yaml`, and a key left with a space after the colon all mean the
+    stack named no sender. Honouring any of them would ask SES for an identity
+    with a blank address — a deploy failure whose cause is whitespace, and one
+    that reaches AWS before anything here explains it.
+
+    Trimmed rather than only compared, so a value that survives is also the value
+    used: an address with a trailing space is a `From:` header with one. */
+let configured = (key: string): option<string> =>
+  switch Util_LocalConfig.get(key) {
+  | Some(_) as v => v
+  | None => Pulumi.Config.make(Some("platform"))->Pulumi.Config.get(key)
+  }->Option.flatMap(value => {
+    let trimmed = value->String.trim
+    trimmed === "" ? None : Some(trimmed)
+  })
+
+/** The transports a deployment can choose between for the EMAIL channel. The name travels to the
+    Lambdas, so it is also the wire value — one spelling, not a deploy-time enum
+    and a runtime string that can disagree. */
+type emailProvider =
+  | Ses
+  | Log
+
+let emailProviderName = (provider: emailProvider): string =>
+  switch provider {
+  | Ses => "ses"
+  | Log => "log"
+  }
+
+/**
+Which transport this stack asked for. SES is the default, so a deployment that
+says nothing gets the real one — the safe direction is that mail works, and a
+stack opting out of sending says so explicitly.
+
+An unrecognised value is refused rather than defaulted. Falling back to SES on a
+typo would provision a real identity for a stack that asked to only log, which
+is the one mistake this key exists to prevent.
+*/
+let parseEmailProvider = (raw: string): emailProvider =>
+  switch raw->String.trim->String.toLowerCase {
+  | "ses" => Ses
+  | "log" => Log
+  | other =>
+    JsError.throwWithMessage(
+      `platform:${emailProviderKey} is "${other}", which is not an email provider.\n` ++
+      `  Known values: "ses" (default — a verified SES identity) and "log" ` ++
+      `(writes each message to the log, sends nothing).`,
+    )
+  }
+
+let emailProvider = (): emailProvider =>
+  configured(emailProviderKey)->Option.mapOr(Ses, parseEmailProvider)
+
+/** The `From:` a log-transport deployment presents as when the stack named no
+    address.
+
+    Hard-coded where the SES address is required, and the asymmetry follows from
+    what the value is for: a logged message reaches nobody, so there is nothing to
+    verify and nothing that differs per environment. `.test` is reserved for
+    exactly this (RFC 6761) — it can never resolve, so an address escaping into a
+    fixture cannot reach a real inbox. */
+let logDefaultAddress = "notifications@online-shop.test"
+
+/**
+Provision the capability and hand back the platform's messaging handle.
+
+`~name` is used only by the SES arm, which is the only arm with a resource: the
+log transport is a runtime decision carried in an environment variable, so choosing it
+creates nothing and costs nothing to leave configured on a stack that is torn
+down and rebuilt.
+*/
+let make = (
+  ~name: string,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+): ReventlessInfra.Platform.messagingSender => {
+  // Read whether or not there is an email sender: the SMS half is independent,
+  // and a stack may state one without the other.
+  let smsSender = configured(smsSenderKey)->Option.map(Pulumi.Input.make)
+  let chosen = emailProvider()
+  let displayName = configured(emailSenderNameKey)
+  let providerInput = Pulumi.Input.make(chosen->emailProviderName)
+
+  switch (chosen, configured(emailSenderKey)) {
+  // Asked for SES and named no address. Nothing is provisioned, and the deploy
+  // gate refuses this the moment a plugin declares it needs messaging — here
+  // rather than there because this module has no view of what the plugins want.
+  | (Ses, None) => {emailProvider: providerInput, smsSender: ?smsSender}
+  | (Ses, Some(address)) => {
+      emailSender: Capability_Messaging_Ses.emailSender(~name, ~address, ~displayName, ~opts?),
+      emailProvider: providerInput,
+      smsSender: ?smsSender,
+    }
+  | (Log, address) => {
+      emailSender: Pulumi.Input.make(
+        Reventless.Messaging.fromHeader(
+          ~displayName,
+          ~address=address->Option.getOr(logDefaultAddress),
+        ),
+      ),
+      emailProvider: providerInput,
+      smsSender: ?smsSender,
+    }
+  }
+}

package/src/capability/Capability_Messaging.res.mjs

@@ -0,0 +1,96 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Messaging$Reventless from "@reventlessdev/reventless-spec/src/semantic/Messaging.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../util/Util_LocalConfig.res.mjs";
+import * as Capability_Messaging_Ses$ReventlessAws from "./Capability_Messaging_Ses.res.mjs";
+
+let emailProviderKey = "messagingEmailProvider";
+
+let emailSenderKey = "messagingEmailSender";
+
+let emailSenderNameKey = "messagingEmailSenderName";
+
+let smsSenderKey = "messagingSmsSender";
+
+function configured(key) {
+  let v = Util_LocalConfig$ReventlessAws.get(key);
+  return Stdlib_Option.flatMap(v !== undefined ? v : new Pulumi.Config("platform").get(key), value => {
+    let trimmed = value.trim();
+    if (trimmed === "") {
+      return;
+    } else {
+      return trimmed;
+    }
+  });
+}
+
+function emailProviderName(provider) {
+  if (provider === "Ses") {
+    return "ses";
+  } else {
+    return "log";
+  }
+}
+
+function parseEmailProvider(raw) {
+  let other = raw.trim().toLowerCase();
+  switch (other) {
+    case "log" :
+      return "Log";
+    case "ses" :
+      return "Ses";
+    default:
+      return Stdlib_JsError.throwWithMessage(`platform:` + emailProviderKey + ` is "` + other + `", which is not an email provider.\n  Known values: "ses" (default — a verified SES identity) and "log" (writes each message to the log, sends nothing).`);
+  }
+}
+
+function emailProvider() {
+  return Stdlib_Option.mapOr(configured(emailProviderKey), "Ses", parseEmailProvider);
+}
+
+let logDefaultAddress = "notifications@online-shop.test";
+
+function make(name, opts) {
+  let smsSender = Stdlib_Option.map(configured(smsSenderKey), prim => prim);
+  let chosen = emailProvider();
+  let displayName = configured(emailSenderNameKey);
+  let providerInput = emailProviderName(chosen);
+  let match = configured(emailSenderKey);
+  if (chosen === "Ses") {
+    if (match !== undefined) {
+      return {
+        emailSender: Capability_Messaging_Ses$ReventlessAws.emailSender(name, match, displayName, opts),
+        smsSender: smsSender,
+        emailProvider: providerInput
+      };
+    } else {
+      return {
+        smsSender: smsSender,
+        emailProvider: providerInput
+      };
+    }
+  } else {
+    return {
+      emailSender: Messaging$Reventless.fromHeader(displayName, Stdlib_Option.getOr(match, logDefaultAddress)),
+      smsSender: smsSender,
+      emailProvider: providerInput
+    };
+  }
+}
+
+export {
+  emailProviderKey,
+  emailSenderKey,
+  emailSenderNameKey,
+  smsSenderKey,
+  configured,
+  emailProviderName,
+  parseEmailProvider,
+  emailProvider,
+  logDefaultAddress,
+  make,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/capability/Capability_Messaging_Ses.res

@@ -1,10 +1,11 @@
-// A verified SES sender identity, provisioned with the framework's house
-// conventions applied — the backing for the messaging capability's email channel.
+// A verified SES sender identity — the email channel's real transport.
 //
-// The identity is the whole of the provisioning: SES sends from a verified
-// address, and everything else a send needs travels on the message. So this
-// helper exists to make the sender a deploy-time decision with one owner rather
-// than an environment variable each stack spells for itself.
+// Provisioning only. Which transport a deployment uses, and what address it
+// sends from, are read by `Capability_Messaging`, which is the entry point a
+// platform root calls; this module receives a resolved address and creates the
+// identity for it. Split that way because a deployment can choose *not* to have
+// an SES identity, and a module that read its own config could not be left
+// uncalled without also leaving the config unread.
 //
 // **Verification is not instant and not automatic.** Creating the identity asks
 // AWS to send a confirmation mail to the address; until somebody follows it, SES
@@ -18,14 +19,26 @@
 
 open PulumiAws
 
-/** Declare the sender address and hand back the platform's messaging handle.
-    `~email` is the `From:` every message this deployment sends carries. */
-let make = (
+/**
+Create the identity and hand back the `From:` it sends as.
+
+`~name` is the Pulumi resource name — a URN rather than a setting, so it stays in
+code: moving it to config would replace the resource whenever a stack spelled it
+differently.
+
+The identity is created for the bare address, because SES verifies an address and
+not a header; the display name is applied afterwards, to the value the send path
+reads. Applied over the identity's own output rather than over the configured
+string, so the sender a Lambda is handed still depends on the resource existing.
+*/
+let emailSender = (
   ~name: string,
-  ~email: string,
+  ~address: string,
+  ~displayName: option<string>,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
-): ReventlessInfra.Platform.messagingSender => {
-  let identity = SES.EmailIdentity.make(~name, ~args={email: email}, ~opts?)
-
-  {emailSender: identity.email->Pulumi.Output.asInput}
+): Pulumi.Input.t<string> => {
+  let identity = SES.EmailIdentity.make(~name, ~args={email: address}, ~opts?)
+  identity.email
+  ->Pulumi.Output.apply(verified => Reventless.Messaging.fromHeader(~displayName, ~address=verified))
+  ->Pulumi.Output.asInput
 }

package/src/capability/Capability_Messaging_Ses.res.mjs

@@ -2,17 +2,16 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Messaging$Reventless from "@reventlessdev/reventless-spec/src/semantic/Messaging.res.mjs";
 
-function make(name, email, opts) {
+function emailSender(name, address, displayName, opts) {
   let identity = new (Aws.ses.EmailIdentity)(name, {
-    email: email
+    email: address
   }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
-  return {
-    emailSender: identity.email
-  };
+  return identity.email.apply(verified => Messaging$Reventless.fromHeader(displayName, verified));
 }
 
 export {
-  make,
+  emailSender,
 }
 /* @pulumi/aws Not a pure module */

package/tests/Capability_MessagingTest.res

@@ -0,0 +1,100 @@
+open JestGlobals
+
+// Which transport a stack mails through, and who it sends as. There is no
+// default address: a placeholder would provision an identity nobody can verify,
+// so "unset" has to survive the whole way to the deploy gate as absence rather
+// than as an address.
+
+module Messaging = Capability_Messaging
+
+let withEnv = (key, value, f) => {
+  Dict.set(NodeProcess.env, key, value)
+  let result = f()
+  Dict.delete(NodeProcess.env, key)
+  result
+}
+
+describe("Capability_Messaging — reading a configured value", () => {
+  // Only the env-var rung is reachable here: the rungs below it end at
+  // `Pulumi.Config`, which needs a deploy-time runtime this suite does not have.
+  // `configured` returns before touching it whenever the variable is set.
+  testSync("an address set in the environment is the sender", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "mail@shop.test", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(Some("mail@shop.test"))
+  })
+
+  // A stray `REVENTLESS_MESSAGING_EMAIL_SENDER=` in CI, or a blank line in the
+  // sidecar. Reading it as an address asks SES for an identity with none.
+  testSync("an empty value is not an address", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(None)
+  })
+
+  // The one that is not obviously empty: a key left with a space after the colon.
+  // It reached SES as an identity request for " " before this was trimmed.
+  testSync("a whitespace-only value is not an address either", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "   ", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(None)
+  })
+
+  testSync("a surviving value is the trimmed one", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "  mail@shop.test  ", () =>
+      Messaging.configured(Messaging.emailSenderKey)
+    )
+    expect(sender)->toEqual(Some("mail@shop.test"))
+  })
+
+  testSync("the sms sender reads off its own key", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_SMS_SENDER", "+15550100", () =>
+      Messaging.configured(Messaging.smsSenderKey)
+    )
+    expect(sender)->toEqual(Some("+15550100"))
+  })
+})
+
+describe("Capability_Messaging — choosing a transport", () => {
+  testSync("ses and log are the two a stack can name", () => {
+    let pair: (Messaging.emailProvider, Messaging.emailProvider) = (Ses, Log)
+    expect((Messaging.parseEmailProvider("ses"), Messaging.parseEmailProvider("log")))->toEqual(pair)
+  })
+
+  // Config files are written by hand; a capitalised or padded value means what it
+  // says, and refusing it would be pedantry rather than safety.
+  testSync("the value is read case- and whitespace-insensitively", () => {
+    expect(Messaging.parseEmailProvider("  LOG "))->toEqual(Messaging.Log)
+  })
+
+  // The one that matters: defaulting a typo to SES would provision a real
+  // identity for a stack that asked to only log.
+  testSync("an unrecognised transport is refused, not defaulted", () => {
+    let outcome = try {
+      let _ = Messaging.parseEmailProvider("smtp")
+      None
+    } catch {
+    | JsExn(e) => e->JsExn.message
+    }
+    expect(outcome->Option.getOr("")->String.includes("is not an email provider"))->toBe(true)
+  })
+
+  // SES is the default so that a deployment saying nothing still mails: a stack
+  // that means not to send says so, rather than silence meaning it.
+  testSync("a named transport wins over the default", () => {
+    let chosen = withEnv("REVENTLESS_MESSAGING_EMAIL_PROVIDER", "log", () => Messaging.emailProvider())
+    let expected: Messaging.emailProvider = Log
+    expect(chosen)->toEqual(expected)
+  })
+})
+
+describe("Capability_Messaging — the log transport's default sender", () => {
+  // Hard-coded where the SES address is required, because a logged message
+  // reaches nobody. `.test` can never resolve, so it cannot be a real inbox.
+  testSync("is a reserved address", () => {
+    expect(Messaging.logDefaultAddress->String.endsWith(".test"))->toBe(true)
+  })
+})

package/tests/Capability_MessagingTest.res.mjs

@@ -0,0 +1,85 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Capability_Messaging$ReventlessAws from "../src/capability/Capability_Messaging.res.mjs";
+
+function withEnv(key, value, f) {
+  process.env[key] = value;
+  let result = f();
+  Stdlib_Dict.$$delete(process.env, key);
+  return result;
+}
+
+globalThis.describe("Capability_Messaging — reading a configured value", () => {
+  globalThis.test("an address set in the environment is the sender", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "mail@shop.test", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual("mail@shop.test");
+  });
+  globalThis.test("an empty value is not an address", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual(undefined);
+  });
+  globalThis.test("a whitespace-only value is not an address either", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "   ", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual(undefined);
+  });
+  globalThis.test("a surviving value is the trimmed one", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_EMAIL_SENDER", "  mail@shop.test  ", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.emailSenderKey));
+    globalThis.expect(sender).toEqual("mail@shop.test");
+  });
+  globalThis.test("the sms sender reads off its own key", () => {
+    let sender = withEnv("REVENTLESS_MESSAGING_SMS_SENDER", "+15550100", () => Capability_Messaging$ReventlessAws.configured(Capability_Messaging$ReventlessAws.smsSenderKey));
+    globalThis.expect(sender).toEqual("+15550100");
+  });
+});
+
+globalThis.describe("Capability_Messaging — choosing a transport", () => {
+  globalThis.test("ses and log are the two a stack can name", () => {
+    globalThis.expect([
+      Capability_Messaging$ReventlessAws.parseEmailProvider("ses"),
+      Capability_Messaging$ReventlessAws.parseEmailProvider("log")
+    ]).toEqual([
+      "Ses",
+      "Log"
+    ]);
+  });
+  globalThis.test("the value is read case- and whitespace-insensitively", () => {
+    globalThis.expect(Capability_Messaging$ReventlessAws.parseEmailProvider("  LOG ")).toEqual("Log");
+  });
+  globalThis.test("an unrecognised transport is refused, not defaulted", () => {
+    let outcome;
+    try {
+      Capability_Messaging$ReventlessAws.parseEmailProvider("smtp");
+      outcome = undefined;
+    } catch (raw_e) {
+      let e = Primitive_exceptions.internalToException(raw_e);
+      if (e.RE_EXN_ID === "JsExn") {
+        outcome = Stdlib_JsExn.message(e._1);
+      } else {
+        throw e;
+      }
+    }
+    globalThis.expect(Stdlib_Option.getOr(outcome, "").includes("is not an email provider")).toBe(true);
+  });
+  globalThis.test("a named transport wins over the default", () => {
+    let chosen = withEnv("REVENTLESS_MESSAGING_EMAIL_PROVIDER", "log", () => Capability_Messaging$ReventlessAws.emailProvider());
+    globalThis.expect(chosen).toEqual("Log");
+  });
+});
+
+globalThis.describe("Capability_Messaging — the log transport's default sender", () => {
+  globalThis.test("is a reserved address", () => {
+    globalThis.expect(Capability_Messaging$ReventlessAws.logDefaultAddress.endsWith(".test")).toBe(true);
+  });
+});
+
+let Messaging;
+
+export {
+  Messaging,
+  withEnv,
+}
+/*  Not a pure module */