@reventlessdev/reventless-aws 3.0.0-alpha.368 → 3.0.0-alpha.370

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.370 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
+# 3.0.0-alpha.369 (2026-10-01)
+
+### Features
+
+* **spec, aws, core, local:** an app declares its environments, and every deployment records its commit ([c7cc925](https://github.com/ReventlessDev/reventless-core/commit/c7cc92573e97742b681a9000cea0bdfd6e9a33fc))
+
+
 # 3.0.0-alpha.368 (2026-09-29)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.368",
+  "version": "3.0.0-alpha.370",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -8,7 +8,8 @@
     "provision-admin": "./run-provision-admin.mjs",
     "provision-accounts": "./run-provision-accounts.mjs",
     "bake-manifest": "./run-bake-manifest.mjs",
-    "deploy-app": "./run-deploy-app.mjs"
+    "deploy-app": "./run-deploy-app.mjs",
+    "resolve-environment": "./run-resolve-environment.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-appsync": "3.970.0",
@@ -22,17 +23,17 @@
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.27",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.22",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.284",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.148",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.154",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.182"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.184"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/run-resolve-environment.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from "./scripts/ResolveEnvironment.res.mjs"
+await main()

package/scripts/ProvisionAdmin.res

@@ -76,7 +76,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "${Reventless.AdminGroup.name}" group if it is missing, the account if
+Creates the "${Reventless.Role.adminGroup()}" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -222,7 +222,7 @@ let run = async ({email, providerId, stack}: request): result<unit, string> =>
     switch await checkPoolAcceptsEmail(~providerId) {
     | Error(_) as e => e
     | Ok() =>
-      let group = Reventless.AdminGroup.name
+      let group = Reventless.Role.adminGroup()
       let password = Reventless.Util_Password.generate()
       await ensureGroup(~providerId, ~group)
       await ensureUser(~providerId, ~email)

package/scripts/ProvisionAdmin.res.mjs

@@ -1,9 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Util_Password$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Password.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
 import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
@@ -36,7 +36,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "` + AdminGroup$Reventless.name + `" group if it is missing, the account if
+Creates the "` + Role$Reventless.adminGroup() + `" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -156,12 +156,13 @@ async function run(param) {
   if (e$1.TAG !== "Ok") {
     return e$1;
   }
+  let group = Role$Reventless.adminGroup();
   let password = Util_Password$Reventless.generate();
-  await ensureGroup(providerId, AdminGroup$Reventless.name);
+  await ensureGroup(providerId, group);
   await ensureUser(providerId, email);
   await setPassword(providerId, email, password);
-  await addToGroup(providerId, email, AdminGroup$Reventless.name);
-  console.log(signInDetails(providerId, email, password, AdminGroup$Reventless.name));
+  await addToGroup(providerId, email, group);
+  console.log(signInDetails(providerId, email, password, group));
   return {
     TAG: "Ok",
     _0: undefined
@@ -212,4 +213,4 @@ export {
   cli,
   main,
 }
-/* CliArgs-Reventless Not a pure module */
+/* usage Not a pure module */

package/scripts/ResolveEnvironment.res

@@ -0,0 +1,135 @@
+/***
+Which environment a push, a tag or a pull request deploys to, from the app's
+`environments.yaml`.
+
+```
+pnpm exec resolve-environment --ref refs/heads/test
+pnpm exec resolve-environment --pull-request 7 --base dev
+```
+
+Prints `key=value` lines, so the deploy workflow appends them to
+`$GITHUB_OUTPUT` as they are:
+
+```
+matched=true
+environment=test
+stack=test
+purpose=test
+```
+
+Nothing matched is an answer, not a failure: `matched=false` and exit 0, so a push
+to a branch no environment names deploys nowhere and says so. The workflow asks
+only when the file exists; without it the stack is the branch, as it always was.
+*/
+
+type request =
+  | Push(string)
+  | PullRequest({number: int, base: string, draft: bool})
+
+type args = {
+  file: option<string>,
+  manifest: option<string>,
+  request: request,
+}
+
+let parseArgs = (argv: array<string>): result<args, string> =>
+  Reventless.CliArgs.parse(
+    ~strings=["file", "manifest", "ref", "pull-request", "base"],
+    ~bools=["draft"],
+    argv,
+  )
+  ->Result.flatMap(Reventless.CliArgs.noPositionals)
+  ->Result.flatMap(a => {
+    let string = name => a->Reventless.CliArgs.string(name)
+    let request = switch (string("ref"), string("pull-request"), string("base")) {
+    | (Some(ref), None, None) => Ok(Push(ref))
+    | (None, Some(number), Some(base)) =>
+      switch Int.fromString(number) {
+      | Some(number) => Ok(PullRequest({number, base, draft: a->Reventless.CliArgs.bool("draft")}))
+      | None => Error(`--pull-request takes a number, not "${number}"`)
+      }
+    | (None, Some(_), None) => Error("--pull-request needs --base, the branch it targets")
+    | (None, None, None) => Error("say what deploys: --ref, or --pull-request with --base")
+    | _ => Error("--ref and --pull-request are two different questions; ask one")
+    }
+    request->Result.map(request => {file: string("file"), manifest: string("manifest"), request})
+  })
+
+let usage = `
+Usage: resolve-environment (--ref <ref> | --pull-request <n> --base <branch> [--draft])
+                           [--file <path>] [--manifest <path>]
+
+Which environment of the app's environments.yaml a deploy goes to.
+
+  --ref <ref>            A push or a tag: refs/heads/<branch> or refs/tags/<tag>.
+  --pull-request <n>     A pull request, by number ...
+  --base <branch>        ... and the branch it targets.
+  --draft                The pull request is a draft.
+  --file <path>          The environments file. Defaults to ${Reventless.Environments.fileName}
+                         beside the deploy manifest.
+  --manifest <path>      The deploy manifest. Defaults to ${DeployManifest.defaultFile}
+                         in the working directory.
+
+Prints matched, environment, stack and purpose as key=value lines; a deploy that
+matches nothing prints matched=false and exits 0.
+`
+
+/** The lines printed for a request, from the environments already read. */
+let answer = (environments: Reventless.Environments.t, request: request): array<string> => {
+  let resolved = switch request {
+  | Push(ref) =>
+    ref
+    ->Reventless.Environments.refOf
+    ->Option.flatMap(ref => environments->Reventless.Environments.resolve(ref))
+  | PullRequest({number, base, draft}) =>
+    environments->Reventless.Environments.resolvePullRequest(~base, ~number, ~draft)
+  }
+  switch resolved {
+  | Some({name, stack, purpose}) => [
+      "matched=true",
+      `environment=${name}`,
+      `stack=${stack}`,
+      `purpose=${purpose->Reventless.Environments.purposeName}`,
+    ]
+  | None => ["matched=false"]
+  }
+}
+
+let run = (args: args): result<array<string>, string> => {
+  let file = switch args.file {
+  | Some(file) => file
+  | None =>
+    Reventless.Environments.pathBeside(
+      ~manifest=args.manifest->Option.getOr(
+        NodePath.join([NodeProcess.cwd(), DeployManifest.defaultFile]),
+      ),
+    )
+  }
+  if !NodeFs.existsSync(file) {
+    Error(
+      `no environments file at ${file}. Without one every branch deploys to the stack of its own name, and there is nothing to resolve; --file names another path.`,
+    )
+  } else {
+    file
+    ->Reventless.Environments.parseFile
+    ->Result.map(environments => answer(environments, args.request))
+    ->Result.mapError(message =>
+      `${file}: ${message}. The deploy reads any file of this name beside the deploy manifest as its environments; a file kept there for something else needs another name, or the workflow's environments input pointed elsewhere.`
+    )
+  }
+}
+
+let cli: Reventless.CliArgs.cli<args> = {bin: "resolve-environment", usage, parse: parseArgs}
+
+let main = () =>
+  Reventless.CliArgs.run(cli, async args =>
+    switch run(args) {
+    | Ok(lines) => lines->Array.forEach(line => Console.log(line))
+    | Error(message) =>
+      Console.error(`resolve-environment: ${message}`)
+      NodeProcess.exit(1)
+    }
+  )
+
+// No top-level call: `../run-resolve-environment.mjs` invokes [main], so a test can
+// import this module.

package/scripts/ResolveEnvironment.res.mjs

@@ -0,0 +1,148 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
+import * as Environments$Reventless from "@reventlessdev/reventless-spec/src/types/Environments.res.mjs";
+import * as DeployManifest$ReventlessAws from "./DeployManifest.res.mjs";
+
+function parseArgs(argv) {
+  return Stdlib_Result.flatMap(Stdlib_Result.flatMap(CliArgs$Reventless.parse([
+    "file",
+    "manifest",
+    "ref",
+    "pull-request",
+    "base"
+  ], ["draft"], undefined, undefined, argv), CliArgs$Reventless.noPositionals), a => {
+    let match = CliArgs$Reventless.string(a, "ref");
+    let match$1 = CliArgs$Reventless.string(a, "pull-request");
+    let match$2 = CliArgs$Reventless.string(a, "base");
+    let request;
+    if (match !== undefined) {
+      request = match$1 !== undefined || match$2 !== undefined ? ({
+          TAG: "Error",
+          _0: "--ref and --pull-request are two different questions; ask one"
+        }) : ({
+          TAG: "Ok",
+          _0: {
+            TAG: "Push",
+            _0: match
+          }
+        });
+    } else if (match$1 !== undefined) {
+      if (match$2 !== undefined) {
+        let number = Stdlib_Int.fromString(match$1, undefined);
+        request = number !== undefined ? ({
+            TAG: "Ok",
+            _0: {
+              TAG: "PullRequest",
+              number: number,
+              base: match$2,
+              draft: CliArgs$Reventless.bool(a, "draft")
+            }
+          }) : ({
+            TAG: "Error",
+            _0: `--pull-request takes a number, not "` + match$1 + `"`
+          });
+      } else {
+        request = {
+          TAG: "Error",
+          _0: "--pull-request needs --base, the branch it targets"
+        };
+      }
+    } else {
+      request = match$2 !== undefined ? ({
+          TAG: "Error",
+          _0: "--ref and --pull-request are two different questions; ask one"
+        }) : ({
+          TAG: "Error",
+          _0: "say what deploys: --ref, or --pull-request with --base"
+        });
+    }
+    return Stdlib_Result.map(request, request => ({
+      file: CliArgs$Reventless.string(a, "file"),
+      manifest: CliArgs$Reventless.string(a, "manifest"),
+      request: request
+    }));
+  });
+}
+
+let usage = `
+Usage: resolve-environment (--ref <ref> | --pull-request <n> --base <branch> [--draft])
+                           [--file <path>] [--manifest <path>]
+
+Which environment of the app's environments.yaml a deploy goes to.
+
+  --ref <ref>            A push or a tag: refs/heads/<branch> or refs/tags/<tag>.
+  --pull-request <n>     A pull request, by number ...
+  --base <branch>        ... and the branch it targets.
+  --draft                The pull request is a draft.
+  --file <path>          The environments file. Defaults to ` + Environments$Reventless.fileName + `
+                         beside the deploy manifest.
+  --manifest <path>      The deploy manifest. Defaults to ` + DeployManifest$ReventlessAws.defaultFile + `
+                         in the working directory.
+
+Prints matched, environment, stack and purpose as key=value lines; a deploy that
+matches nothing prints matched=false and exits 0.
+`;
+
+function answer(environments, request) {
+  let resolved;
+  resolved = request.TAG === "Push" ? Stdlib_Option.flatMap(Environments$Reventless.refOf(request._0), ref => Environments$Reventless.resolve(environments, ref)) : Environments$Reventless.resolvePullRequest(environments, request.base, request.number, request.draft);
+  if (resolved !== undefined) {
+    return [
+      "matched=true",
+      `environment=` + resolved.name,
+      `stack=` + resolved.stack,
+      `purpose=` + Environments$Reventless.purposeName(resolved.purpose)
+    ];
+  } else {
+    return ["matched=false"];
+  }
+}
+
+function run(args) {
+  let file = args.file;
+  let file$1 = file !== undefined ? file : Environments$Reventless.pathBeside(Stdlib_Option.getOr(args.manifest, Nodepath.join(process.cwd(), DeployManifest$ReventlessAws.defaultFile)));
+  if (Nodefs.existsSync(file$1)) {
+    return Stdlib_Result.mapError(Stdlib_Result.map(Environments$Reventless.parseFile(file$1), environments => answer(environments, args.request)), message => file$1 + `: ` + message + `. The deploy reads any file of this name beside the deploy manifest as its environments; a file kept there for something else needs another name, or the workflow's environments input pointed elsewhere.`);
+  } else {
+    return {
+      TAG: "Error",
+      _0: `no environments file at ` + file$1 + `. Without one every branch deploys to the stack of its own name, and there is nothing to resolve; --file names another path.`
+    };
+  }
+}
+
+let cli = {
+  bin: "resolve-environment",
+  usage: usage,
+  parse: parseArgs
+};
+
+function main() {
+  return CliArgs$Reventless.run(cli, undefined, undefined, async args => {
+    let lines = run(args);
+    if (lines.TAG === "Ok") {
+      lines._0.forEach(line => {
+        console.log(line);
+      });
+      return;
+    }
+    console.error(`resolve-environment: ` + lines._0);
+    process.exit(1);
+  });
+}
+
+export {
+  parseArgs,
+  usage,
+  answer,
+  run,
+  cli,
+  main,
+}
+/* node:fs Not a pure module */

package/src/Platform.res

@@ -107,6 +107,24 @@ let messagingEmailSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.ma
     `""` means the platform named none, which the runtime reads as its default. */
 let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** Which group stands for which role, only where the two differ; every other
+    role maps to the group of its own name. Call before `Make()`: the platform
+    resolves roles while it is built, and a mapping stated later is refused. */
+let roleGroups = Reventless.Role.setGroups
+
+/** The groups of a user pool this deployment did not create, which no accounts
+    manifest names. They count as provided by the check that every role a plugin
+    needs has a group. */
+let providedGroups = Reventless.Role.provideGroups
+
+/** The group a role resolves to — the name this platform writes into its
+    directives, its shell configuration and the elevated groups. For code that
+    grants access by group, so it never spells one itself. */
+let groupOf = Reventless.Role.groupOf
+
+/** `groupOf(Role.admin)`. */
+let adminGroup = Reventless.Role.adminGroup
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -144,7 +162,15 @@ module MakeWithConfig = (
   // A default, never a forcing: an explicit `setElevatedGroups` in a platform
   // root — including one naming nobody — means what it says and wins. See
   // [Reventless.OwnerScope.defaultElevatedGroups].
-  Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+  Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
+
+  // What this deployment provides for the roles its plugins need: the
+  // administrator group the stack declares, and the groups of the accounts
+  // provisioning creates. Read when each plugin is built, after the root has
+  // mapped its roles.
+  Reventless.Role.provideGroupsFrom(() =>
+    [Reventless.Role.adminGroup()]->Array.concat(Reventless.AccountsManifest.declaredGroups())
+  )
 
   // Dispatch per-flavor commandHandlerConfig records to the four runtime
   // builders. Every sub-record is optional; only branches the caller actually
@@ -308,13 +334,16 @@ module MakeWithConfig = (
   // Admin base as a source-API document — auth-decorated (all fields Admin,
   // Cognito-only; the deploy-time SigV4 system-caller fields died with the
   // fragment registry) plus the canonical stamp.
-  let adminSourceSdl = (): string =>
+  let adminSourceSdl = (): string => {
+    // The directive below fixes the administrator's group for this deploy.
+    Reventless.Role.freeze()
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
         ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group=Reventless.AdminGroup.name,
+        ~group=Reventless.Role.adminGroup(),
       ),
     )
+  }
 
   // Split-mode Domain source document: relay base types + Platform_ping — the
   // Domain merged API's canonical owner (plugin fields come from plugin sources).

package/src/Platform.res.mjs

@@ -13,10 +13,10 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
@@ -34,6 +34,7 @@ import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
 import * as Plugin_Stack$ReventlessAws from "./plugin/stack/Plugin_Stack.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as Platform_Casts$ReventlessAws from "./Platform_Casts.res.mjs";
 import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
 import * as QueryDbBackend$ReventlessAws from "./adapter/QueryDb/QueryDbBackend.res.mjs";
@@ -152,7 +153,8 @@ let messagingEmailProviderRef = {
 };
 
 function MakeWithConfig(Config) {
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -214,7 +216,8 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -1566,7 +1569,8 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1628,7 +1632,8 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2958,6 +2963,14 @@ function Make($star) {
   };
 }
 
+let roleGroups = Role$Reventless.setGroups;
+
+let providedGroups = Role$Reventless.provideGroups;
+
+let groupOf = Role$Reventless.groupOf;
+
+let adminGroup = Role$Reventless.adminGroup;
+
 export {
   log,
   apiConfigRef,
@@ -2969,6 +2982,10 @@ export {
   geocoderPlaceIndexRef,
   messagingEmailSenderRef,
   messagingEmailProviderRef,
+  roleGroups,
+  providedGroups,
+  groupOf,
+  adminGroup,
   MakeWithConfig,
   Make,
 }

package/src/Platform_Stack.res

@@ -25,7 +25,7 @@ type cognitoUserPool = {
  *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
  *   says otherwise, 12-char password policy, no MFA, and admin-only user
  *   creation unless `platform:signUpMode` says otherwise), plus the
- *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   administrator group named by [Reventless.Role.adminGroup] and an elevated-groups
  *   default naming it. What it does **not** create is the first administrator:
  *   accounts are not stack resources, and a pool full of them is not something a
  *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
@@ -302,7 +302,7 @@ let _resolveUncached = (): cognitoUserPool => {
     // An ordinary child resource: the pool is ours, so this needs no out-of-band
     // call and Pulumi's state stays the authority for whether it exists.
     let _adminGroup = Util_CognitoGroupUser.addUserGroup(
-      ~name=Reventless.AdminGroup.name,
+      ~name=Reventless.Role.adminGroup(),
       ~userPoolId=pool.id,
     )
 
@@ -400,7 +400,10 @@ let _resolveUncached = (): cognitoUserPool => {
   // name is what a caller needs either way, and an output that appeared in one
   // mode and not the other would read as "there is no administrator group here"
   // rather than "this stack did not create it".
-  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+  Pulumi.Pulumi.export(
+    "identityProviderAdminGroup",
+    Pulumi.Output.make(Reventless.Role.adminGroup()),
+  )
 
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking

package/src/Platform_Stack.res.mjs

@@ -5,7 +5,7 @@ import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
@@ -133,7 +133,7 @@ function _resolveUncached() {
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
-    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(Role$Reventless.adminGroup(), pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -181,7 +181,7 @@ function _resolveUncached() {
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
-  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(Role$Reventless.adminGroup()));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -194,7 +194,7 @@ let make = (
   let adminEntryJson =
     ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
-      ReventlessCore.Platform_Admin_Structure.structure,
+      ReventlessCore.Platform_Admin_Structure.structure(),
     )->JSON.stringify
 
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -107,7 +107,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
         encodeSelections(j.selections)
       ]
     ]))) : "";
-  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure()));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -6,7 +6,7 @@
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
 //
 // The narrowing has to happen here rather than in our own enforcement code
-// because `@authorize(AllowGroups([...]))` compiles to a field directive AppSync
+// because `@authorize(AllowRoles([...]))` compiles to a field directive AppSync
 // evaluates against `cognito:groups` **before any of our code executes**. A
 // request header we invent could scope reads correctly and still leave every
 // group-gated mutation callable — right about the data, wrong about the writes.