@reventlessdev/reventless-aws 3.0.0-alpha.370 → 3.0.0-alpha.372

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.372 (2026-10-05)
+
+### Bug Fixes
+
+* **deploy:** the pending-creates recovery runs from reventless-aws, and works ([b9e749e](https://github.com/ReventlessDev/reventless-core/commit/b9e749eb09354a559505fa6facc7f58e38afd2a9))
+### Features
+
+* **deploy:** a plugin names its own region, and can stay out of review environments ([7edd318](https://github.com/ReventlessDev/reventless-core/commit/7edd3187f51f74e57c331b1cb417b17de8067b58))
+* **deploy:** the deploy workflow names its state backend ([a370346](https://github.com/ReventlessDev/reventless-core/commit/a3703461bae9dc22c098315a09bbabcf0c5816b1))
+
+
+# 3.0.0-alpha.371 (2026-10-01)
+
+### Bug Fixes
+
+* check a plugin's roles against the user pool's groups ([ddb3c42](https://github.com/ReventlessDev/reventless-core/commit/ddb3c422b7226a19800e781abd5f03af18867007))
+
+
 # 3.0.0-alpha.370 (2026-10-01)
 
 * feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.370",
+  "version": "3.0.0-alpha.372",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -9,7 +9,8 @@
     "provision-accounts": "./run-provision-accounts.mjs",
     "bake-manifest": "./run-bake-manifest.mjs",
     "deploy-app": "./run-deploy-app.mjs",
-    "resolve-environment": "./run-resolve-environment.mjs"
+    "resolve-environment": "./run-resolve-environment.mjs",
+    "clear-pending-creates": "./run-clear-pending-creates.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-appsync": "3.970.0",
@@ -21,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.27",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.28",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.22",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.184"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.39",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/run-clear-pending-creates.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from "./scripts/ClearPendingCreates.res.mjs"
+await main()

package/scripts/ClearPendingCreates.res

@@ -0,0 +1,142 @@
+/***
+Before `pulumi up`, recovers a stack an interrupted deploy left behind: releases a
+stale lock, drops the pending creates known to have nothing in AWS behind them,
+and refreshes. Any other pending operation stops it: `--clear-pending-creates`
+drops them all, and would orphan a function or a role that does exist.
+*/
+
+/** Resource types with nothing in AWS behind them, so a pending create of one is
+    safe to drop. Add one only when that holds; a refusal costs one look, an
+    orphan stays until someone finds it. */
+let safeTypes = [
+  // ACM's wait for DNS validation, which gives up after 1h15m when the record is late.
+  "aws:acm/certificateValidation:CertificateValidation",
+]
+
+type pending = {urn: string, resourceType: string, operation: string}
+
+let pendingOperations = (export: JSON.t): array<pending> => {
+  let field = (json, name) => json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(name))
+  let text = (json, name) => json->field(name)->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+  export
+  ->field("deployment")
+  ->Option.flatMap(deployment => deployment->field("pending_operations"))
+  ->Option.flatMap(JSON.Decode.array)
+  ->Option.getOr([])
+  ->Array.map(operation => {
+    let resource = operation->field("resource")->Option.getOr(JSON.Null)
+    {
+      urn: resource->text("urn"),
+      resourceType: resource->text("type"),
+      operation: operation->text("type"),
+    }
+  })
+}
+
+let isSafe = (pending: pending) => safeTypes->Array.includes(pending.resourceType)
+
+type args = {stack: string, cwd: string}
+
+let parseArgs = (argv: array<string>): result<args, string> =>
+  Reventless.CliArgs.parse(~strings=["stack", "cwd"], argv)
+  ->Result.flatMap(Reventless.CliArgs.noPositionals)
+  ->Result.flatMap(a =>
+    switch a->Reventless.CliArgs.string("stack") {
+    | Some(stack) =>
+      Ok({stack, cwd: a->Reventless.CliArgs.string("cwd")->Option.getOr(NodeProcess.cwd())})
+    | None => Error("--stack names the stack to recover")
+    }
+  )
+
+let usage = `
+Usage: clear-pending-creates --stack <name> [--cwd <dir>]
+
+Recovers a stack before \`pulumi up\`: cancels a stale update, drops the pending
+creates of types with nothing in AWS behind them, and refreshes. Any other pending
+operation fails the command, for someone to resolve by hand.
+
+  --stack <name>   The stack.
+  --cwd <dir>      The Pulumi project. Defaults to the working directory.
+`
+
+let pulumi = (args: args, command: array<string>) =>
+  NodeChildProcess.spawnSync(
+    "pulumi",
+    command->Array.concat(["--stack", args.stack, "--cwd", args.cwd, "--non-interactive"]),
+    {encoding: "utf8", maxBuffer: 256 * 1024 * 1024},
+  )
+
+let succeeded = (result: NodeChildProcess.spawnSyncResult) =>
+  result.status->Nullable.toOption == Some(0)
+
+let stderrOf = (result: NodeChildProcess.spawnSyncResult) =>
+  result.stderr->Nullable.toOption->Option.getOr("")->String.trim
+
+let run = (args: args): result<unit, array<string>> => {
+  let cancel = pulumi(args, ["cancel", "--yes"])
+  switch stderrOf(cancel) {
+  | message
+    if !succeeded(cancel) &&
+    message != "" &&
+    !(message->String.toLowerCase->String.includes("no update in progress")) =>
+    Console.error(`::warning::pulumi cancel: ${message}`)
+  | _ => ()
+  }
+  let exported = pulumi(args, ["stack", "export"])
+  let state = switch exported.stdout->Nullable.toOption {
+  | Some(stdout) if succeeded(exported) =>
+    try Ok(JSON.parseOrThrow(stdout)) catch {
+    | _ => Error([`the export of stack ${args.stack} is not JSON`])
+    }
+  | _ => Error([`pulumi stack export failed: ${stderrOf(exported)}`])
+  }
+  state->Result.flatMap(state => {
+    let pending = pendingOperations(state)
+    let refused = pending->Array.filter(p => !isSafe(p))
+    if pending == [] {
+      Console.log(`No pending operations on stack ${args.stack}.`)
+    } else {
+      Console.log(
+        `${pending->Array.length->Int.toString} pending operation(s) on stack ${args.stack}.`,
+      )
+    }
+    if refused != [] {
+      Error(
+        refused->Array.map(p =>
+          `Pending ${p.operation} of ${p.urn} (${p.resourceType}): not cleared, because something may exist in AWS behind it. Resolve it by hand, or, if the type has nothing behind it, add it to ClearPendingCreates.safeTypes.`
+        ),
+      )
+    } else {
+      // Every pending operation left is safe, so the refresh may drop them all.
+      // `pulumi state delete` cannot: a pending create has no resource in the state.
+      pending->Array.forEach(p =>
+        Console.log(`::warning::Clearing pending ${p.operation} of ${p.urn} (${p.resourceType})`)
+      )
+      let clear = pending == [] ? [] : ["--clear-pending-creates"]
+      // A failed refresh is usually a stale provider serialization, which the
+      // `pulumi up` after this heals.
+      let refreshed = pulumi(args, ["refresh", "--yes", "--skip-preview"]->Array.concat(clear))
+      if !succeeded(refreshed) {
+        Console.error(
+          `::warning::pulumi refresh had errors; pulumi up runs anyway. ${stderrOf(refreshed)}`,
+        )
+      }
+      Ok()
+    }
+  })
+}
+
+let cli: Reventless.CliArgs.cli<args> = {bin: "clear-pending-creates", usage, parse: parseArgs}
+
+let main = () =>
+  Reventless.CliArgs.run(cli, async args =>
+    switch run(args) {
+    | Ok() => ()
+    | Error(messages) =>
+      messages->Array.forEach(message => Console.error(`::error::${message}`))
+      NodeProcess.exit(1)
+    }
+  )
+
+// No top-level call: `../run-clear-pending-creates.mjs` invokes [main], so a test
+// can import this module.

package/scripts/ClearPendingCreates.res.mjs

@@ -0,0 +1,187 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
+import * as Nodechild_process from "node:child_process";
+
+let safeTypes = ["aws:acm/certificateValidation:CertificateValidation"];
+
+function pendingOperations($$export) {
+  let field = (json, name) => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[name]);
+  let text = (json, name) => Stdlib_Option.getOr(Stdlib_Option.flatMap(field(json, name), Stdlib_JSON.Decode.string), "");
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(field($$export, "deployment"), deployment => field(deployment, "pending_operations")), Stdlib_JSON.Decode.array), []).map(operation => {
+    let resource = Stdlib_Option.getOr(field(operation, "resource"), null);
+    return {
+      urn: text(resource, "urn"),
+      resourceType: text(resource, "type"),
+      operation: text(operation, "type")
+    };
+  });
+}
+
+function isSafe(pending) {
+  return safeTypes.includes(pending.resourceType);
+}
+
+function parseArgs(argv) {
+  return Stdlib_Result.flatMap(Stdlib_Result.flatMap(CliArgs$Reventless.parse([
+    "stack",
+    "cwd"
+  ], undefined, undefined, undefined, argv), CliArgs$Reventless.noPositionals), a => {
+    let stack = CliArgs$Reventless.string(a, "stack");
+    if (stack !== undefined) {
+      return {
+        TAG: "Ok",
+        _0: {
+          stack: stack,
+          cwd: Stdlib_Option.getOr(CliArgs$Reventless.string(a, "cwd"), process.cwd())
+        }
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: "--stack names the stack to recover"
+      };
+    }
+  });
+}
+
+let usage = `
+Usage: clear-pending-creates --stack <name> [--cwd <dir>]
+
+Recovers a stack before \`pulumi up\`: cancels a stale update, drops the pending
+creates of types with nothing in AWS behind them, and refreshes. Any other pending
+operation fails the command, for someone to resolve by hand.
+
+  --stack <name>   The stack.
+  --cwd <dir>      The Pulumi project. Defaults to the working directory.
+`;
+
+function pulumi(args, command) {
+  return Nodechild_process.spawnSync("pulumi", command.concat([
+    "--stack",
+    args.stack,
+    "--cwd",
+    args.cwd,
+    "--non-interactive"
+  ]), {
+    encoding: "utf8",
+    maxBuffer: 268435456
+  });
+}
+
+function succeeded(result) {
+  return Primitive_object.equal(Primitive_option.fromNullable(result.status), 0);
+}
+
+function stderrOf(result) {
+  return Stdlib_Option.getOr(Primitive_option.fromNullable(result.stderr), "").trim();
+}
+
+function run(args) {
+  let cancel = pulumi(args, [
+    "cancel",
+    "--yes"
+  ]);
+  let message = stderrOf(cancel);
+  if (!succeeded(cancel) && message !== "" && !message.toLowerCase().includes("no update in progress")) {
+    console.error(`::warning::pulumi cancel: ` + message);
+  }
+  let exported = pulumi(args, [
+    "stack",
+    "export"
+  ]);
+  let stdout = exported.stdout;
+  let state;
+  let exit = 0;
+  if ((stdout == null) || !succeeded(exported)) {
+    exit = 1;
+  } else {
+    try {
+      state = {
+        TAG: "Ok",
+        _0: JSON.parse(stdout)
+      };
+    } catch (exn) {
+      state = {
+        TAG: "Error",
+        _0: [`the export of stack ` + args.stack + ` is not JSON`]
+      };
+    }
+  }
+  if (exit === 1) {
+    state = {
+      TAG: "Error",
+      _0: [`pulumi stack export failed: ` + stderrOf(exported)]
+    };
+  }
+  return Stdlib_Result.flatMap(state, state => {
+    let pending = pendingOperations(state);
+    let refused = pending.filter(p => !safeTypes.includes(p.resourceType));
+    if (Primitive_object.equal(pending, [])) {
+      console.log(`No pending operations on stack ` + args.stack + `.`);
+    } else {
+      console.log(pending.length.toString() + ` pending operation(s) on stack ` + args.stack + `.`);
+    }
+    if (Primitive_object.notequal(refused, [])) {
+      return {
+        TAG: "Error",
+        _0: refused.map(p => `Pending ` + p.operation + ` of ` + p.urn + ` (` + p.resourceType + `): not cleared, because something may exist in AWS behind it. Resolve it by hand, or, if the type has nothing behind it, add it to ClearPendingCreates.safeTypes.`)
+      };
+    }
+    pending.forEach(p => {
+      console.log(`::warning::Clearing pending ` + p.operation + ` of ` + p.urn + ` (` + p.resourceType + `)`);
+    });
+    let clear = Primitive_object.equal(pending, []) ? [] : ["--clear-pending-creates"];
+    let refreshed = pulumi(args, [
+      "refresh",
+      "--yes",
+      "--skip-preview"
+    ].concat(clear));
+    if (!succeeded(refreshed)) {
+      console.error(`::warning::pulumi refresh had errors; pulumi up runs anyway. ` + stderrOf(refreshed));
+    }
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  });
+}
+
+let cli = {
+  bin: "clear-pending-creates",
+  usage: usage,
+  parse: parseArgs
+};
+
+function main() {
+  return CliArgs$Reventless.run(cli, undefined, undefined, async args => {
+    let messages = run(args);
+    if (messages.TAG === "Ok") {
+      return;
+    }
+    messages._0.forEach(message => {
+      console.error(`::error::` + message);
+    });
+    process.exit(1);
+  });
+}
+
+export {
+  safeTypes,
+  pendingOperations,
+  isSafe,
+  parseArgs,
+  usage,
+  pulumi,
+  succeeded,
+  stderrOf,
+  run,
+  cli,
+  main,
+}
+/* CliArgs-Reventless Not a pure module */

package/scripts/DeployApp.res

@@ -86,6 +86,7 @@ type project = {
   projectName: string,
   program: string,
   stackDefaults: dict<string>,
+  region: option<string>,
 }
 
 @module("yaml") external parseYaml: string => JSON.t = "parse"
@@ -111,6 +112,7 @@ let projectOf = (p: DeployManifest.project): result<project, string> => {
         projectName,
         program: NodePath.join([p.dir, field("main")->Option.getOr("index.js")]),
         stackDefaults: p.stackDefaults,
+        region: p.region,
       })
     }
   }
@@ -150,6 +152,19 @@ let backendNeedsPassphrase = (~url: option<string>, ~env: dict<string>): bool =>
   | _ => false
   }
 
+/** A manifest that puts a stack in another region than the one `up` deploys
+    every stack to. */
+let regionProblems = (~projects: array<project>, ~region: string): array<string> =>
+  projects->Array.filterMap(p =>
+    switch p.region {
+    | Some(own) if own != region =>
+      Some(
+        `${p.label} deploys to ${own} in the manifest, and deploy-app deploys every stack to one region, ${region}. Deploy it with the deploy workflow, or from a manifest without that region.`,
+      )
+    | _ => None
+    }
+  )
+
 let unbuilt = (projects: array<project>): array<project> =>
   projects->Array.filter(p => !NodeFs.existsSync(p.program))
 
@@ -201,7 +216,7 @@ let check = async (~projects: array<project>): result<ready, array<string>> => {
         }
       | exception _ =>
         problems->Array.push(
-          "Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud) or `pulumi login --local`, and try again.",
+          "Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud), `pulumi login s3://<bucket>` (a bucket of your own) or `pulumi login --local`, and try again.",
         )
       }
     | exception _ =>
@@ -210,6 +225,9 @@ let check = async (~projects: array<project>): result<ready, array<string>> => {
       )
     }
   }
+  region->Option.forEach(region =>
+    regionProblems(~projects, ~region)->Array.forEach(p => problems->Array.push(p))
+  )
   unbuilt(projects)->Array.forEach(p =>
     problems->Array.push(
       `${p.label} is not built: ${p.program} is missing. Run \`pnpm run build\` and try again.`,

package/scripts/DeployApp.res.mjs

@@ -134,7 +134,8 @@ function projectOf(p) {
         dir: p.dir,
         projectName: projectName,
         program: Nodepath.join(p.dir, Stdlib_Option.getOr(field("main"), "index.js")),
-        stackDefaults: p.stackDefaults
+        stackDefaults: p.stackDefaults,
+        region: p.region
       }
     };
   } else {
@@ -183,6 +184,15 @@ function backendNeedsPassphrase(url, env) {
   }
 }
 
+function regionProblems(projects, region) {
+  return Stdlib_Array.filterMap(projects, p => {
+    let own = p.region;
+    if (own !== undefined && own !== region) {
+      return p.label + ` deploys to ` + own + ` in the manifest, and deploy-app deploys every stack to one region, ` + region + `. Deploy it with the deploy workflow, or from a manifest without that region.`;
+    }
+  });
+}
+
 function unbuilt(projects) {
   return projects.filter(p => !Nodefs.existsSync(p.program));
 }
@@ -243,7 +253,7 @@ async function check(projects) {
         who = await workspace.whoAmI();
         exit$3 = 2;
       } catch (exn$3) {
-        problems.push("Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud) or `pulumi login --local`, and try again.");
+        problems.push("Pulumi is not logged in. Run `pulumi login` (Pulumi Cloud), `pulumi login s3://<bucket>` (a bucket of your own) or `pulumi login --local`, and try again.");
       }
       if (exit$3 === 2) {
         if (backendNeedsPassphrase(who.url, process.env)) {
@@ -252,6 +262,11 @@ async function check(projects) {
       }
     }
   }
+  Stdlib_Option.forEach(region, region => {
+    regionProblems(projects, region).forEach(p => {
+      problems.push(p);
+    });
+  });
   unbuilt(projects).forEach(p => {
     problems.push(p.label + ` is not built: ` + p.program + ` is missing. Run \`pnpm run build\` and try again.`);
   });
@@ -917,6 +932,7 @@ export {
   requiredNodeMajor,
   checkNode,
   backendNeedsPassphrase,
+  regionProblems,
   unbuilt,
   check,
   layerName,

package/scripts/DeployManifest.res

@@ -7,6 +7,8 @@ it here. Paths in the file are relative to the file's own folder.
 
 `stack-defaults` on an entry are the settings `deploy-app` gives a stack it
 creates for that folder — what a new stack of this app cannot deploy without.
+A plugin's `region` overrides the file's for that stack; `review: false` keeps it
+out of a pull request's review environment.
 */
 
 @module("yaml") external parseYaml: string => JSON.t = "parse"
@@ -24,6 +26,8 @@ type plugin = {
   path: string,
   @as("depends-on") dependsOn?: array<string>,
   @as("stack-defaults") stackDefaults?: dict<string>,
+  region?: string,
+  review?: bool,
 }
 
 @schema
@@ -34,7 +38,7 @@ type t = {
 }
 
 /** One stack folder, with its path made absolute. */
-type project = {name: string, dir: string, stackDefaults: dict<string>}
+type project = {name: string, dir: string, stackDefaults: dict<string>, region: option<string>}
 
 type resolved = {
   file: string,
@@ -60,6 +64,7 @@ let resolve = (manifest: t, ~file: string): resolved => {
       name: manifest.platform.name->Option.getOr("platform"),
       dir: NodePath.resolve([base, manifest.platform.path]),
       stackDefaults: manifest.platform.stackDefaults->Option.getOr(Dict.make()),
+      region: None,
     },
     plugins: manifest.plugins
     ->Option.getOr([])
@@ -67,6 +72,7 @@ let resolve = (manifest: t, ~file: string): resolved => {
       name: p.name,
       dir: NodePath.resolve([base, p.path]),
       stackDefaults: p.stackDefaults->Option.getOr(Dict.make()),
+      region: p.region,
     }),
   }
 }

package/scripts/DeployManifest.res.mjs

@@ -18,7 +18,9 @@ let pluginSchema = Sury.$schema(s => ({
   name: s.m(Sury.string),
   path: s.m(Sury.string),
   "depends-on": s.m(Sury.$option(Sury.array(Sury.string))),
-  "stack-defaults": s.m(Sury.$option(Sury.record(Sury.string)))
+  "stack-defaults": s.m(Sury.$option(Sury.record(Sury.string))),
+  region: s.m(Sury.$option(Sury.string)),
+  review: s.m(Sury.$option(Sury.boolean))
 }));
 
 let schema = Sury.$schema(s => ({
@@ -57,12 +59,14 @@ function resolve(manifest, file) {
     platform: {
       name: Stdlib_Option.getOr(manifest.platform.name, "platform"),
       dir: Nodepath.resolve(base, manifest.platform.path),
-      stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {})
+      stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {}),
+      region: undefined
     },
     plugins: Stdlib_Option.getOr(manifest.plugins, []).map(p => ({
       name: p.name,
       dir: Nodepath.resolve(base, p.path),
-      stackDefaults: Stdlib_Option.getOr(p["stack-defaults"], {})
+      stackDefaults: Stdlib_Option.getOr(p["stack-defaults"], {}),
+      region: p.region
     }))
   };
 }

package/src/Platform.res

@@ -112,11 +112,34 @@ let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.
     resolves roles while it is built, and a mapping stated later is refused. */
 let roleGroups = Reventless.Role.setGroups
 
-/** The groups of a user pool this deployment did not create, which no accounts
-    manifest names. They count as provided by the check that every role a plugin
-    needs has a group. */
+/** Groups a root says its identity provider has, for a provider the platform
+    cannot list. Where it can (`loadProvidedGroups`), the listing decides, and a
+    declared group the pool lacks fails the deploy. */
 let providedGroups = Reventless.Role.provideGroups
 
+/** The platform stack a plugin stack deploys against (`platform:stack`), or
+    `None` in a program that is its own platform. One reference per program:
+    a second with the same name is a duplicate resource. */
+let platformStackRefCache: ref<option<option<Pulumi.StackReference.t>>> = ref(None)
+
+let platformStackReference = (): option<Pulumi.StackReference.t> =>
+  switch platformStackRefCache.contents {
+  | Some(stackRef) => stackRef
+  | None =>
+    let stackRef =
+      Pulumi.Config.make(Some("platform"))
+      ->Pulumi.Config.get("stack")
+      ->Option.map(stack => Pulumi.StackReference.make(stack))
+    platformStackRefCache := Some(stackRef)
+    stackRef
+  }
+
+/** Ask the user pool which groups it has, so the role check compares each
+    plugin's roles with the pool. A plugin's deploy program calls `deployPlugin`
+    once this resolves; see [Platform_ProvidedGroups]. */
+let loadProvidedGroups = (): promise<unit> =>
+  Platform_ProvidedGroups.load(~stackRef=platformStackReference())
+
 /** The group a role resolves to — the name this platform writes into its
     directives, its shell configuration and the elevated groups. For code that
     grants access by group, so it never spells one itself. */
@@ -164,10 +187,10 @@ module MakeWithConfig = (
   // [Reventless.OwnerScope.defaultElevatedGroups].
   Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
 
-  // What this deployment provides for the roles its plugins need: the
-  // administrator group the stack declares, and the groups of the accounts
-  // provisioning creates. Read when each plugin is built, after the root has
-  // mapped its roles.
+  // What this deployment provides for the roles its plugins need, where the pool
+  // was not listed (`loadProvidedGroups`): the administrator group the stack
+  // declares, and the groups of the accounts provisioning creates. Read when each
+  // plugin is built, after the root has mapped its roles.
   Reventless.Role.provideGroupsFrom(() =>
     [Reventless.Role.adminGroup()]->Array.concat(Reventless.AccountsManifest.declaredGroups())
   )
@@ -228,10 +251,7 @@ module MakeWithConfig = (
   // Determine API source based on platform:stack config.
   // - Platform/monolithic mode (no config): create a real AppSync API resource.
   // - Plugin mode (config set): reference the platform's shared API via StackReference.
-  let platformStackRef =
-    Pulumi.Config.make(Some("platform"))
-    ->Pulumi.Config.get("stack")
-    ->Option.map(stack => Pulumi.StackReference.make(stack))
+  let platformStackRef = platformStackReference()
 
   // The declared object stores, as the upload claimer needs them: qualified
   // name, physical bucket, served prefix.