@reventlessdev/reventless-local 3.0.0-alpha.298 → 3.0.0-alpha.300

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.300 (2026-10-25)
+
+**Note:** Version bump only for package @reventlessdev/reventless-local
+
+
+
+
+
+# 3.0.0-alpha.299 (2026-10-25)
+
+* refactor!: internal results and tool records whose parts may be absent are optional fields ([7009ddf](https://github.com/ReventlessDev/reventless-core/commit/7009ddf5d522f39ec9946a3b5cd062ceae889bbf))
+* refactor(aws)!: command-line arguments a tool may not be given are optional fields ([82d5880](https://github.com/ReventlessDev/reventless-core/commit/82d5880e9aeda73fe9625dee73a1ca633b20a59a))
+* refactor(spec)!: the plugin structure's optional parts are optional fields ([130bad5](https://github.com/ReventlessDev/reventless-core/commit/130bad581caf725a9d61b5a3df3d012e4f8ba402))
+* feat!: an inbound translation is async and handed the platform's capabilities, and its audit row withholds sensitive fields ([dae6049](https://github.com/ReventlessDev/reventless-core/commit/dae6049e084f81408a494a2cd2011ec564dda65c))
+### Features
+
+* a door open to anonymous callers is limited per source address, and answers Throttled past the limit ([259a671](https://github.com/ReventlessDev/reventless-core/commit/259a671969dd25579d26227a8fe80cba3194f0aa))
+* a plugin declares per role how a person is admitted, and the local platform honors the self-service and provisioned halves ([9c37bf5](https://github.com/ReventlessDev/reventless-core/commit/9c37bf50f15cac1703bf2c351713518121a56211))
+* a stash capability holds a value for minutes outside the log and hands it over once ([627f285](https://github.com/ReventlessDev/reventless-core/commit/627f28529ead2d2d31bdd091c9f42e7faca40f6f))
+* **local:** the platform reads its accounts file again when it changes ([eeb2b5f](https://github.com/ReventlessDev/reventless-core/commit/eeb2b5f8ec9d5baca2d2d8bfb81260f07713a3a6))
+
+### BREAKING CHANGES
+
+* code that builds these records drops `name: None` and
+writes `name: x` for `name: Some(x)`; a destructure of one of them binds a
+field that may be absent with `?name`.
+* code that builds these records drops `name: None` and
+writes `name: x` for `name: Some(x)`.
+* code that builds these records drops `name: None`, writes
+`name: x` for `name: Some(x)`, and `name: ?x` for a value already of type
+option.
+* an inbound translation's translate takes ~capabilities and
+returns a promise, and its spec must declare capabilityNeeds ([] for one that
+only maps input). FromSlice steps return promises.
+
+
+
 # 3.0.0-alpha.298 (2026-10-23)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.298",
+  "version": "3.0.0-alpha.300",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -34,24 +34,24 @@
     "graphql-yoga": "^5.21.0",
     "sury": "11.0.0",
     "ws": "^8.18.0",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
-    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
-    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
+    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
+    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.24",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.155",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.307",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.255",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.171",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.175",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.36"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.309",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.257",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.206",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.173",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.157",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.37",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.177"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.107"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.108"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/EmitCapabilities.res

@@ -61,7 +61,7 @@ let usage = `Usage: emit-capabilities <srcDir> [<compositionModule>]
 
   Run from the plugin package, after rescript build.`
 
-type args = {srcDir: string, compositionModule: option<string>}
+type args = {srcDir: string, compositionModule?: string}
 
 let parseArgs = (argv: array<string>): result<args, string> =>
   Reventless.CliArgs.parse(argv)
@@ -70,14 +70,14 @@ let parseArgs = (argv: array<string>): result<args, string> =>
     let positionals = a->Reventless.CliArgs.positionals
     switch positionals->Array.get(0) {
     | None | Some("") => Error("<srcDir> is required.")
-    | Some(srcDir) => Ok({srcDir, compositionModule: positionals->Array.get(1)})
+    | Some(srcDir) => Ok({srcDir, compositionModule: ?(positionals->Array.get(1))})
     }
   })
 
 let cli: Reventless.CliArgs.cli<args> = {bin: "emit-capabilities", usage, parse: parseArgs}
 
 let main = () =>
-  Reventless.CliArgs.run(cli, async ({srcDir: srcDirArg, compositionModule}) => {
+  Reventless.CliArgs.run(cli, async ({srcDir: srcDirArg, ?compositionModule}) => {
     // The local platform defaults to Debug-level logging; a build step should not.
     switch NodeProcess.env->Dict.get("LOG_LEVEL") {
     | Some(_) => ()

package/src/LocalPlatformRegistry.res

@@ -11,7 +11,7 @@ type store = {
   // "sqlite" | "memory" | "postgres". A `:memory:` SQLite file reports "memory".
   kind: string,
   // Some only for a store this machine can open by name.
-  path: option<string>,
+  path?: string,
 }
 
 @schema

package/src/LocalSeedTarget.res

@@ -147,7 +147,7 @@ let announce = (t: t): unit =>
     collapsed them would tell an in-memory platform to check its disk. */
 let storePath = (t: t): result<string, string> =>
   switch t.origin {
-  | Running({store: {kind: "sqlite", path: Some(path)}}) => Ok(path)
+  | Running({store: {kind: "sqlite", path: ?Some(path)}}) => Ok(path)
   | Running({store: {kind: "memory"}, endpoint}) =>
     Error(`the platform at ${endpoint} keeps its store in memory; restart it to empty it.`)
   | Running({store: {kind: "postgres"}, endpoint}) =>

package/src/Platform.res

@@ -949,6 +949,34 @@ module MakeWithConfig = (
     })
   }
 
+  // Runs `f` once every plugin's structure has landed, with the plugin names
+  // and structures. The same moment the bake waits for, for the same reason: a
+  // structure only exists once its Output resolves, and anything read off all of
+  // them has to wait for the last.
+  let whenStructuresLanded = (
+    ~pluginComponents: array<ReventlessCore.Plugin.component>,
+    f: array<(string, Reventless.Plugin.pluginStructure)> => unit,
+  ) => {
+    let resolved: array<(string, Reventless.Plugin.pluginStructure)> = []
+    let expected = pluginComponents->Array.length
+    pluginComponents->Array.forEach(plugin => {
+      let outputs: ReventlessInfra.Plugin.outputs = plugin->ReventlessCore.Component.outputs
+      let _ =
+        (outputs.id, outputs.pluginStructure)
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((id, ps)) => {
+          let name = id->String.split("@")->Array.get(0)->Option.getOr(id)
+          switch ps {
+          | Some(def) => resolved->Array.push((name, def))
+          | None => ()
+          }
+          if resolved->Array.length === expected {
+            f(resolved)
+          }
+        })
+    })
+  }
+
   // The object stores a plugin's fields declared, as `{plugin}.{store}` keys.
   let declaredStoresOf = (structure: Reventless.Plugin.pluginStructure) =>
     structure.requiredStores->Option.getOr([])
@@ -1238,7 +1266,6 @@ module MakeWithConfig = (
                   ~store="pluginApiFragments",
                 ),
             ),
-            apiTarget: None,
             structure: pluginStructure->Option.map(
               s =>
                 s->ReventlessCore.Plugin_Helpers.offloadPayload(
@@ -1246,7 +1273,6 @@ module MakeWithConfig = (
                   ~store="pluginStructures",
                 ),
             ),
-            dcbEventLog: None,
             kind: Domain,
           }
           // Dispatch Connect(def) to the Plugin aggregate (id = plugin NAME).
@@ -1384,7 +1410,7 @@ module MakeWithConfig = (
       ~port=domainPort,
       ~endpoint=`http://localhost:${domainPort->Int.toString}/graphql`,
       ~loginEndpoint=`http://localhost:${domainPort->Int.toString}/__inmemory/login`,
-      ~store={kind, path},
+      ~store={kind, ?path},
     )
     // After the register, and it fills the tap port in once the socket is bound:
     // the port is ephemeral by default, so it is not known until `listen` calls
@@ -1771,6 +1797,34 @@ module MakeWithConfig = (
       ~uiSlotsFile=?hostUiBundle->Option.flatMap(cfg => cfg.uiSlotsFile),
       ~shellConfig=hostUiBundle->Option.flatMap(cfg => cfg.shellConfig),
     )
+    // What the plugins declare about admission is read once their structures
+    // have landed. First the refusal: a role declared self-service or by
+    // invitation that nothing here honors stops the platform, as a role no
+    // group stands for does. Then the shell is told where the doors are and
+    // which groups a visitor may sign up for, by writing `config.json` again
+    // with the one key the declaration alone could not supply.
+    whenStructuresLanded(~pluginComponents=plugins, structures => {
+      Reventless.AdmissionCheck.check(
+        ~structures,
+        ~provisioned=LocalCapabilities.provisioned(),
+        ~elevatedGroups=Reventless.OwnerScope.elevatedGroups(),
+        ~adminGroup=Reventless.Role.adminGroup(),
+        // This platform admits callers who are not signed in on every door
+        // whose rule says so.
+        ~anonymousDoors=true,
+      )
+      ReventlessCore.Platform_SelfRegistration.fromStructures(
+        structures,
+      )->Option.forEach(selfRegistration =>
+        ShellConfig.emit(
+          ~dir=?hostUiDir,
+          ~bakedManifest=hostUiBundle->Option.flatMap(cfg => cfg.bakedManifest),
+          ~uiSlotsFile=?hostUiBundle->Option.flatMap(cfg => cfg.uiSlotsFile),
+          ~shellConfig=hostUiBundle->Option.flatMap(cfg => cfg.shellConfig),
+          ~selfRegistration,
+        )
+      )
+    })
     // Unconditional for the same reason, and one file over: it is also what
     // restores the shell package's own hints for a platform that has stopped
     // declaring its own.

package/src/Platform.res.mjs

@@ -18,6 +18,7 @@ import * as AnsiStyle$Reventless from "@reventlessdev/reventless-spec/src/AnsiSt
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
 import * as Backend$ReventlessLocal from "./adapter/Backend.res.mjs";
@@ -25,6 +26,7 @@ import * as UiHints$ReventlessLocal from "./UiHints.res.mjs";
 import * as UiSlots$ReventlessLocal from "./UiSlots.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as LocalBus$ReventlessLocal from "./adapter/LocalBus.res.mjs";
+import * as AdmissionCheck$Reventless from "@reventlessdev/reventless-spec/src/types/AdmissionCheck.res.mjs";
 import * as Api_Naming$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Naming.res.mjs";
 import * as CommandOutcome$Reventless from "@reventlessdev/reventless-spec/src/components/CommandOutcome.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
@@ -94,6 +96,7 @@ import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventl
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 import * as LocalCommandTopicChannel$ReventlessLocal from "./adapter/CommandTopic/LocalCommandTopicChannel.res.mjs";
 import * as LocalEventTopicPublisher$ReventlessLocal from "./adapter/EventTopic/LocalEventTopicPublisher.res.mjs";
+import * as Platform_SelfRegistration$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_SelfRegistration.res.mjs";
 import * as StateChangeSlice_Builder$ReventlessLocal from "./components/StateChangeSlice_Builder.res.mjs";
 import * as DcbEventLogStorage_Sqlite$ReventlessLocal from "./adapter/DcbEventLog/DcbEventLogStorage_Sqlite.res.mjs";
 import * as LocalEventCollectorChannel$ReventlessLocal from "./adapter/EventCollector/LocalEventCollectorChannel.res.mjs";
@@ -884,6 +887,30 @@ function MakeWithConfig(Config) {
       });
     });
   };
+  let whenStructuresLanded = (pluginComponents, f) => {
+    let resolved = [];
+    let expected = pluginComponents.length;
+    pluginComponents.forEach(plugin => {
+      let outputs = Component$ReventlessCore.outputs(plugin);
+      Pulumi.all([
+        outputs.id,
+        outputs.pluginStructure
+      ]).apply(param => {
+        let ps = param[1];
+        let id = param[0];
+        let name = Stdlib_Option.getOr(id.split("@")[0], id);
+        if (ps !== undefined) {
+          resolved.push([
+            name,
+            ps
+          ]);
+        }
+        if (resolved.length === expected) {
+          return f(resolved);
+        }
+      });
+    });
+  };
   let seedPluginStructuresStore = pluginComponents => {
     pluginComponents.forEach(plugin => {
       let outputs = Component$ReventlessCore.outputs(plugin);
@@ -1043,9 +1070,7 @@ function MakeWithConfig(Config) {
           eventCollector: param[2].name,
           extensionProtocols: [],
           apiSchemaFragment: Stdlib_Option.map(param[5], f => Plugin_Helpers$ReventlessCore.offloadPayload(f, Plugin$Reventless.apiSchemaFragmentSchema, "pluginApiFragments")),
-          apiTarget: undefined,
           structure: Stdlib_Option.map(param[7], s => Plugin_Helpers$ReventlessCore.offloadPayload(s, Plugin$Reventless.pluginStructureSchema, "pluginStructures")),
-          dcbEventLog: undefined,
           kind: "Domain"
         };
         dispatchPluginCommand(pluginName, {
@@ -1341,7 +1366,11 @@ function MakeWithConfig(Config) {
     });
     subscribeToPluginEvents();
     let hostUiDir = HostShellDist$ReventlessLocal.resolve(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.assetsDir));
-    ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), hostUiDir);
+    ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), undefined, hostUiDir);
+    whenStructuresLanded(plugins$1, structures => {
+      AdmissionCheck$Reventless.check(structures, LocalCapabilities$ReventlessLocal.provisioned(), OwnerScope$Reventless.elevatedGroups(), Role$Reventless.adminGroup(), true);
+      Stdlib_Option.forEach(Platform_SelfRegistration$ReventlessCore.fromStructures(structures), selfRegistration => ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), selfRegistration, hostUiDir));
+    });
     UiHints$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiHintsFile), hostUiDir);
     UiHints$ReventlessLocal.watch(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiHintsFile), hostUiDir, LocalEvents_Server$ReventlessLocal.broadcastUiHintsChanged);
     UiSlots$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), hostUiDir);
@@ -2653,6 +2682,30 @@ function Make($star) {
       });
     });
   };
+  let whenStructuresLanded = (pluginComponents, f) => {
+    let resolved = [];
+    let expected = pluginComponents.length;
+    pluginComponents.forEach(plugin => {
+      let outputs = Component$ReventlessCore.outputs(plugin);
+      Pulumi.all([
+        outputs.id,
+        outputs.pluginStructure
+      ]).apply(param => {
+        let ps = param[1];
+        let id = param[0];
+        let name = Stdlib_Option.getOr(id.split("@")[0], id);
+        if (ps !== undefined) {
+          resolved.push([
+            name,
+            ps
+          ]);
+        }
+        if (resolved.length === expected) {
+          return f(resolved);
+        }
+      });
+    });
+  };
   let seedPluginStructuresStore = pluginComponents => {
     pluginComponents.forEach(plugin => {
       let outputs = Component$ReventlessCore.outputs(plugin);
@@ -2812,9 +2865,7 @@ function Make($star) {
           eventCollector: param[2].name,
           extensionProtocols: [],
           apiSchemaFragment: Stdlib_Option.map(param[5], f => Plugin_Helpers$ReventlessCore.offloadPayload(f, Plugin$Reventless.apiSchemaFragmentSchema, "pluginApiFragments")),
-          apiTarget: undefined,
           structure: Stdlib_Option.map(param[7], s => Plugin_Helpers$ReventlessCore.offloadPayload(s, Plugin$Reventless.pluginStructureSchema, "pluginStructures")),
-          dcbEventLog: undefined,
           kind: "Domain"
         };
         dispatchPluginCommand(pluginName, {
@@ -3105,7 +3156,11 @@ function Make($star) {
     });
     subscribeToPluginEvents();
     let hostUiDir = HostShellDist$ReventlessLocal.resolve(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.assetsDir));
-    ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), hostUiDir);
+    ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), undefined, hostUiDir);
+    whenStructuresLanded(plugins$1, structures => {
+      AdmissionCheck$Reventless.check(structures, LocalCapabilities$ReventlessLocal.provisioned(), OwnerScope$Reventless.elevatedGroups(), Role$Reventless.adminGroup(), true);
+      Stdlib_Option.forEach(Platform_SelfRegistration$ReventlessCore.fromStructures(structures), selfRegistration => ShellConfig$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.shellConfig), selfRegistration, hostUiDir));
+    });
     UiHints$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiHintsFile), hostUiDir);
     UiHints$ReventlessLocal.watch(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiHintsFile), hostUiDir, LocalEvents_Server$ReventlessLocal.broadcastUiHintsChanged);
     UiSlots$ReventlessLocal.emit(Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.uiSlotsFile), hostUiDir);

package/src/ShellConfig.res

@@ -50,6 +50,7 @@ let computedKeys = [
   journeyManifestsKey,
   ReventlessCore.Platform_UiSlots.configKey,
   ReventlessCore.Platform_AdminGroup.configKey,
+  ReventlessCore.Platform_SelfRegistration.configKey,
 ]
 
 /**
@@ -63,6 +64,9 @@ let overlay = (
   ~bakedManifest: option<ReventlessInfra.Platform.bakedManifest>,
   ~uiSlotsFile: option<string>=?,
   ~shellConfig: option<dict<JSON.t>>,
+  // Read off the plugin structures once they have landed, so the first write
+  // (from the declaration alone) omits it and the second carries it.
+  ~selfRegistration: option<ReventlessCore.Platform_SelfRegistration.config>=?,
 ): dict<JSON.t> => {
   let out =
     Reventless.ShellEnvironment.local
@@ -83,6 +87,11 @@ let overlay = (
 
   ReventlessCore.Platform_AdminGroup.configEntry()->Option.forEach(((k, v)) => out->Dict.set(k, v))
 
+  selfRegistration->Option.forEach(c => {
+    let (k, v) = ReventlessCore.Platform_SelfRegistration.configEntry(c)
+    out->Dict.set(k, v)
+  })
+
   bakedManifest->Option.forEach(config => {
     out->Dict.set("manifestUrl", JSON.Encode.string(manifestUrlOf(config)))
     // Omitted entirely when nothing is declared, so a single-audience deployment
@@ -138,10 +147,11 @@ let emit = (
   ~bakedManifest: option<ReventlessInfra.Platform.bakedManifest>,
   ~uiSlotsFile: option<string>=?,
   ~shellConfig: option<dict<JSON.t>>,
+  ~selfRegistration: option<ReventlessCore.Platform_SelfRegistration.config>=?,
   // The platform's chosen `assetsDir`; unset, the host-shell package's `dist/`.
   ~dir: option<string>=?,
 ) => {
-  let overlay = overlay(~bakedManifest, ~uiSlotsFile?, ~shellConfig)
+  let overlay = overlay(~bakedManifest, ~uiSlotsFile?, ~shellConfig, ~selfRegistration?)
   let declared = overlay->Dict.keysToArray->Array.filter(k => !(environmentKeys->Array.includes(k)))
 
   switch switch dir {

package/src/ShellConfig.res.mjs

@@ -13,6 +13,7 @@ import * as HostShellDist$ReventlessLocal from "./HostShellDist.res.mjs";
 import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
 import * as Platform_AdminGroup$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminGroup.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
+import * as Platform_SelfRegistration$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_SelfRegistration.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
@@ -37,11 +38,12 @@ let computedKeys = Belt_Array.concatMany([
     "manifestUrl",
     journeyManifestsKey,
     Platform_UiSlots$ReventlessCore.configKey,
-    Platform_AdminGroup$ReventlessCore.configKey
+    Platform_AdminGroup$ReventlessCore.configKey,
+    Platform_SelfRegistration$ReventlessCore.configKey
   ]
 ]);
 
-function overlay(bakedManifest, uiSlotsFile, shellConfig) {
+function overlay(bakedManifest, uiSlotsFile, shellConfig, selfRegistration) {
   let out = Object.fromEntries(ShellEnvironment$Reventless.configFields(ShellEnvironment$Reventless.local));
   Stdlib_Option.forEach(uiSlotsFile, param => {
     out[Platform_UiSlots$ReventlessCore.configKey] = Platform_UiSlots$ReventlessCore.url;
@@ -49,6 +51,10 @@ function overlay(bakedManifest, uiSlotsFile, shellConfig) {
   Stdlib_Option.forEach(Platform_AdminGroup$ReventlessCore.configEntry(), param => {
     out[param[0]] = param[1];
   });
+  Stdlib_Option.forEach(selfRegistration, c => {
+    let match = Platform_SelfRegistration$ReventlessCore.configEntry(c);
+    out[match[0]] = match[1];
+  });
   Stdlib_Option.forEach(bakedManifest, config => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(config.key);
     let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(config);
@@ -86,8 +92,8 @@ function readObject(path, label) {
   }
 }
 
-function emit(bakedManifest, uiSlotsFile, shellConfig, dir) {
-  let overlay$1 = overlay(bakedManifest, uiSlotsFile, shellConfig);
+function emit(bakedManifest, uiSlotsFile, shellConfig, selfRegistration, dir) {
+  let overlay$1 = overlay(bakedManifest, uiSlotsFile, shellConfig, selfRegistration);
   let declared = Object.keys(overlay$1).filter(k => !environmentKeys.includes(k));
   let dir$1 = dir !== undefined ? dir : HostShellDist$ReventlessLocal.dir();
   if (dir$1 === undefined) {

package/src/adapter/Auth/Auth_GraphqlContext.res

@@ -20,7 +20,19 @@ module YG = GraphqlYoga
 
 type fetchHeaders
 type fetchRequest = {headers: fetchHeaders}
-type yogaInitialCtx = {request: fetchRequest}
+type socket = {remoteAddress?: string}
+type nodeRequest = {socket?: socket}
+// `req` is the Node request yoga is handed when it serves over `http`; absent
+// when the context is built some other way, such as in a test.
+type yogaInitialCtx = {request: fetchRequest, req?: nodeRequest}
+
+/** Where a request came from, as the socket says — not a forwarded header, which
+    the caller writes. What the limit on anonymous doors counts by. */
+let sourceAddressOf = (ctx: yogaInitialCtx): string =>
+  ctx.req
+  ->Option.flatMap(r => r.socket)
+  ->Option.flatMap(s => s.remoteAddress)
+  ->Option.getOr("unknown")
 
 @send
 external headersForEach: (fetchHeaders, (string, string) => unit) => unit = "forEach"
@@ -65,7 +77,11 @@ let buildAuthContext = async (initial: YG.initialContext): JSON.t => {
   let requestContext: ReventlessCore.Auth_Adapter.requestContext = {headers: headers}
   let result = await LocalAuth.authenticate(requestContext)
   let identity = identityFromAuthResult(result)
-  Obj.magic({"identity": identity, "authenticated": isAuthenticated(result)})
+  Obj.magic({
+    "identity": identity,
+    "authenticated": isAuthenticated(result),
+    "sourceAddress": sourceAddressOf(ctx),
+  })
 }
 
 // Read the identity attached by `buildAuthContext` from the resolver context.

package/src/adapter/Auth/Auth_GraphqlContext.res.mjs

@@ -1,10 +1,15 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Graphql from "graphql";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
 import * as Auth_RefusalVocabulary$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_RefusalVocabulary.res.mjs";
 
+function sourceAddressOf(ctx) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(ctx.req, r => r.socket), s => s.remoteAddress), "unknown");
+}
+
 function extractHeaders(headers) {
   let acc = {};
   headers.forEach((value, key) => {
@@ -38,7 +43,8 @@ async function buildAuthContext(initial) {
   let identity = identityFromAuthResult(result);
   return {
     identity: identity,
-    authenticated: isAuthenticated(result)
+    authenticated: isAuthenticated(result),
+    sourceAddress: sourceAddressOf(initial)
   };
 }
 
@@ -105,6 +111,7 @@ let YG;
 
 export {
   YG,
+  sourceAddressOf,
   extractHeaders,
   identityFromAuthResult,
   isAuthenticated,

package/src/adapter/Auth/UserStore.res

@@ -26,6 +26,10 @@ let parseFile = AccountsManifest.parseFile
 
 // ── Resolution & loading ────────────────────────────────────────────────────
 
+/** The usernames the accounts file gave, so a reload can forget those it no
+    longer lists without touching accounts registered some other way. */
+let fromFile: ref<array<string>> = ref([])
+
 let _registerEntries = (entries: array<entry>): unit =>
   entries->Array.forEach(({username, password, groups, ?userId}) => {
     let id: Identity.t = {
@@ -63,6 +67,7 @@ let pluginChecked: ref<bool> = ref(false)
 let resetResolution = (): unit => {
   resolved := false
   pluginChecked := false
+  fromFile := []
 }
 
 /**
@@ -95,6 +100,7 @@ let load = (~users: option<array<entry>>=?, ~usersFile: option<string>=?, ()): r
     | Some(path) =>
       parseFile(path)->Result.map(entries => {
         _registerEntries(entries)
+        fromFile := entries->Array.map(e => e.username)
         UsersFile(path)
       })
     | None =>
@@ -102,6 +108,7 @@ let load = (~users: option<array<entry>>=?, ~usersFile: option<string>=?, ()): r
       if NodeFs.existsSync(defaultPath) {
         parseFile(defaultPath)->Result.map(entries => {
           _registerEntries(entries)
+          fromFile := entries->Array.map(e => e.username)
           DefaultFile(defaultPath)
         })
       } else {
@@ -114,13 +121,105 @@ let load = (~users: option<array<entry>>=?, ~usersFile: option<string>=?, ()): r
   }
 }
 
+// ── Reloading ───────────────────────────────────────────────────────────────
+
+/**
+Reads the accounts file again: accounts it adds can sign in, changed ones sign in
+with their new password and groups, and ones it no longer lists are forgotten. A
+token already issued stays valid until it expires, as it carries its identity.
+A file that does not parse changes nothing, so a half-saved edit never signs
+everyone out. Says what it did, for the log.
+*/
+let reload = (path: string): result<string, string> =>
+  switch parseFile(path) {
+  | Error(e) => Error(e)
+  | Ok(entries) =>
+    let names = entries->Array.map(e => e.username)
+    let dropped = fromFile.contents->Array.filter(n => !(names->Array.includes(n)))
+    dropped->Array.forEach(username => LocalAuth.Login.removeCredentials(~username))
+    _registerEntries(entries)
+    fromFile := names
+    Ok(
+      `${names->Array.length->Int.toString} accounts` ++ (
+        dropped == [] ? "" : `, removed: ${dropped->Array.join(", ")}`
+      ),
+    )
+  }
+
+/** The roles the plugins need that the accounts no longer provide, as the
+    platform's start would have refused them; empty when all are provided. */
+let unmetAfterReload = (): array<RoleCoverage.need> =>
+  switch Role.providedGroups() {
+  | None => []
+  | Some(provided) => RoleCoverage.unmet(RoleCoverage.checked.contents, ~provided)
+  }
+
+let _watcher: ref<option<NodeFs.watcher>> = ref(None)
+let _pending: ref<option<timeoutId>> = ref(None)
+
+/** Stops following the accounts file. */
+let unwatch = (): unit => {
+  _watcher.contents->Option.forEach(NodeFs.watcherClose)
+  _watcher := None
+  _pending.contents->Option.forEach(clearTimeout)
+  _pending := None
+}
+
+/**
+Follows the accounts file, so an account the tools or the developer add can sign
+in without a restart. The folder is watched, not the file, as an editor that
+saves by replacing the file would silence a watch on it. One save fires several
+events; they are read once, a moment after the last.
+*/
+let watch = (path: string): unit => {
+  unwatch()
+  let dir = NodePath.dirname(path)
+  let base = NodePath.basename(path)
+  let last = ref(NodeFs.existsSync(path) ? NodeFs.readFileSync(path) : "")
+  switch NodeFs.watch(dir, (_, file) =>
+    if file->Nullable.toOption->Option.mapOr(true, f => f == base) {
+      _pending.contents->Option.forEach(clearTimeout)
+      _pending := Some(setTimeout(() => {
+            _pending := None
+            switch NodeFs.readFileSync(path) {
+            | text if text != last.contents =>
+              last := text
+              switch reload(path) {
+              | Ok(said) =>
+                Console.log(`[LocalAuth] ${base} changed — reloaded ${said}.`)
+                switch unmetAfterReload() {
+                | [] => ()
+                | missing =>
+                  Console.warn(
+                    `[LocalAuth] No account is in the group of: ` ++
+                    missing
+                    ->Array.map(RoleCoverage.describe)
+                    ->Array.join("; ") ++ ". Every such caller is refused until one is.",
+                  )
+                }
+              | Error(e) => Console.warn(`[LocalAuth] ${base} changed but was not read: ${e}`)
+              }
+            | _ => ()
+            | exception _ => ()
+            }
+          }, 100))
+    }
+  ) {
+  | w => _watcher := Some(w->NodeFs.watcherUnref)
+  | exception _ => ()
+  }
+}
+
 /**
  * Idempotent auto-discovery. Platform.startServers calls this before
  * `DomainGraphQL_Server.start`, so a `.reventless/users.yaml` in cwd
- * hydrates the Login store automatically. No-op once `load` has been
- * called from anywhere.
+ * hydrates the Login store automatically, and follows the file from then on.
+ * No-op once `load` has been called from anywhere.
  */
 let autoLoadOnce = (): unit =>
   if !resolved.contents {
-    let _ = load()
+    switch load() {
+    | Ok(DefaultFile(path)) | Ok(UsersFile(path)) => watch(path)
+    | _ => ()
+    }
   }