@reventlessdev/reventless-local 3.0.0-alpha.250 → 3.0.0-alpha.251

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.251 (2026-09-11)
+
+* feat(spec)!: a secret is a capability, so a test can know it in advance ([71507c6](https://github.com/ReventlessDev/reventless-core/commit/71507c6459b49178746f00c5040cb479d7fdade8))
+* feat(spec)!: making a principal is a capability, so the provider is replaceable ([3e59b9b](https://github.com/ReventlessDev/reventless-core/commit/3e59b9b665cc7e4b6b6f156b63b1b6bd0c6181ca))
+### Features
+
+* **aws:** the first administrator is one command, not the console ([5f1a846](https://github.com/ReventlessDev/reventless-core/commit/5f1a84603b21a9feb691a08a148751c6c6e8eca8))
+* **aws:** the rest of the cast is a file, not a comment ([aa23581](https://github.com/ReventlessDev/reventless-core/commit/aa23581f09948a47fb451ec2ecf2fc2bdd8e6ee6))
+
+### BREAKING CHANGES
+
+* Capabilities.t gains a secrets member. A platform that builds
+the record literally no longer compiles until it supplies one;
+Capabilities.none.secrets is the refusing value. Code that spreads
+Capabilities.none is unaffected.
+* Capabilities.t gains an identityProvider member. A platform
+that builds the record literally no longer compiles until it supplies one;
+Capabilities.none.identityProvider is the refusing value to pass while no
+backend exists. Code that spreads Capabilities.none is unaffected.
+
+
+
 # 3.0.0-alpha.250 (2026-09-09)
 
 **Note:** Version bump only for package @reventlessdev/reventless-local

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.250",
+  "version": "3.0.0-alpha.251",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -36,17 +36,17 @@
     "ws": "^8.18.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.33",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.28",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.11",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.22",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.11",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.20",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.261",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.109",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.162",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.21",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.125",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.208",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.134"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.262",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.110",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.209",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.163",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.126",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.135",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.21"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Auth/LocalAuth.res

@@ -24,7 +24,7 @@ let defaultUser: Identity.t = {
 let adminUser: Identity.t = {
   userId: "local-admin",
   username: "admin",
-  groups: ["Admin", "User"],
+  groups: [AdminGroup.name, "User"],
   provider: InMemory,
 }
 

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -8,6 +8,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 
 let defaultUser_groups = ["User"];
@@ -20,7 +21,7 @@ let defaultUser = {
 };
 
 let adminUser_groups = [
-  "Admin",
+  AdminGroup$Reventless.name,
   "User"
 ];
 

package/src/adapter/Auth/UserStore.res

@@ -14,40 +14,15 @@ open Reventless
 /**
  * One YAML entry. `groups` is required (use `[]` for an unprivileged user);
  * `userId` defaults to the username when omitted.
+ *
+ * The shape belongs to [AccountsManifest] rather than to this adapter: the AWS
+ * provisioning tool writes the same file, and two definitions of one file format
+ * is how a manifest starts working on one platform and failing on the other.
  */
-@schema
-type entry = {
-  username: string,
-  password: string,
-  groups: array<string>,
-  userId?: string,
-}
-
-// ── YAML parsing (eemeli/yaml) ──────────────────────────────────────────────
-
-@module("yaml") external _yamlParse: string => unknown = "parse"
-
-let _entriesSchema = S.array(entrySchema)
+type entry = AccountsManifest.entry
 
-/** Parses a YAML document string into entries (best-effort). */
-let parseString = (yamlText: string): result<array<entry>, string> =>
-  try {
-    let json = _yamlParse(yamlText)->Obj.magic
-    Ok(S.parseOrThrow(json, ~to=_entriesSchema))
-  } catch {
-  | JsExn(err) => Error(JsExn.message(err)->Option.getOr("YAML parse error"))
-  | _ => Error("YAML parse error")
-  }
-
-/** Reads + parses a YAML file. */
-let parseFile = (path: string): result<array<entry>, string> =>
-  try {
-    let text = NodeFs.readFileSync(path)
-    parseString(text)
-  } catch {
-  | JsExn(err) => Error(JsExn.message(err)->Option.getOr(`Cannot read ${path}`))
-  | _ => Error(`Cannot read ${path}`)
-  }
+let parseString = AccountsManifest.parseString
+let parseFile = AccountsManifest.parseFile
 
 // ── Resolution & loading ────────────────────────────────────────────────────
 
@@ -62,7 +37,7 @@ let _registerEntries = (entries: array<entry>): unit =>
     LocalAuth.Login.setCredentials(~username, ~password, ~identity=id)
   })
 
-let _defaultPath = (): string => NodePath.join([NodeProcess.cwd(), ".reventless/users.yaml"])
+let _defaultPath = AccountsManifest.defaultPath
 
 /**
  * Hydrates the Login store. Returns the resolution path actually used

package/src/adapter/Auth/UserStore.res.mjs

@@ -1,66 +1,10 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as S from "sury/src/S.res.mjs";
-import * as Sury from "sury";
-import * as Yaml from "yaml";
 import * as Nodefs from "node:fs";
-import * as Nodepath from "node:path";
-import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
-import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
-
-let entrySchema = Sury.$schema(s => ({
-  username: s.m(Sury.string),
-  password: s.m(Sury.string),
-  groups: s.m(Sury.array(Sury.string)),
-  userId: s.m(Sury.$option(Sury.string))
-}));
-
-let _entriesSchema = Sury.array(entrySchema);
-
-function parseString(yamlText) {
-  try {
-    let json = Yaml.parse(yamlText);
-    return {
-      TAG: "Ok",
-      _0: S.parseOrThrow(json, _entriesSchema)
-    };
-  } catch (raw_err) {
-    let err = Primitive_exceptions.internalToException(raw_err);
-    if (err.RE_EXN_ID === "JsExn") {
-      return {
-        TAG: "Error",
-        _0: Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "YAML parse error")
-      };
-    } else {
-      return {
-        TAG: "Error",
-        _0: "YAML parse error"
-      };
-    }
-  }
-}
-
-function parseFile(path) {
-  try {
-    return parseString(Nodefs.readFileSync(path, "utf8"));
-  } catch (raw_err) {
-    let err = Primitive_exceptions.internalToException(raw_err);
-    if (err.RE_EXN_ID === "JsExn") {
-      return {
-        TAG: "Error",
-        _0: Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), `Cannot read ` + path)
-      };
-    } else {
-      return {
-        TAG: "Error",
-        _0: `Cannot read ` + path
-      };
-    }
-  }
-}
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 
 function _registerEntries(entries) {
   entries.forEach(param => {
@@ -77,10 +21,6 @@ function _registerEntries(entries) {
   });
 }
 
-function _defaultPath() {
-  return Nodepath.join(process.cwd(), ".reventless/users.yaml");
-}
-
 let resolved = {
   contents: false
 };
@@ -99,7 +39,7 @@ function load(users, usersFile, param) {
     };
   }
   if (usersFile !== undefined) {
-    return Stdlib_Result.map(parseFile(usersFile), entries => {
+    return Stdlib_Result.map(AccountsManifest$Reventless.parseFile(usersFile), entries => {
       _registerEntries(entries);
       return {
         TAG: "UsersFile",
@@ -107,9 +47,9 @@ function load(users, usersFile, param) {
       };
     });
   }
-  let defaultPath = _defaultPath();
+  let defaultPath = AccountsManifest$Reventless.defaultPath();
   if (Nodefs.existsSync(defaultPath)) {
-    return Stdlib_Result.map(parseFile(defaultPath), entries => {
+    return Stdlib_Result.map(AccountsManifest$Reventless.parseFile(defaultPath), entries => {
       _registerEntries(entries);
       return {
         TAG: "DefaultFile",
@@ -132,9 +72,13 @@ function autoLoadOnce() {
   }
 }
 
+let parseString = AccountsManifest$Reventless.parseString;
+
+let parseFile = AccountsManifest$Reventless.parseFile;
+
+let _defaultPath = AccountsManifest$Reventless.defaultPath;
+
 export {
-  entrySchema,
-  _entriesSchema,
   parseString,
   parseFile,
   _registerEntries,
@@ -144,4 +88,4 @@ export {
   load,
   autoLoadOnce,
 }
-/* entrySchema Not a pure module */
+/* node:fs Not a pure module */

package/src/adapter/LocalCapabilities.res

@@ -27,4 +27,10 @@ let registerMessagingSender = (sender: string) => messagingSenderRef := sender
 let capabilities = (): Reventless.Capabilities.t => {
   geocode: Reventless.Capabilities.none.geocode,
   messaging: ReventlessCore.Messaging_Log_Backend.provider(~sender=messagingSenderRef.contents),
+  // Refusing rather than absent: the seam exists so a deployment can be asked
+  // what it provisions. Nothing writes back to the local user store yet, and
+  // answering `Unavailable` leaves the work queued and visible instead of
+  // recording a verdict against a person who has done nothing wrong.
+  identityProvider: Reventless.Capabilities.none.identityProvider,
+  secrets: ReventlessCore.Secrets_Node_Backend.provider,
 }

package/src/adapter/LocalCapabilities.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
+import * as Secrets_Node_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Secrets/Secrets_Node_Backend.res.mjs";
 import * as Messaging_Log_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Messaging/Messaging_Log_Backend.res.mjs";
 
 let messagingSenderRef = {
@@ -14,7 +15,9 @@ function registerMessagingSender(sender) {
 function capabilities() {
   return {
     geocode: Capabilities$Reventless.none.geocode,
-    messaging: Messaging_Log_Backend$ReventlessCore.provider(messagingSenderRef.contents)
+    messaging: Messaging_Log_Backend$ReventlessCore.provider(messagingSenderRef.contents),
+    identityProvider: Capabilities$Reventless.none.identityProvider,
+    secrets: Secrets_Node_Backend$ReventlessCore.provider
   };
 }
 

package/src/adapter/PlatformGraphQL_Server.res

@@ -41,7 +41,7 @@ let wrapAdmin = (resolvers: dict<ReventlessGraphqlServer.GraphQL_ServerInstance.
   resolvers
   ->Dict.toArray
   ->Array.forEach(((k, v)) =>
-    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group="Admin", v))
+    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group=Reventless.AdminGroup.name, v))
   )
   wrapped
 }

package/src/adapter/PlatformGraphQL_Server.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Auth_GraphqlContext$ReventlessLocal from "./Auth/Auth_GraphqlContext.res.mjs";
 import * as GraphQL_ServerInstance$ReventlessGraphqlServer from "@reventlessdev/reventless-graphql-server/src/GraphQL_ServerInstance.res.mjs";
 
@@ -8,7 +9,7 @@ let instance = GraphQL_ServerInstance$ReventlessGraphqlServer.make("GraphQL:Plat
 function wrapAdmin(resolvers) {
   let wrapped = {};
   Object.entries(resolvers).forEach(param => {
-    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup("Admin", param[1]);
+    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup(AdminGroup$Reventless.name, param[1]);
   });
   return wrapped;
 }