@reventlessdev/reventless-core 3.0.0-alpha.224 → 3.0.0-alpha.225

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.225 (2026-08-12)
+
+### Features
+
+* **commands:** stamp owner-marked fields from the authenticated caller ([5266655](https://github.com/ReventlessDev/reventless-core/commit/5266655b34de4d90c8148dec686cb0f336ac223d))
+* **core:** warn when an owner-scoped view exempts nobody ([cafa7a8](https://github.com/ReventlessDev/reventless-core/commit/cafa7a8b2082aeb00e53a9ed9da5bb978158db2d))
+* **platform:** bake a curated component manifest as a static asset ([4f30265](https://github.com/ReventlessDev/reventless-core/commit/4f30265a51fc2c59e69afd8074cf1b2534c06378))
+* **plugin:** publish the access a component's authorization rule implies ([e0d0f09](https://github.com/ReventlessDev/reventless-core/commit/e0d0f096b72fe44b185ed28dc1c133364fa841b8))
+* **plugin:** publish which field ties a component to its owner ([ca71289](https://github.com/ReventlessDev/reventless-core/commit/ca7128931ce525af0d7d3a4487b2b5c54b19bec0))
+* **queries:** narrow owner-bearing reads to the caller ([ba9cc3d](https://github.com/ReventlessDev/reventless-core/commit/ba9cc3d58d7914a9e4827bda90a704a74b1b82dd))
+* **spec:** let a record name the field that identifies its owner ([b69ee91](https://github.com/ReventlessDev/reventless-core/commit/b69ee9123e6beb38fcdd716519103ab9328213c6))
+* **spec:** let the environment name the groups exempt from owner scoping ([2de5c51](https://github.com/ReventlessDev/reventless-core/commit/2de5c5118347a46998f9ab603308fca09addf00b))
+
+
 # 3.0.0-alpha.224 (2026-08-11)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.224",
+  "version": "3.0.0-alpha.225",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,16 +29,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.4",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.4",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.4",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.4",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.134",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.108",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.135",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.109"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/admin/Platform_Admin_Structure.res

@@ -76,6 +76,8 @@ let activateCommand: commandDef = {
   allowedStates: Some(["Inactive"]),
   targetState: None,
   apiExposed: Some(true),
+  requiredAccess: None,
+  ownerField: None,
 }
 
 let deactivateCommand: commandDef = {
@@ -88,6 +90,8 @@ let deactivateCommand: commandDef = {
   allowedStates: Some(["Connected", "Disconnected"]),
   targetState: None,
   apiExposed: Some(true),
+  requiredAccess: None,
+  ownerField: None,
 }
 
 let pluginAggregate: writableDef = {
@@ -131,6 +135,8 @@ let pluginReadModel: queryableDef = {
   // with no `*Id` field.
   idField: None,
   idFieldSource: None,
+  requiredAccess: None,
+  ownerField: None,
 }
 
 let structure: pluginStructure = {

package/src/admin/Platform_Admin_Structure.res.mjs

@@ -64,7 +64,9 @@ let activateCommand = {
   references: activateCommand_references,
   allowedStates: activateCommand_allowedStates,
   targetState: undefined,
-  apiExposed: activateCommand_apiExposed
+  apiExposed: activateCommand_apiExposed,
+  requiredAccess: undefined,
+  ownerField: undefined
 };
 
 let deactivateCommand_schema = encodeSchema(idArgsSchema);
@@ -91,7 +93,9 @@ let deactivateCommand = {
   references: deactivateCommand_references,
   allowedStates: deactivateCommand_allowedStates,
   targetState: undefined,
-  apiExposed: deactivateCommand_apiExposed
+  apiExposed: deactivateCommand_apiExposed,
+  requiredAccess: undefined,
+  ownerField: undefined
 };
 
 let pluginAggregate_commands = [
@@ -147,11 +151,13 @@ let pluginReadModel = {
   searchableFields: pluginReadModel_searchableFields,
   labelFieldSource: pluginReadModel_labelFieldSource,
   statusField: pluginReadModel_statusField,
+  ownerField: undefined,
   visibility: undefined,
   chapter: undefined,
   singleQueryField: pluginReadModel_singleQueryField,
   idField: undefined,
-  idFieldSource: undefined
+  idFieldSource: undefined,
+  requiredAccess: undefined
 };
 
 let structure_readModels = [pluginReadModel];

package/src/admin/Platform_BakedManifest.res

@@ -0,0 +1,154 @@
+// Curation for the baked component manifest: a deployment's include-list applied
+// to the registered plugin structures, encoded through the very same encoder
+// `Platform_ComponentDefinitions` uses.
+//
+// Curation is not authorization. This module decides WHAT EXISTS for a
+// deployment's audience — deployment data, settled before anyone logs in. What a
+// caller may do stays a server-side decision, enforced per query and per
+// mutation, and nothing here relaxes it. That split is the reason a curated file
+// can be static at all.
+//
+// The filtering happens on the `pluginStructure` record, never on the encoded
+// JSON: whatever survives is then handed to
+// `Platform_ComponentDefinitionsApi.encodePluginStructureEntry`, so a baked entry
+// and a served entry cannot drift in shape, and an include-list that names
+// everything produces byte-identical output.
+
+open Reventless.Plugin
+
+type error =
+  | UnknownPlugin(string)
+  | UnknownView({plugin: string, view: string})
+  | UnknownCommand({plugin: string, command: string})
+
+let describe = (e: error): string =>
+  switch e {
+  | UnknownPlugin(plugin) => `baked manifest: no registered plugin named "${plugin}"`
+  | UnknownView({plugin, view}) =>
+    `baked manifest: plugin "${plugin}" has no view named "${view}"`
+  | UnknownCommand({plugin, command}) =>
+    `baked manifest: plugin "${plugin}" has no command named "${command}"`
+  }
+
+// Views are named by component name — a view IS the surface. Commands are named
+// by command name, not by the write-side component that carries them: the
+// command is what a user invokes, and which slice or aggregate it lives on is an
+// implementation detail the author should not have to know to curate a shop.
+type selection = {
+  plugin: string,
+  views: option<array<string>>,
+  commands: option<array<string>>,
+}
+
+let publicViews = (def: pluginStructure): array<queryableDef> =>
+  Array.concat(def.readModels, def.stateViewSlices)->Array.filter(
+    Platform_ComponentDefinitionsApi.isPublicQueryable,
+  )
+
+let writeSides = (def: pluginStructure): array<writableDef> =>
+  Array.concat(def.stateChangeSlices, def.aggregates)
+
+let commandNames = (def: pluginStructure): array<string> =>
+  def->writeSides->Array.flatMap(w => w.commands->Array.map(c => c.name))
+
+// Every name in the selection has to resolve. A silent no-op here ships a shell
+// with a page missing for a reason no log explains — the same class of failure as
+// a malformed hints file, and it gets the same treatment: fail the deploy.
+let validate = (~def: pluginStructure, sel: selection): result<unit, error> => {
+  let known = (names, candidates) =>
+    names
+    ->Option.getOr([])
+    ->Array.find(name => !(candidates->Array.includes(name)))
+
+  switch sel.views->known(def->publicViews->Array.map(q => q.name)) {
+  | Some(view) => Error(UnknownView({plugin: sel.plugin, view}))
+  | None =>
+    switch sel.commands->known(def->commandNames) {
+    | Some(command) => Error(UnknownCommand({plugin: sel.plugin, command}))
+    | None => Ok()
+    }
+  }
+}
+
+let isSelected = (selected: option<array<string>>, name: string): bool =>
+  switch selected {
+  | None => true
+  | Some(names) => names->Array.includes(name)
+  }
+
+// An Internal view survives the bake only when an included command references it.
+// It is carried for one reason — to be a reference target — and a shell reading a
+// baked manifest has no admin API to recover a missing one from, so leaving it out
+// breaks the picker permanently in the one deployment shape with no fallback.
+// Naming it discloses nothing: the domain API already serves that view to the same
+// caller (Internal is a menu hint, not a boundary).
+let referencedEntities = (~pluginName: string, kept: array<writableDef>): array<string> =>
+  kept
+  ->Array.flatMap(w => w.commands)
+  ->Array.flatMap(c => c.references)
+  ->Array.filterMap(r =>
+    switch r.plugin {
+    | Some(p) if Plugin.name(p) !== pluginName => None
+    | _ => Some(r.entity)
+    }
+  )
+
+let curateStructure = (
+  ~pluginId: string,
+  ~def: pluginStructure,
+  sel: selection,
+): result<pluginStructure, error> =>
+  validate(~def, sel)->Result.map(() => {
+    let pluginName = Plugin.name(pluginId)
+    let keepCommands = (ws: array<writableDef>) =>
+      ws
+      ->Array.map(w => {...w, commands: w.commands->Array.filter(c => sel.commands->isSelected(c.name))})
+      // A write side left with no command contributes no surface. Dropping it
+      // keeps the curated entry a description of what the app offers rather than
+      // a list of components whose commands were all removed.
+      ->Array.filter(w => w.commands->Array.length > 0)
+
+    let stateChangeSlices = def.stateChangeSlices->keepCommands
+    let aggregates = def.aggregates->keepCommands
+    let referenced = referencedEntities(
+      ~pluginName,
+      Array.concat(stateChangeSlices, aggregates),
+    )
+    let keepViews = (qs: array<queryableDef>) =>
+      qs->Array.filter(q =>
+        if Platform_ComponentDefinitionsApi.isPublicQueryable(q) {
+          sel.views->isSelected(q.name)
+        } else {
+          referenced->Array.includes(q.name)
+        }
+      )
+
+    {
+      ...def,
+      readModels: def.readModels->keepViews,
+      stateViewSlices: def.stateViewSlices->keepViews,
+      stateChangeSlices,
+      aggregates,
+    }
+  })
+
+// The whole file: one entry per selection, in the order the deployment declared
+// them, so the include-list also states the order a consumer reads plugins in.
+let curate = (
+  ~structures: array<(string, pluginStructure)>,
+  ~selections: array<selection>,
+): result<JSON.t, error> =>
+  selections->Array.reduce(Ok([]), (acc, sel) =>
+    acc->Result.flatMap(entries =>
+      switch structures->Array.find(((pluginId, _)) => Plugin.name(pluginId) === sel.plugin) {
+      | None => Error(UnknownPlugin(sel.plugin))
+      | Some((pluginId, def)) =>
+        curateStructure(~pluginId, ~def, sel)->Result.map(curated => {
+          entries->Array.push(
+            Platform_ComponentDefinitionsApi.encodePluginStructureEntry(~pluginId, curated),
+          )
+          entries
+        })
+      }
+    )
+  )->Result.map(JSON.Encode.array)

package/src/admin/Platform_BakedManifest.res.mjs

@@ -0,0 +1,156 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Plugin$ReventlessCore from "../plugin/component/Plugin.res.mjs";
+import * as Platform_ComponentDefinitionsApi$ReventlessCore from "./Platform_ComponentDefinitionsApi.res.mjs";
+
+function describe(e) {
+  switch (e.TAG) {
+    case "UnknownPlugin" :
+      return `baked manifest: no registered plugin named "` + e._0 + `"`;
+    case "UnknownView" :
+      return `baked manifest: plugin "` + e.plugin + `" has no view named "` + e.view + `"`;
+    case "UnknownCommand" :
+      return `baked manifest: plugin "` + e.plugin + `" has no command named "` + e.command + `"`;
+  }
+}
+
+function publicViews(def) {
+  return def.readModels.concat(def.stateViewSlices).filter(Platform_ComponentDefinitionsApi$ReventlessCore.isPublicQueryable);
+}
+
+function writeSides(def) {
+  return def.stateChangeSlices.concat(def.aggregates);
+}
+
+function commandNames(def) {
+  return writeSides(def).flatMap(w => w.commands.map(c => c.name));
+}
+
+function validate(def, sel) {
+  let known = (names, candidates) => Stdlib_Option.getOr(names, []).find(name => !candidates.includes(name));
+  let view = known(sel.views, publicViews(def).map(q => q.name));
+  if (view !== undefined) {
+    return {
+      TAG: "Error",
+      _0: {
+        TAG: "UnknownView",
+        plugin: sel.plugin,
+        view: view
+      }
+    };
+  }
+  let command = known(sel.commands, commandNames(def));
+  if (command !== undefined) {
+    return {
+      TAG: "Error",
+      _0: {
+        TAG: "UnknownCommand",
+        plugin: sel.plugin,
+        command: command
+      }
+    };
+  } else {
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+}
+
+function isSelected(selected, name) {
+  if (selected !== undefined) {
+    return selected.includes(name);
+  } else {
+    return true;
+  }
+}
+
+function referencedEntities(pluginName, kept) {
+  return Stdlib_Array.filterMap(kept.flatMap(w => w.commands).flatMap(c => c.references), r => {
+    let p = r.plugin;
+    if (p !== undefined && Plugin$ReventlessCore.name(p) !== pluginName) {
+      return;
+    } else {
+      return r.entity;
+    }
+  });
+}
+
+function curateStructure(pluginId, def, sel) {
+  return Stdlib_Result.map(validate(def, sel), () => {
+    let pluginName = Plugin$ReventlessCore.name(pluginId);
+    let keepCommands = ws => ws.map(w => ({
+      name: w.name,
+      commands: w.commands.filter(c => isSelected(sel.commands, c.name)),
+      producedEventTypes: w.producedEventTypes,
+      consumedEventTypes: w.consumedEventTypes,
+      linkedViews: w.linkedViews,
+      consistencyRead: w.consistencyRead,
+      events: w.events,
+      errors: w.errors,
+      chapter: w.chapter
+    })).filter(w => w.commands.length !== 0);
+    let stateChangeSlices = keepCommands(def.stateChangeSlices);
+    let aggregates = keepCommands(def.aggregates);
+    let referenced = referencedEntities(pluginName, stateChangeSlices.concat(aggregates));
+    let keepViews = qs => qs.filter(q => {
+      if (Platform_ComponentDefinitionsApi$ReventlessCore.isPublicQueryable(q)) {
+        return isSelected(sel.views, q.name);
+      } else {
+        return referenced.includes(q.name);
+      }
+    });
+    return {
+      readModels: keepViews(def.readModels),
+      stateViewSlices: keepViews(def.stateViewSlices),
+      stateChangeSlices: stateChangeSlices,
+      aggregates: aggregates,
+      automationSlices: def.automationSlices,
+      outboundTranslationSlices: def.outboundTranslationSlices,
+      inboundTranslationSlices: def.inboundTranslationSlices,
+      extensions: def.extensions,
+      extensionPoints: def.extensionPoints,
+      requiredStores: def.requiredStores,
+      requiredStoreDeclarations: def.requiredStoreDeclarations
+    };
+  });
+}
+
+function curate(structures, selections) {
+  return Stdlib_Result.map(Stdlib_Array.reduce(selections, {
+    TAG: "Ok",
+    _0: []
+  }, (acc, sel) => Stdlib_Result.flatMap(acc, entries => {
+    let match = structures.find(param => Plugin$ReventlessCore.name(param[0]) === sel.plugin);
+    if (match === undefined) {
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnknownPlugin",
+          _0: sel.plugin
+        }
+      };
+    }
+    let pluginId = match[0];
+    return Stdlib_Result.map(curateStructure(pluginId, match[1], sel), curated => {
+      entries.push(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(pluginId, curated));
+      return entries;
+    });
+  })), prim => prim);
+}
+
+export {
+  describe,
+  publicViews,
+  writeSides,
+  commandNames,
+  validate,
+  isSelected,
+  referencedEntities,
+  curateStructure,
+  curate,
+}
+/* No side effect */

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -18,7 +18,7 @@ open Reventless.Plugin
 // consumers long after they were being encoded.
 let sdlTypes: array<string> = [
   `type Platform_FieldReference {\n  fieldName: String!\n  entity: String!\n  plugin: String\n}`,
-  `type Platform_CommandDef {\n  name: String!\n  schema: String!\n  level: String!\n  aggregateIdField: String\n  mutationField: String!\n  references: [Platform_FieldReference!]!\n  allowedStates: [String!]\n  targetState: String\n  apiExposed: Boolean\n}`,
+  `type Platform_CommandDef {\n  name: String!\n  schema: String!\n  level: String!\n  aggregateIdField: String\n  mutationField: String!\n  references: [Platform_FieldReference!]!\n  allowedStates: [String!]\n  targetState: String\n  apiExposed: Boolean\n  requiredAccess: [String!]\n  ownerField: String\n}`,
   `type Platform_EventDef {\n  name: String!\n  schema: String!\n  references: [Platform_FieldReference!]!\n}`,
   // Same fields as Platform_EventDef, kept a distinct type because a refusal is not
   // a fact: a caller selecting `errors` is asking what a command can be rejected
@@ -29,7 +29,7 @@ let sdlTypes: array<string> = [
   // structures persisted before the fields existed decode as `None`, a hand-rolled
   // def may decline to state them, and a state whose key cannot be resolved has no
   // `idField` to report.
-  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n}`,
+  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
   `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
@@ -81,6 +81,11 @@ let encodeCommandDef = (c: commandDef): JSON.t =>
     ),
     ("targetState", c.targetState->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("apiExposed", c.apiExposed->Option.mapOr(JSON.Encode.null, JSON.Encode.bool)),
+    // Null, not `[]`: a rule asking for nothing checkable and a def written
+    // before the field existed are the same answer to a client — "no key gates
+    // this" — and neither should read as "gated by an empty set".
+    ("requiredAccess", c.requiredAccess->Option.mapOr(JSON.Encode.null, encodeStrings)),
+    ("ownerField", c.ownerField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
   ])->JSON.Encode.object
 
 // Internal ReadModels / StateViewSlices are carried in pluginStructure for developer
@@ -121,6 +126,8 @@ let encodeQueryableDef = (r: queryableDef): JSON.t =>
     ),
     ("idField", r.idField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("idFieldSource", r.idFieldSource->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    ("requiredAccess", r.requiredAccess->Option.mapOr(JSON.Encode.null, encodeStrings)),
+    ("ownerField", r.ownerField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
   ])->JSON.Encode.object
 
 let encodeEventDef = (e: eventDef): JSON.t =>

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -6,11 +6,11 @@ import * as Plugin$ReventlessCore from "../plugin/component/Plugin.res.mjs";
 
 let sdlTypes = [
   `type Platform_FieldReference {\n  fieldName: String!\n  entity: String!\n  plugin: String\n}`,
-  `type Platform_CommandDef {\n  name: String!\n  schema: String!\n  level: String!\n  aggregateIdField: String\n  mutationField: String!\n  references: [Platform_FieldReference!]!\n  allowedStates: [String!]\n  targetState: String\n  apiExposed: Boolean\n}`,
+  `type Platform_CommandDef {\n  name: String!\n  schema: String!\n  level: String!\n  aggregateIdField: String\n  mutationField: String!\n  references: [Platform_FieldReference!]!\n  allowedStates: [String!]\n  targetState: String\n  apiExposed: Boolean\n  requiredAccess: [String!]\n  ownerField: String\n}`,
   `type Platform_EventDef {\n  name: String!\n  schema: String!\n  references: [Platform_FieldReference!]!\n}`,
   `type Platform_ErrorDef {\n  name: String!\n  schema: String!\n  references: [Platform_FieldReference!]!\n}`,
   `type Platform_WriteSideDef {\n  name: String!\n  commands: [Platform_CommandDef!]!\n  linkedViews: [String!]!\n  consistencyRead: String\n  producedEventTypes: [String!]!\n  consumedEventTypes: [String!]!\n  events: [Platform_EventDef!]!\n  errors: [Platform_ErrorDef!]!\n  chapter: String\n}`,
-  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n}`,
+  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
   `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
@@ -79,6 +79,14 @@ function encodeCommandDef(c) {
     [
       "apiExposed",
       Stdlib_Option.mapOr(c.apiExposed, null, prim => prim)
+    ],
+    [
+      "requiredAccess",
+      Stdlib_Option.mapOr(c.requiredAccess, null, encodeStrings)
+    ],
+    [
+      "ownerField",
+      Stdlib_Option.mapOr(c.ownerField, null, prim => prim)
     ]
   ]);
 }
@@ -144,6 +152,14 @@ function encodeQueryableDef(r) {
     [
       "idFieldSource",
       Stdlib_Option.mapOr(r.idFieldSource, null, prim => prim)
+    ],
+    [
+      "requiredAccess",
+      Stdlib_Option.mapOr(r.requiredAccess, null, encodeStrings)
+    ],
+    [
+      "ownerField",
+      Stdlib_Option.mapOr(r.ownerField, null, prim => prim)
     ]
   ]);
 }

package/src/components/Api/OwnerScopeDiagnostics.res

@@ -0,0 +1,54 @@
+// The one thing a deployment can get wrong about `@owner` without anything
+// failing.
+//
+// `OwnerScope.elevatedGroups` defaults to `[]`, which is the safe default: it
+// scopes everybody rather than exempting somebody by accident. But a deployment
+// that never calls `setElevatedGroups` gets that default silently, and then
+// *administrators are scoped too* — an operator opening an owner-scoped view
+// sees only the rows they happen to own.
+//
+// Nothing errors, and it is invisible from outside: an operator whose elevated
+// list is empty and an operator who genuinely owns nothing produce the identical
+// empty page. That is the same unfalsifiability that makes a denied read
+// indistinguishable from an empty one, arriving by a different route — so it is
+// worth a line at registration rather than a support ticket later.
+//
+// Lives in core rather than in each adapter so the rule and its wording are
+// stated once. Local and AWS both register owner-scoped views; two copies of
+// this check would be two chances to word the consequence differently, or to
+// fix one and not the other.
+
+let log = Logger.fromEnv()
+
+// Warned once per read model. Resolver registration can run more than once in a
+// process (tests build several platforms; a deploy walks every plugin), and a
+// warning repeated per construction is a warning people learn to scroll past.
+let warned: Set.t<string> = Set.make()
+
+/**
+Warn when `view` declares an `@owner` field but no group is exempt from scoping.
+
+`~comp` names the calling adapter so the line points at the transport it came
+from. Silent when the view declares no owner, and silent once the deployment has
+configured any elevated group — this is a "you probably forgot" signal, not a
+policy about which groups are correct.
+*/
+let warnIfNoElevatedGroups = (~comp: string, ~view: string, ~ownerField: option<string>) =>
+  switch ownerField {
+  | Some(field) if Reventless.OwnerScope.elevatedGroups()->Array.length == 0 =>
+    if !(warned->Set.has(view)) {
+      warned->Set.add(view)
+      log.warn(
+        ~comp,
+        `${view}: "${field}" is declared @owner, but no elevated groups are configured. ` ++
+        "Every caller — administrators included — will see only their own rows. " ++
+        "Call OwnerScope.setElevatedGroups([...]) before components are built, or set " ++
+        "REVENTLESS_ELEVATED_GROUPS — the environment is what reaches a deployment's " ++
+        "separate function runtimes, which a call in the deploy program does not.",
+      )
+    }
+  | _ => ()
+  }
+
+/** Test seam: forget what has already been warned about. */
+let resetWarnings = () => warned->Set.clear

package/src/components/Api/OwnerScopeDiagnostics.res.mjs

@@ -0,0 +1,27 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let warned = new Set();
+
+function warnIfNoElevatedGroups(comp, view, ownerField) {
+  if (ownerField !== undefined && OwnerScope$Reventless.elevatedGroups().length === 0 && !warned.has(view)) {
+    warned.add(view);
+    return log.warn(comp, undefined, view + `: "` + ownerField + `" is declared @owner, but no elevated groups are configured. ` + "Every caller — administrators included — will see only their own rows. Call OwnerScope.setElevatedGroups([...]) before components are built, or set REVENTLESS_ELEVATED_GROUPS — the environment is what reaches a deployment's separate function runtimes, which a call in the deploy program does not.");
+  }
+}
+
+function resetWarnings() {
+  warned.clear();
+}
+
+export {
+  log,
+  warned,
+  warnIfNoElevatedGroups,
+  resetWarnings,
+}
+/* log Not a pure module */

package/src/components/Api/QueryDbListQuery.res

@@ -75,12 +75,28 @@ let buildConnection = (
 // it defaults to the shared rule so every caller applies the same one — the AWS
 // Lambda used to pass a no-op here, which silently made `filter.ids` reject a
 // global id on that provider only. Everything else is pure over the item array.
+// `ownerScope` is `(fieldName, requiredValue)`, and it is deliberately NOT read
+// out of `argsDict`. Two reasons, both fatal to the obvious alternative of
+// injecting `filter.<owner>Eq`:
+//
+//   - the owner field usually is not in `capability.filterFields` at all (it is
+//     admitted only by `@id` / `@index` / `@scan` and friends), so there is no
+//     filter input to inject into; and
+//   - `filter` is the caller's own argument. A predicate that decides what the
+//     caller may see must arrive on a channel the caller cannot name or
+//     overwrite.
+//
+// It joins the same `filtered` pass as everything else, which puts it BEFORE
+// ordering and pagination. Narrowing a materialised page afterwards would return
+// short pages with valid-looking cursors — a bug that reads as "the list
+// sometimes ends early" rather than as an access-control fault.
 let run = (
   ~items: array<JSON.t>,
   ~argsDict: Dict.t<JSON.t>,
   ~capability: GraphQL_FragmentGenerator.serverCapability,
   ~labelField: string,
   ~decodeLocalId: string => option<string>=Api_Ids.toLocalId,
+  ~ownerScope: option<(string, string)>=?,
 ): JSON.t => {
   let filterDict =
     argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
@@ -161,7 +177,15 @@ let run = (
     | _ => true
     }
     let passPerField = perFieldChecks->Array.every(check => check(item))
-    passSearch && passPrefix && passIds && passPerField
+    // A row that does not state an owner never matches a scoped read. Treating a
+    // missing field as "belongs to everyone" would expose exactly the rows that
+    // predate the annotation, which are the ones nobody remembers to check.
+    let passOwner = switch ownerScope {
+    | Some((field, required)) =>
+      getFieldString(item, field)->Option.mapOr(false, v => v == required)
+    | None => true
+    }
+    passSearch && passPrefix && passIds && passPerField && passOwner
   })
 
   let orderByDict = argsDict->Dict.get("orderBy")->Option.flatMap(JSON.Decode.object)

package/src/components/Api/QueryDbListQuery.res.mjs

@@ -48,7 +48,7 @@ function buildConnection(pageItems, hasNextPage, hasPreviousPage, cursorValueOf)
   };
 }
 
-function run(items, argsDict, capability, labelField, decodeLocalIdOpt) {
+function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerScope) {
   let decodeLocalId = decodeLocalIdOpt !== undefined ? decodeLocalIdOpt : Api_Ids$ReventlessCore.toLocalId;
   let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
   let search = Stdlib_Option.flatMap(filterDict["search"], Stdlib_JSON.Decode.string);
@@ -95,8 +95,15 @@ function run(items, argsDict, capability, labelField, decodeLocalIdOpt) {
       passIds = true;
     }
     let passPerField = perFieldChecks.every(check => check(item));
-    if (passSearch && passPrefix && passIds) {
-      return passPerField;
+    let passOwner;
+    if (ownerScope !== undefined) {
+      let required = ownerScope[1];
+      passOwner = Stdlib_Option.mapOr(getFieldString(item, ownerScope[0]), false, v => v === required);
+    } else {
+      passOwner = true;
+    }
+    if (passSearch && passPrefix && passIds && passPerField) {
+      return passOwner;
     } else {
       return false;
     }