@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/scripts/ProvisionIdentity.res.mjs

@@ -1,10 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
 import * as DynamoDb_DynamoDb$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DynamoDb.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
 import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
@@ -17,6 +20,8 @@ function parseArgs(argv) {
     _0: {
       poolName: defaultPoolName,
       providerId: undefined,
+      loginIdentifier: Auth_LoginIdentifier$ReventlessAws.default,
+      signUpMode: Auth_SignUpMode$ReventlessAws.default,
       help: false
     }
   };
@@ -31,6 +36,20 @@ function parseArgs(argv) {
       let a = match._0;
       let exit$1 = 0;
       switch (flag) {
+        case "--login-identifier" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_LoginIdentifier$ReventlessAws.parse(value), loginIdentifier => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: loginIdentifier,
+              signUpMode: a.signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--name" :
           if (value !== undefined) {
             acc = {
@@ -38,6 +57,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: value,
                 providerId: a.providerId,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -53,6 +74,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: a.poolName,
                 providerId: value,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -61,6 +84,20 @@ function parseArgs(argv) {
             exit = 1;
           }
           break;
+        case "--sign-up-mode" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_SignUpMode$ReventlessAws.parse(value), signUpMode => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: a.loginIdentifier,
+              signUpMode: signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--help" :
         case "-h" :
           exit$1 = 2;
@@ -77,6 +114,8 @@ function parseArgs(argv) {
           _0: {
             poolName: a.poolName,
             providerId: a.providerId,
+            loginIdentifier: a.loginIdentifier,
+            signUpMode: a.signUpMode,
             help: true
           }
         };
@@ -95,21 +134,36 @@ function parseArgs(argv) {
   return acc;
 }
 
+let _loginIdentifiers = Auth_LoginIdentifier$ReventlessAws.all.map(Auth_LoginIdentifier$ReventlessAws.toString).join(" | ");
+
+let _defaultLoginIdentifier = Auth_LoginIdentifier$ReventlessAws.toString(Auth_LoginIdentifier$ReventlessAws.default);
+
+let _signUpModes = Auth_SignUpMode$ReventlessAws.all.map(Auth_SignUpMode$ReventlessAws.toString).join(" | ");
+
+let _defaultSignUpMode = Auth_SignUpMode$ReventlessAws.toString(Auth_SignUpMode$ReventlessAws.default);
+
 let usage = `
 Provision a Reventless identity provider and its active-role store.
 
   --name <name>          Pool name to create or adopt (default: ` + defaultPoolName + `)
   --provider-id <id>     Use this existing pool instead of creating one; only the
                          store is provisioned
+  --login-identifier <a> Sign-in attribute for a pool this creates: ` + _loginIdentifiers + `
+                         (default: ` + _defaultLoginIdentifier + `). Fixed at creation —
+                         no later change is possible without replacing the pool
+                         and losing every account in it.
+  --sign-up-mode <m>     Whether a stranger may register themselves: ` + _signUpModes + `
+                         (default: ` + _defaultSignUpMode + `). Correctable later, but on a
+                         pool shared between stacks it applies to all of them.
 
 Creates nothing that a platform stack owns, and never attaches a trigger.
 Region and credentials come from the environment, as for any AWS SDK call.
 `;
 
-function poolSettings(poolName) {
+function poolSettings(poolName, loginIdentifier, signUpMode) {
   return {
     PoolName: poolName,
-    UsernameAttributes: ["email"],
+    UsernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier),
     MfaConfiguration: "OFF",
     Policies: {
       PasswordPolicy: {
@@ -120,7 +174,7 @@ function poolSettings(poolName) {
       }
     },
     AdminCreateUserConfig: {
-      AllowAdminCreateUserOnly: true
+      AllowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     }
   };
 }
@@ -194,10 +248,10 @@ async function resolvePool(args) {
       _0: existing
     };
   }
-  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName)));
+  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName, args.loginIdentifier, args.signUpMode)));
   let id$1 = Stdlib_Option.flatMap(created.UserPool, p => p.Id);
   if (id$1 !== undefined) {
-    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `")`);
+    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `", sign-in on ` + Auth_LoginIdentifier$ReventlessAws.toString(args.loginIdentifier) + `, sign-up ` + Auth_SignUpMode$ReventlessAws.toString(args.signUpMode) + `)`);
     return {
       TAG: "Ok",
       _0: id$1
@@ -305,7 +359,14 @@ or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
 derives the same store, so there is nothing else to configure.
 
 The pre-token-generation trigger is attached by the deploy, not by this script.
-Users and groups are yours to create.`;
+
+Once a stack has deployed against this provider, make the first administrator:
+
+  pnpm exec provision-admin --provider-id ` + providerId + ` --email you@example.com
+
+That is a separate bin because it provisions nothing a stack owns, and because it
+is needed on a pool created here and on one a stack created for itself alike. See
+[ProvisionAdmin].`;
 }
 
 async function run() {
@@ -361,6 +422,10 @@ export {
   Schema,
   defaultPoolName,
   parseArgs,
+  _loginIdentifiers,
+  _defaultLoginIdentifier,
+  _signUpModes,
+  _defaultSignUpMode,
   usage,
   poolSettings,
   findPoolByName,
@@ -373,4 +438,4 @@ export {
   run,
   main,
 }
-/* @aws-sdk/client-dynamodb Not a pure module */
+/* _loginIdentifiers Not a pure module */

package/scripts/ProvisionProvider.res

@@ -0,0 +1,104 @@
+/***
+Which identity provider a provisioning run is about.
+
+Both bins ask the same question and neither should make the operator answer it
+twice. The docs used to say `--provider-id $(pulumi stack output
+identityProviderId)`, which is a command substitution a tool can perform.
+
+🚨 **Three sources, in this order, and the last is a fallback rather than the
+path.** An explicit `--provider-id` wins, then `REVENTLESS_IDENTITY_PROVIDER_ID`
+— the variable [Platform_Stack] reads for the same value, so a CI shell that
+already exports it needs no second spelling — and only then the stack.
+
+Reading the stack works in *both* modes, which is the fact that makes this worth
+doing rather than a convenience for auto deployments only: [Platform_Stack]
+exports `identityProviderId` whether it created the pool or was handed one, so a
+BYO deployment re-exports the provider it was given.
+
+🚨 **It always reports which source answered, and which stack.** `pulumi stack
+output` with no `--stack` reads whichever stack happens to be selected, so a run
+against `alpha` while the operator believes they are on `beta` would succeed —
+in the wrong pool, leaving working accounts somewhere nobody is looking. That is
+worse than failing. So the stack is resolved by name, named in the output, and
+overridable with `--stack`.
+*/
+
+/** Where an id came from, so a run can say so rather than leave it inferred. */
+type source =
+  | Flag
+  | Environment
+  | Stack(string)
+
+let describe = (source: source): string =>
+  switch source {
+  | Flag => "--provider-id"
+  | Environment => "REVENTLESS_IDENTITY_PROVIDER_ID"
+  | Stack(stack) => `stack ${stack}`
+  }
+
+/** The same variable [Platform_Stack] reads for the same value. */
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID"
+
+/** `stdio` leaves stderr to the caller's terminal but keeps stdout, so a Pulumi
+  failure is legible where it happens instead of being swallowed and re-reported
+  as a vaguer message here. */
+let pulumi = (args: array<string>): string =>
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {encoding: "utf8", stdio: ["ignore", "pipe", "ignore"]},
+  )->String.trim
+
+/** The stack the working directory currently has selected. `None` when there is
+  no Pulumi project here, no stack selected, or no `pulumi` on the PATH — all of
+  which are ordinary for someone running against a BYO pool, and none of which
+  should be an error until the id is actually needed. */
+let selectedStack = (): option<string> =>
+  switch pulumi(["stack", "--show-name"]) {
+  | "" => None
+  | name => Some(name)
+  | exception _ => None
+  }
+
+/**
+The provider id a stack exports.
+
+`--stack` is passed explicitly even when it names the already-selected stack, so
+the value read and the name reported cannot drift apart between the two calls.
+*/
+let fromStack = (~stack: string): result<string, string> =>
+  switch pulumi(["stack", "output", "identityProviderId", "--stack", stack]) {
+  | "" =>
+    Error(
+      `stack "${stack}" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`,
+    )
+  | id => Ok(id)
+  | exception _ =>
+    Error(
+      `could not read identityProviderId from stack "${stack}" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`,
+    )
+  }
+
+/**
+The provider this run is about, and where the answer came from.
+
+The error names all three sources rather than only the one that was tried last:
+someone who has no Pulumi project here needs to be told about the flag, and
+someone who has one needs to be told it was consulted and came back empty.
+*/
+let resolve = (~given: option<string>, ~stack: option<string>): result<(string, source), string> =>
+  switch given {
+  | Some(id) => Ok((id, Flag))
+  | None =>
+    switch NodeProcess.env->Dict.get(envKey) {
+    | Some(id) if id->String.trim != "" => Ok((id, Environment))
+    | _ =>
+      switch stack->Option.orElse(selectedStack()) {
+      | None =>
+        Error(
+          `--provider-id is required (or set ${envKey}). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`,
+        )
+      | Some(stack) => fromStack(~stack)->Result.map(id => (id, Stack(stack)))
+      }
+    }
+  }

package/scripts/ProvisionProvider.res.mjs

@@ -0,0 +1,123 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Nodechild_process from "node:child_process";
+
+function describe(source) {
+  if (typeof source !== "object") {
+    if (source === "Flag") {
+      return "--provider-id";
+    } else {
+      return "REVENTLESS_IDENTITY_PROVIDER_ID";
+    }
+  } else {
+    return `stack ` + source._0;
+  }
+}
+
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID";
+
+function pulumi(args) {
+  return Nodechild_process.execFileSync("pulumi", args, {
+    encoding: "utf8",
+    stdio: [
+      "ignore",
+      "pipe",
+      "ignore"
+    ]
+  }).trim();
+}
+
+function selectedStack() {
+  let name;
+  try {
+    name = pulumi([
+      "stack",
+      "--show-name"
+    ]);
+  } catch (exn) {
+    return;
+  }
+  if (name === "") {
+    return;
+  } else {
+    return name;
+  }
+}
+
+function fromStack(stack) {
+  let id;
+  try {
+    id = pulumi([
+      "stack",
+      "output",
+      "identityProviderId",
+      "--stack",
+      stack
+    ]);
+  } catch (exn) {
+    return {
+      TAG: "Error",
+      _0: `could not read identityProviderId from stack "` + stack + `" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`
+    };
+  }
+  if (id === "") {
+    return {
+      TAG: "Error",
+      _0: `stack "` + stack + `" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`
+    };
+  } else {
+    return {
+      TAG: "Ok",
+      _0: id
+    };
+  }
+}
+
+function resolve(given, stack) {
+  if (given !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: [
+        given,
+        "Flag"
+      ]
+    };
+  }
+  let id = process.env[envKey];
+  if (id !== undefined && id.trim() !== "") {
+    return {
+      TAG: "Ok",
+      _0: [
+        id,
+        "Environment"
+      ]
+    };
+  }
+  let stack$1 = Stdlib_Option.orElse(stack, selectedStack());
+  if (stack$1 !== undefined) {
+    return Stdlib_Result.map(fromStack(stack$1), id => [
+      id,
+      {
+        TAG: "Stack",
+        _0: stack$1
+      }
+    ]);
+  } else {
+    return {
+      TAG: "Error",
+      _0: `--provider-id is required (or set ` + envKey + `). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`
+    };
+  }
+}
+
+export {
+  describe,
+  envKey,
+  pulumi,
+  selectedStack,
+  fromStack,
+  resolve,
+}
+/* node:child_process Not a pure module */

package/scripts/PulumiCli.res

@@ -0,0 +1,43 @@
+/***
+Reading deployed stacks through the `pulumi` CLI, so a command follows whatever
+backend the CLI is logged into.
+
+stderr goes to the caller's terminal: a Pulumi failure is legible where it
+happens rather than re-reported here as a vaguer message.
+*/
+
+let run = (~cwd: string, args: array<string>): string =>
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args->Array.concat(["--cwd", cwd, "--non-interactive"]),
+    {encoding: "utf8", stdio: ["ignore", "pipe", "inherit"], maxBuffer: 64 * 1024 * 1024},
+  )->String.trim
+
+/** Whether the project in `dir` keeps settings for `stack` — how the deploy
+    workflow tells a stack that was never deployed from one that was. */
+let hasStackFile = (~dir: string, ~stack: string): bool =>
+  NodeFs.existsSync(NodePath.join([dir, `Pulumi.${stack}.yaml`]))
+
+let stackOutputs = (~dir: string, ~stack: string): result<dict<JSON.t>, string> =>
+  switch run(~cwd=dir, ["stack", "output", "--json", "--stack", stack]) {
+  | text =>
+    switch text->JSON.parseOrThrow->JSON.Decode.object {
+    | Some(outputs) => Ok(outputs)
+    | None => Error(`stack "${stack}" in ${dir} returned outputs that are not an object`)
+    | exception _ => Error(`stack "${stack}" in ${dir} returned outputs that are not JSON`)
+    }
+  | exception _ => Error(`could not read the outputs of stack "${stack}" in ${dir}`)
+  }
+
+let selectedStack = (~dir: string): option<string> =>
+  switch run(~cwd=dir, ["stack", "--show-name"]) {
+  | "" => None
+  | name => Some(name)
+  | exception _ => None
+  }
+
+let stringOutput = (outputs: dict<JSON.t>, name: string): option<string> =>
+  switch outputs->Dict.get(name)->Option.flatMap(JSON.Decode.string) {
+  | Some("") | None => None
+  | value => value
+  }

package/scripts/PulumiCli.res.mjs

@@ -0,0 +1,106 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Nodechild_process from "node:child_process";
+
+function run(cwd, args) {
+  return Nodechild_process.execFileSync("pulumi", args.concat([
+    "--cwd",
+    cwd,
+    "--non-interactive"
+  ]), {
+    encoding: "utf8",
+    stdio: [
+      "ignore",
+      "pipe",
+      "inherit"
+    ],
+    maxBuffer: 67108864
+  }).trim();
+}
+
+function hasStackFile(dir, stack) {
+  return Nodefs.existsSync(Nodepath.join(dir, `Pulumi.` + stack + `.yaml`));
+}
+
+function stackOutputs(dir, stack) {
+  let exit = 0;
+  let text;
+  try {
+    text = run(dir, [
+      "stack",
+      "output",
+      "--json",
+      "--stack",
+      stack
+    ]);
+    exit = 1;
+  } catch (exn) {
+    return {
+      TAG: "Error",
+      _0: `could not read the outputs of stack "` + stack + `" in ` + dir
+    };
+  }
+  if (exit === 1) {
+    let exit$1 = 0;
+    let outputs;
+    try {
+      outputs = Stdlib_JSON.Decode.object(JSON.parse(text));
+      exit$1 = 2;
+    } catch (exn$1) {
+      return {
+        TAG: "Error",
+        _0: `stack "` + stack + `" in ` + dir + ` returned outputs that are not JSON`
+      };
+    }
+    if (exit$1 === 2) {
+      if (outputs !== undefined) {
+        return {
+          TAG: "Ok",
+          _0: outputs
+        };
+      } else {
+        return {
+          TAG: "Error",
+          _0: `stack "` + stack + `" in ` + dir + ` returned outputs that are not an object`
+        };
+      }
+    }
+  }
+}
+
+function selectedStack(dir) {
+  let name;
+  try {
+    name = run(dir, [
+      "stack",
+      "--show-name"
+    ]);
+  } catch (exn) {
+    return;
+  }
+  if (name === "") {
+    return;
+  } else {
+    return name;
+  }
+}
+
+function stringOutput(outputs, name) {
+  let value = Stdlib_Option.flatMap(outputs[name], Stdlib_JSON.Decode.string);
+  if (value !== undefined && value !== "") {
+    return value;
+  }
+}
+
+export {
+  run,
+  hasStackFile,
+  stackOutputs,
+  selectedStack,
+  stringOutput,
+}
+/* node:fs Not a pure module */

package/src/Platform.res

@@ -121,6 +121,31 @@ module MakeWithConfig = (
 ): (
   ReventlessInfra.Platform.T with type api = Types.AppSync.api and type role = Types.AppSync.role
 ) => {
+  // The administrator group reads across every owner, unless the deployment says
+  // otherwise.
+  //
+  // Authorization and owner scoping decide admin-ness independently and nothing
+  // checks that they agree: without this, a deployment gets an administrator who
+  // passes every authorization check and then reads *empty* owner-scoped views.
+  // `Util_OwnerScopeEnv.applyElevatedGroupsDefault` already carries whatever
+  // `OwnerScope.elevatedGroups()` holds into every Lambda's environment — the pipe
+  // was laid and nothing ever put a value in.
+  //
+  // 🚨 **Here, at the entry point, rather than beside the pool that declares the
+  // group.** The value has to be set before the runtime builder composes any
+  // Lambda's environment, and this functor's body runs when the functor is
+  // applied — necessarily before any plugin is built through it. Written into
+  // `Platform_Stack.resolveCognitoUserPool` it would instead depend on *which
+  // caller resolved the pool first*, which is precisely how a feature once
+  // vanished from a deploy with no error and no resource; see the note on
+  // `_resolveUncached`. Ordering that is structural beats ordering that happens
+  // to hold.
+  //
+  // A default, never a forcing: an explicit `setElevatedGroups` in a platform
+  // root — including one naming nobody — means what it says and wins. See
+  // [Reventless.OwnerScope.defaultElevatedGroups].
+  Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+
   // Dispatch per-flavor commandHandlerConfig records to the four runtime
   // builders. Every sub-record is optional; only branches the caller actually
   // supplied propagate, and within each sub-record every field is optional too
@@ -287,7 +312,7 @@ module MakeWithConfig = (
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
         ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group="Admin",
+        ~group=Reventless.AdminGroup.name,
       ),
     )
 
@@ -1467,7 +1492,7 @@ module MakeWithConfig = (
     // GETs from it to resolve an offloaded `structure`. Kept out of the declared
     // `@storageRef` stores and their pending-claim/expiry machinery: offload
     // objects are written durably up front and are never "pending".
-    let offloadProtection = Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName())
+    let offloadProtection = Util_StoreLayout.protectionOfDeployedStack()
     let offloadBucket = PulumiAws.S3.Bucket.make(
       ~name="reventless-offload",
       ~args={
@@ -1493,6 +1518,14 @@ module MakeWithConfig = (
       },
     )
     Pulumi.Pulumi.export("offloadBucket", offloadBucketName)
+    // What a plugin stack's `platform:stack` names, fully qualified so it holds on
+    // every backend. `deploy-app` reads it to point the plugin stacks it creates.
+    Pulumi.Pulumi.export(
+      "platformStack",
+      Pulumi.Output.make(
+        `${Pulumi.Pulumi.getOrganization()}/${Pulumi.Pulumi.getProjectName()}/${Pulumi.Pulumi.getStackName()}`,
+      ),
+    )
 
     // Mount the Platform_ComponentDefinitions Lambda resolver on the Platform API
     // (split mode) or Domain API (unified mode — platformApi == domainApi above).
@@ -1749,7 +1782,7 @@ module MakeWithConfig = (
       ~stack=stackName,
       ~prodStacks=Util_HostUiDomain.resolveProdStacks(),
     )
-    let storeProtection = Util_StoreLayout.protectionFor(~stack=stackName)
+    let storeProtection = Util_StoreLayout.protectionOfDeployedStack()
 
     // Dedup by `(plugin, store)` — that pair is a store's identity, and many
     // fields legitimately name one store.
@@ -1759,7 +1792,8 @@ module MakeWithConfig = (
         switch c {
         | ObjectStore({plugin, store}) => Some((plugin, store))
         | Geocoding
-        | Messaging =>
+        | Messaging
+        | IdentityProvider =>
           None
         }
       )
@@ -2503,6 +2537,15 @@ module MakeWithConfig = (
   let startServers = () => ()
 
   let deployPlugin = (~plugin: module(PluginMaker), ~apiTarget=Domain) => {
+    // Without the setting the plugin used to deploy as a platform of its own,
+    // with no error, and never register with the real one.
+    if platformStackRef->Option.isNone {
+      JsError.throwWithMessage(
+        `This plugin stack has no platform:stack setting, so it cannot find its platform. ` ++
+        `Set it to the platform's stack: pulumi config set platform:stack ` ++
+        `${Pulumi.Pulumi.getOrganization()}/<platform project>/${Pulumi.Pulumi.getStackName()}`,
+      )
+    }
     log.info(
       ~comp="Platform:deployPlugin",
       `target=${switch apiTarget {
@@ -2826,6 +2869,10 @@ module MakeWithConfig = (
                   `as \`~messagingSender\`. The sender itself is configuration and has no ` ++
                   `default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or ` ++
                   `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++ `\`platform:messagingEmailProvider: log\` to log every message and send none.`
+                | IdentityProvider =>
+                  `\n  IdentityProvider has no backend on any platform yet — the seam and the ` ++
+                  `refusal exist, the Cognito and local implementations do not. A plugin ` ++
+                  `declaring this need cannot be deployed until one lands; nothing about this ` ++ `deployment's configuration will change that.`
                 }
               )
               // One line per capability, not per declaring component: two slices