@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.346

package/scripts/ProvisionIdentity.res.mjs

@@ -1,10 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
 import * as DynamoDb_DynamoDb$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DynamoDb.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
 import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
@@ -17,6 +20,8 @@ function parseArgs(argv) {
     _0: {
       poolName: defaultPoolName,
       providerId: undefined,
+      loginIdentifier: Auth_LoginIdentifier$ReventlessAws.default,
+      signUpMode: Auth_SignUpMode$ReventlessAws.default,
       help: false
     }
   };
@@ -31,6 +36,20 @@ function parseArgs(argv) {
       let a = match._0;
       let exit$1 = 0;
       switch (flag) {
+        case "--login-identifier" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_LoginIdentifier$ReventlessAws.parse(value), loginIdentifier => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: loginIdentifier,
+              signUpMode: a.signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--name" :
           if (value !== undefined) {
             acc = {
@@ -38,6 +57,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: value,
                 providerId: a.providerId,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -53,6 +74,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: a.poolName,
                 providerId: value,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -61,6 +84,20 @@ function parseArgs(argv) {
             exit = 1;
           }
           break;
+        case "--sign-up-mode" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_SignUpMode$ReventlessAws.parse(value), signUpMode => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: a.loginIdentifier,
+              signUpMode: signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--help" :
         case "-h" :
           exit$1 = 2;
@@ -77,6 +114,8 @@ function parseArgs(argv) {
           _0: {
             poolName: a.poolName,
             providerId: a.providerId,
+            loginIdentifier: a.loginIdentifier,
+            signUpMode: a.signUpMode,
             help: true
           }
         };
@@ -95,21 +134,36 @@ function parseArgs(argv) {
   return acc;
 }
 
+let _loginIdentifiers = Auth_LoginIdentifier$ReventlessAws.all.map(Auth_LoginIdentifier$ReventlessAws.toString).join(" | ");
+
+let _defaultLoginIdentifier = Auth_LoginIdentifier$ReventlessAws.toString(Auth_LoginIdentifier$ReventlessAws.default);
+
+let _signUpModes = Auth_SignUpMode$ReventlessAws.all.map(Auth_SignUpMode$ReventlessAws.toString).join(" | ");
+
+let _defaultSignUpMode = Auth_SignUpMode$ReventlessAws.toString(Auth_SignUpMode$ReventlessAws.default);
+
 let usage = `
 Provision a Reventless identity provider and its active-role store.
 
   --name <name>          Pool name to create or adopt (default: ` + defaultPoolName + `)
   --provider-id <id>     Use this existing pool instead of creating one; only the
                          store is provisioned
+  --login-identifier <a> Sign-in attribute for a pool this creates: ` + _loginIdentifiers + `
+                         (default: ` + _defaultLoginIdentifier + `). Fixed at creation —
+                         no later change is possible without replacing the pool
+                         and losing every account in it.
+  --sign-up-mode <m>     Whether a stranger may register themselves: ` + _signUpModes + `
+                         (default: ` + _defaultSignUpMode + `). Correctable later, but on a
+                         pool shared between stacks it applies to all of them.
 
 Creates nothing that a platform stack owns, and never attaches a trigger.
 Region and credentials come from the environment, as for any AWS SDK call.
 `;
 
-function poolSettings(poolName) {
+function poolSettings(poolName, loginIdentifier, signUpMode) {
   return {
     PoolName: poolName,
-    UsernameAttributes: ["email"],
+    UsernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier),
     MfaConfiguration: "OFF",
     Policies: {
       PasswordPolicy: {
@@ -120,7 +174,7 @@ function poolSettings(poolName) {
       }
     },
     AdminCreateUserConfig: {
-      AllowAdminCreateUserOnly: true
+      AllowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     }
   };
 }
@@ -194,10 +248,10 @@ async function resolvePool(args) {
       _0: existing
     };
   }
-  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName)));
+  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName, args.loginIdentifier, args.signUpMode)));
   let id$1 = Stdlib_Option.flatMap(created.UserPool, p => p.Id);
   if (id$1 !== undefined) {
-    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `")`);
+    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `", sign-in on ` + Auth_LoginIdentifier$ReventlessAws.toString(args.loginIdentifier) + `, sign-up ` + Auth_SignUpMode$ReventlessAws.toString(args.signUpMode) + `)`);
     return {
       TAG: "Ok",
       _0: id$1
@@ -305,7 +359,14 @@ or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
 derives the same store, so there is nothing else to configure.
 
 The pre-token-generation trigger is attached by the deploy, not by this script.
-Users and groups are yours to create.`;
+
+Once a stack has deployed against this provider, make the first administrator:
+
+  pnpm exec provision-admin --provider-id ` + providerId + ` --email you@example.com
+
+That is a separate bin because it provisions nothing a stack owns, and because it
+is needed on a pool created here and on one a stack created for itself alike. See
+[ProvisionAdmin].`;
 }
 
 async function run() {
@@ -361,6 +422,10 @@ export {
   Schema,
   defaultPoolName,
   parseArgs,
+  _loginIdentifiers,
+  _defaultLoginIdentifier,
+  _signUpModes,
+  _defaultSignUpMode,
   usage,
   poolSettings,
   findPoolByName,
@@ -373,4 +438,4 @@ export {
   run,
   main,
 }
-/* @aws-sdk/client-dynamodb Not a pure module */
+/* _loginIdentifiers Not a pure module */

package/scripts/ProvisionProvider.res

@@ -0,0 +1,104 @@
+/***
+Which identity provider a provisioning run is about.
+
+Both bins ask the same question and neither should make the operator answer it
+twice. The docs used to say `--provider-id $(pulumi stack output
+identityProviderId)`, which is a command substitution a tool can perform.
+
+🚨 **Three sources, in this order, and the last is a fallback rather than the
+path.** An explicit `--provider-id` wins, then `REVENTLESS_IDENTITY_PROVIDER_ID`
+— the variable [Platform_Stack] reads for the same value, so a CI shell that
+already exports it needs no second spelling — and only then the stack.
+
+Reading the stack works in *both* modes, which is the fact that makes this worth
+doing rather than a convenience for auto deployments only: [Platform_Stack]
+exports `identityProviderId` whether it created the pool or was handed one, so a
+BYO deployment re-exports the provider it was given.
+
+🚨 **It always reports which source answered, and which stack.** `pulumi stack
+output` with no `--stack` reads whichever stack happens to be selected, so a run
+against `alpha` while the operator believes they are on `beta` would succeed —
+in the wrong pool, leaving working accounts somewhere nobody is looking. That is
+worse than failing. So the stack is resolved by name, named in the output, and
+overridable with `--stack`.
+*/
+
+/** Where an id came from, so a run can say so rather than leave it inferred. */
+type source =
+  | Flag
+  | Environment
+  | Stack(string)
+
+let describe = (source: source): string =>
+  switch source {
+  | Flag => "--provider-id"
+  | Environment => "REVENTLESS_IDENTITY_PROVIDER_ID"
+  | Stack(stack) => `stack ${stack}`
+  }
+
+/** The same variable [Platform_Stack] reads for the same value. */
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID"
+
+/** `stdio` leaves stderr to the caller's terminal but keeps stdout, so a Pulumi
+  failure is legible where it happens instead of being swallowed and re-reported
+  as a vaguer message here. */
+let pulumi = (args: array<string>): string =>
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {encoding: "utf8", stdio: ["ignore", "pipe", "ignore"]},
+  )->String.trim
+
+/** The stack the working directory currently has selected. `None` when there is
+  no Pulumi project here, no stack selected, or no `pulumi` on the PATH — all of
+  which are ordinary for someone running against a BYO pool, and none of which
+  should be an error until the id is actually needed. */
+let selectedStack = (): option<string> =>
+  switch pulumi(["stack", "--show-name"]) {
+  | "" => None
+  | name => Some(name)
+  | exception _ => None
+  }
+
+/**
+The provider id a stack exports.
+
+`--stack` is passed explicitly even when it names the already-selected stack, so
+the value read and the name reported cannot drift apart between the two calls.
+*/
+let fromStack = (~stack: string): result<string, string> =>
+  switch pulumi(["stack", "output", "identityProviderId", "--stack", stack]) {
+  | "" =>
+    Error(
+      `stack "${stack}" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`,
+    )
+  | id => Ok(id)
+  | exception _ =>
+    Error(
+      `could not read identityProviderId from stack "${stack}" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`,
+    )
+  }
+
+/**
+The provider this run is about, and where the answer came from.
+
+The error names all three sources rather than only the one that was tried last:
+someone who has no Pulumi project here needs to be told about the flag, and
+someone who has one needs to be told it was consulted and came back empty.
+*/
+let resolve = (~given: option<string>, ~stack: option<string>): result<(string, source), string> =>
+  switch given {
+  | Some(id) => Ok((id, Flag))
+  | None =>
+    switch NodeProcess.env->Dict.get(envKey) {
+    | Some(id) if id->String.trim != "" => Ok((id, Environment))
+    | _ =>
+      switch stack->Option.orElse(selectedStack()) {
+      | None =>
+        Error(
+          `--provider-id is required (or set ${envKey}). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`,
+        )
+      | Some(stack) => fromStack(~stack)->Result.map(id => (id, Stack(stack)))
+      }
+    }
+  }

package/scripts/ProvisionProvider.res.mjs

@@ -0,0 +1,123 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Nodechild_process from "node:child_process";
+
+function describe(source) {
+  if (typeof source !== "object") {
+    if (source === "Flag") {
+      return "--provider-id";
+    } else {
+      return "REVENTLESS_IDENTITY_PROVIDER_ID";
+    }
+  } else {
+    return `stack ` + source._0;
+  }
+}
+
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID";
+
+function pulumi(args) {
+  return Nodechild_process.execFileSync("pulumi", args, {
+    encoding: "utf8",
+    stdio: [
+      "ignore",
+      "pipe",
+      "ignore"
+    ]
+  }).trim();
+}
+
+function selectedStack() {
+  let name;
+  try {
+    name = pulumi([
+      "stack",
+      "--show-name"
+    ]);
+  } catch (exn) {
+    return;
+  }
+  if (name === "") {
+    return;
+  } else {
+    return name;
+  }
+}
+
+function fromStack(stack) {
+  let id;
+  try {
+    id = pulumi([
+      "stack",
+      "output",
+      "identityProviderId",
+      "--stack",
+      stack
+    ]);
+  } catch (exn) {
+    return {
+      TAG: "Error",
+      _0: `could not read identityProviderId from stack "` + stack + `" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`
+    };
+  }
+  if (id === "") {
+    return {
+      TAG: "Error",
+      _0: `stack "` + stack + `" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`
+    };
+  } else {
+    return {
+      TAG: "Ok",
+      _0: id
+    };
+  }
+}
+
+function resolve(given, stack) {
+  if (given !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: [
+        given,
+        "Flag"
+      ]
+    };
+  }
+  let id = process.env[envKey];
+  if (id !== undefined && id.trim() !== "") {
+    return {
+      TAG: "Ok",
+      _0: [
+        id,
+        "Environment"
+      ]
+    };
+  }
+  let stack$1 = Stdlib_Option.orElse(stack, selectedStack());
+  if (stack$1 !== undefined) {
+    return Stdlib_Result.map(fromStack(stack$1), id => [
+      id,
+      {
+        TAG: "Stack",
+        _0: stack$1
+      }
+    ]);
+  } else {
+    return {
+      TAG: "Error",
+      _0: `--provider-id is required (or set ` + envKey + `). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`
+    };
+  }
+}
+
+export {
+  describe,
+  envKey,
+  pulumi,
+  selectedStack,
+  fromStack,
+  resolve,
+}
+/* node:child_process Not a pure module */

package/src/Platform.res

@@ -121,6 +121,31 @@ module MakeWithConfig = (
 ): (
   ReventlessInfra.Platform.T with type api = Types.AppSync.api and type role = Types.AppSync.role
 ) => {
+  // The administrator group reads across every owner, unless the deployment says
+  // otherwise.
+  //
+  // Authorization and owner scoping decide admin-ness independently and nothing
+  // checks that they agree: without this, a deployment gets an administrator who
+  // passes every authorization check and then reads *empty* owner-scoped views.
+  // `Util_OwnerScopeEnv.applyElevatedGroupsDefault` already carries whatever
+  // `OwnerScope.elevatedGroups()` holds into every Lambda's environment — the pipe
+  // was laid and nothing ever put a value in.
+  //
+  // 🚨 **Here, at the entry point, rather than beside the pool that declares the
+  // group.** The value has to be set before the runtime builder composes any
+  // Lambda's environment, and this functor's body runs when the functor is
+  // applied — necessarily before any plugin is built through it. Written into
+  // `Platform_Stack.resolveCognitoUserPool` it would instead depend on *which
+  // caller resolved the pool first*, which is precisely how a feature once
+  // vanished from a deploy with no error and no resource; see the note on
+  // `_resolveUncached`. Ordering that is structural beats ordering that happens
+  // to hold.
+  //
+  // A default, never a forcing: an explicit `setElevatedGroups` in a platform
+  // root — including one naming nobody — means what it says and wins. See
+  // [Reventless.OwnerScope.defaultElevatedGroups].
+  Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+
   // Dispatch per-flavor commandHandlerConfig records to the four runtime
   // builders. Every sub-record is optional; only branches the caller actually
   // supplied propagate, and within each sub-record every field is optional too
@@ -287,7 +312,7 @@ module MakeWithConfig = (
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
         ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group="Admin",
+        ~group=Reventless.AdminGroup.name,
       ),
     )
 
@@ -1759,7 +1784,8 @@ module MakeWithConfig = (
         switch c {
         | ObjectStore({plugin, store}) => Some((plugin, store))
         | Geocoding
-        | Messaging =>
+        | Messaging
+        | IdentityProvider =>
           None
         }
       )
@@ -2826,6 +2852,10 @@ module MakeWithConfig = (
                   `as \`~messagingSender\`. The sender itself is configuration and has no ` ++
                   `default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or ` ++
                   `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++ `\`platform:messagingEmailProvider: log\` to log every message and send none.`
+                | IdentityProvider =>
+                  `\n  IdentityProvider has no backend on any platform yet — the seam and the ` ++
+                  `refusal exist, the Cognito and local implementations do not. A plugin ` ++
+                  `declaring this need cannot be deployed until one lands; nothing about this ` ++ `deployment's configuration will change that.`
                 }
               )
               // One line per capability, not per declaring component: two slices

package/src/Platform.res.mjs

@@ -16,7 +16,9 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
@@ -150,6 +152,7 @@ let messagingEmailProviderRef = {
 };
 
 function MakeWithConfig(Config) {
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -211,7 +214,7 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -1439,10 +1442,13 @@ function MakeWithConfig(Config) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }
@@ -1550,6 +1556,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1611,7 +1618,7 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2814,10 +2821,13 @@ function Make($star) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }