@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/src/Platform.res.mjs

@@ -16,7 +16,9 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
@@ -150,6 +152,7 @@ let messagingEmailProviderRef = {
 };
 
 function MakeWithConfig(Config) {
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -211,7 +214,7 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -687,7 +690,8 @@ function MakeWithConfig(Config) {
   };
   let provisionPgChangeFeedRelay = () => {
     let feedTargets = (connectionConfig, logName, feed, isClassic) => Stdlib_Array.filterMap(PgProjectionFeed$ReventlessAws.getFeedQueues(), fq => {
-      if (isClassic ? fq.includeClassic : fq.includeDcb) {
+      let included = isClassic ? fq.includeClassic : fq.includeDcb;
+      if (included) {
         return {
           connectionConfig: connectionConfig,
           logName: logName,
@@ -1438,10 +1442,13 @@ function MakeWithConfig(Config) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }
@@ -1549,6 +1556,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1610,7 +1618,7 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2086,7 +2094,8 @@ function Make($star) {
   };
   let provisionPgChangeFeedRelay = () => {
     let feedTargets = (connectionConfig, logName, feed, isClassic) => Stdlib_Array.filterMap(PgProjectionFeed$ReventlessAws.getFeedQueues(), fq => {
-      if (isClassic ? fq.includeClassic : fq.includeDcb) {
+      let included = isClassic ? fq.includeClassic : fq.includeDcb;
+      if (included) {
         return {
           connectionConfig: connectionConfig,
           logName: logName,
@@ -2812,10 +2821,13 @@ function Make($star) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }

package/src/Platform_Casts.res

@@ -45,7 +45,9 @@
 // The "proper" fix — `inboundAppSyncResolverParams<'runtimeParts>` — would
 // require propagating `'runtimeParts` through `platformHooks`, `Plugin_Builder`,
 // and `Admin`.
-external asLambdaRuntime: ReventlessCore.Runtime.environment<unknown> => ReventlessCore.Runtime.environment<Util.Lambda.runtimeParts> = "%identity"
+external asLambdaRuntime: ReventlessCore.Runtime.environment<
+  unknown,
+> => ReventlessCore.Runtime.environment<Util.Lambda.runtimeParts> = "%identity"
 
 // ─────────────────────────────────────────────────────────────────────────────
 // CAST 2 — hook callback arguments (unknown → concrete component types)
@@ -62,8 +64,13 @@ external asLambdaRuntime: ReventlessCore.Runtime.environment<unknown> => Reventl
 // `reventless-core` cannot import `DcbEventLog.component`, `CommandTopic.component`,
 // or `CommandTopic_Adapter.remoteChannel`. The AWS platform registers these
 // callbacks and is the only caller, always passing the correct concrete value.
-external asDcbEventLogComponent: unknown => ReventlessCore.Component.t<unit, ReventlessCore.DcbEventLog.outputs, unit> = "%identity"
-external asDcbCommandTopicComponent: unknown => ReventlessCore.CommandTopic.component<unit> = "%identity"
+external asDcbEventLogComponent: unknown => ReventlessCore.Component.t<
+  unit,
+  ReventlessCore.DcbEventLog.outputs,
+  unit,
+> = "%identity"
+external asDcbCommandTopicComponent: unknown => ReventlessCore.CommandTopic.component<unit> =
+  "%identity"
 external asDcbEventLog: unknown => ReventlessCore.DcbEventLog.component = "%identity"
 external asRemoteChannel: unknown => ReventlessCore.CommandTopic_Adapter.remoteChannel = "%identity"
 
@@ -103,4 +110,6 @@ external asSqsChannelParts: 'a => Util.SQS.channelParts = "%identity"
 // level — it is a mismatch between ReScript's JS boxing convention and Pulumi's
 // Proxy-based lazy evaluation model.
 external _toUnknown: 'a => unknown = "%identity"
-let wrapHookedValue: 'a => ReventlessCore.Plugin_Helpers.hookedValue<unknown> = x => {val: x->_toUnknown}
+let wrapHookedValue: 'a => ReventlessCore.Plugin_Helpers.hookedValue<unknown> = x => {
+  val: x->_toUnknown,
+}

package/src/Platform_Stack.res

@@ -12,15 +12,24 @@ type cognitoUserPool = {
     is declared with the trigger's ARN), while the mutation that writes it is
     provisioned after the API — see [Auth_ActiveRoleStore.res]. */
   activeRoleTable: Auth_ActiveRoleStore.storeTable,
+  /** The sign-in attribute this stack created the pool with. `None` in BYO mode:
+    the pool's own choice was made elsewhere and no lookup here reads it back,
+    so reporting one would be a guess. */
+  loginIdentifier: option<Auth_LoginIdentifier.t>,
 }
 
 /**
  * Resolve the Cognito UserPool used by AppSync auth. Two modes:
  *
  * - **Auto**: no `platform:identityProviderId` config — create a fresh UserPool
- *   with SPA-friendly defaults (email username, 12-char password policy, no
- *   MFA, admin-only user creation). Caller is responsible for creating
- *   groups (`Admin`, `User`, …) and users via the AWS console / CLI.
+ *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
+ *   says otherwise, 12-char password policy, no MFA, and admin-only user
+ *   creation unless `platform:signUpMode` says otherwise), plus the
+ *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   default naming it. What it does **not** create is the first administrator:
+ *   accounts are not stack resources, and a pool full of them is not something a
+ *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
+ *   and no step of this needs the AWS console.
  *
  * - **BYO**: provider ID provided — skip pool creation, look up the existing
  *   pool via `aws.cognito.getUserPool` for its ARN. Lookup precedence
@@ -38,10 +47,21 @@ type cognitoUserPool = {
  * Pulumi can destroy without touching the parent pool).
  *
  * Always exports `identityProviderId`, `identityProviderClientId`,
- * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged` and
- * `activeRoleStore` as stack outputs so downstream stacks (and Stage D AppSync
- * wiring) can read them via `StackReference` — plus, for one release, the
- * deprecated `cognito*` spellings of the first five.
+ * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged`,
+ * `identityProviderLoginIdentifier`, `identityProviderAdminGroup` and
+ * `activeRoleStore` as stack outputs so
+ * downstream stacks (and Stage D AppSync wiring) can read them via
+ * `StackReference` — plus, for one release, the deprecated `cognito*` spellings
+ * of the first five.
+ *
+ * 🚨 In auto mode `platform:loginIdentifier` picks the sign-in attribute, and it
+ * is the one setting no later deploy can correct: changing it replaces the pool
+ * and empties it. Absent means `email`. See [Auth_LoginIdentifier].
+ *
+ * `platform:signUpMode` decides whether a stranger may register themselves.
+ * Absent means `adminOnly`. It is the opposite kind of setting — an ordinary
+ * in-place update, free and reversible on a pool full of accounts — but on a
+ * pool shared between stacks the flip is pool-wide. See [Auth_SignUpMode].
  *
  * Also provisions the role-state table and the pre-token-generation trigger that
  * narrows `cognito:groups` to a caller's chosen role. They belong here rather
@@ -86,6 +106,42 @@ let _identityProviderId = (~cfg: Pulumi.Config.t): option<string> => {
   }
 }
 
+/** The sign-in attribute for a pool this stack creates, from
+  `platform:loginIdentifier` (or `REVENTLESS_LOGIN_IDENTIFIER` / the sidecar).
+
+  Absent means `email`, which is what every pool so far was created with. An
+  unrecognised spelling fails the deploy — see [Auth_LoginIdentifier] for why
+  defaulting past a typo here is unrecoverable. */
+let _loginIdentifier = (~cfg: Pulumi.Config.t): Auth_LoginIdentifier.t => {
+  let raw = switch Util_LocalConfig.get("loginIdentifier") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("loginIdentifier")
+  }
+  switch Auth_LoginIdentifier.parse(raw) {
+  | Ok(identifier) => identifier
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
+/** Whether a stranger may create their own account in a pool this stack creates,
+  from `platform:signUpMode` (or `REVENTLESS_SIGN_UP_MODE` / the sidecar).
+
+  Absent means `adminOnly`, which is what every pool so far was created with, so
+  an existing stack redeploys unchanged. Unlike the sign-in attribute this is an
+  ordinary in-place update on a live pool — but an unrecognised spelling still
+  fails the deploy, because defaulting past it would refuse every registration
+  while the config read as if it allowed them. See [Auth_SignUpMode]. */
+let _signUpMode = (~cfg: Pulumi.Config.t): Auth_SignUpMode.t => {
+  let raw = switch Util_LocalConfig.get("signUpMode") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("signUpMode")
+  }
+  switch Auth_SignUpMode.parse(raw) {
+  | Ok(mode) => mode
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
   let existingPoolId = _identityProviderId(~cfg)
@@ -183,11 +239,19 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
       activeRoleTable,
+      loginIdentifier: None,
     }
 
   | None =>
+    let loginIdentifier = _loginIdentifier(~cfg)
+    let signUpMode = _signUpMode(~cfg)
+    // In place, unlike the sign-in attribute below: `AdminCreateUserConfig` is a
+    // member of `UpdateUserPoolRequest`, so flipping this on a pool full of
+    // accounts is an ordinary update rather than a replacement.
     let adminConfig: PulumiAws.Cognito.UserPool.adminCreateUserConfig = {
-      allowAdminCreateUserOnly: Pulumi.Input.make(true),
+      allowAdminCreateUserOnly: Pulumi.Input.make(
+        signUpMode->Auth_SignUpMode.allowAdminCreateUserOnly,
+      ),
     }
     let pwdPolicy: PulumiAws.Cognito.UserPool.passwordPolicy = {
       minimumLength: Pulumi.Input.make(12),
@@ -204,7 +268,13 @@ let _resolveUncached = (): cognitoUserPool => {
       ~name="HostUiPool",
       ~args={
         adminCreateUserConfig: Pulumi.Input.make(adminConfig),
-        usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
+        // 🚨 Changing this on a live stack replaces the pool and empties it —
+        // Cognito has no update for the sign-in attribute. Chosen once, here.
+        usernameAttributes: Pulumi.Input.make(
+          loginIdentifier
+          ->Auth_LoginIdentifier.usernameAttributes
+          ->Array.map(Pulumi.Input.make),
+        ),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
         lambdaConfig: Pulumi.Input.make({
@@ -219,6 +289,23 @@ let _resolveUncached = (): cognitoUserPool => {
       },
     )
 
+    // The administrator group, declared beside the pool that holds it.
+    //
+    // Auto mode only, and the restriction is the point: a group is a pool-level
+    // fact, and on a pool this stack does not own those are not this stack's to
+    // declare. Two stacks pointed at one shared provider would each declare this
+    // group, and the second would fail on a name that already exists — the same
+    // split, for the same reason, as [Auth_SignUpMode] and the active-role store.
+    // The BYO half is `provision-admin`, which creates the group beside the first
+    // administrator who needs it.
+    //
+    // An ordinary child resource: the pool is ours, so this needs no out-of-band
+    // call and Pulumi's state stays the authority for whether it exists.
+    let _adminGroup = Util_CognitoGroupUser.addUserGroup(
+      ~name=Reventless.AdminGroup.name,
+      ~userPoolId=pool.id,
+    )
+
     let tokenUnits2: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
       accessToken: Pulumi.Input.make("minutes"),
       idToken: Pulumi.Input.make("minutes"),
@@ -247,6 +334,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable,
+      loginIdentifier: Some(loginIdentifier),
     }
   }
 
@@ -279,11 +367,23 @@ let _resolveUncached = (): cognitoUserPool => {
   let managedStr = Pulumi.Output.make(result.managed ? "true" : "false")
   let regionOutput = Pulumi.Output.make(regionStr)
 
+  // The sign-in attribute is unchangeable after creation, so the value a pool was
+  // born with has to be readable somewhere other than the source that has since
+  // moved on. `unknown` for a BYO pool: this stack did not choose it and does not
+  // read it back.
+  let loginIdentifierStr = Pulumi.Output.make(
+    switch result.loginIdentifier {
+    | Some(identifier) => Auth_LoginIdentifier.toString(identifier)
+    | None => "unknown"
+    },
+  )
+
   Pulumi.Pulumi.export("identityProviderId", result.poolId)
   Pulumi.Pulumi.export("identityProviderClientId", result.clientId)
   Pulumi.Pulumi.export("identityProviderArn", result.poolArn)
   Pulumi.Pulumi.export("identityProviderRegion", regionOutput)
   Pulumi.Pulumi.export("identityProviderManaged", managedStr)
+  Pulumi.Pulumi.export("identityProviderLoginIdentifier", loginIdentifierStr)
 
   // Deprecated spellings — see above.
   Pulumi.Pulumi.export("cognitoUserPoolId", result.poolId)
@@ -292,6 +392,16 @@ let _resolveUncached = (): cognitoUserPool => {
   Pulumi.Pulumi.export("cognitoRegion", regionOutput)
   Pulumi.Pulumi.export("cognitoUserPoolManaged", managedStr)
 
+  // The group that administers this deployment, readable without reading source.
+  // `provision-admin` puts its first user in it, and a deployment overriding who
+  // is elevated needs to know which name it is overriding.
+  //
+  // Exported in both pool modes although only auto mode *declares* the group: the
+  // name is what a caller needs either way, and an output that appeared in one
+  // mode and not the other would read as "there is no administrator group here"
+  // rather than "this stack did not create it".
+  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking
   // rather than a value anything is meant to copy into a config.

package/src/Platform_Stack.res.mjs

@@ -4,10 +4,15 @@ import * as Aws from "@pulumi/aws";
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "./adapter/Auth/Auth_LoginIdentifier.res.mjs";
+import * as Util_CognitoGroupUser$ReventlessAws from "./util/Util_CognitoGroupUser.res.mjs";
 import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
 import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
@@ -35,6 +40,28 @@ function _identityProviderId(cfg) {
   }
 }
 
+function _loginIdentifier(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("loginIdentifier");
+  let raw = v !== undefined ? v : cfg.get("loginIdentifier");
+  let identifier = Auth_LoginIdentifier$ReventlessAws.parse(raw);
+  if (identifier.TAG === "Ok") {
+    return identifier._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(identifier._0);
+  }
+}
+
+function _signUpMode(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("signUpMode");
+  let raw = v !== undefined ? v : cfg.get("signUpMode");
+  let mode = Auth_SignUpMode$ReventlessAws.parse(raw);
+  if (mode.TAG === "Ok") {
+    return mode._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(mode._0);
+  }
+}
+
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let existingPoolId = _identityProviderId(cfg);
@@ -77,11 +104,14 @@ function _resolveUncached() {
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
       managed: false,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: undefined
     };
   } else {
+    let loginIdentifier = _loginIdentifier(cfg);
+    let signUpMode = _signUpMode(cfg);
     let adminConfig = {
-      allowAdminCreateUserOnly: true
+      allowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     };
     let pwdPolicy_minimumLength = 12;
     let pwdPolicy_requireLowercase = true;
@@ -98,11 +128,12 @@ function _resolveUncached() {
         preTokenGeneration: activeRoleTrigger.functionArn
       },
       adminCreateUserConfig: adminConfig,
-      usernameAttributes: ["email"],
+      usernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier).map(prim => prim),
       passwordPolicy: pwdPolicy,
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -129,23 +160,28 @@ function _resolveUncached() {
       clientId: client$1.id,
       poolArn: pool.arn,
       managed: true,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: loginIdentifier
     };
   }
   Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   let managedStr = Pulumi.output(result.managed ? "true" : "false");
   let regionOutput = Pulumi.output(regionStr);
+  let identifier = result.loginIdentifier;
+  let loginIdentifierStr = Pulumi.output(identifier !== undefined ? Auth_LoginIdentifier$ReventlessAws.toString(identifier) : "unknown");
   Pulumi$Pulumi.$$export("identityProviderId", result.poolId);
   Pulumi$Pulumi.$$export("identityProviderClientId", result.clientId);
   Pulumi$Pulumi.$$export("identityProviderArn", result.poolArn);
   Pulumi$Pulumi.$$export("identityProviderRegion", regionOutput);
   Pulumi$Pulumi.$$export("identityProviderManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderLoginIdentifier", loginIdentifierStr);
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }
@@ -168,6 +204,8 @@ export {
   log,
   _deprecatedPoolIdKey,
   _identityProviderId,
+  _loginIdentifier,
+  _signUpMode,
   _resolveUncached,
   _cached,
   resolveCognitoUserPool,

package/src/adapter/Api/AppSyncEventsSigner_Ops.res

@@ -17,7 +17,9 @@ let sha256hex = (data: string): string =>
 let hmacFromStr = (key: string, data: string): NodeCrypto.buffer =>
   NodeCrypto.createHmac("sha256", key)->NodeCrypto.hmacUpdate(data)->NodeCrypto.hmacDigestBuffer
 let hmacFromBuf = (key: NodeCrypto.buffer, data: string): NodeCrypto.buffer =>
-  NodeCrypto.createHmacFromBuffer("sha256", key)->NodeCrypto.hmacUpdate(data)->NodeCrypto.hmacDigestBuffer
+  NodeCrypto.createHmacFromBuffer("sha256", key)
+  ->NodeCrypto.hmacUpdate(data)
+  ->NodeCrypto.hmacDigestBuffer
 
 // ── SigV4 ───────────────────────────────────────────────────────────────────
 
@@ -71,7 +73,10 @@ let signedHeaders = (
   let kRegion = hmacFromBuf(kDate, region)
   let kService = hmacFromBuf(kRegion, "appsync")
   let kSigning = hmacFromBuf(kService, "aws4_request")
-  let signature = NodeCrypto.createHmacFromBuffer("sha256", kSigning)->NodeCrypto.hmacUpdate(stringToSign)->NodeCrypto.hmacDigest("hex")
+  let signature =
+    NodeCrypto.createHmacFromBuffer("sha256", kSigning)
+    ->NodeCrypto.hmacUpdate(stringToSign)
+    ->NodeCrypto.hmacDigest("hex")
 
   let authorization = `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaderList}, Signature=${signature}`
   let out = Dict.fromArray(sorted)
@@ -115,5 +120,4 @@ let postEvent = async (
 
 // AppSync Events channel segments allow only [A-Za-z0-9-]; anything else
 // collapses to `-`. Mirrors the UI's AutoLive.normalizeSegment.
-let pathSegment = (value: string): string =>
-  value->String.replaceRegExp(%re("/[^A-Za-z0-9-]/g"), "-")
+let pathSegment = (value: string): string => value->String.replaceRegExp(/[^A-Za-z0-9-]/g, "-")

package/src/adapter/Api/AppSync_EventsApi.res

@@ -43,7 +43,6 @@
     installed, subscribe goes through the API-level auth modes only
     (single-tenant open-core case).
 */
-
 module Api = PulumiAws.AwsNative.AppSync.Api
 module ChannelNamespace = PulumiAws.AwsNative.AppSync.ChannelNamespace
 
@@ -158,15 +157,18 @@ let make = (
   let subscribeAuth = subscribeAuthRef.contents
   let codeHandlersInput: option<Pulumi.Input.t<string>> =
     subscribeAuth->Option.map(c => c.codeHandlers->Pulumi.Input.make)
-  let handlerConfigsInput: option<Pulumi.Input.t<ChannelNamespace.handlerConfigsArgs>> =
-    subscribeAuth->Option.map(c => {
+  let handlerConfigsInput: option<
+    Pulumi.Input.t<ChannelNamespace.handlerConfigsArgs>,
+  > = subscribeAuth->Option.map(c =>
+    {
       ChannelNamespace.onSubscribe: {
         ChannelNamespace.behavior: ChannelNamespace.handlerBehaviorCode->Pulumi.Input.make,
         integration: {
           ChannelNamespace.dataSourceName: c.dataSourceName,
         }->Pulumi.Input.make,
       }->Pulumi.Input.make,
-    }->Pulumi.Input.make)
+    }->Pulumi.Input.make
+  )
   let defaultNamespace = ChannelNamespace.make(
     ~name=name ++ "DefaultNS",
     ~args={
@@ -182,14 +184,12 @@ let make = (
   // API-level `defaultPublishAuthModes` (IAM-only), so authenticated browsers
   // can publish ephemeral payloads on `/client/**` while `/default/**` change
   // descriptors stay Lambda-only.
-  let clientAuthModes: Pulumi.Input.t<
-    array<Pulumi.Input.t<ChannelNamespace.authMode>>,
-  > =
+  let clientAuthModes: Pulumi.Input.t<array<Pulumi.Input.t<ChannelNamespace.authMode>>> =
     [
-      ({authType: Api.amazonCognitoUserPools->Pulumi.Input.make}: ChannelNamespace.authMode)
-      ->Pulumi.Input.make,
-      ({authType: Api.awsIam->Pulumi.Input.make}: ChannelNamespace.authMode)
-      ->Pulumi.Input.make,
+      (
+        {authType: Api.amazonCognitoUserPools->Pulumi.Input.make}: ChannelNamespace.authMode
+      )->Pulumi.Input.make,
+      ({authType: Api.awsIam->Pulumi.Input.make}: ChannelNamespace.authMode)->Pulumi.Input.make,
     ]->Pulumi.Input.make
   let clientNamespace = ChannelNamespace.make(
     ~name=name ++ "ClientNS",
@@ -208,6 +208,4 @@ let make = (
 /** HTTP endpoint URL for use as Lambda `APPSYNC_ENDPOINT` env var.
     Constructs `https://{dns.http}` from the raw domain name in the API output. */
 let httpEndpoint = (eventsApi: t): Pulumi.Output.t<string> =>
-  eventsApi.api.dns->Pulumi.Output.apply(dns =>
-    "https://" ++ dns.http->Option.getOr("")
-  )
+  eventsApi.api.dns->Pulumi.Output.apply(dns => "https://" ++ dns.http->Option.getOr(""))

package/src/adapter/Api/AppSync_Resolver_Native.res

@@ -2,7 +2,6 @@
     `PulumiAws.AppSync.Resolver` that uses `@pulumi/aws-native` (Cloud Control
     API) so the CFN handler can internally wait out schema -> resolver
     propagation. See docs/plans/done/appsync-resolver-aws-native.md. */
-
 module Native = PulumiAws.AwsNative.AppSync.Resolver
 module Functions = PulumiAws.AppSync.Resolver.Functions
 
@@ -28,7 +27,7 @@ let makeUnitJsResolver = (
       code,
       runtime: Native.appsyncJs->Pulumi.Input.make,
     },
-    ~opts=opts,
+    ~opts,
   )
 
 let makeSubscriptionResolverCode = (~filter: option<string>): string => {
@@ -62,7 +61,7 @@ let makeSubscriptionResolver = (
       code: makeSubscriptionResolverCode(~filter=subscriptionFilter)->Pulumi.Input.make,
       runtime: Native.appsyncJs->Pulumi.Input.make,
     },
-    ~opts=opts,
+    ~opts,
   )
 
 let makePipelineJsResolver = (
@@ -89,5 +88,5 @@ let makePipelineJsResolver = (
         }: Native.pipelineConfig
       )->Pulumi.Input.make,
     },
-    ~opts=opts,
+    ~opts,
   )