@reventlessdev/reventless-aws 3.0.0-alpha.383 → 3.0.0-alpha.385

package/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.385 (2026-10-16)
+
+* feat!(inbound): a translation slice can declare a signed webhook URL ([0ad6994](https://github.com/ReventlessDev/reventless-core/commit/0ad69949fcc91c2756c60ca8cb120dd468841d8b))
+
+### BREAKING CHANGES
+
+* InboundTranslationSlice.Spec requires `endpoint`. Specs under
+@@reventless.spec get it from the PPX (republish reventless-ppx with this
+release); hand-written specs add `let endpoint = None`.
+
+
+
+# 3.0.0-alpha.384 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
 # 3.0.0-alpha.383 (2026-10-16)
 
 * feat!(automation): schedules set by events ([53bc436](https://github.com/ReventlessDev/reventless-core/commit/53bc4363dffce81ef36475728bf0dae704716021))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.383",
+  "version": "3.0.0-alpha.385",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -23,18 +23,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.32",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.29",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.30",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.193",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.296",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.160",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.165"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.195",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.298",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.41",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.162",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.167"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -148,6 +148,11 @@ let groupOf = Reventless.Role.groupOf
 /** `groupOf(Role.admin)`. */
 let adminGroup = Reventless.Role.adminGroup
 
+/** The plugin's webhook base URL — each inbound slice's endpoint is its `path`
+    under it — or `""` when no slice declares one. Read after `deployPlugin`, to
+    export it and register it with the sender. */
+let webhookUrl = (): Pulumi.Output.t<string> => PluginRuntime_Builder.webhookUrlRef.contents
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool

package/src/Platform.res.mjs

@@ -171,6 +171,10 @@ function loadProvidedGroups() {
   return Platform_ProvidedGroups$ReventlessAws.load(platformStackReference());
 }
 
+function webhookUrl() {
+  return PluginRuntime_Builder$ReventlessAws.webhookUrlRef.contents;
+}
+
 function MakeWithConfig(Config) {
   OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
   Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
@@ -3008,6 +3012,7 @@ export {
   loadProvidedGroups,
   groupOf,
   adminGroup,
+  webhookUrl,
   MakeWithConfig,
   Make,
 }

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -30,7 +30,7 @@ import { handleQueueEvent, publishJsons as sqsPublishJsons } from "@reventlessde
 // per-slice handler building (functor + decode + handleCommands), all
 // compiler-checked against the framework signatures (see the module header and
 // docs/plans/done/minimize-lambda-entrypoint-mjs-shell.md).
-import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler, buildInboundReceiver } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
+import { deriveScope, commandTypeNames, makeStorageOps, buildSliceHandler, buildInboundReceiver, buildWebhookSlice, serveWebhook } from "./DcbCommandTopicEntryPoint_Ops.res.mjs";
 import { makeDynamoQueryDbOps } from "./QueryDbEntryPoint_Ops.res.mjs";
 
 const dynamicImport = (specifier) => import('/var/task/node_modules/' + specifier);
@@ -177,6 +177,8 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // follow-up, so on that backend the receiver runs without persistence.
   const inboundModules = config.inboundTranslationSliceModules || [];
   const inboundReceiversByField = {};
+  // Route W registry: the slices whose spec declares an endpoint.
+  const webhookSlices = [];
   await Promise.all(inboundModules.map(async ({ spec, translation, auditTableName }) => {
     const specModule = await loadModule(spec);
     const translationModule = await loadModule(translation);
@@ -203,6 +205,8 @@ export async function buildHandlersForConfig(config, opts = {}) {
       publishJsons,
       auditOps,
     );
+    const webhook = buildWebhookSlice(specModule, translationModule, publishJsons, auditOps);
+    if (webhook != null) webhookSlices.push(webhook);
   }));
 
   // Sync (default): inline-dispatch the command via the same composite handler
@@ -276,8 +280,9 @@ export async function buildHandlersForConfig(config, opts = {}) {
   // Elements past the first two are additive — existing callers (the integration
   // tests) keep destructuring the first two. No deploy-time `plugin` fragment
   // needed here: this Lambda serves exactly one plugin and HANDLER_CONFIG already
-  // names it. The 5th element is the Route 0 inbound-translation registry.
-  return [sqsHandler, cmdGenHandler, dcbComp(config.pluginName), config.pluginName, inboundReceiversByField];
+  // names it. The 5th element is the Route 0 inbound-translation registry, the
+  // 6th the Route W webhook slices.
+  return [sqsHandler, cmdGenHandler, dcbComp(config.pluginName), config.pluginName, inboundReceiversByField, webhookSlices];
 }
 
 async function buildHandler() {
@@ -313,7 +318,23 @@ initPromise.catch(() => {});
 
 export async function handler(event, context) {
   setRequestId(context?.awsRequestId);
-  const [sqsHandler, cmdGenHandler, comp, plugin, inboundReceivers] = await initPromise;
+  const [sqsHandler, cmdGenHandler, comp, plugin, inboundReceivers, webhookSlices] = await initPromise;
+
+  // Route W: a request on the Lambda's Function URL, for an inbound slice's
+  // webhook. The body stays raw until its signature is checked.
+  if (event.requestContext?.http != null && typeof event.rawPath === "string") {
+    const body = event.body == null
+      ? ""
+      : event.isBase64Encoded ? Buffer.from(event.body, "base64").toString("utf8") : event.body;
+    const headers = {};
+    for (const [name, value] of Object.entries(event.headers ?? {})) headers[name.toLowerCase()] = value;
+    return await serveWebhook(webhookSlices ?? [], {
+      method: event.requestContext.http.method,
+      path: event.rawPath,
+      headers,
+      body,
+    });
+  }
 
   // Route 0: InboundTranslationSlice mutation — the AppSync resolver invokes this
   // Lambda with `{__inboundTranslation: true, fieldName, arguments, identity}`.

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -258,7 +258,14 @@ type inboundCallback = {
     ReventlessInfra.CommandTopic.publishJsons,
     JSON.t,
     ~caller: Reventless.Identity.t=?,
+    ~door: ReventlessInfra.InboundTranslationSlice.door=?,
   ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+  refuse: (
+    ~body: string,
+    ~errorCode: string,
+    string,
+  ) => ReventlessInfra.InboundTranslationSlice.receiveResult,
+  webhook: option<ReventlessCore.InboundTranslationSlice_Webhook.route>,
   auditLog: dict<ReventlessCore.InboundTranslationSlice_Callback.auditRow>,
 }
 @module(
@@ -266,9 +273,49 @@ type inboundCallback = {
 )
 external makeInboundCallback: specModule => translationModule => inboundCallback = "Make"
 
+// The request's audit row to its table, when one was threaded. A failed write is
+// logged, not raised: the commands are published.
+let persistAudit = async (
+  callback: inboundCallback,
+  auditQueryDbOps: option<ReventlessCore.QueryDb_Adapter.operations>,
+  result: ReventlessInfra.InboundTranslationSlice.receiveResult,
+) =>
+  switch auditQueryDbOps {
+  | Some(ops) =>
+    let id = result->ReventlessCore.InboundTranslationSlice_Callback.requestIdOf
+    switch callback.auditLog->ReventlessCore.InboundTranslationSlice_Callback.takeAuditRow(id) {
+    | Some(row) =>
+      let json =
+        row->Reventless.Util_Sury.toJson(
+          ReventlessCore.InboundTranslationSlice_Callback.auditRowSchema,
+        )
+      // `save` resolves `Error(_)` rather than throwing, so its result is read.
+      try {
+        switch await ops.save(id, json, ReventlessCore.QueryDb.Overwrite, None) {
+        | Ok() => ()
+        | Error(err) =>
+          ReventlessCore.EffectLogger.logError(
+            ~comp="InboundTranslationSlice.audit",
+            `failed to persist audit row ${id}: ${err->ReventlessCore.QueryDb.storageErrorToString}`,
+          )->Effect.runSync
+        }
+      } catch {
+      | exn =>
+        let detail =
+          exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error")
+        ReventlessCore.EffectLogger.logError(
+          ~comp="InboundTranslationSlice.audit",
+          `failed to persist audit row ${id}: ${detail}`,
+        )->Effect.runSync
+      }
+    | None => ()
+    }
+  | None => ()
+  }
+
 // Builds the inbound receive handler: `receive` for the resolver's caller, then
-// the request's audit row to its table when one was threaded. Answers the
-// `commandOutcome` JSON the AppSync direct-invocation route answers with.
+// the request's audit row. Answers the `commandOutcome` JSON the AppSync
+// direct-invocation route answers with.
 let buildInboundReceiver = (
   spec: specModule,
   translation: translationModule,
@@ -282,42 +329,56 @@ let buildInboundReceiver = (
       args,
       ~caller=ReventlessCore.InboundTranslationSlice_Callback.doorCaller(identity),
     )
-    switch auditQueryDbOps {
-    | Some(ops) =>
-      let id = result->ReventlessCore.InboundTranslationSlice_Callback.requestIdOf
-      switch callback.auditLog->ReventlessCore.InboundTranslationSlice_Callback.takeAuditRow(id) {
-      | Some(row) =>
-        let json =
-          row->Reventless.Util_Sury.toJson(
-            ReventlessCore.InboundTranslationSlice_Callback.auditRowSchema,
-          )
-        // A failed audit write is logged, not raised: the commands are published.
-        // `save` resolves `Error(_)` rather than throwing, so its result is read.
-        try {
-          switch await ops.save(id, json, ReventlessCore.QueryDb.Overwrite, None) {
-          | Ok() => ()
-          | Error(err) =>
-            ReventlessCore.EffectLogger.logError(
-              ~comp="InboundTranslationSlice.audit",
-              `failed to persist audit row ${id}: ${err->ReventlessCore.QueryDb.storageErrorToString}`,
-            )->Effect.runSync
-          }
-        } catch {
-        | exn =>
-          let detail =
-            exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown error")
-          ReventlessCore.EffectLogger.logError(
-            ~comp="InboundTranslationSlice.audit",
-            `failed to persist audit row ${id}: ${detail}`,
-          )->Effect.runSync
-        }
-      | None => ()
-      }
-    | None => ()
-    }
+    await persistAudit(callback, auditQueryDbOps, result)
     result
     ->ReventlessCore.InboundTranslationSlice_Callback.receiveResultToOutcome
     // `CommandTopic_Helpers`, not `CommandTopic`, which imports `@pulumi/pulumi`.
     ->ReventlessCore.CommandTopic_Helpers.commandOutcomeToJson
   }
 }
+
+// The slice's webhook door, when its spec declares an endpoint: both operations
+// persist the audit row they write.
+let buildWebhookSlice = (
+  spec: specModule,
+  translation: translationModule,
+  ~publishJsons: ReventlessInfra.CommandTopic.publishJsons,
+  ~auditQueryDbOps: option<ReventlessCore.QueryDb_Adapter.operations>,
+): Nullable.t<ReventlessCore.InboundTranslationSlice_Webhook.slice> => {
+  let callback = makeInboundCallback(spec)(translation)
+  let persisted = async result => {
+    await persistAudit(callback, auditQueryDbOps, result)
+    result
+  }
+  callback.webhook
+  ->Option.map((route): ReventlessCore.InboundTranslationSlice_Webhook.slice => {
+    route,
+    receive: async (input, ~caller) =>
+      await persisted(await callback.receive(publishJsons, input, ~caller, ~door=Webhook)),
+    refuse: async (~body, ~errorCode, error) =>
+      await persisted(callback.refuse(~body, ~errorCode, error)),
+  })
+  ->Nullable.fromOption
+}
+
+/** Serve a Function URL request on the plugin's webhook slices. Answers the
+    response shape a Function URL expects. */
+let serveWebhook = async (
+  slices: array<ReventlessCore.InboundTranslationSlice_Webhook.slice>,
+  request: ReventlessCore.InboundTranslationSlice_Webhook.request,
+): JSON.t => {
+  let {status, body} = await ReventlessCore.InboundTranslationSlice_Webhook.dispatch(
+    slices,
+    request,
+  )
+  Dict.fromArray([
+    ("statusCode", JSON.Encode.int(status)),
+    (
+      "headers",
+      Dict.fromArray([
+        ("content-type", JSON.Encode.string("application/json")),
+      ])->JSON.Encode.object,
+    ),
+    ("body", JSON.Encode.string(body)),
+  ])->JSON.Encode.object
+}

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs

@@ -5,6 +5,7 @@ import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
+import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
@@ -13,6 +14,7 @@ import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Mess
 import * as QueryDb$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as CommandTopic_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic_Helpers.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
 import * as InboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
 import * as DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs";
 import * as DcbEventLogStorage_Postgres_Runtime$ReventlessAws from "../DcbEventLog/DcbEventLogStorage_Postgres_Runtime.res.mjs";
@@ -118,31 +120,73 @@ function buildSliceHandler(spec, behavior, scope, dcbEventLog) {
   };
 }
 
+async function persistAudit(callback, auditQueryDbOps, result) {
+  if (auditQueryDbOps === undefined) {
+    return;
+  }
+  let id = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result);
+  let row = InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(callback.auditLog, id);
+  if (row === undefined) {
+    return;
+  }
+  let json = Util_Sury$Reventless.toJson(row, InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema);
+  try {
+    let err = await auditQueryDbOps.save(id, json, "Overwrite", undefined);
+    if (err.TAG === "Ok") {
+      return;
+    } else {
+      return Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + QueryDb$ReventlessCore.storageErrorToString(err._0)));
+    }
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown error");
+    return Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + detail));
+  }
+}
+
 function buildInboundReceiver(spec, translation, publishJsons, auditQueryDbOps) {
   let callback = InboundTranslationSlice_CallbackResMjs.Make(spec)(translation);
   return async (args, identity) => {
-    let result = await callback.receive(publishJsons, args, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(identity));
-    if (auditQueryDbOps !== undefined) {
-      let id = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result);
-      let row = InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(callback.auditLog, id);
-      if (row !== undefined) {
-        let json = Util_Sury$Reventless.toJson(row, InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema);
-        try {
-          let err = await auditQueryDbOps.save(id, json, "Overwrite", undefined);
-          if (err.TAG !== "Ok") {
-            Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + QueryDb$ReventlessCore.storageErrorToString(err._0)));
-          }
-        } catch (raw_exn) {
-          let exn = Primitive_exceptions.internalToException(raw_exn);
-          let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown error");
-          Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + detail));
-        }
-      }
-    }
+    let result = await callback.receive(publishJsons, args, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(identity), undefined);
+    await persistAudit(callback, auditQueryDbOps, result);
     return CommandTopic_Helpers$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result));
   };
 }
 
+function buildWebhookSlice(spec, translation, publishJsons, auditQueryDbOps) {
+  let callback = InboundTranslationSlice_CallbackResMjs.Make(spec)(translation);
+  let persisted = async result => {
+    await persistAudit(callback, auditQueryDbOps, result);
+    return result;
+  };
+  return Stdlib_Nullable.fromOption(Stdlib_Option.map(callback.webhook, route => ({
+    route: route,
+    receive: async (input, caller) => await persisted(await callback.receive(publishJsons, input, caller, "Webhook")),
+    refuse: async (body, errorCode, error) => await persisted(callback.refuse(body, errorCode, error))
+  })));
+}
+
+async function serveWebhook(slices, request) {
+  let match = await InboundTranslationSlice_Webhook$ReventlessCore.dispatch(slices, undefined, undefined, request);
+  return Object.fromEntries([
+    [
+      "statusCode",
+      match.status
+    ],
+    [
+      "headers",
+      Object.fromEntries([[
+          "content-type",
+          "application/json"
+        ]])
+    ],
+    [
+      "body",
+      match.body
+    ]
+  ]);
+}
+
 export {
   deriveScope,
   commandTypeNames,
@@ -150,6 +194,9 @@ export {
   makePostgresStorageOps,
   makeStorageOps,
   buildSliceHandler,
+  persistAudit,
   buildInboundReceiver,
+  buildWebhookSlice,
+  serveWebhook,
 }
 /* Stdlib_JsExn Not a pure module */

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -41,6 +41,11 @@ let forDcbCommandTopic = (
   // the per-flavor commandHandlerConfig below (whichever is higher wins).
   ~sliceMemoryFloor: int=0,
   ~sliceTimeoutFloor: int=0,
+  // The webhook secrets, by environment variable, when some inbound slice declares
+  // an endpoint: the sync Lambda then gets a public Function URL, handed to
+  // `onWebhookUrl`. The entry point routes its requests by path.
+  ~webhookSecrets: option<dict<Pulumi.Output.t<string>>>=?,
+  ~onWebhookUrl: Pulumi.Output.t<string> => unit=_ => (),
   ~connect,
   dcbCommandTopic,
 ) =>
@@ -107,6 +112,12 @@ let forDcbCommandTopic = (
         }
       })
     )
+    let webhookSecrets = isAsync ? None : webhookSecrets
+    webhookSecrets->Option.forEach(secrets =>
+      secrets->Dict.forEachWithKey((value, key) =>
+        envVars->Dict.set(key, value->Pulumi.Output.asInput)
+      )
+    )
     // First-class log-level override → LOG_LEVEL, winning over any generic
     // envVars entry. When unset, makeFromCodeAsset applies the tier default.
     cfg.logLevel->Option.forEach(level =>
@@ -319,6 +330,41 @@ let forDcbCommandTopic = (
       )
     })
 
+    if webhookSecrets->Option.isSome {
+      let customOpts =
+        opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+      let functionName =
+        runtime.parts.lambda->Pulumi.Output.flatMap(lambda => lambda.name)->Pulumi.Output.asInput
+      let url = PulumiAws.FunctionUrl.make(
+        ~name=`${name}-webhook`,
+        ~args={authorizationType: None, functionName},
+        ~opts=customOpts,
+      )
+      // A public URL needs both grants: the URL invoke, and the function invoke
+      // limited to calls arriving through that URL.
+      let _ = PulumiAws.Lambda.Permission.make(
+        ~name=`${name}-webhookUrl`,
+        ~args={
+          action: "lambda:InvokeFunctionUrl",
+          function: functionName,
+          principal: "*",
+          functionUrlAuthType: "NONE",
+        },
+        ~opts=customOpts,
+      )
+      let _ = PulumiAws.Lambda.Permission.make(
+        ~name=`${name}-webhookInvoke`,
+        ~args={
+          action: "lambda:InvokeFunction",
+          function: functionName,
+          principal: "*",
+          invokedViaFunctionUrl: true,
+        },
+        ~opts=customOpts,
+      )
+      onWebhookUrl(url.functionUrl)
+    }
+
     connect(~runtime)
     CommandTopicChannel.SQS.clearBatchSize()
   }

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
@@ -11,16 +12,18 @@ import * as DcbBackend$ReventlessAws from "../DcbEventLog/DcbBackend.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_LambdaEnvBudget$ReventlessAws from "../../util/Util_LambdaEnvBudget.res.mjs";
 import * as CommandTopicChannel_SQS$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./RuntimeEnvironment_Lambda.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
 
-function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginName, syncConfig, asyncConfig, sliceMemoryFloorOpt, sliceTimeoutFloorOpt, connect, dcbCommandTopic) {
+function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginName, syncConfig, asyncConfig, sliceMemoryFloorOpt, sliceTimeoutFloorOpt, webhookSecrets, onWebhookUrlOpt, connect, dcbCommandTopic) {
   let inboundSlices = inboundSlicesOpt !== undefined ? inboundSlicesOpt : [];
   let sliceMemoryFloor = sliceMemoryFloorOpt !== undefined ? sliceMemoryFloorOpt : 0;
   let sliceTimeoutFloor = sliceTimeoutFloorOpt !== undefined ? sliceTimeoutFloorOpt : 0;
+  let onWebhookUrl = onWebhookUrlOpt !== undefined ? onWebhookUrlOpt : param => {};
   if (slicePaths.length === 0 && inboundSlices.length === 0) {
     return log.warn("StateChangeSliceRuntime_Builder_Single", undefined, "forDcbCommandTopic skipped (no slice specs)");
   }
@@ -54,6 +57,10 @@ function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginNa
       return;
     }
   }));
+  let webhookSecrets$1 = isAsync ? undefined : webhookSecrets;
+  Stdlib_Option.forEach(webhookSecrets$1, secrets => Stdlib_Dict.forEachWithKey(secrets, (value, key) => {
+    envVars[key] = value;
+  }));
   Stdlib_Option.forEach(cfg.logLevel, level => {
     envVars["LOG_LEVEL"] = Pulumi.output(level);
   });
@@ -129,6 +136,27 @@ function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginNa
       }])),
     role: runtime.parts.lambdaRole.id
   }));
+  if (Stdlib_Option.isSome(webhookSecrets$1)) {
+    let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+    let functionName = Output$Pulumi.flatMap(runtime.parts.lambda, lambda => lambda.name);
+    let url = new (Aws.lambda.FunctionUrl)(name + `-webhook`, {
+      authorizationType: "NONE",
+      functionName: functionName
+    }, customOpts);
+    new (Aws.lambda.Permission)(name + `-webhookUrl`, {
+      action: "lambda:InvokeFunctionUrl",
+      function: functionName,
+      principal: "*",
+      functionUrlAuthType: "NONE"
+    }, customOpts);
+    new (Aws.lambda.Permission)(name + `-webhookInvoke`, {
+      action: "lambda:InvokeFunction",
+      function: functionName,
+      principal: "*",
+      invokedViaFunctionUrl: true
+    }, customOpts);
+    onWebhookUrl(url.functionUrl);
+  }
   connect(runtime);
   CommandTopicChannel_SQS$ReventlessAws.clearBatchSize();
 }

package/src/components/Api/AppSync_Adapter.res

@@ -309,21 +309,18 @@ let injectAwsAuth = (
       iamQueryFieldPrefixes->Array.push(entry.listFieldName)
       iamTypePrefixes->Array.push(entry.returnTypeName)
     }
+    // Every door the entry emits: the resolvers here do not check the rule, so a
+    // by-ids or by-index field left to the open directive reads the gated rows.
+    let fieldNames = ReventlessCore.GraphQL_FragmentGenerator.queryFieldNamesOf(entry)
     switch entry.authorization {
-    | Some({group}) =>
-      queryAuthMap->Dict.set(entry.singleFieldName, [group])
-      queryAuthMap->Dict.set(entry.listFieldName, [group])
+    | Some({group}) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, [group]))
     | None => ()
     }
     switch entry.permission {
     | Some(permission) =>
       switch AppSync_SdlDecorate.permissionToGate(permission) {
-      | Groups(groups) =>
-        queryAuthMap->Dict.set(entry.singleFieldName, groups)
-        queryAuthMap->Dict.set(entry.listFieldName, groups)
-      | AnyAuthenticated =>
-        queryAuthMap->Dict.delete(entry.singleFieldName)
-        queryAuthMap->Dict.delete(entry.listFieldName)
+      | Groups(groups) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, groups))
+      | AnyAuthenticated => fieldNames->Array.forEach(f => queryAuthMap->Dict.delete(f))
       | Anonymous =>
         // Both derived field names, because the spec declares one permission and
         // the generator emits two fields from it; naming only one would send the

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -154,11 +154,13 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
       iamQueryFieldPrefixes.push(entry.listFieldName);
       iamTypePrefixes.push(entry.returnTypeName);
     }
+    let fieldNames = GraphQL_FragmentGenerator$ReventlessCore.queryFieldNamesOf(entry);
     let match = entry.authorization;
     if (match !== undefined) {
       let group = match.group;
-      queryAuthMap[entry.singleFieldName] = [group];
-      queryAuthMap[entry.listFieldName] = [group];
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = [group];
+      });
     }
     let permission = entry.permission;
     if (permission === undefined) {
@@ -167,16 +169,17 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(permission);
     if (typeof groups !== "object") {
       if (groups === "AnyAuthenticated") {
-        Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
-        return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+        fieldNames.forEach(f => Stdlib_Dict.$$delete(queryAuthMap, f));
+        return;
       }
       anonymousFields.push(entry.singleFieldName);
       anonymousFields.push(entry.listFieldName);
       return;
     } else {
       let groups$1 = groups._0;
-      queryAuthMap[entry.singleFieldName] = groups$1;
-      queryAuthMap[entry.listFieldName] = groups$1;
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = groups$1;
+      });
       return;
     }
   });

package/src/components/InboundTranslationSlice_Builder.res

@@ -25,6 +25,12 @@ module Make = (
       ~specPath=Util_Bundle.getModuleSpecifier(Spec.moduleUrl),
       ~translationPath=Util_Bundle.getModuleSpecifier(Translation.moduleUrl),
     )
+    switch Spec.endpoint {
+    | Some({auth: SignedBody({secret})}) =>
+      PluginRuntime_Builder.registerWebhook(~specName=Spec.name, ~secret=Some(secret))
+    | Some({auth: Open}) => PluginRuntime_Builder.registerWebhook(~specName=Spec.name, ~secret=None)
+    | None => ()
+    }
     module InnerMake = Inner.Make(Spec, Translation)
     module Spec = Spec
     module Translation = Translation

package/src/components/InboundTranslationSlice_Builder.res.mjs

@@ -15,6 +15,15 @@ function Make(Api) {
   })(Api);
   let Make$1 = Spec => (Translation => {
     PluginRuntime_Builder$ReventlessAws.registerInboundTranslationSliceSpec(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl));
+    let match = Spec.endpoint;
+    if (match !== undefined) {
+      let match$1 = match.auth;
+      if (typeof match$1 !== "object") {
+        PluginRuntime_Builder$ReventlessAws.registerWebhook(Spec.name, undefined);
+      } else {
+        PluginRuntime_Builder$ReventlessAws.registerWebhook(Spec.name, match$1._0.secret);
+      }
+    }
     let InnerMake = Inner.Make(Spec)(Translation);
     let make = (publishJsons, runtime, opts) => {
       let component = InnerMake.make(publishJsons, runtime, opts);

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -161,6 +161,29 @@ let registerInboundAuditTableName = (~specName: string, tableName: Pulumi.Output
     )
   }
 
+// Webhook endpoints. Each slice's route is read off its spec at run time, so the
+// deploy needs only whether any slice has one (the sync command Lambda then gets a
+// Function URL) and the secrets they name, which become that Lambda's environment.
+// A secret is read when the slice registers, outside any `apply`, so a missing one
+// fails `pulumi preview` too.
+let webhookSlices: array<string> = []
+let webhookSecrets: dict<Pulumi.Output.t<string>> = Dict.make()
+
+let registerWebhook = (~specName: string, ~secret: option<string>) => {
+  if !(webhookSlices->Array.includes(specName)) {
+    webhookSlices->Array.push(specName)
+  }
+  secret->Option.forEach(secret =>
+    webhookSecrets->Dict.set(
+      ReventlessCore.InboundTranslationSlice_Webhook.secretEnvKey(secret),
+      Pulumi.Config.make(Some("webhook"))->Pulumi.Config.requireSecret(secret),
+    )
+  )
+}
+
+// The plugin's webhook base URL, once its command Lambda has one; "" until then.
+let webhookUrlRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
+
 /**
 Redundant with the seams that populate `dcbConfigRef` automatically:
 `pluginName` is set by `registerPluginName` (called from `Plugin_Builder.make`
@@ -933,6 +956,8 @@ module Make = (
     StateChangeSliceRuntime_Builder_Single.forDcbCommandTopic(
       ~slicePaths,
       ~inboundSlices,
+      ~webhookSecrets=?webhookSlices->Array.length > 0 ? Some(webhookSecrets) : None,
+      ~onWebhookUrl=url => webhookUrlRef := url,
       ~dcbTableName=dcbConfig.dcbTableName,
       ~pluginName=dcbConfig.pluginName,
       ~syncConfig=syncStateChangesConfigRef.contents,

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -22,6 +22,7 @@ import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as Util_LambdaEnvBudget$ReventlessAws from "../../util/Util_LambdaEnvBudget.res.mjs";
 import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../../adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
 import * as StateChangeSliceRuntime_Builder_Single$ReventlessAws from "../../adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -139,6 +140,23 @@ function registerInboundAuditTableName(specName, tableName) {
   }
 }
 
+let webhookSlices = [];
+
+let webhookSecrets = {};
+
+function registerWebhook(specName, secret) {
+  if (!webhookSlices.includes(specName)) {
+    webhookSlices.push(specName);
+  }
+  Stdlib_Option.forEach(secret, secret => {
+    webhookSecrets[InboundTranslationSlice_Webhook$ReventlessCore.secretEnvKey(secret)] = new Pulumi.Config("webhook").requireSecret(secret);
+  });
+}
+
+let webhookUrlRef = {
+  contents: Pulumi.output("")
+};
+
 function registerDcbConfig(pluginName, dcbTableName, stateChangeSliceModulePathsOpt, param) {
   let stateChangeSliceModulePaths = stateChangeSliceModulePathsOpt !== undefined ? stateChangeSliceModulePathsOpt : [];
   dcbConfigRef.contents = {
@@ -542,7 +560,9 @@ function Make(EventCollectorChannel) {
         };
       }
     });
-    StateChangeSliceRuntime_Builder_Single$ReventlessAws.forDcbCommandTopic(slicePaths, inboundSlices, dcbConfig.dcbTableName, dcbConfig.pluginName, syncStateChangesConfigRef.contents, asyncStateChangesConfigRef.contents, memorySize, timeout, connect, dcbCommandTopic);
+    StateChangeSliceRuntime_Builder_Single$ReventlessAws.forDcbCommandTopic(slicePaths, inboundSlices, dcbConfig.dcbTableName, dcbConfig.pluginName, syncStateChangesConfigRef.contents, asyncStateChangesConfigRef.contents, memorySize, timeout, webhookSlices.length !== 0 ? webhookSecrets : undefined, url => {
+      webhookUrlRef.contents = url;
+    }, connect, dcbCommandTopic);
   };
   let finish = () => {};
   return {
@@ -577,6 +597,10 @@ export {
   registeredInboundSlices,
   registerInboundTranslationSliceSpec,
   registerInboundAuditTableName,
+  webhookSlices,
+  webhookSecrets,
+  registerWebhook,
+  webhookUrlRef,
   registerDcbConfig,
   registerDcbTableName,
   heartbeatConfigRef,

package/tests/AppSync_AdapterTest.res

@@ -606,6 +606,58 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       )
     },
   )
+
+  // The resolvers check no rule, so a door the gate misses reads the gated rows.
+  // Run through the real generator, so a door it adds later is covered too.
+  testSync("a roles-gated entry's every generated door carries its groups", () => {
+    let byCategory: Reventless.ReadModel.indexConfig = {
+      index: "byCategory",
+      type_: "S",
+      idField: "categoryId",
+      projectionType: ALL,
+    }
+    let gated = (
+      ~single,
+      ~list,
+      ~subIdField=?,
+      ~indexQueries=?,
+    ): ReventlessInfra.Api.querySchemaEntry => {
+      singleFieldName: single,
+      listFieldName: list,
+      returnTypeName: single,
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: AllowRoles([Reventless.Role.make("Admin")]),
+      ?subIdField,
+      ?indexQueries,
+    }
+    let entries = [
+      gated(~single="p_Item", ~list="p_Items", ~indexQueries=[byCategory]),
+      gated(~single="p_Line", ~list="p_Lines", ~subIdField="lineId"),
+    ]
+    let frag = ReventlessCore.GraphQL_FragmentGenerator.generate(
+      ~mutationEntries=[],
+      ~queryEntries=entries,
+    )
+    let queries = (
+      AppSync_Adapter.injectAwsAuth(
+        frag,
+        ~mutationEntries=[],
+        ~queryEntries=entries,
+      )->decodeFragment
+    ).queries
+    let names = queries->Array.map(ReventlessCore.GraphQL_Stitcher.extractLeadingName)
+    expect(
+      ["p_ItemsByIds", "p_ItemsRefs", "p_ItemByCategory", "p_LineItems"]->Array.every(
+        door => names->Array.includes(door),
+      ),
+    )->toBe(true)
+    expect(
+      queries->Array.filter(
+        field => !(field->String.includes(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)),
+      ),
+    )->toEqual([])
+  })
 })
 
 // ── Type-level dual-auth ─────────────────────────────────────────────────────

package/tests/AppSync_AdapterTest.res.mjs

@@ -12,6 +12,7 @@ import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core
 import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
+import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 globalThis.describe("AppSync_Adapter.sha256Hex", () => {
   globalThis.test("returns a 64-character hex string", () => {
@@ -596,6 +597,40 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
       }
     });
   });
+  globalThis.test("a roles-gated entry's every generated door carries its groups", () => {
+    let gated = (single, list, subIdField, indexQueries) => ({
+      singleFieldName: single,
+      listFieldName: list,
+      returnTypeName: single,
+      stateSchema: Sury.unknown,
+      authorization: undefined,
+      permission: {
+        TAG: "AllowRoles",
+        _0: ["Admin"]
+      },
+      subIdField: subIdField,
+      indexQueries: indexQueries
+    });
+    let entries = [
+      gated("p_Item", "p_Items", undefined, [{
+          index: "byCategory",
+          type_: "S",
+          idField: "categoryId",
+          projectionType: "ALL"
+        }]),
+      gated("p_Line", "p_Lines", "lineId", undefined)
+    ];
+    let frag = GraphQL_FragmentGenerator$ReventlessCore.generate([], entries);
+    let queries = GraphQL_Stitcher$ReventlessCore.decode(AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], entries)).queries;
+    let names = queries.map(GraphQL_Stitcher$ReventlessCore.extractLeadingName);
+    globalThis.expect([
+      "p_ItemsByIds",
+      "p_ItemsRefs",
+      "p_ItemByCategory",
+      "p_LineItems"
+    ].every(door => names.includes(door))).toBe(true);
+    globalThis.expect(queries.filter(field => !field.includes(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`))).toEqual([]);
+  });
 });
 
 globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {

package/tests/EpInboundTestSlice.res

@@ -15,6 +15,7 @@ type command = AddThing({thingId: string})
 
 let targetName = "AddThing"
 let externalSystem: option<string> = Some("TestFeed")
+let endpoint = None
 
 type role = Reventless.Role.name
 let authorizationOf = (_: string): Reventless.Authorization.rule<role> => AllowRoles([

package/tests/EpInboundTestSlice.res.mjs

@@ -27,6 +27,8 @@ let targetName = "AddThing";
 
 let externalSystem = "TestFeed";
 
+let endpoint;
+
 export {
   name,
   moduleUrl,
@@ -34,6 +36,7 @@ export {
   commandSchema,
   targetName,
   externalSystem,
+  endpoint,
   authorizationOf,
 }
 /* externalInputSchema Not a pure module */