@reventlessdev/reventless-local 3.0.0-alpha.294 → 3.0.0-alpha.296

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.296 (2026-10-22)
+
+### Features
+
+* **local:** the local platform provisions an identity provider over the accounts file ([1a46867](https://github.com/ReventlessDev/reventless-core/commit/1a46867ac391b3b4a2d6973606d782547190dcb8))
+
+
+# 3.0.0-alpha.295 (2026-10-21)
+
+**Note:** Version bump only for package @reventlessdev/reventless-local
+
+
+
+
+
 # 3.0.0-alpha.294 (2026-10-21)
 
 * feat!: a rejected command says whether the model, the access check or the platform said no ([6a8a6b0](https://github.com/ReventlessDev/reventless-core/commit/6a8a6b0f2f31e766ae26a944c23b0904e51a5865))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.294",
+  "version": "3.0.0-alpha.296",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -38,20 +38,20 @@
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
-    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.303",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.151",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.251",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.167",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.200",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.305",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.153",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.253",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.169",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.202",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.36",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.172"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.174"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.104"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.107"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/Platform.res

@@ -1000,6 +1000,13 @@ module MakeWithConfig = (
                   ReventlessCore.StorePrefixCollision.collisionMessage(c),
                 ),
             )
+            // The deployed platform refuses a declared need it does not
+            // provision; here it is a warning, for the reason `unmetWarning` gives.
+            LocalCapabilities.unmetWarning(
+              ~declared=def.requiredCapabilities
+              ->Option.getOr([])
+              ->Array.map(d => (d.capability, d.component)),
+            )->Option.forEach(message => log.warn(~comp="Platform:plugins", message))
           | None => ()
           }
         })
@@ -1545,6 +1552,10 @@ module MakeWithConfig = (
     // ignores them.
     geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
     messagingSender?: ReventlessInfra.Platform.messagingSender,
+    // Local only, until the AWS platform has a provider to pass the same way:
+    // `Capability_IdentityProvider_UserStore.make()`, writing the accounts file
+    // the auth adapter loads.
+    identityProvider?: Reventless.IdentityProvider.t,
     uploadBucket?: ReventlessInfra.Platform.objectStore,
     // Still ignored: a mode is a shell *build* input locally, turned on in the
     // host-shell package's own `public/config.json`, where the AWS deploy has to
@@ -1586,6 +1597,12 @@ module MakeWithConfig = (
       log.info(~comp="Platform", `messaging: log transport as ${address} (nothing is sent)`)
     | _ => ()
     }
+    switch hostUiBundle->Option.flatMap(cfg => cfg.identityProvider) {
+    | Some(provider) =>
+      LocalCapabilities.registerIdentityProvider(provider)
+      log.info(~comp="Platform", `identity provider: the accounts file`)
+    | None => ()
+    }
 
     // Runtime extension seam. Fired before anything is built, so an extension's
     // interception and publish hooks are registered before the first command or

package/src/Platform.res.mjs

@@ -899,7 +899,10 @@ function MakeWithConfig(Config) {
             qualified: param[0],
             prefix: param[1]
           }))).forEach(c => log.warn("Platform:plugins", undefined, StorePrefixCollision$ReventlessCore.collisionMessage(c)));
-          return;
+          return Stdlib_Option.forEach(LocalCapabilities$ReventlessLocal.unmetWarning(Stdlib_Option.getOr(ps.requiredCapabilities, []).map(d => [
+            d.capability,
+            d.component
+          ])), message => log.warn("Platform:plugins", undefined, message));
         }
       });
     });
@@ -1264,6 +1267,11 @@ function MakeWithConfig(Config) {
         log.info("Platform", undefined, `messaging: log transport as ` + sender + ` (nothing is sent)`);
       }
     }
+    let provider = Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.identityProvider);
+    if (provider !== undefined) {
+      LocalCapabilities$ReventlessLocal.registerIdentityProvider(provider);
+      log.info("Platform", undefined, `identity provider: the accounts file`);
+    }
     RuntimeExtension$ReventlessCore.notifyColdStart("Platform", "LocalPlatform", ResourceAttribution$ReventlessCore.current.contents.plugin, ResourceAttribution$ReventlessCore.current.contents.platform);
     let projectionCatchup = Stdlib_Option.map(BackendState$ReventlessLocal.getSqliteDb(), db => [
       db,
@@ -2660,7 +2668,10 @@ function Make($star) {
             qualified: param[0],
             prefix: param[1]
           }))).forEach(c => log.warn("Platform:plugins", undefined, StorePrefixCollision$ReventlessCore.collisionMessage(c)));
-          return;
+          return Stdlib_Option.forEach(LocalCapabilities$ReventlessLocal.unmetWarning(Stdlib_Option.getOr(ps.requiredCapabilities, []).map(d => [
+            d.capability,
+            d.component
+          ])), message => log.warn("Platform:plugins", undefined, message));
         }
       });
     });
@@ -3020,6 +3031,11 @@ function Make($star) {
         log.info("Platform", undefined, `messaging: log transport as ` + sender + ` (nothing is sent)`);
       }
     }
+    let provider = Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.identityProvider);
+    if (provider !== undefined) {
+      LocalCapabilities$ReventlessLocal.registerIdentityProvider(provider);
+      log.info("Platform", undefined, `identity provider: the accounts file`);
+    }
     RuntimeExtension$ReventlessCore.notifyColdStart("Platform", "LocalPlatform", ResourceAttribution$ReventlessCore.current.contents.plugin, ResourceAttribution$ReventlessCore.current.contents.platform);
     let projectionCatchup = Stdlib_Option.map(BackendState$ReventlessLocal.getSqliteDb(), db => [
       db,

package/src/adapter/Auth/LocalAuth.res

@@ -100,6 +100,16 @@ module Login = {
     store := Dict.make()
   }
 
+  /** The credentials behind a username, for a caller that rewrites them. */
+  let credentialsOf = (~username: string): option<credentials> => store.contents->Dict.get(username)
+
+  /** Forget an account on both sides, so neither a login nor an `X-User`
+      header resolves it afterwards. */
+  let removeCredentials = (~username: string): unit => {
+    store.contents->Dict.delete(username)
+    users.contents->Dict.delete(username)
+  }
+
   // ── HMAC secret (lazy) ──
   //
   // Resolved once on first use, from three sources in order:

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -3,6 +3,7 @@
 import * as Sury from "sury";
 import * as Nodefs from "node:fs";
 import * as Nodepath from "node:path";
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
@@ -88,6 +89,15 @@ function resetStore() {
   store.contents = {};
 }
 
+function credentialsOf(username) {
+  return store.contents[username];
+}
+
+function removeCredentials(username) {
+  Stdlib_Dict.$$delete(store.contents, username);
+  Stdlib_Dict.$$delete(users.contents, username);
+}
+
 let _secretFileName = "token-secret";
 
 function _secretDir() {
@@ -286,6 +296,8 @@ let Login = {
   store: store,
   setCredentials: setCredentials,
   resetStore: resetStore,
+  credentialsOf: credentialsOf,
+  removeCredentials: removeCredentials,
   _secretFileName: _secretFileName,
   _secretDir: _secretDir,
   _mint: _mint,

package/src/adapter/LocalCapabilities.res

@@ -24,13 +24,62 @@ let messagingSenderRef = ref("")
     `PluginRuntime_Builder.registerMessagingSender`. */
 let registerMessagingSender = (sender: string) => messagingSenderRef := sender
 
+// Refusing until a root provides one: the seam exists so a deployment can be
+// asked what it provisions, and answering `Unavailable` leaves the work queued
+// and visible instead of recording a verdict against a person who has done
+// nothing wrong.
+let identityProviderRef = ref(Reventless.Capabilities.none.identityProvider)
+
+/** Provision the identity provider. Called by `makePlatform` from the handle a
+    root declared, `Capability_IdentityProvider_UserStore.make()`. */
+let registerIdentityProvider = (provider: Reventless.IdentityProvider.t) =>
+  identityProviderRef := provider
+
+/** What this platform provisions, in the terms a plugin declares its needs:
+    read off the same refs `capabilities()` reads, so it cannot disagree with
+    what a slice is handed. Geocoding is never here — no local geocoder exists. */
+let provisioned = (): array<Reventless.CapabilityNeed.t> =>
+  Array.concat(
+    messagingSenderRef.contents == "" ? [] : [Reventless.CapabilityNeed.Messaging],
+    identityProviderRef.contents.operations == []
+      ? []
+      : [Reventless.CapabilityNeed.IdentityProvider],
+  )
+
+/**
+The warning for a plugin declaring needs this platform does not provision, or
+`None` when every need is met.
+
+A warning where the AWS deploy refuses, and the difference is deliberate: no
+local geocoder exists, so a refusal would stop every plugin carrying the
+geocoding trait from running locally at all. What the developer loses without
+this is the explanation — the slice's items stay retried and nothing says why.
+*/
+let unmetWarning = (~declared: array<(string, string)>): option<string> =>
+  switch Reventless.CapabilityNeed.unmet(~declared, ~provisioned=provisioned()) {
+  | [] => None
+  | missing =>
+    Some(
+      Reventless.CapabilityNeed.unmetMessage(missing) ++
+      missing
+      ->Array.map(u =>
+        switch u.need {
+        | Geocoding => `\n  Geocoding has no local provider; the slice's items are retried and stay queued.`
+        | Messaging =>
+          `\n  Messaging is \`Capability_Messaging_Log.make()\`, passed to the platform as ` ++ `\`~messagingSender\`.`
+        | IdentityProvider =>
+          `\n  IdentityProvider is \`Capability_IdentityProvider_UserStore.make()\`, passed to the ` ++ `platform as \`~identityProvider\`.`
+        }
+      )
+      ->Belt.Set.String.fromArray
+      ->Belt.Set.String.toArray
+      ->Array.join(""),
+    )
+  }
+
 let capabilities = (): Reventless.Capabilities.t => {
   geocode: Reventless.Capabilities.none.geocode,
   messaging: ReventlessCore.Messaging_Log_Backend.provider(~sender=messagingSenderRef.contents),
-  // Refusing rather than absent: the seam exists so a deployment can be asked
-  // what it provisions. Nothing writes back to the local user store yet, and
-  // answering `Unavailable` leaves the work queued and visible instead of
-  // recording a verdict against a person who has done nothing wrong.
-  identityProvider: Reventless.Capabilities.none.identityProvider,
+  identityProvider: identityProviderRef.contents,
   secrets: ReventlessCore.Secrets_Node_Backend.provider,
 }

package/src/adapter/LocalCapabilities.res.mjs

@@ -1,6 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
+import * as CapabilityNeed$Reventless from "@reventlessdev/reventless-spec/src/semantic/CapabilityNeed.res.mjs";
 import * as Secrets_Node_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Secrets/Secrets_Node_Backend.res.mjs";
 import * as Messaging_Log_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Messaging/Messaging_Log_Backend.res.mjs";
 
@@ -12,11 +15,42 @@ function registerMessagingSender(sender) {
   messagingSenderRef.contents = sender;
 }
 
+let identityProviderRef = {
+  contents: Capabilities$Reventless.none.identityProvider
+};
+
+function registerIdentityProvider(provider) {
+  identityProviderRef.contents = provider;
+}
+
+function provisioned() {
+  return (
+    messagingSenderRef.contents === "" ? [] : ["Messaging"]
+  ).concat(Primitive_object.equal(identityProviderRef.contents.operations, []) ? [] : ["IdentityProvider"]);
+}
+
+function unmetWarning(declared) {
+  let missing = CapabilityNeed$Reventless.unmet(declared, provisioned());
+  if (missing.length !== 0) {
+    return CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
+      let match = u.need;
+      switch (match) {
+        case "Geocoding" :
+          return `\n  Geocoding has no local provider; the slice's items are retried and stay queued.`;
+        case "Messaging" :
+          return `\n  Messaging is \`Capability_Messaging_Log.make()\`, passed to the platform as \`~messagingSender\`.`;
+        case "IdentityProvider" :
+          return `\n  IdentityProvider is \`Capability_IdentityProvider_UserStore.make()\`, passed to the platform as \`~identityProvider\`.`;
+      }
+    }))).join("");
+  }
+}
+
 function capabilities() {
   return {
     geocode: Capabilities$Reventless.none.geocode,
     messaging: Messaging_Log_Backend$ReventlessCore.provider(messagingSenderRef.contents),
-    identityProvider: Capabilities$Reventless.none.identityProvider,
+    identityProvider: identityProviderRef.contents,
     secrets: Secrets_Node_Backend$ReventlessCore.provider
   };
 }
@@ -24,6 +58,10 @@ function capabilities() {
 export {
   messagingSenderRef,
   registerMessagingSender,
+  identityProviderRef,
+  registerIdentityProvider,
+  provisioned,
+  unmetWarning,
   capabilities,
 }
 /* Capabilities-Reventless Not a pure module */

package/src/capability/Capability_IdentityProvider_UserStore.res

@@ -0,0 +1,129 @@
+// The identity provider a dev platform provisions — the local counterpart to
+// the Cognito provider the AWS platform does not have yet, and reached the same
+// way `Capability_Messaging_Log` is: a root calls `make`, passes the handle as
+// `~identityProvider` in `~hostUiBundle`, and the platform puts it on the
+// capability record every slice's `translate` receives.
+//
+// Its store is `.reventless/users.yaml`, the file the in-memory auth adapter
+// already loads at startup, so an account made here survives a restart with no
+// second store to keep in step. Every write goes to the file and to the live
+// `LocalAuth.Login` store together, so the running process and the next one
+// agree.
+//
+// 🚨 **The file is shared and unlocked.** The seed runner reads it and
+// `provision-accounts` writes it; two processes editing at once can lose one
+// edit. Recorded rather than solved: the loss is a dev account, and a lock
+// would be more machinery than the file is worth.
+//
+// The principal's handle is the username, and the username is the address the
+// person is reached at — what a pool signing in on an email address does.
+
+open Reventless
+
+let usernameOf = (contact: Messaging.recipient): result<string, IdentityProvider.failure> =>
+  switch contact {
+  | ToEmail(email) => Ok(Email.toString(email))
+  | ToSms(phone) => Ok(Phone.toString(phone))
+  | ToPush(_) => Error(Refused("a push address cannot be signed in with"))
+  }
+
+let passwordOf = (credential: IdentityProvider.credential): string =>
+  switch credential {
+  | Password(password) => password
+  | NoCredential => ""
+  }
+
+// A file the provider cannot read or write is a gap in the deployment, so the
+// answer is retryable; a manifest refusing an edit is a verdict on the request.
+let storeFailure = (message: string): IdentityProvider.failure => Unavailable(message)
+
+let make = (~path: option<string>=?, ()): IdentityProvider.t => {
+  let file = () => path->Option.getOr(AccountsManifest.defaultPath())
+  let identityOf = (~username, ~groups): Identity.t => {
+    userId: username,
+    username,
+    groups,
+    provider: InMemory,
+  }
+
+  let createPrincipal = async (
+    ~contact: Messaging.recipient,
+    ~credential: IdentityProvider.credential,
+    ~groups: array<string>,
+  ): result<IdentityProvider.principal, IdentityProvider.failure> =>
+    switch usernameOf(contact) {
+    | Error(_) as e => e
+    | Ok(username) if LocalAuth.Login.credentialsOf(~username)->Option.isSome => Error(Conflict)
+    | Ok(username) =>
+      let password = passwordOf(credential)
+      switch AccountsManifest.editFile(
+        ~path=file(),
+        ~edits=[Append({username, password, groups})],
+      ) {
+      | Error(message) if message->String.endsWith("already declared in the manifest") =>
+        Error(Conflict)
+      | Error(message) => Error(storeFailure(message))
+      | Ok() =>
+        LocalAuth.Login.setCredentials(
+          ~username,
+          ~password,
+          ~identity=identityOf(~username, ~groups),
+        )
+        Ok({IdentityProvider.providerId: username})
+      }
+    }
+
+  let setGroups = async (~username, ~groups): result<unit, IdentityProvider.failure> =>
+    switch LocalAuth.Login.credentialsOf(~username) {
+    | None => Error(Refused(`no principal ${username}`))
+    | Some({identity}) if identity.groups == groups => Ok()
+    | Some({password, identity}) =>
+      switch AccountsManifest.editFile(~path=file(), ~edits=[SetGroups({username, groups})]) {
+      | Error(message) => Error(storeFailure(message))
+      | Ok() =>
+        LocalAuth.Login.setCredentials(~username, ~password, ~identity={...identity, groups})
+        Ok()
+      }
+    }
+
+  let addToGroup = (~principal: IdentityProvider.principal, ~group: string) => {
+    let username = principal.providerId
+    let current = LocalAuth.Login.credentialsOf(~username)->Option.mapOr([], c => c.identity.groups)
+    setGroups(
+      ~username,
+      ~groups=current->Array.includes(group) ? current : Array.concat(current, [group]),
+    )
+  }
+
+  let removeFromGroup = (~principal: IdentityProvider.principal, ~group: string) => {
+    let username = principal.providerId
+    let current = LocalAuth.Login.credentialsOf(~username)->Option.mapOr([], c => c.identity.groups)
+    setGroups(~username, ~groups=current->Array.filter(g => g != group))
+  }
+
+  // Deleting what is not there is the retry of a delete that happened.
+  let deletePrincipal = async (~principal: IdentityProvider.principal): result<
+    unit,
+    IdentityProvider.failure,
+  > => {
+    let username = principal.providerId
+    switch LocalAuth.Login.credentialsOf(~username) {
+    | None => Ok()
+    | Some(_) =>
+      switch AccountsManifest.editFile(~path=file(), ~edits=[Remove(username)]) {
+      | Error(message) => Error(storeFailure(message))
+      | Ok() =>
+        LocalAuth.Login.removeCredentials(~username)
+        Ok()
+      }
+    }
+  }
+
+  IdentityProvider.make(
+    ~createPrincipal,
+    ~addToGroup,
+    ~removeFromGroup,
+    ~deletePrincipal,
+    ~operations=[CreatePrincipal, AddToGroup, RemoveFromGroup, DeletePrincipal],
+  )
+}

package/src/capability/Capability_IdentityProvider_UserStore.res.mjs

@@ -0,0 +1,187 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as LocalAuth$ReventlessLocal from "../adapter/Auth/LocalAuth.res.mjs";
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
+import * as IdentityProvider$Reventless from "@reventlessdev/reventless-spec/src/semantic/IdentityProvider.res.mjs";
+
+function usernameOf(contact) {
+  switch (contact.TAG) {
+    case "ToEmail" :
+    case "ToSms" :
+      return {
+        TAG: "Ok",
+        _0: contact._0
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Refused",
+          _0: "a push address cannot be signed in with"
+        }
+      };
+  }
+}
+
+function passwordOf(credential) {
+  if (typeof credential !== "object") {
+    return "";
+  } else {
+    return credential._0;
+  }
+}
+
+function storeFailure(message) {
+  return {
+    TAG: "Unavailable",
+    _0: message
+  };
+}
+
+function make(path, param) {
+  let identityOf = (username, groups) => ({
+    userId: username,
+    username: username,
+    groups: groups,
+    provider: "InMemory"
+  });
+  let createPrincipal = async (contact, credential, groups) => {
+    let e = usernameOf(contact);
+    if (e.TAG !== "Ok") {
+      return e;
+    }
+    let username = e._0;
+    if (Stdlib_Option.isSome(LocalAuth$ReventlessLocal.Login.credentialsOf(username))) {
+      return {
+        TAG: "Error",
+        _0: "Conflict"
+      };
+    }
+    let password = passwordOf(credential);
+    let message = AccountsManifest$Reventless.editFile(Stdlib_Option.getOr(path, AccountsManifest$Reventless.defaultPath()), [{
+        TAG: "Append",
+        _0: {
+          username: username,
+          password: password,
+          groups: groups
+        }
+      }]);
+    if (message.TAG === "Ok") {
+      LocalAuth$ReventlessLocal.Login.setCredentials(username, password, identityOf(username, groups));
+      return {
+        TAG: "Ok",
+        _0: {
+          providerId: username
+        }
+      };
+    }
+    let message$1 = message._0;
+    if (message$1.endsWith("already declared in the manifest")) {
+      return {
+        TAG: "Error",
+        _0: "Conflict"
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Unavailable",
+          _0: message$1
+        }
+      };
+    }
+  };
+  let setGroups = async (username, groups) => {
+    let match = LocalAuth$ReventlessLocal.Login.credentialsOf(username);
+    if (match === undefined) {
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Refused",
+          _0: `no principal ` + username
+        }
+      };
+    }
+    let identity = match.identity;
+    if (Primitive_object.equal(identity.groups, groups)) {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+    let message = AccountsManifest$Reventless.editFile(Stdlib_Option.getOr(path, AccountsManifest$Reventless.defaultPath()), [{
+        TAG: "SetGroups",
+        username: username,
+        groups: groups
+      }]);
+    if (message.TAG !== "Ok") {
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Unavailable",
+          _0: message._0
+        }
+      };
+    }
+    let newrecord = {...identity};
+    LocalAuth$ReventlessLocal.Login.setCredentials(username, match.password, (newrecord.groups = groups, newrecord));
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  };
+  let addToGroup = (principal, group) => {
+    let username = principal.providerId;
+    let current = Stdlib_Option.mapOr(LocalAuth$ReventlessLocal.Login.credentialsOf(username), [], c => c.identity.groups);
+    return setGroups(username, current.includes(group) ? current : current.concat([group]));
+  };
+  let removeFromGroup = (principal, group) => {
+    let username = principal.providerId;
+    let current = Stdlib_Option.mapOr(LocalAuth$ReventlessLocal.Login.credentialsOf(username), [], c => c.identity.groups);
+    return setGroups(username, current.filter(g => g !== group));
+  };
+  let deletePrincipal = async principal => {
+    let username = principal.providerId;
+    let match = LocalAuth$ReventlessLocal.Login.credentialsOf(username);
+    if (match === undefined) {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+    let message = AccountsManifest$Reventless.editFile(Stdlib_Option.getOr(path, AccountsManifest$Reventless.defaultPath()), [{
+        TAG: "Remove",
+        _0: username
+      }]);
+    if (message.TAG !== "Ok") {
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Unavailable",
+          _0: message._0
+        }
+      };
+    }
+    LocalAuth$ReventlessLocal.Login.removeCredentials(username);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  };
+  return IdentityProvider$Reventless.make(createPrincipal, addToGroup, removeFromGroup, deletePrincipal, [
+    "CreatePrincipal",
+    "AddToGroup",
+    "RemoveFromGroup",
+    "DeletePrincipal"
+  ]);
+}
+
+export {
+  usernameOf,
+  passwordOf,
+  storeFailure,
+  make,
+}
+/* LocalAuth-ReventlessLocal Not a pure module */

package/tests/capability/Capability_IdentityProvider_UserStoreTest.res

@@ -0,0 +1,173 @@
+open JestGlobals
+
+// The local identity provider over the accounts file. What matters is that the
+// file and the running login store say the same thing after every operation,
+// and that a process starting afresh from the file sees the account.
+
+let email = address => Reventless.Messaging.ToEmail(Reventless.Email.unsafe(address))
+
+let freshFile = (): string => {
+  let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "reventless-identity-"]))
+  NodePath.join([dir, ".reventless", "users.yaml"])
+}
+
+let resetAll = () => {
+  LocalAuth.resetUsers()
+  LocalAuth.Login.resetStore()
+  UserStore.resetResolution()
+}
+
+let restartFrom = (file: string): unit => {
+  resetAll()
+  switch UserStore.load(~usersFile=file, ()) {
+  | Ok(_) => ()
+  | Error(message) => JsError.throwWithMessage(`reload failed: ${message}`)
+  }
+}
+
+describe("Capability_IdentityProvider_UserStore", () => {
+  testSync("publishes all four operations", () =>
+    expect(Capability_IdentityProvider_UserStore.make(~path=freshFile(), ()).operations)->toEqual([
+      Reventless.IdentityProvider.CreatePrincipal,
+      AddToGroup,
+      RemoveFromGroup,
+      DeletePrincipal,
+    ])
+  )
+
+  testPromise("a created principal can log in now and after a restart", async () => {
+    resetAll()
+    let file = freshFile()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=file, ())
+    let created = await provider.createPrincipal(
+      ~contact=email("new@example.com"),
+      ~credential=Password("secret-1"),
+      ~groups=["Shopper"],
+    )
+    expect(created)->toEqual(Ok({Reventless.IdentityProvider.providerId: "new@example.com"}))
+    expect(
+      (await LocalAuth.Login.issue(~username="new@example.com", ~password="secret-1"))->Result.isOk,
+    )->toBe(true)
+
+    restartFrom(file)
+    expect(
+      (await LocalAuth.Login.issue(~username="new@example.com", ~password="secret-1"))->Result.isOk,
+    )->toBe(true)
+    expect(LocalAuth.lookupUser("new@example.com")->Option.map(i => i.groups))->toEqual(
+      Some(["Shopper"]),
+    )
+  })
+
+  testPromise("the same contact twice is a Conflict, not a second account", async () => {
+    resetAll()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=freshFile(), ())
+    let create = () =>
+      provider.createPrincipal(
+        ~contact=email("twice@example.com"),
+        ~credential=NoCredential,
+        ~groups=[],
+      )
+    let _ = await create()
+    expect(await create())->toEqual(Error(Reventless.IdentityProvider.Conflict))
+  })
+
+  // An empty password is the manifest's "authenticates nowhere", so the account
+  // exists for the next provisioning step without a credential anyone holds.
+  testPromise("NoCredential writes an account no password opens", async () => {
+    resetAll()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=freshFile(), ())
+    let _ = await provider.createPrincipal(
+      ~contact=email("later@example.com"),
+      ~credential=NoCredential,
+      ~groups=[],
+    )
+    expect(LocalAuth.lookupUser("later@example.com")->Option.isSome)->toBe(true)
+    expect(
+      (await LocalAuth.Login.issue(~username="later@example.com", ~password=""))->Result.isOk,
+    )->toBe(true)
+  })
+
+  testPromise("a push address is refused, since nothing signs in with one", async () => {
+    let provider = Capability_IdentityProvider_UserStore.make(~path=freshFile(), ())
+    let answer = await provider.createPrincipal(
+      ~contact=ToPush(Fcm({registrationToken: "tok"})),
+      ~credential=NoCredential,
+      ~groups=[],
+    )
+    expect(
+      switch answer {
+      | Error(Refused(_)) => true
+      | _ => false
+      },
+    )->toBe(true)
+  })
+
+  testPromise("groups round-trip through the file", async () => {
+    resetAll()
+    let file = freshFile()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=file, ())
+    let principal: Reventless.IdentityProvider.principal = {providerId: "grp@example.com"}
+    let _ = await provider.createPrincipal(
+      ~contact=email("grp@example.com"),
+      ~credential=Password("pw"),
+      ~groups=["Shopper"],
+    )
+    expect(await provider.addToGroup(~principal, ~group="Reviewer"))->toEqual(Ok())
+    expect(await provider.addToGroup(~principal, ~group="Reviewer"))->toEqual(Ok())
+    restartFrom(file)
+    expect(LocalAuth.lookupUser("grp@example.com")->Option.map(i => i.groups))->toEqual(
+      Some(["Shopper", "Reviewer"]),
+    )
+    expect(await provider.removeFromGroup(~principal, ~group="Shopper"))->toEqual(Ok())
+    restartFrom(file)
+    expect(LocalAuth.lookupUser("grp@example.com")->Option.map(i => i.groups))->toEqual(
+      Some(["Reviewer"]),
+    )
+  })
+
+  testPromise("grouping a principal that does not exist is refused", async () => {
+    resetAll()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=freshFile(), ())
+    let answer = await provider.addToGroup(~principal={providerId: "ghost"}, ~group="Shopper")
+    expect(answer)->toEqual(Error(Reventless.IdentityProvider.Refused("no principal ghost")))
+  })
+
+  testPromise("deleting removes the account from the file and the login, twice", async () => {
+    resetAll()
+    let file = freshFile()
+    let provider = Capability_IdentityProvider_UserStore.make(~path=file, ())
+    let principal: Reventless.IdentityProvider.principal = {providerId: "gone@example.com"}
+    let _ = await provider.createPrincipal(
+      ~contact=email("gone@example.com"),
+      ~credential=Password("pw"),
+      ~groups=[],
+    )
+    expect(await provider.deletePrincipal(~principal))->toEqual(Ok())
+    expect(LocalAuth.lookupUser("gone@example.com"))->toEqual(None)
+    expect(await provider.deletePrincipal(~principal))->toEqual(Ok())
+    restartFrom(file)
+    expect(LocalAuth.lookupUser("gone@example.com"))->toEqual(None)
+  })
+
+  testPromise("the file's own comments survive every operation", async () => {
+    resetAll()
+    let file = freshFile()
+    NodeFs.mkdirSync(NodePath.dirname(file), {recursive: true})
+    NodeFs.writeFileSync(
+      file,
+      `- username: admin # keep this one
+  password: pw
+  groups: [Admin]
+`,
+    )
+    let provider = Capability_IdentityProvider_UserStore.make(~path=file, ())
+    let _ = await provider.createPrincipal(
+      ~contact=email("c@example.com"),
+      ~credential=Password("pw"),
+      ~groups=[],
+    )
+    let _ = await provider.addToGroup(~principal={providerId: "c@example.com"}, ~group="Shopper")
+    let _ = await provider.deletePrincipal(~principal={providerId: "c@example.com"})
+    expect(NodeFs.readFileSync(file)->String.includes("# keep this one"))->toBe(true)
+  })
+})

package/tests/capability/Capability_IdentityProvider_UserStoreTest.res.mjs

@@ -0,0 +1,221 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodeos from "node:os";
+import * as Nodepath from "node:path";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
+import * as UserStore$ReventlessLocal from "../../src/adapter/Auth/UserStore.res.mjs";
+import * as Capability_IdentityProvider_UserStore$ReventlessLocal from "../../src/capability/Capability_IdentityProvider_UserStore.res.mjs";
+
+function email(address) {
+  return {
+    TAG: "ToEmail",
+    _0: address
+  };
+}
+
+function freshFile() {
+  let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "reventless-identity-"));
+  return Nodepath.join(dir, ".reventless", "users.yaml");
+}
+
+function resetAll() {
+  LocalAuth$ReventlessLocal.resetUsers();
+  LocalAuth$ReventlessLocal.Login.resetStore();
+  UserStore$ReventlessLocal.resetResolution();
+}
+
+function restartFrom(file) {
+  resetAll();
+  let message = UserStore$ReventlessLocal.load(undefined, file, undefined);
+  if (message.TAG === "Ok") {
+    return;
+  } else {
+    return Stdlib_JsError.throwWithMessage(`reload failed: ` + message._0);
+  }
+}
+
+globalThis.describe("Capability_IdentityProvider_UserStore", () => {
+  globalThis.test("publishes all four operations", () => {
+    globalThis.expect(Capability_IdentityProvider_UserStore$ReventlessLocal.make(freshFile(), undefined).operations).toEqual([
+      "CreatePrincipal",
+      "AddToGroup",
+      "RemoveFromGroup",
+      "DeletePrincipal"
+    ]);
+  });
+  globalThis.test("a created principal can log in now and after a restart", async () => {
+    resetAll();
+    let file = freshFile();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(file, undefined);
+    let created = await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "new@example.com"
+    }, {
+      TAG: "Password",
+      _0: "secret-1"
+    }, ["Shopper"]);
+    globalThis.expect(created).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "new@example.com"
+      }
+    });
+    globalThis.expect(Stdlib_Result.isOk(await LocalAuth$ReventlessLocal.Login.issue("new@example.com", "secret-1", undefined))).toBe(true);
+    restartFrom(file);
+    globalThis.expect(Stdlib_Result.isOk(await LocalAuth$ReventlessLocal.Login.issue("new@example.com", "secret-1", undefined))).toBe(true);
+    globalThis.expect(Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("new@example.com"), i => i.groups)).toEqual(["Shopper"]);
+  });
+  globalThis.test("the same contact twice is a Conflict, not a second account", async () => {
+    resetAll();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(freshFile(), undefined);
+    let create = () => provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "twice@example.com"
+    }, "NoCredential", []);
+    await create();
+    globalThis.expect(await create()).toEqual({
+      TAG: "Error",
+      _0: "Conflict"
+    });
+  });
+  globalThis.test("NoCredential writes an account no password opens", async () => {
+    resetAll();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(freshFile(), undefined);
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "later@example.com"
+    }, "NoCredential", []);
+    globalThis.expect(Stdlib_Option.isSome(LocalAuth$ReventlessLocal.lookupUser("later@example.com"))).toBe(true);
+    globalThis.expect(Stdlib_Result.isOk(await LocalAuth$ReventlessLocal.Login.issue("later@example.com", "", undefined))).toBe(true);
+  });
+  globalThis.test("a push address is refused, since nothing signs in with one", async () => {
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(freshFile(), undefined);
+    let answer = await provider.createPrincipal({
+      TAG: "ToPush",
+      _0: {
+        TAG: "Fcm",
+        registrationToken: "tok"
+      }
+    }, "NoCredential", []);
+    let tmp;
+    if (answer.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = answer._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG !== "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("groups round-trip through the file", async () => {
+    resetAll();
+    let file = freshFile();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(file, undefined);
+    let principal = {
+      providerId: "grp@example.com"
+    };
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "grp@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, ["Shopper"]);
+    globalThis.expect(await provider.addToGroup(principal, "Reviewer")).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    globalThis.expect(await provider.addToGroup(principal, "Reviewer")).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    restartFrom(file);
+    globalThis.expect(Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("grp@example.com"), i => i.groups)).toEqual([
+      "Shopper",
+      "Reviewer"
+    ]);
+    globalThis.expect(await provider.removeFromGroup(principal, "Shopper")).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    restartFrom(file);
+    globalThis.expect(Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("grp@example.com"), i => i.groups)).toEqual(["Reviewer"]);
+  });
+  globalThis.test("grouping a principal that does not exist is refused", async () => {
+    resetAll();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(freshFile(), undefined);
+    let answer = await provider.addToGroup({
+      providerId: "ghost"
+    }, "Shopper");
+    globalThis.expect(answer).toEqual({
+      TAG: "Error",
+      _0: {
+        TAG: "Refused",
+        _0: "no principal ghost"
+      }
+    });
+  });
+  globalThis.test("deleting removes the account from the file and the login, twice", async () => {
+    resetAll();
+    let file = freshFile();
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(file, undefined);
+    let principal = {
+      providerId: "gone@example.com"
+    };
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "gone@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, []);
+    globalThis.expect(await provider.deletePrincipal(principal)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    globalThis.expect(LocalAuth$ReventlessLocal.lookupUser("gone@example.com")).toEqual(undefined);
+    globalThis.expect(await provider.deletePrincipal(principal)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    restartFrom(file);
+    globalThis.expect(LocalAuth$ReventlessLocal.lookupUser("gone@example.com")).toEqual(undefined);
+  });
+  globalThis.test("the file's own comments survive every operation", async () => {
+    resetAll();
+    let file = freshFile();
+    Nodefs.mkdirSync(Nodepath.dirname(file), {
+      recursive: true
+    });
+    Nodefs.writeFileSync(file, `- username: admin # keep this one
+  password: pw
+  groups: [Admin]
+`, "utf8");
+    let provider = Capability_IdentityProvider_UserStore$ReventlessLocal.make(file, undefined);
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "c@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, []);
+    await provider.addToGroup({
+      providerId: "c@example.com"
+    }, "Shopper");
+    await provider.deletePrincipal({
+      providerId: "c@example.com"
+    });
+    globalThis.expect(Nodefs.readFileSync(file, "utf8").includes("# keep this one")).toBe(true);
+  });
+});
+
+export {
+  email,
+  freshFile,
+  resetAll,
+  restartFrom,
+}
+/*  Not a pure module */

package/tests/capability/LocalCapabilitiesTest.res

@@ -0,0 +1,49 @@
+open JestGlobals
+
+// The local platform's answer to "what do you provision", and the warning a
+// plugin gets for declaring more. Read off the same refs the slices are handed,
+// so the two cannot disagree.
+
+let declared = [
+  ("Geocoding", "GeocodeAddress"),
+  ("Messaging", "SendNotification"),
+  ("IdentityProvider", "CreateAccount"),
+]
+
+let reset = () => {
+  LocalCapabilities.registerMessagingSender("")
+  LocalCapabilities.registerIdentityProvider(Reventless.Capabilities.none.identityProvider)
+}
+
+describe("LocalCapabilities.unmetWarning", () => {
+  testSync("a bare platform provisions nothing, and the warning names each need once", () => {
+    reset()
+    expect(LocalCapabilities.provisioned())->toEqual([])
+    let message = LocalCapabilities.unmetWarning(~declared)->Option.getOr("")
+    expect(message->String.includes("Geocoding (GeocodeAddress)"))->toBe(true)
+    expect(message->String.includes("Capability_Messaging_Log.make()"))->toBe(true)
+    expect(message->String.includes("Capability_IdentityProvider_UserStore.make()"))->toBe(true)
+  })
+
+  testSync("a registered provider leaves the warning", () => {
+    reset()
+    LocalCapabilities.registerMessagingSender("Shop <shop@example.test>")
+    LocalCapabilities.registerIdentityProvider(
+      Capability_IdentityProvider_UserStore.make(~path="/nonexistent/users.yaml", ()),
+    )
+    expect(LocalCapabilities.provisioned())->toEqual([
+      Reventless.CapabilityNeed.Messaging,
+      IdentityProvider,
+    ])
+    let message = LocalCapabilities.unmetWarning(~declared)->Option.getOr("")
+    expect(message->String.includes("Messaging"))->toBe(false)
+    expect(message->String.includes("IdentityProvider"))->toBe(false)
+    expect(message->String.includes("Geocoding"))->toBe(true)
+    reset()
+  })
+
+  testSync("a plugin declaring nothing gets no warning", () => {
+    reset()
+    expect(LocalCapabilities.unmetWarning(~declared=[]))->toEqual(None)
+  })
+})