@reventlessdev/reventless-aws 3.0.0-alpha.395 → 3.0.0-alpha.397

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.397 (2026-10-23)
+
+### Bug Fixes
+
+* **aws:** a supplied pool without an identity store deploys, and its accounts keep their pool id ([49695ef](https://github.com/ReventlessDev/reventless-core/commit/49695ef79de89925c1e718ee9afa9a6ad7abd1f9))
+
+
+# 3.0.0-alpha.396 (2026-10-23)
+
+### Features
+
+* **aws:** a new account gets a domain user id, carried as a token claim from a pool-scoped identity store ([ccfc90c](https://github.com/ReventlessDev/reventless-core/commit/ccfc90ced0c211cab23843864a2b4e580001b3ae))
+* **aws:** a slice declaring the identity provider is handed one over the platform's Cognito pool ([b3a933b](https://github.com/ReventlessDev/reventless-core/commit/b3a933bbda475d0ce932a8de30616f738d639417))
+
+
 # 3.0.0-alpha.395 (2026-10-22)
 
 * feat(aws)!: the host shell's config.json names the identity provider under the neutral keys only ([6ce24ba](https://github.com/ReventlessDev/reventless-core/commit/6ce24ba7dde27da02f76f7f9f6284ad09a48f15a))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.395",
+  "version": "3.0.0-alpha.397",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.33",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.35",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.33",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.31",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.306",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.171",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.175",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.203",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.170"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.307"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/scripts/DeployApp.res

@@ -587,7 +587,13 @@ let up = async (~manifest: DeployManifest.resolved, ~stack: string): result<unit
                     Error("the platform stack exports no identityProviderId to create accounts in")
                   | (Some(file), Some(providerId)) =>
                     Console.log("\n── Creating the accounts ──\n")
-                    switch await ProvisionAccounts.provision(~file, ~providerId) {
+                    // The stack just deployed is the one that exports the store
+                    // a new account's domain id is written to.
+                    switch await ProvisionAccounts.provision(
+                      ~file,
+                      ~providerId,
+                      ~identityStore=?platformOutputs->outputString("identityStore"),
+                    ) {
                     | Error(_) as e => e
                     | Ok() => Ok(Some(file))
                     }

package/scripts/DeployApp.res.mjs

@@ -728,7 +728,7 @@ async function up(manifest, stack) {
   if (match$2 !== undefined) {
     if (match$3 !== undefined) {
       console.log("\n── Creating the accounts ──\n");
-      let e$6 = await ProvisionAccounts$ReventlessAws.provision(match$2, match$3, undefined);
+      let e$6 = await ProvisionAccounts$ReventlessAws.provision(match$2, match$3, outputString(platformOutputs, "identityStore"), undefined);
       accounts = e$6.TAG === "Ok" ? ({
           TAG: "Ok",
           _0: match$2

package/scripts/ProvisionAccounts.res

@@ -178,7 +178,86 @@ drifted from the file is exactly the case a re-run is expected to fix.
 Returns the id the pool minted, which is the value the manifest cannot know until
 the account exists and which nobody should be pasting by hand.
 */
-let applyEntry = async (~providerId: string, ~entry: Manifest.entry): option<string> => {
+/**
+Where the rows mapping a subject to its domain id live, for this pool.
+
+A stack-owned pool's table carries a generated suffix, so it is read off the
+stack's `identityStore` output; a pool no stack owns has the derived name
+`provision-identity` created it under. `None` when neither can be known, which
+is a pool provisioned before the store existed — accounts made then keep their
+`sub`, exactly as every account before them.
+*/
+let // ── The domain id ────────────────────────────────────────────────────────────
+
+identityStoreFor = (~providerId: string, ~stack: option<string>): option<string> =>
+  switch stack->Option.orElse(ProvisionProvider.selectedStack()) {
+  | Some(stack) =>
+    switch ProvisionProvider.pulumi(["stack", "output", "identityStore", "--stack", stack]) {
+    | "" => Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
+    | name => Some(name)
+    | exception _ =>
+      Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
+    }
+  | None => Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
+  }
+
+/** The domain id recorded for a subject, if the store has one. */
+let recordedUserId = async (~store: string, ~sub: string): option<string> =>
+  try {
+    let out = await DynamoDb_DocumentClient.GetCommand.make({
+      tableName: store,
+      key: Dict.fromArray([(Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub))]),
+    })->DynamoDb_DocumentClient.GetCommand.send
+    out.item
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.flatMap(o => o->Dict.get(Auth_IdentityStore_Schema.userIdAttribute))
+    ->Option.flatMap(JSON.Decode.string)
+  } catch {
+  | exn if Util_AwsError.isNotFound(exn) => None
+  }
+
+/**
+The id the manifest should carry for this account.
+
+🚨 **Minted only for an account this run created.** An account that already
+existed has rows keyed by whatever id it has been writing under — its `sub`, or
+a domain id an earlier run minted — and re-minting would orphan every one of
+them. A store that does not exist leaves the account on its `sub`, which is what
+every account before the store did.
+*/
+let domainIdFor = async (~store: option<string>, ~sub: string, ~created: bool): option<string> =>
+  switch store {
+  | None => Some(sub)
+  | Some(store) =>
+    switch await recordedUserId(~store, ~sub) {
+    | Some(_) as recorded => recorded
+    | None if created =>
+      let minted = ReventlessCore.Auth_UserId.mint()
+      try {
+        let _ = await DynamoDb_DocumentClient.PutCommand.make({
+          tableName: store,
+          item: JSON.Encode.object(
+            Dict.fromArray([
+              (Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub)),
+              (Auth_IdentityStore_Schema.userIdAttribute, JSON.Encode.string(minted)),
+            ]),
+          ),
+        })->DynamoDb_DocumentClient.PutCommand.send
+        Some(minted)
+      } catch {
+      | exn if Util_AwsError.isNotFound(exn) =>
+        Console.log(`store    ${store} (missing — the account keeps its pool id)`)
+        Some(sub)
+      }
+    | None => Some(sub)
+    }
+  }
+
+let applyEntry = async (
+  ~providerId: string,
+  ~entry: Manifest.entry,
+  ~identityStore: option<string>,
+): option<string> => {
   let attributes: array<Cognito.AdminCreateUserCommand.attributeType> = looksLikeEmail(
     entry.username,
   )
@@ -200,7 +279,10 @@ let applyEntry = async (~providerId: string, ~entry: Manifest.entry): option<str
     await ProvisionCognito.addToGroup(~providerId, ~username=entry.username, ~group)
     Console.log(`member   ${entry.username} in ${group}`)
   }
-  await ProvisionCognito.subOf(~providerId, ~username=entry.username)
+  switch await ProvisionCognito.subOf(~providerId, ~username=entry.username) {
+  | None => None
+  | Some(sub) => await domainIdFor(~store=identityStore, ~sub, ~created=outcome == Created)
+  }
 }
 
 // ── Main ─────────────────────────────────────────────────────────────────────
@@ -233,6 +315,7 @@ is a parameter so a test can refuse without a pool.
 let provision = async (
   ~file: string,
   ~providerId: string,
+  ~identityStore: option<string>=?,
   ~checkPool=checkPoolAcceptsUsernames,
 ): result<unit, string> =>
   switch Manifest.parseFile(file) {
@@ -256,7 +339,7 @@ let provision = async (
         let fills = []
         for index in 0 to entries->Array.length - 1 {
           let entry = entries->Array.getUnsafe(index)
-          let userId = await applyEntry(~providerId, ~entry)
+          let userId = await applyEntry(~providerId, ~entry, ~identityStore)
           fills->Array.push({Manifest.index, password: None, userId})
         }
         switch Manifest.fillFile(~path=file, ~fills) {
@@ -288,7 +371,9 @@ let run = async (args: args): result<unit, string> =>
       Error(`${message}. To fill in the manifest without creating anything, run prepare-accounts`)
     | Ok((providerId, source)) =>
       Console.log(`provider ${providerId} (from ${source->ProvisionProvider.describe})`)
-      await provision(~file, ~providerId)
+      let identityStore = identityStoreFor(~providerId, ~stack=args.stack)
+      identityStore->Option.forEach(store => Console.log(`store    ${store}`))
+      await provision(~file, ~providerId, ~identityStore?)
     }
   }
 

package/scripts/ProvisionAccounts.res.mjs

@@ -1,12 +1,18 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
 import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
 import * as ProvisionProvider$ReventlessAws from "./ProvisionProvider.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_IdentityStore_Schema.res.mjs";
 
 function parseArgs(argv) {
   return Stdlib_Result.map(Stdlib_Result.flatMap(CliArgs$Reventless.parse([
@@ -103,7 +109,87 @@ async function ensureGroups(providerId, entries) {
   }
 }
 
-async function applyEntry(providerId, entry) {
+function identityStoreFor(providerId, stack) {
+  let stack$1 = Stdlib_Option.orElse(stack, ProvisionProvider$ReventlessAws.selectedStack());
+  if (stack$1 === undefined) {
+    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+  }
+  let name;
+  try {
+    name = ProvisionProvider$ReventlessAws.pulumi([
+      "stack",
+      "output",
+      "identityStore",
+      "--stack",
+      stack$1
+    ]);
+  } catch (exn) {
+    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+  }
+  if (name === "") {
+    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+  } else {
+    return name;
+  }
+}
+
+async function recordedUserId(store, sub) {
+  try {
+    let out = await DynamoDb_DocumentClient$AwsSdk.GetCommand.send(new LibDynamodb.GetCommand({
+      TableName: store,
+      Key: Object.fromEntries([[
+          Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+          sub
+        ]])
+    }));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(out.Item, Stdlib_JSON.Decode.object), o => o[Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute]), Stdlib_JSON.Decode.string);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.isNotFound(exn)) {
+      return;
+    }
+    throw exn;
+  }
+}
+
+async function domainIdFor(store, sub, created) {
+  if (store === undefined) {
+    return sub;
+  }
+  let recorded = await recordedUserId(store, sub);
+  if (recorded !== undefined) {
+    return recorded;
+  }
+  if (!created) {
+    return sub;
+  }
+  let minted = Auth_UserId$ReventlessCore.mint();
+  try {
+    await DynamoDb_DocumentClient$AwsSdk.PutCommand.send(new LibDynamodb.PutCommand({
+      Item: Object.fromEntries([
+        [
+          Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+          sub
+        ],
+        [
+          Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute,
+          minted
+        ]
+      ]),
+      TableName: store
+    }));
+    return minted;
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.isNotFound(exn)) {
+      console.log(`store    ` + store + ` (missing — the account keeps its pool id)`);
+      return sub;
+    }
+    throw exn;
+  }
+}
+
+async function applyEntry(providerId, entry, identityStore) {
   let attributes = looksLikeEmail(entry.username) ? [
       {
         Name: "email",
@@ -122,7 +208,10 @@ async function applyEntry(providerId, entry) {
     await ProvisionCognito$ReventlessAws.addToGroup(providerId, entry.username, group);
     console.log(`member   ` + entry.username + ` in ` + group);
   }
-  return await ProvisionCognito$ReventlessAws.subOf(providerId, entry.username);
+  let sub = await ProvisionCognito$ReventlessAws.subOf(providerId, entry.username);
+  if (sub !== undefined) {
+    return await domainIdFor(identityStore, sub, outcome === "Created");
+  }
 }
 
 function manifestNote(file) {
@@ -133,7 +222,7 @@ function manifestNote(file) {
    credentials for a deployment, not secrets to reuse anywhere real.`;
 }
 
-async function provision(file, providerId, checkPoolOpt) {
+async function provision(file, providerId, identityStore, checkPoolOpt) {
   let checkPool = checkPoolOpt !== undefined ? checkPoolOpt : checkPoolAcceptsUsernames;
   let message = AccountsManifest$Reventless.parseFile(file);
   if (message.TAG !== "Ok") {
@@ -168,7 +257,7 @@ async function provision(file, providerId, checkPoolOpt) {
   let fills = [];
   for (let index = 0, index_finish = entries.length; index < index_finish; ++index) {
     let entry = entries[index];
-    let userId = await applyEntry(providerId, entry);
+    let userId = await applyEntry(providerId, entry, identityStore);
     fills.push({
       index: index,
       password: undefined,
@@ -210,7 +299,11 @@ async function run(args) {
   let match = message._0;
   let providerId = match[0];
   console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
-  return await provision(file, providerId, undefined);
+  let identityStore = identityStoreFor(providerId, args.stack);
+  Stdlib_Option.forEach(identityStore, store => {
+    console.log(`store    ` + store);
+  });
+  return await provision(file, providerId, identityStore, undefined);
 }
 
 let cli = {
@@ -251,6 +344,9 @@ export {
   checkPoolAcceptsUsernames,
   describe,
   ensureGroups,
+  identityStoreFor,
+  recordedUserId,
+  domainIdFor,
   applyEntry,
   manifestNote,
   provision,

package/scripts/ProvisionIdentity.res

@@ -224,10 +224,34 @@ let resolvePool = async (~args: args): result<string, string> =>
 
 // ── The store ────────────────────────────────────────────────────────────────
 
-let keySchema: array<DynamoDb.DynamoDb.DescribeTableCommand.keySchemaElement> = [
-  {attributeName: Schema.partitionKey, keyType: "HASH"},
-  {attributeName: Schema.sortKey, keyType: "RANGE"},
-]
+/** One store to provision: its name, its key, and the refusal for a table under
+    that name with another key. Two stores share the pool's trigger, and this is
+    the shape both are described in. */
+type store = {
+  tableName: string,
+  keySchema: array<(string, string)>,
+  refusal: (~tableName: string, ~actual: array<(string, string)>) => option<string>,
+}
+
+let activeRoleStore = (~providerId: string): store => {
+  tableName: Schema.derivedStoreName(~identityProviderId=providerId),
+  keySchema: Schema.expectedKeySchema,
+  refusal: Schema.keySchemaRefusal,
+}
+
+let identityStore = (~providerId: string): store => {
+  tableName: Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId),
+  keySchema: Auth_IdentityStore_Schema.expectedKeySchema,
+  refusal: Auth_IdentityStore_Schema.keySchemaRefusal,
+}
+
+let keySchemaOf = (pairs: array<(string, string)>): array<
+  DynamoDb.DynamoDb.DescribeTableCommand.keySchemaElement,
+> =>
+  pairs->Array.map(((attributeName, keyType)) => {
+    DynamoDb.DynamoDb.DescribeTableCommand.attributeName,
+    keyType,
+  })
 
 /** The SDK's shape mapped onto the plain pairs [Schema.keySchemaRefusal] compares.
   The refusal itself lives with the schema it is about, since the schema is what
@@ -248,13 +272,10 @@ let describeTable = async (~tableName: string): option<
   | exn if Util_AwsError.isNotFound(exn) => None
   }
 
-let provisionStore = async (~tableName: string): result<unit, string> =>
+let provisionStore = async ({tableName, keySchema, refusal}: store): result<unit, string> =>
   switch await describeTable(~tableName) {
   | Some(described) =>
-    switch Schema.keySchemaRefusal(
-      ~tableName,
-      ~actual=described.keySchema->Option.getOr([])->asPairs,
-    ) {
+    switch refusal(~tableName, ~actual=described.keySchema->Option.getOr([])->asPairs) {
     | Some(message) => Error(message)
     | None =>
       Console.log(`store    ${tableName} (adopted)`)
@@ -263,11 +284,11 @@ let provisionStore = async (~tableName: string): result<unit, string> =>
   | None =>
     let _ = await DynamoDb.DynamoDb.CreateTableCommand.make({
       tableName,
-      keySchema,
-      attributeDefinitions: [
-        {attributeName: Schema.partitionKey, attributeType: "S"},
-        {attributeName: Schema.sortKey, attributeType: "S"},
-      ],
+      keySchema: keySchemaOf(keySchema),
+      attributeDefinitions: keySchema->Array.map(((attributeName, _)) => {
+        DynamoDb.DynamoDb.CreateTableCommand.attributeName,
+        attributeType: "S",
+      }),
       billingMode: "PAY_PER_REQUEST",
     })->DynamoDb.DynamoDb.CreateTableCommand.send
 
@@ -315,12 +336,15 @@ let run = async (args: args): result<unit, string> =>
   switch await resolvePool(~args) {
   | Error(_) as e => e
   | Ok(providerId) =>
-    let tableName = Schema.derivedStoreName(~identityProviderId=providerId)
-    switch await provisionStore(~tableName) {
+    switch await provisionStore(activeRoleStore(~providerId)) {
     | Error(_) as e => e
     | Ok() =>
-      Console.log(nextSteps(~providerId))
-      Ok()
+      switch await provisionStore(identityStore(~providerId)) {
+      | Error(_) as e => e
+      | Ok() =>
+        Console.log(nextSteps(~providerId))
+        Ok()
+      }
     }
   }
 

package/scripts/ProvisionIdentity.res.mjs

@@ -10,6 +10,7 @@ import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs"
 import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_IdentityStore_Schema.res.mjs";
 import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
 
@@ -185,16 +186,28 @@ async function resolvePool(args) {
   }
 }
 
-let keySchema = [
-  {
-    AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
-    KeyType: "HASH"
-  },
-  {
-    AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
-    KeyType: "RANGE"
-  }
-];
+function activeRoleStore(providerId) {
+  return {
+    tableName: Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName(providerId),
+    keySchema: Auth_ActiveRoleStore_Schema$ReventlessAws.expectedKeySchema,
+    refusal: Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal
+  };
+}
+
+function identityStore(providerId) {
+  return {
+    tableName: Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId),
+    keySchema: Auth_IdentityStore_Schema$ReventlessAws.expectedKeySchema,
+    refusal: Auth_IdentityStore_Schema$ReventlessAws.keySchemaRefusal
+  };
+}
+
+function keySchemaOf(pairs) {
+  return pairs.map(param => ({
+    AttributeName: param[0],
+    KeyType: param[1]
+  }));
+}
 
 function asPairs(elements) {
   return elements.map(k => [
@@ -217,10 +230,12 @@ async function describeTable(tableName) {
   }
 }
 
-async function provisionStore(tableName) {
+async function provisionStore(param) {
+  let keySchema = param.keySchema;
+  let tableName = param.tableName;
   let described = await describeTable(tableName);
   if (described !== undefined) {
-    let message = Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(tableName, asPairs(Stdlib_Option.getOr(described.KeySchema, [])));
+    let message = param.refusal(tableName, asPairs(Stdlib_Option.getOr(described.KeySchema, [])));
     if (message !== undefined) {
       return {
         TAG: "Error",
@@ -236,17 +251,11 @@ async function provisionStore(tableName) {
   }
   await DynamoDb_DynamoDb$AwsSdk.CreateTableCommand.send(new ClientDynamodb.CreateTableCommand({
     TableName: tableName,
-    KeySchema: keySchema,
-    AttributeDefinitions: [
-      {
-        AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
-        AttributeType: "S"
-      },
-      {
-        AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
-        AttributeType: "S"
-      }
-    ],
+    KeySchema: keySchemaOf(keySchema),
+    AttributeDefinitions: keySchema.map(param => ({
+      AttributeName: param[0],
+      AttributeType: "S"
+    })),
     BillingMode: "PAY_PER_REQUEST"
   }));
   let waited = await DynamoDb_DynamoDb$AwsSdk.TableExistsWaiter.wait(tableName, undefined);
@@ -296,11 +305,14 @@ async function run(args) {
     return e;
   }
   let providerId = e._0;
-  let tableName = Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName(providerId);
-  let e$1 = await provisionStore(tableName);
+  let e$1 = await provisionStore(activeRoleStore(providerId));
   if (e$1.TAG !== "Ok") {
     return e$1;
   }
+  let e$2 = await provisionStore(identityStore(providerId));
+  if (e$2.TAG !== "Ok") {
+    return e$2;
+  }
   console.log(nextSteps(providerId));
   return {
     TAG: "Ok",
@@ -347,7 +359,9 @@ export {
   poolSettings,
   findPoolByName,
   resolvePool,
-  keySchema,
+  activeRoleStore,
+  identityStore,
+  keySchemaOf,
   asPairs,
   describeTable,
   provisionStore,

package/src/Platform.res

@@ -1287,9 +1287,9 @@ module MakeWithConfig = (
     // door: unlike geocoding, a browser has no business sending mail from the
     // deployment's identity. Unset ⇒ no export, no grant.
     messagingSender?: ReventlessInfra.Platform.messagingSender,
-    // Ignored here: an in-process provider cannot reach a Lambda, and no
-    // pool-backed handle exists yet. The deploy gate refuses a plugin that
-    // declares the need, naming this.
+    // Ignored here: an in-process provider cannot reach a Lambda. Every AWS
+    // platform has a pool, and a plugin whose slice declares the need is handed
+    // a provider over it with no root opt-in — see `deployPlugin`.
     identityProvider?: Reventless.IdentityProvider.t,
     // Optional object store for direct-to-S3 uploads, as returned by
     // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
@@ -2760,6 +2760,37 @@ module MakeWithConfig = (
     }
     PluginRuntime_Builder.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider)
 
+    // The pool and its identity store, read across the same two halves. Every
+    // AWS platform has a pool, so unlike the two above there is no root opt-in:
+    // what a plugin declares decides whether its slices are granted the admin
+    // calls, in the slice runtime's finalizer.
+    let platformOutput = (name: string, ~local: unit => Pulumi.Output.t<string>) =>
+      switch platformStackRef {
+      | Some(stackRef) =>
+        (
+          stackRef->Pulumi.StackReference.getOutput(name): Pulumi.Output.t<option<string>>
+        )->Pulumi.Output.apply(o => o->Option.getOr(""))
+      | None => local()
+      }
+    let identityProviderId = platformOutput("identityProviderId", ~local=() =>
+      Platform_Stack.resolveCognitoUserPool().poolId
+    )
+    PluginRuntime_Builder.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId)
+    PluginRuntime_Builder.registerCapabilityEnv(
+      "IDENTITY_STORE_TABLE",
+      platformOutput("identityStore", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().identityTable.name
+      ),
+    )
+    PluginRuntime_Builder.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().poolArn
+      ),
+      storeArn: platformOutput("identityStoreArn", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().identityTable.arn
+      ),
+    })
+
     module P = unpack(plugin)
     let pluginComponent = P.make()
     ReventlessCore.Plugin_Helpers.clearOffload()
@@ -2895,10 +2926,17 @@ module MakeWithConfig = (
           stackRef->Pulumi.StackReference.getOutput("objectStores"),
           geocoderPlaceIndex,
           messagingEmailSender,
+          identityProviderId,
         )
-        ->Pulumi.Output.all4
+        ->Pulumi.Output.all5
         ->Pulumi.Output.apply((
-          (structure, objectStores, placeIndex, emailSender): (_, option<JSON.t>, string, string),
+          (structure, objectStores, placeIndex, emailSender, poolId): (
+            _,
+            option<JSON.t>,
+            string,
+            string,
+            string,
+          ),
         ) => {
           // ── Declared capabilities ──────────────────────────────────────────
           //
@@ -2922,10 +2960,11 @@ module MakeWithConfig = (
             // The values the slice Lambdas are actually handed, so this reads
             // what decides the outcome rather than a second record of the same
             // intent. `""` is what an unprovisioned platform exports.
-            ~provisioned=Array.concat(
+            ~provisioned=[
               placeIndex == "" ? [] : [Reventless.CapabilityNeed.Geocoding],
               emailSender == "" ? [] : [Reventless.CapabilityNeed.Messaging],
-            ),
+              poolId == "" ? [] : [Reventless.CapabilityNeed.IdentityProvider],
+            ]->Array.flat,
           ) {
           | [] => ()
           | missing =>
@@ -2942,9 +2981,7 @@ module MakeWithConfig = (
                   `default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or ` ++
                   `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++ `\`platform:messagingEmailProvider: log\` to log every message and send none.`
                 | IdentityProvider =>
-                  `\n  IdentityProvider has no backend on any platform yet — the seam and the ` ++
-                  `refusal exist, the Cognito and local implementations do not. A plugin ` ++
-                  `declaring this need cannot be deployed until one lands; nothing about this ` ++ `deployment's configuration will change that.`
+                  `\n  IdentityProvider is the platform's Cognito pool, exported as ` ++ `\`identityProviderId\`. This platform stack exports none — deploy it first.`
                 }
               )
               // One line per capability, not per declaring component: two slices