@reventlessdev/reventless-aws 3.0.0-alpha.396 → 3.0.0-alpha.398

package/CHANGELOG.md

@@ -3,6 +3,46 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.398 (2026-10-25)
+
+### Bug Fixes
+
+* **aws:** provision-accounts mints a domain id only when the deployed trigger reads the store ([2c4b172](https://github.com/ReventlessDev/reventless-core/commit/2c4b172338c2dff8add8121517f2d7caf17fe42b))
+* refactor!: internal results and tool records whose parts may be absent are optional fields ([7009ddf](https://github.com/ReventlessDev/reventless-core/commit/7009ddf5d522f39ec9946a3b5cd062ceae889bbf))
+* refactor(aws)!: deploy and runtime configuration a function may lack are optional fields ([de80a54](https://github.com/ReventlessDev/reventless-core/commit/de80a546501a97b39cbe71200120f062bb260da4))
+* refactor(aws)!: command-line arguments a tool may not be given are optional fields ([82d5880](https://github.com/ReventlessDev/reventless-core/commit/82d5880e9aeda73fe9625dee73a1ca633b20a59a))
+* refactor(spec)!: the plugin structure's optional parts are optional fields ([130bad5](https://github.com/ReventlessDev/reventless-core/commit/130bad581caf725a9d61b5a3df3d012e4f8ba402))
+* feat!: an inbound translation is async and handed the platform's capabilities, and its audit row withholds sensitive fields ([dae6049](https://github.com/ReventlessDev/reventless-core/commit/dae6049e084f81408a494a2cd2011ec564dda65c))
+### Features
+
+* a plugin declares per role how a person is admitted, and the local platform honors the self-service and provisioned halves ([9c37bf5](https://github.com/ReventlessDev/reventless-core/commit/9c37bf50f15cac1703bf2c351713518121a56211))
+* a stash capability holds a value for minutes outside the log and hands it over once ([627f285](https://github.com/ReventlessDev/reventless-core/commit/627f28529ead2d2d31bdd091c9f42e7faca40f6f))
+
+### BREAKING CHANGES
+
+* code that builds these records drops `name: None` and
+writes `name: x` for `name: Some(x)`; a destructure of one of them binds a
+field that may be absent with `?name`.
+* code that builds these records drops `name: None` and
+writes `name: x` for `name: Some(x)`.
+* code that builds these records drops `name: None` and
+writes `name: x` for `name: Some(x)`.
+* code that builds these records drops `name: None`, writes
+`name: x` for `name: Some(x)`, and `name: ?x` for a value already of type
+option.
+* an inbound translation's translate takes ~capabilities and
+returns a promise, and its spec must declare capabilityNeeds ([] for one that
+only maps input). FromSlice steps return promises.
+
+
+
+# 3.0.0-alpha.397 (2026-10-23)
+
+### Bug Fixes
+
+* **aws:** a supplied pool without an identity store deploys, and its accounts keep their pool id ([49695ef](https://github.com/ReventlessDev/reventless-core/commit/49695ef79de89925c1e718ee9afa9a6ad7abd1f9))
+
+
 # 3.0.0-alpha.396 (2026-10-23)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.396",
+  "version": "3.0.0-alpha.398",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.34",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.32",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.36",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.34",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.307",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.308",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.171",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.175"
+    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.172",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.205",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.176"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/scripts/BakeManifest.res

@@ -24,9 +24,9 @@ module Lambda = AwsSdk.Lambda
 // ── Arguments ────────────────────────────────────────────────────────────────
 
 type args = {
-  manifest: option<string>,
-  stack: option<string>,
-  since: option<string>,
+  manifest?: string,
+  stack?: string,
+  since?: string,
   review: bool,
   help: bool,
 }
@@ -35,9 +35,9 @@ let parseArgs = (argv: array<string>): result<args, string> =>
   Reventless.CliArgs.parse(~strings=["manifest", "stack", "since"], ~bools=["review"], argv)
   ->Result.flatMap(Reventless.CliArgs.noPositionals)
   ->Result.map(a => {
-    manifest: a->Reventless.CliArgs.string("manifest"),
-    stack: a->Reventless.CliArgs.string("stack"),
-    since: a->Reventless.CliArgs.string("since")->Option.flatMap(v => v == "" ? None : Some(v)),
+    manifest: ?(a->Reventless.CliArgs.string("manifest")),
+    stack: ?(a->Reventless.CliArgs.string("stack")),
+    since: ?(a->Reventless.CliArgs.string("since")->Option.flatMap(v => v == "" ? None : Some(v))),
     review: a->Reventless.CliArgs.bool("review"),
     help: a->Reventless.CliArgs.help,
   })
@@ -129,13 +129,13 @@ type registration = {
   plugin: string,
   state: string,
   expected: string,
-  found: option<string>,
-  writtenAt: option<string>,
+  found?: string,
+  writtenAt?: string,
 }
 
 type summary = {plugins: int, registered: int, unchanged: int, matched: int}
 
-type written = {bucket: string, key: string, bytes: int, group: option<string>}
+type written = {bucket: string, key: string, bytes: int, group?: string}
 
 type answer =
   | Baked({written: array<written>, summary: option<summary>, registrations: array<registration>})
@@ -155,8 +155,8 @@ let _registrations = (o: dict<JSON.t>): array<registration> =>
     plugin: r->_string("plugin")->Option.getOr("?"),
     state: r->_string("state")->Option.getOr("?"),
     expected: r->_string("expected")->Option.getOr("?"),
-    found: r->_string("found"),
-    writtenAt: r->_string("writtenAt"),
+    found: ?(r->_string("found")),
+    writtenAt: ?(r->_string("writtenAt")),
   })
 
 let readAnswer = (json: JSON.t): result<answer, string> => {
@@ -184,7 +184,7 @@ let readAnswer = (json: JSON.t): result<answer, string> => {
           bucket: e->_string("bucket")->Option.getOr("?"),
           key: e->_string("key")->Option.getOr("?"),
           bytes: e->_int("bytes"),
-          group: e->_string("group"),
+          group: ?(e->_string("group")),
         }),
         summary: summaryEntry->Option.map(s => {
           plugins: s->_int("plugins"),
@@ -215,7 +215,7 @@ let unreachable = (registrations: array<registration>): array<registration> =>
 
 type settled = {
   written: array<written>,
-  summary: option<summary>,
+  summary?: summary,
   registrations: array<registration>,
 }
 
@@ -233,7 +233,7 @@ let converge = async (
     | Ok(json) =>
       switch readAnswer(json) {
       | Error(_) as e => e
-      | Ok(Baked({written, summary, registrations})) => Ok({written, summary, registrations})
+      | Ok(Baked({written, summary, registrations})) => Ok({written, ?summary, registrations})
       | Ok(Pending({pending, registrations})) =>
         registrations->Array.forEach(r => log(registrationLine(r)))
         switch unreachable(registrations) {
@@ -340,7 +340,7 @@ let bake = async (
         ~attempts,
       ) {
       | Error(_) as e => e
-      | Ok({written, summary, registrations}) =>
+      | Ok({written, ?summary, registrations}) =>
         written->Array.forEach(w =>
           Console.log(
             `Wrote ${w.bucket}/${w.key} (${w.bytes->Int.toString} bytes${w.group->Option.mapOr(

package/scripts/DeployApp.res

@@ -29,8 +29,8 @@ module Manifest = Reventless.AccountsManifest
 type command = Up | Down
 
 type args = {
-  command: option<command>,
-  manifest: option<string>,
+  command?: command,
+  manifest?: string,
   stack: string,
   help: bool,
 }
@@ -41,16 +41,15 @@ let parseArgs = (argv: array<string>): result<args, string> =>
   Reventless.CliArgs.parse(~strings=["manifest", "stack"], argv)->Result.flatMap(a => {
     let help = a->Reventless.CliArgs.help
     let args = {
-      command: None,
-      manifest: a->Reventless.CliArgs.string("manifest"),
+      manifest: ?(a->Reventless.CliArgs.string("manifest")),
       stack: a->Reventless.CliArgs.string("stack")->Option.getOr(defaultStack),
       help,
     }
     let positionals = a->Reventless.CliArgs.positionals
     switch (positionals->Array.get(0), positionals->Array.get(1)) {
     | (_, Some(surplus)) => Reventless.CliArgs.extra(surplus)
-    | (Some("up"), None) => Ok({...args, command: Some(Up)})
-    | (Some("down"), None) => Ok({...args, command: Some(Down)})
+    | (Some("up"), None) => Ok({...args, command: Up})
+    | (Some("down"), None) => Ok({...args, command: Down})
     | (Some(other), None) => Reventless.CliArgs.extra(other)
     | (None, None) => help ? Ok(args) : Error("say `up` or `down`")
     }
@@ -86,7 +85,7 @@ type project = {
   projectName: string,
   program: string,
   stackDefaults: dict<string>,
-  region: option<string>,
+  region?: string,
 }
 
 @module("yaml") external parseYaml: string => JSON.t = "parse"
@@ -112,7 +111,7 @@ let projectOf = (p: DeployManifest.project): result<project, string> => {
         projectName,
         program: NodePath.join([p.dir, field("main")->Option.getOr("index.js")]),
         stackDefaults: p.stackDefaults,
-        region: p.region,
+        region: ?p.region,
       })
     }
   }
@@ -693,7 +692,7 @@ let down = async (~manifest: DeployManifest.resolved, ~stack: string): result<un
     }
   }
 
-let run = async ({command, manifest, stack}: args): result<unit, string> =>
+let run = async ({?command, ?manifest, stack}: args): result<unit, string> =>
   switch DeployManifest.load(manifest->Option.getOr(DeployManifest.defaultFile)) {
   | Error(_) as e => e
   | Ok(manifest) =>

package/scripts/DeployApp.res.mjs

@@ -39,7 +39,6 @@ function parseArgs(argv) {
     let args_manifest = CliArgs$Reventless.string(a, "manifest");
     let args_stack = Stdlib_Option.getOr(CliArgs$Reventless.string(a, "stack"), defaultStack);
     let args = {
-      command: undefined,
       manifest: args_manifest,
       stack: args_stack,
       help: help
@@ -65,24 +64,16 @@ function parseArgs(argv) {
     }
     switch (match) {
       case "down" :
+        let newrecord = {...args};
         return {
           TAG: "Ok",
-          _0: {
-            command: "Down",
-            manifest: args_manifest,
-            stack: args_stack,
-            help: help
-          }
+          _0: (newrecord.command = "Down", newrecord)
         };
       case "up" :
+        let newrecord$1 = {...args};
         return {
           TAG: "Ok",
-          _0: {
-            command: "Up",
-            manifest: args_manifest,
-            stack: args_stack,
-            help: help
-          }
+          _0: (newrecord$1.command = "Up", newrecord$1)
         };
       default:
         return CliArgs$Reventless.extra(match);

package/scripts/DeployManifest.res

@@ -42,14 +42,14 @@ type project = {
   name: string,
   dir: string,
   stackDefaults: dict<string>,
-  region: option<string>,
+  region?: string,
   /** Whether a review environment deploys it: false only on a plugin marked so. */
   review: bool,
 }
 
 type resolved = {
   file: string,
-  region: option<string>,
+  region?: string,
   platform: project,
   plugins: array<project>,
 }
@@ -66,12 +66,11 @@ let resolve = (manifest: t, ~file: string): resolved => {
   let base = NodePath.dirname(NodePath.resolve([file]))
   {
     file,
-    region: manifest.region,
+    region: ?manifest.region,
     platform: {
       name: manifest.platform.name->Option.getOr("platform"),
       dir: NodePath.resolve([base, manifest.platform.path]),
       stackDefaults: manifest.platform.stackDefaults->Option.getOr(Dict.make()),
-      region: None,
       review: true,
     },
     plugins: manifest.plugins
@@ -80,7 +79,7 @@ let resolve = (manifest: t, ~file: string): resolved => {
       name: p.name,
       dir: NodePath.resolve([base, p.path]),
       stackDefaults: p.stackDefaults->Option.getOr(Dict.make()),
-      region: p.region,
+      region: ?p.region,
       review: p.review->Option.getOr(true),
     }),
   }

package/scripts/DeployManifest.res.mjs

@@ -60,7 +60,6 @@ function resolve(manifest, file) {
       name: Stdlib_Option.getOr(manifest.platform.name, "platform"),
       dir: Nodepath.resolve(base, manifest.platform.path),
       stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {}),
-      region: undefined,
       review: true
     },
     plugins: Stdlib_Option.getOr(manifest.plugins, []).map(p => ({

package/scripts/ProvisionAccounts.res

@@ -44,9 +44,9 @@ module Manifest = Reventless.AccountsManifest
 // ── Arguments ────────────────────────────────────────────────────────────────
 
 type args = {
-  providerId: option<string>,
-  stack: option<string>,
-  file: option<string>,
+  providerId?: string,
+  stack?: string,
+  file?: string,
   help: bool,
 }
 
@@ -58,9 +58,9 @@ let parseArgs = (argv: array<string>): result<args, string> =>
   Reventless.CliArgs.parse(~strings=["provider-id", "stack", "file"], argv)
   ->Result.flatMap(Reventless.CliArgs.noPositionals)
   ->Result.map(a => {
-    providerId: a->Reventless.CliArgs.string("provider-id"),
-    stack: a->Reventless.CliArgs.string("stack"),
-    file: a->Reventless.CliArgs.string("file"),
+    providerId: ?(a->Reventless.CliArgs.string("provider-id")),
+    stack: ?(a->Reventless.CliArgs.string("stack")),
+    file: ?(a->Reventless.CliArgs.string("file")),
     help: a->Reventless.CliArgs.help,
   })
 
@@ -167,38 +167,30 @@ let ensureGroups = async (~providerId: string, ~entries: array<Manifest.entry>):
   }
 }
 
-/**
-One account: the entry, applied.
-
-The password is set unconditionally rather than only for an account this run
-created — the same reason `provision-admin` does it, arriving at a manifest: the
-file is the record of what the credential *is*, so an account whose password
-drifted from the file is exactly the case a re-run is expected to fix.
+// ── The domain id ────────────────────────────────────────────────────────────
 
-Returns the id the pool minted, which is the value the manifest cannot know until
-the account exists and which nobody should be pasting by hand.
-*/
 /**
-Where the rows mapping a subject to its domain id live, for this pool.
-
-A stack-owned pool's table carries a generated suffix, so it is read off the
-stack's `identityStore` output; a pool no stack owns has the derived name
-`provision-identity` created it under. `None` when neither can be known, which
-is a pool provisioned before the store existed — accounts made then keep their
-`sub`, exactly as every account before them.
+The identity store the pool's trigger reads, or `None` when it reads none.
+
+Only a deployed stack can say, through its `identityStore` output, because the
+store matters only if the trigger was deployed knowing it. An empty output is a
+supplied pool whose store did not exist at the last deploy; a missing one is a
+stack deployed before the store existed; no stack is a pool nothing here can
+vouch for. In each of those the trigger adds no claim, so an id minted now would
+be one the account's own token never carries — every row it wrote would be keyed
+by its `sub` while the manifest named another id. The account keeps its `sub`
+instead, as every account before the store did, and the next deploy that wires
+the store lets the following run mint.
 */
-let // ── The domain id ────────────────────────────────────────────────────────────
-
-identityStoreFor = (~providerId: string, ~stack: option<string>): option<string> =>
+let identityStoreFor = (~stack: option<string>): option<string> =>
   switch stack->Option.orElse(ProvisionProvider.selectedStack()) {
+  | None => None
   | Some(stack) =>
     switch ProvisionProvider.pulumi(["stack", "output", "identityStore", "--stack", stack]) {
-    | "" => Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
+    | "" => None
     | name => Some(name)
-    | exception _ =>
-      Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
+    | exception _ => None
     }
-  | None => Some(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=providerId))
   }
 
 /** The domain id recorded for a subject, if the store has one. */
@@ -253,6 +245,17 @@ let domainIdFor = async (~store: option<string>, ~sub: string, ~created: bool):
     }
   }
 
+/**
+One account: the entry, applied.
+
+The password is set unconditionally rather than only for an account this run
+created — the same reason `provision-admin` does it, arriving at a manifest: the
+file is the record of what the credential *is*, so an account whose password
+drifted from the file is exactly the case a re-run is expected to fix.
+
+Returns the id the pool minted, which is the value the manifest cannot know until
+the account exists and which nobody should be pasting by hand.
+*/
 let applyEntry = async (
   ~providerId: string,
   ~entry: Manifest.entry,
@@ -340,7 +343,7 @@ let provision = async (
         for index in 0 to entries->Array.length - 1 {
           let entry = entries->Array.getUnsafe(index)
           let userId = await applyEntry(~providerId, ~entry, ~identityStore)
-          fills->Array.push({Manifest.index, password: None, userId})
+          fills->Array.push({Manifest.index, ?userId})
         }
         switch Manifest.fillFile(~path=file, ~fills) {
         | Error(message) => Error(`${file}: ${message}`)
@@ -371,8 +374,13 @@ let run = async (args: args): result<unit, string> =>
       Error(`${message}. To fill in the manifest without creating anything, run prepare-accounts`)
     | Ok((providerId, source)) =>
       Console.log(`provider ${providerId} (from ${source->ProvisionProvider.describe})`)
-      let identityStore = identityStoreFor(~providerId, ~stack=args.stack)
-      identityStore->Option.forEach(store => Console.log(`store    ${store}`))
+      let identityStore = identityStoreFor(~stack=args.stack)
+      Console.log(
+        switch identityStore {
+        | Some(store) => `store    ${store}`
+        | None => `store    none the deployed trigger reads — new accounts keep their pool id`
+        },
+      )
       await provision(~file, ~providerId, ~identityStore?)
     }
   }

package/scripts/ProvisionAccounts.res.mjs

@@ -109,10 +109,10 @@ async function ensureGroups(providerId, entries) {
   }
 }
 
-function identityStoreFor(providerId, stack) {
+function identityStoreFor(stack) {
   let stack$1 = Stdlib_Option.orElse(stack, ProvisionProvider$ReventlessAws.selectedStack());
   if (stack$1 === undefined) {
-    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+    return;
   }
   let name;
   try {
@@ -124,10 +124,10 @@ function identityStoreFor(providerId, stack) {
       stack$1
     ]);
   } catch (exn) {
-    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+    return;
   }
   if (name === "") {
-    return Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(providerId);
+    return;
   } else {
     return name;
   }
@@ -260,7 +260,6 @@ async function provision(file, providerId, identityStore, checkPoolOpt) {
     let userId = await applyEntry(providerId, entry, identityStore);
     fills.push({
       index: index,
-      password: undefined,
       userId: userId
     });
   }
@@ -299,10 +298,8 @@ async function run(args) {
   let match = message._0;
   let providerId = match[0];
   console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
-  let identityStore = identityStoreFor(providerId, args.stack);
-  Stdlib_Option.forEach(identityStore, store => {
-    console.log(`store    ` + store);
-  });
+  let identityStore = identityStoreFor(args.stack);
+  console.log(identityStore !== undefined ? `store    ` + identityStore : `store    none the deployed trigger reads — new accounts keep their pool id`);
   return await provision(file, providerId, identityStore, undefined);
 }
 

package/scripts/ProvisionAdmin.res

@@ -41,9 +41,9 @@ module Cognito = CognitoIdentityServiceProvider
 // ── Arguments ────────────────────────────────────────────────────────────────
 
 type args = {
-  providerId: option<string>,
-  stack: option<string>,
-  email: option<string>,
+  providerId?: string,
+  stack?: string,
+  email?: string,
   help: bool,
 }
 
@@ -56,9 +56,9 @@ let parseArgs = (argv: array<string>): result<args, string> =>
   Reventless.CliArgs.parse(~strings=["provider-id", "stack", "email"], argv)
   ->Result.flatMap(Reventless.CliArgs.noPositionals)
   ->Result.map(a => {
-    providerId: a->Reventless.CliArgs.string("provider-id"),
-    stack: a->Reventless.CliArgs.string("stack"),
-    email: a->Reventless.CliArgs.string("email"),
+    providerId: ?(a->Reventless.CliArgs.string("provider-id")),
+    stack: ?(a->Reventless.CliArgs.string("stack")),
+    email: ?(a->Reventless.CliArgs.string("email")),
     help: a->Reventless.CliArgs.help,
   })
 
@@ -200,21 +200,21 @@ made through a signed-in session because there is no signed-in session yet. The
 rest of the cast is a list rather than a command: declare it in
 .reventless/users.yaml and run \`pnpm exec provision-accounts\`.`
 
-type request = {email: string, providerId: option<string>, stack: option<string>}
+type request = {email: string, providerId?: string, stack?: string}
 
 /** The address is required before anything else is looked at: it costs nothing,
     while resolving the provider may shell out to Pulumi, and a run missing both
     arguments should say the cheap thing rather than fail on a stack lookup it
     never needed. */
 let parseRequest = (argv: array<string>): result<request, string> =>
-  parseArgs(argv)->Result.flatMap(({email, providerId, stack}) =>
+  parseArgs(argv)->Result.flatMap(({?email, ?providerId, ?stack}) =>
     switch email {
     | None => Error("--email is required — it is the address the administrator signs in with")
-    | Some(email) => Ok({email, providerId, stack})
+    | Some(email) => Ok({email, ?providerId, ?stack})
     }
   )
 
-let run = async ({email, providerId, stack}: request): result<unit, string> =>
+let run = async ({email, ?providerId, ?stack}: request): result<unit, string> =>
   switch ProvisionProvider.resolve(~given=providerId, ~stack) {
   | Error(_) as e => e
   | Ok((providerId, source)) =>

package/scripts/ProvisionIdentity.res

@@ -37,7 +37,7 @@ module Schema = Auth_ActiveRoleStore_Schema
 
 type args = {
   poolName: string,
-  providerId: option<string>,
+  providerId?: string,
   loginIdentifier: Auth_LoginIdentifier.t,
   signUpMode: Auth_SignUpMode.t,
   help: bool,
@@ -69,7 +69,7 @@ let parseArgs = (argv: array<string>): result<args, string> =>
     | (Ok(loginIdentifier), Ok(signUpMode)) =>
       Ok({
         poolName: given("name")->Option.getOr(defaultPoolName),
-        providerId: given("provider-id"),
+        providerId: ?given("provider-id"),
         loginIdentifier,
         signUpMode,
         help: a->Reventless.CliArgs.help,

package/scripts/ResolveEnvironment.res

@@ -27,8 +27,8 @@ type request =
   | PullRequest({number: int, base: string, draft: bool})
 
 type args = {
-  file: option<string>,
-  manifest: option<string>,
+  file?: string,
+  manifest?: string,
   request: request,
 }
 
@@ -52,7 +52,7 @@ let parseArgs = (argv: array<string>): result<args, string> =>
     | (None, None, None) => Error("say what deploys: --ref, or --pull-request with --base")
     | _ => Error("--ref and --pull-request are two different questions; ask one")
     }
-    request->Result.map(request => {file: string("file"), manifest: string("manifest"), request})
+    request->Result.map(request => {file: ?string("file"), manifest: ?string("manifest"), request})
   })
 
 let usage = `

package/src/Platform.res

@@ -71,7 +71,7 @@ type objectStoreEndpoint = {
   // itself. `None` when a host-UI bundle is deployed — there the shell's own
   // origin serves the store same-origin and a relative `/{prefix}/…` resolves
   // without a base.
-  baseUrl: option<Pulumi.Output.t<string>>,
+  baseUrl?: Pulumi.Output.t<string>,
 }
 let objectStoreEndpointsRef: ref<array<objectStoreEndpoint>> = ref([])
 
@@ -534,7 +534,6 @@ module MakeWithConfig = (
     let eventsApi: AppSync_EventsApi.t = {
       name: "DomainEventsApi",
       api,
-      defaultNamespace: None,
     }
     Some(eventsApi)
   }
@@ -1858,7 +1857,8 @@ module MakeWithConfig = (
         | ObjectStore({plugin, store}) => Some((plugin, store))
         | Geocoding
         | Messaging
-        | IdentityProvider =>
+        | IdentityProvider
+        | Stash =>
           None
         }
       )
@@ -2047,7 +2047,7 @@ module MakeWithConfig = (
       store,
       keyPrefix,
       bucketName: physicalBucketName->Pulumi.Output.fromInput,
-      baseUrl: storeServingBaseUrl,
+      baseUrl: ?storeServingBaseUrl,
     })
     objectStoreEndpointsRef := declaredStoreEndpoints
 
@@ -2982,6 +2982,8 @@ module MakeWithConfig = (
                   `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++ `\`platform:messagingEmailProvider: log\` to log every message and send none.`
                 | IdentityProvider =>
                   `\n  IdentityProvider is the platform's Cognito pool, exported as ` ++ `\`identityProviderId\`. This platform stack exports none — deploy it first.`
+                | Stash =>
+                  `\n  Stash has no deployed backend yet; the local platform keeps one in ` ++ `memory. Host a plugin that needs it on the local platform.`
                 }
               )
               // One line per capability, not per declaring component: two slices