@reventlessdev/reventless-aws 3.0.0-alpha.398 → 3.0.0-alpha.400

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.400 (2026-10-25)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
+# 3.0.0-alpha.399 (2026-10-25)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.398 (2026-10-25)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.398",
+  "version": "3.0.0-alpha.400",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -24,17 +24,17 @@
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.36",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.34",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.36",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.308",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.310",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.207",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.172",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.205",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.176"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.174",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.178"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/scripts/DeployApp.res

@@ -61,7 +61,7 @@ Usage: deploy-app up|down [--manifest <path>] [--stack <name>]
 Deploy an app to AWS, or remove it again.
 
   deploy-app up     Deploy the platform and every plugin, bake the component
-                    manifest, create the accounts in .reventless/users.<stack>.yaml,
+                    manifest, create the accounts in .reventless/accounts.<stack>.yaml,
                     and print the web address and the sign-ins.
   deploy-app down   Remove every stack, and the Lambda layer and SSM parameter
                     \`up\` created.
@@ -495,12 +495,23 @@ let outputString = (outputs: dict<Automation.outputValue>, name: string): option
 /** The stack's own accounts file beside the platform, started from the app's
     template, or `None` when the app has no template — then there is nothing to
     create. Per stack because the file records the ids one pool minted: sharing
-    `users.yaml` would overwrite another deployment's record of its accounts. */
-let accountsFileName = stack => `users.${stack}.yaml`
+    `accounts.yaml` would overwrite another deployment's record of its accounts. A stack deployed
+    before the file was renamed keeps its `users.<stack>.yaml` until it is renamed. */
+let accountsFileName = stack => `accounts.${stack}.yaml`
+let oldAccountsFileName = stack => `users.${stack}.yaml`
 
 let accountsFile = (~platformDir: string, ~stack: string): option<string> => {
-  let file = NodePath.join([platformDir, ".reventless", accountsFileName(stack)])
-  let template = NodePath.join([platformDir, Manifest.templateName])
+  let file = {
+    let current = NodePath.join([platformDir, ".reventless", accountsFileName(stack)])
+    let old = NodePath.join([platformDir, ".reventless", oldAccountsFileName(stack)])
+    if !NodeFs.existsSync(current) && NodeFs.existsSync(old) {
+      Manifest.noticeOldName(old)
+      old
+    } else {
+      current
+    }
+  }
+  let template = Manifest.templateIn(platformDir)
   switch (NodeFs.existsSync(file), NodeFs.existsSync(template)) {
   | (false, false) => None
   | (true, _) => Some(file)

package/scripts/DeployApp.res.mjs

@@ -87,7 +87,7 @@ Usage: deploy-app up|down [--manifest <path>] [--stack <name>]
 Deploy an app to AWS, or remove it again.
 
   deploy-app up     Deploy the platform and every plugin, bake the component
-                    manifest, create the accounts in .reventless/users.<stack>.yaml,
+                    manifest, create the accounts in .reventless/accounts.<stack>.yaml,
                     and print the web address and the sign-ins.
   deploy-app down   Remove every stack, and the Lambda layer and SSM parameter
                     \`up\` created.
@@ -611,12 +611,18 @@ function outputString(outputs, name) {
 }
 
 function accountsFileName(stack) {
+  return `accounts.` + stack + `.yaml`;
+}
+
+function oldAccountsFileName(stack) {
   return `users.` + stack + `.yaml`;
 }
 
 function accountsFile(platformDir, stack) {
-  let file = Nodepath.join(platformDir, ".reventless", accountsFileName(stack));
-  let template = Nodepath.join(platformDir, AccountsManifest$Reventless.templateName);
+  let current = Nodepath.join(platformDir, ".reventless", accountsFileName(stack));
+  let old = Nodepath.join(platformDir, ".reventless", oldAccountsFileName(stack));
+  let file = !Nodefs.existsSync(current) && Nodefs.existsSync(old) ? (AccountsManifest$Reventless.noticeOldName(old), old) : current;
+  let template = AccountsManifest$Reventless.templateIn(platformDir);
   let match = Nodefs.existsSync(file);
   let match$1 = Nodefs.existsSync(template);
   if (match) {
@@ -946,6 +952,7 @@ export {
   deploy,
   outputString,
   accountsFileName,
+  oldAccountsFileName,
   accountsFile,
   signInLines,
   up,

package/scripts/ProvisionAccounts.res

@@ -17,7 +17,7 @@ one alone is enough.
 pnpm exec provision-accounts
 ```
 
-It reads `.reventless/users.yaml`, and knows nothing about any particular
+It reads `.reventless/accounts.yaml`, and knows nothing about any particular
 application's cast: the manifest belongs to whoever is deploying. A demo's four
 roles and a company's twelve staff are the same run. Which pool it writes to is
 [ProvisionProvider]'s question, and usually needs no argument either.
@@ -76,7 +76,7 @@ Turn a declared cast of accounts into working sign-ins.
                        created the pool or was handed one.
   --stack <name>       Read that output from this stack instead of the selected
                        one. The run always names the stack it used.
-  --file <path>        The manifest. Defaults to .reventless/users.yaml relative
+  --file <path>        The manifest. Defaults to .reventless/accounts.yaml relative
                        to the working directory, which is where both platforms
                        keep it.
 

package/scripts/ProvisionAccounts.res.mjs

@@ -39,7 +39,7 @@ Turn a declared cast of accounts into working sign-ins.
                        created the pool or was handed one.
   --stack <name>       Read that output from this stack instead of the selected
                        one. The run always names the stack it used.
-  --file <path>        The manifest. Defaults to .reventless/users.yaml relative
+  --file <path>        The manifest. Defaults to .reventless/accounts.yaml relative
                        to the working directory, which is where both platforms
                        keep it.
 

package/scripts/ProvisionAdmin.res

@@ -198,7 +198,7 @@ ${passwordNote}
 This script bootstraps the first account only, which is the one that cannot be
 made through a signed-in session because there is no signed-in session yet. The
 rest of the cast is a list rather than a command: declare it in
-.reventless/users.yaml and run \`pnpm exec provision-accounts\`.`
+.reventless/accounts.yaml and run \`pnpm exec provision-accounts\`.`
 
 type request = {email: string, providerId?: string, stack?: string}
 

package/scripts/ProvisionAdmin.res.mjs

@@ -119,7 +119,7 @@ The first administrator is ready.
 This script bootstraps the first account only, which is the one that cannot be
 made through a signed-in session because there is no signed-in session yet. The
 rest of the cast is a list rather than a command: declare it in
-.reventless/users.yaml and run \`pnpm exec provision-accounts\`.`;
+.reventless/accounts.yaml and run \`pnpm exec provision-accounts\`.`;
 }
 
 function parseRequest(argv) {

package/src/adapter/Identity/IdentityProvider_Cognito_Backend.res

@@ -1,7 +1,7 @@
 // The identity provider a deployed platform provisions: principals in its
 // Cognito pool, and each new one's domain id in the identity store the pool's
 // pre-token trigger reads. The AWS counterpart of the local platform's
-// `Capability_IdentityProvider_UserStore`, and reached the same way — on the
+// `Capability_IdentityProvider_AccountStore`, and reached the same way — on the
 // capability record a slice's `translate` receives.
 //
 // Pulumi-free so it ships in the slice Lambda. The pool calls go through an

package/tests/ProvisionAccountsTest.res

@@ -147,7 +147,7 @@ describe("ProvisionAccounts.provision", () => {
 
   test("a refused pool leaves the manifest untouched", async () => {
     let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "provision-accounts-"]))
-    let file = NodePath.join([dir, "users.yaml"])
+    let file = NodePath.join([dir, "accounts.yaml"])
     NodeFs.writeFileSync(file, manifest)
     let refuse = async (~providerId as _, ~usernames as _) => Error("pool signs in on email")
     let outcome = await Provision.provision(

package/tests/ProvisionAccountsTest.res.mjs

@@ -147,7 +147,7 @@ globalThis.describe("ProvisionAccounts.provision", () => {
 `;
   globalThis.test("a refused pool leaves the manifest untouched", async () => {
     let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "provision-accounts-"));
-    let file = Nodepath.join(dir, "users.yaml");
+    let file = Nodepath.join(dir, "accounts.yaml");
     Nodefs.writeFileSync(file, manifest, "utf8");
     let refuse = async (param, param$1) => ({
       TAG: "Error",