@reventlessdev/reventless-core 3.0.0-alpha.233 → 3.0.0-alpha.235

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.235 (2026-08-15)
+
+### Features
+
+* **core:** curate the pages a shell builds across a plugin's views ([589835a](https://github.com/ReventlessDev/reventless-core/commit/589835a1ad428c5e2dea8bf6e4c64e49d2f67e0d))
+
+
+# 3.0.0-alpha.234 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
 # 3.0.0-alpha.233 (2026-08-14)
 
 **Note:** Version bump only for package @reventlessdev/reventless-core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.233",
+  "version": "3.0.0-alpha.235",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,16 +29,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.7",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.6",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.7",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.6",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.114",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.142"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Auth/Auth_RefusalVocabulary.res

@@ -0,0 +1,168 @@
+// The cross-provider contract for "which refusal did I just get" — see
+// [docs/plans/appsync-refusal-vocabulary.md].
+//
+// An authorization gate has two ways to refuse and they ask the caller for
+// opposite things. A caller whose credentials did not verify should present new
+// ones. A caller who is simply not entitled will meet the same answer however
+// many times they authenticate — asking them to sign in again ends a working
+// session and fixes nothing.
+//
+// Both adapters draw that distinction. They express it in shapes that have
+// nothing in common, because neither chose its own vocabulary: the local adapter
+// sets `extensions.code` on a GraphQL error, and AppSync refuses at two
+// different layers with `errorType` values the service picks. A client written
+// against one is quietly wrong against the other — it reads for a key that is
+// never present, finds nothing, and proceeds as though nothing was refused.
+//
+// So this module is a mapping, not an equality. It cannot make the two paths
+// answer alike; `extensions` is not even reachable from an AppSync resolver.
+// What it can do is let a caller ask the one question that matters — *was this
+// about entitlement or about identity?* — and get an answer without knowing
+// which adapter it is talking to.
+//
+// Every row here is an observed response, captured against a deployed API and
+// the local server, not a reading of documentation.
+
+/**
+Which of the two refusals a response carries.
+
+`Entitlement` — the caller was identified and is not permitted. Re-authenticating
+changes nothing; the session is still good.
+
+`Identity` — the caller was not identified. New credentials are the remedy, and
+discarding the session is correct here and only here.
+*/
+type refusalKind =
+  | Entitlement
+  | Identity
+
+/** The adapter a signal belongs to. */
+type adapter =
+  | Local
+  | AppSync
+
+/**
+One observed refusal shape.
+
+`discriminator` names where a client looks; `value` is what it finds there.
+Together with `httpStatus` they are sufficient to classify a response — see
+[classify], which is what callers should use rather than re-deriving this.
+*/
+type signal = {
+  adapter: adapter,
+  kind: refusalKind,
+  httpStatus: int,
+  discriminator: string,
+  value: string,
+}
+
+/**
+The `extensions.code` the local adapter sets for each refusal.
+
+Exported so the adapter emits these rather than repeating the literals: a table
+the emitting code does not read is documentation, and documentation drifts. The
+AppSync values have no equivalent here — the service picks those, which is the
+whole reason this module is a mapping rather than a shared constant.
+*/
+let localEntitlementCode = "FORBIDDEN"
+
+/** See [localEntitlementCode]. */
+let localIdentityCode = "UNAUTHORIZED"
+
+/**
+The correspondence both adapters are held to.
+
+🚨 **The two AppSync values differ by a suffix and mean opposite things.**
+`Unauthorized` is the entitlement refusal; `UnauthorizedException` is the identity
+one. A client matching on the substring `"Unauthorized"` — the obvious thing to
+write — collapses exactly the distinction this table exists to preserve, and
+collapses it in the dangerous direction: it treats "you lack the role" as "your
+session is dead" and signs the caller out of a session that was working.
+
+Use [classify]. It is the only reason this table is data rather than prose.
+*/
+let signals: array<signal> = [
+  {
+    adapter: Local,
+    kind: Entitlement,
+    httpStatus: 200,
+    discriminator: "extensions.code",
+    value: localEntitlementCode,
+  },
+  {
+    adapter: Local,
+    kind: Identity,
+    httpStatus: 200,
+    discriminator: "extensions.code",
+    value: localIdentityCode,
+  },
+  {
+    adapter: AppSync,
+    kind: Entitlement,
+    httpStatus: 200,
+    discriminator: "errors[].errorType",
+    value: "Unauthorized",
+  },
+  {
+    // The request never becomes a GraphQL execution: the service rejects it
+    // before the schema is reached, so there is no field error to read and the
+    // status line is the whole answer.
+    adapter: AppSync,
+    kind: Identity,
+    httpStatus: 401,
+    discriminator: "x-amzn-errortype",
+    value: "UnauthorizedException",
+  },
+]
+
+/**
+Classify a refusal without knowing which adapter produced it.
+
+Pass what the response actually carried: its status, the `errorType` of a GraphQL
+error if there was one, and `extensions.code` if there was one. Returns `None`
+when the response is not a refusal this contract recognises — which includes a
+successful response, so a caller must not read `None` as "allowed".
+
+Ordering matters and is the point of the function. The transport status is
+checked first, because a 401 is the identity refusal on the AppSync path and its
+`x-amzn-errortype` (`UnauthorizedException`) shares a prefix with the entitlement
+value (`Unauthorized`). Matching the error type first would classify every
+unidentified AppSync caller as merely unentitled.
+*/
+let classify = (
+  ~httpStatus: int,
+  ~errorType: option<string>=?,
+  ~extensionsCode: option<string>=?,
+): option<refusalKind> =>
+  if httpStatus == 401 {
+    Some(Identity)
+  } else {
+    switch extensionsCode {
+    | Some(c) if c == localEntitlementCode => Some(Entitlement)
+    | Some(c) if c == localIdentityCode => Some(Identity)
+    | _ =>
+      switch errorType {
+      // Exact match, never a prefix or `includes` — see the warning on [signals].
+      | Some("Unauthorized") => Some(Entitlement)
+      | Some("UnauthorizedException") => Some(Identity)
+      | _ => None
+      }
+    }
+  }
+
+/** The signals one adapter can produce. */
+let signalsFor = (adapter: adapter): array<signal> =>
+  signals->Array.filter(s => s.adapter == adapter)
+
+/**
+Whether a refusal means the caller should be asked to authenticate again.
+
+The one decision the distinction exists to drive, kept here so no client has to
+re-derive it — and so the wrong answer cannot be arrived at independently in
+several places.
+*/
+let warrantsReauthentication = (kind: refusalKind): bool =>
+  switch kind {
+  | Identity => true
+  | Entitlement => false
+  }

package/src/adapter/Auth/Auth_RefusalVocabulary.res.mjs

@@ -0,0 +1,80 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let localEntitlementCode = "FORBIDDEN";
+
+let localIdentityCode = "UNAUTHORIZED";
+
+let signals = [
+  {
+    adapter: "Local",
+    kind: "Entitlement",
+    httpStatus: 200,
+    discriminator: "extensions.code",
+    value: localEntitlementCode
+  },
+  {
+    adapter: "Local",
+    kind: "Identity",
+    httpStatus: 200,
+    discriminator: "extensions.code",
+    value: localIdentityCode
+  },
+  {
+    adapter: "AppSync",
+    kind: "Entitlement",
+    httpStatus: 200,
+    discriminator: "errors[].errorType",
+    value: "Unauthorized"
+  },
+  {
+    adapter: "AppSync",
+    kind: "Identity",
+    httpStatus: 401,
+    discriminator: "x-amzn-errortype",
+    value: "UnauthorizedException"
+  }
+];
+
+function classify(httpStatus, errorType, extensionsCode) {
+  if (httpStatus === 401) {
+    return "Identity";
+  }
+  if (extensionsCode !== undefined) {
+    if (extensionsCode === localEntitlementCode) {
+      return "Entitlement";
+    }
+    if (extensionsCode === localIdentityCode) {
+      return "Identity";
+    }
+  }
+  if (errorType === undefined) {
+    return;
+  }
+  switch (errorType) {
+    case "Unauthorized" :
+      return "Entitlement";
+    case "UnauthorizedException" :
+      return "Identity";
+    default:
+      return;
+  }
+}
+
+function signalsFor(adapter) {
+  return signals.filter(s => s.adapter === adapter);
+}
+
+function warrantsReauthentication(kind) {
+  return kind !== "Entitlement";
+}
+
+export {
+  localEntitlementCode,
+  localIdentityCode,
+  signals,
+  classify,
+  signalsFor,
+  warrantsReauthentication,
+}
+/* No side effect */

package/src/admin/Platform_BakedManifest.res

@@ -20,6 +20,22 @@ type error =
   | UnknownPlugin(string)
   | UnknownView({plugin: string, view: string})
   | UnknownCommand({plugin: string, command: string})
+  | UnknownDerived({plugin: string, kind: string})
+
+/** The pages a shell builds across a plugin's views rather than from any one of
+    them, as the vocabulary a deployment curates them by.
+
+    A closed set, and deliberately kinds rather than page names. A dashboard and
+    a lifecycle page are named by the framework, but a canvas is named by the
+    views it draws — from that deployment's hints and the view modes its shell
+    registered, neither of which this side can see. Curating by kind is the
+    question this side CAN answer, and it is also the question an author is
+    asking: "does this audience get calendars", not "does it get the one called
+    Deliveries".
+
+    Ordered as they appear in a menu (the dashboard tops the group, canvases and
+    schedulers tail it), so the vocabulary reads as the page set it curates. */
+let derivedKinds = ["dashboard", "lifecycles", "canvas", "scheduler"]
 
 let describe = (e: error): string =>
   switch e {
@@ -28,16 +44,26 @@ let describe = (e: error): string =>
     `baked manifest: plugin "${plugin}" has no view named "${view}"`
   | UnknownCommand({plugin, command}) =>
     `baked manifest: plugin "${plugin}" has no command named "${command}"`
+  | UnknownDerived({plugin, kind}) =>
+    `baked manifest: plugin "${plugin}" names derived page kind "${kind}" — ` ++
+    `known kinds: ${derivedKinds->Array.join(", ")}`
   }
 
 // Views are named by component name — a view IS the surface. Commands are named
 // by command name, not by the write-side component that carries them: the
 // command is what a user invokes, and which slice or aggregate it lives on is an
 // implementation detail the author should not have to know to curate a shop.
+//
+// `derived` is neither: it names page KINDS, for the reason `derivedKinds`
+// gives. Unlike the other two, what it selects is not filtered here — there is
+// nothing in a `pluginStructure` to filter, because the pages do not exist until
+// a shell builds them. It travels to the shell instead, which is the only place
+// that can honour it.
 type selection = {
   plugin: string,
   views: option<array<string>>,
   commands: option<array<string>>,
+  derived: option<array<string>>,
 }
 
 let publicViews = (def: pluginStructure): array<queryableDef> =>
@@ -65,7 +91,16 @@ let validate = (~def: pluginStructure, sel: selection): result<unit, error> => {
   | None =>
     switch sel.commands->known(def->commandNames) {
     | Some(command) => Error(UnknownCommand({plugin: sel.plugin, command}))
-    | None => Ok()
+    | None =>
+      // Against the vocabulary rather than against this plugin: a kind that
+      // generates no page here is a fact about the plugin's schemas, not a
+      // mistake — a shop naming `lifecycles` for a plugin whose views gain a
+      // status field next month is stating an intention, and failing it would
+      // punish the deployment for being early.
+      switch sel.derived->known(derivedKinds) {
+      | Some(kind) => Error(UnknownDerived({plugin: sel.plugin, kind}))
+      | None => Ok()
+      }
     }
   }
 }
@@ -182,7 +217,11 @@ let curate = (
       | Some((pluginId, def)) =>
         curateStructure(~pluginId, ~def, sel)->Result.map(curated => {
           entries->Array.push(
-            Platform_ComponentDefinitionsApi.encodePluginStructureEntry(~pluginId, curated),
+            Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
+              ~pluginId,
+              ~derived=?sel.derived,
+              curated,
+            ),
           )
           entries
         })

package/src/admin/Platform_BakedManifest.res.mjs

@@ -6,6 +6,13 @@ import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Plugin$ReventlessCore from "../plugin/component/Plugin.res.mjs";
 import * as Platform_ComponentDefinitionsApi$ReventlessCore from "./Platform_ComponentDefinitionsApi.res.mjs";
 
+let derivedKinds = [
+  "dashboard",
+  "lifecycles",
+  "canvas",
+  "scheduler"
+];
+
 function describe(e) {
   switch (e.TAG) {
     case "UnknownPlugin" :
@@ -14,6 +21,8 @@ function describe(e) {
       return `baked manifest: plugin "` + e.plugin + `" has no view named "` + e.view + `"`;
     case "UnknownCommand" :
       return `baked manifest: plugin "` + e.plugin + `" has no command named "` + e.command + `"`;
+    case "UnknownDerived" :
+      return `baked manifest: plugin "` + e.plugin + `" names derived page kind "` + e.kind + `" — known kinds: ` + derivedKinds.join(", ");
   }
 }
 
@@ -52,6 +61,17 @@ function validate(def, sel) {
         command: command
       }
     };
+  }
+  let kind = known(sel.derived, derivedKinds);
+  if (kind !== undefined) {
+    return {
+      TAG: "Error",
+      _0: {
+        TAG: "UnknownDerived",
+        plugin: sel.plugin,
+        kind: kind
+      }
+    };
   } else {
     return {
       TAG: "Ok",
@@ -189,13 +209,14 @@ function curate(structures, selections) {
     }
     let pluginId = match[0];
     return Stdlib_Result.map(curateStructure(pluginId, match[1], sel), curated => {
-      entries.push(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(pluginId, curated));
+      entries.push(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(pluginId, sel.derived, curated));
       return entries;
     });
   })), prim => prim);
 }
 
 export {
+  derivedKinds,
   describe,
   publicViews,
   writeSides,

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -207,8 +207,21 @@ let encodeExtensionDef = (e: extensionDef): JSON.t =>
     ("commandTypes", encodeStrings(e.commandTypes)),
   ])->JSON.Encode.object
 
-let encodePluginStructureEntry = (~pluginId: string, def: pluginStructure): JSON.t =>
-  Dict.fromArray([
+// `derived` is curation, not structure: it says which of the pages a shell
+// builds across this plugin's views that shell may build. It therefore arrives
+// as an argument rather than off `def` — nothing in a compiled plugin decides
+// it, and the admin path, which curates nothing, passes none.
+//
+// Absent key ⇒ every kind, which is what an uncurated entry means and what
+// every manifest written before the field says. A curated entry that wants none
+// says so with `[]`, and the two are only distinguishable because the key is
+// omitted rather than nulled.
+let encodePluginStructureEntry = (
+  ~pluginId: string,
+  ~derived: option<array<string>>=?,
+  def: pluginStructure,
+): JSON.t => {
+  let entry = Dict.fromArray([
     ("pluginId", JSON.Encode.string(Plugin.name(pluginId))),
     (
       "readModels",
@@ -247,4 +260,9 @@ let encodePluginStructureEntry = (~pluginId: string, def: pluginStructure): JSON
       ->JSON.Encode.array,
     ),
     ("extensions", def.extensions->Array.map(encodeExtensionDef)->JSON.Encode.array),
-  ])->JSON.Encode.object
+  ])
+  derived->Option.forEach(kinds =>
+    entry->Dict.set("derivedPages", kinds->Array.map(JSON.Encode.string)->JSON.Encode.array)
+  )
+  entry->JSON.Encode.object
+}

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -339,8 +339,8 @@ function encodeExtensionDef(e) {
   ]);
 }
 
-function encodePluginStructureEntry(pluginId, def) {
-  return Object.fromEntries([
+function encodePluginStructureEntry(pluginId, derived, def) {
+  let entry = Object.fromEntries([
     [
       "pluginId",
       Plugin$ReventlessCore.name(pluginId)
@@ -382,6 +382,10 @@ function encodePluginStructureEntry(pluginId, def) {
       def.extensions.map(encodeExtensionDef)
     ]
   ]);
+  Stdlib_Option.forEach(derived, kinds => {
+    entry["derivedPages"] = kinds.map(prim => prim);
+  });
+  return entry;
 }
 
 let sdlQueryField = `  Platform_ComponentDefinitions: [Platform_ComponentDefinitionEntry!]!`;

package/src/components/Dcb/Dcb_Builder.res

@@ -895,7 +895,7 @@ module Make = (
         //
         // Stage E2: a DCB StateChangeSlice has a single GraphQL field but its
         // command type may declare multiple constructors with different
-        // authorization rules. The @aws_auth directive operates at field
+        // authorization rules. The Cognito group directive operates at field
         // granularity, so we read the auth for the first constructor (matching
         // the existing dcbTags convention at line 549 above). When all
         // constructors share the file-level default, this is exact; when they

package/src/plugin/lifecycle/PluginSpec.res

@@ -17,7 +17,7 @@ type command =
   | @noApi Connect(pluginDefinition)
   | @noApi Disconnect(version)
   // Admin lifecycle commands — API-exposed (auto-derived admin mutations,
-  // Cognito @aws_auth gated). `version` selects which known version to act on.
+  // Cognito group-gated). `version` selects which known version to act on.
   | Activate(version)
   | Deactivate(version)
   // Records a protocol-version incompatibility without changing connection state.

package/tests/adapter/RefusalVocabularyTest.res

@@ -0,0 +1,93 @@
+open JestGlobals
+
+// The contract in Auth_RefusalVocabulary is a mapping between two adapters that
+// cannot answer alike. The AWS rows cannot be asserted from a checkout — they
+// need a deployed API — so what is asserted here is the *table*: that it names
+// both adapters, that entitlement stays distinguishable from identity in each,
+// and that `classify` resolves the collision the two AppSync values create.
+//
+// Observed bodies behind these rows: docs/plans/appsync-group-authorization-unenforced.md §8.
+
+open ReventlessCore.Auth_RefusalVocabulary
+
+describe("Auth_RefusalVocabulary — the table", () => {
+  testSync("names both adapters", () => {
+    expect(signalsFor(Local)->Array.length)->toBeGreaterThan(0)
+    expect(signalsFor(AppSync)->Array.length)->toBeGreaterThan(0)
+  })
+
+  testSync("each adapter can express both refusals", () => {
+    [Local, AppSync]->Array.forEach(adapter => {
+      let kinds = signalsFor(adapter)->Array.map(s => s.kind)
+      expect(kinds->Array.includes(Entitlement))->toBe(true)
+      expect(kinds->Array.includes(Identity))->toBe(true)
+    })
+  })
+
+  testSync("within an adapter the two refusals are actually distinguishable", () => {
+    // A mapping whose two rows look identical to a client would be worthless —
+    // it has to differ in the status, the place to look, or the value found.
+    [Local, AppSync]->Array.forEach(adapter => {
+      let signals = signalsFor(adapter)
+      let entitlement = signals->Array.find(s => s.kind == Entitlement)
+      let identity = signals->Array.find(s => s.kind == Identity)
+      switch (entitlement, identity) {
+      | (Some(e), Some(i)) =>
+        let differs =
+          e.httpStatus != i.httpStatus || e.discriminator != i.discriminator || e.value != i.value
+        expect(differs)->toBe(true)
+      | _ => JsError.throwWithMessage("adapter is missing one of the two refusals")
+      }
+    })
+  })
+})
+
+describe("Auth_RefusalVocabulary.classify", () => {
+  testSync("classifies every row of the table as that row's kind", () => {
+    signals->Array.forEach(s => {
+      let errorType = s.discriminator->String.includes("errorType") ? Some(s.value) : None
+      let extensionsCode = s.discriminator == "extensions.code" ? Some(s.value) : None
+      // The 401 row's discriminator is a response header; status alone carries it.
+      expect(classify(~httpStatus=s.httpStatus, ~errorType?, ~extensionsCode?))->toEqual(Some(s.kind))
+    })
+  })
+
+  // The trap the table exists to defuse: on AppSync the entitlement value is a
+  // strict prefix of the identity one. A client matching by substring collapses
+  // them, and collapses them the dangerous way — signing out a caller whose
+  // session was fine.
+  testSync("Unauthorized and UnauthorizedException are opposite answers", () => {
+    expect(classify(~httpStatus=200, ~errorType="Unauthorized"))->toEqual(Some(Entitlement))
+    expect(classify(~httpStatus=401, ~errorType="UnauthorizedException"))->toEqual(Some(Identity))
+  })
+
+  testSync("a 401 is identity even when a field error would say otherwise", () => {
+    // Status is checked first precisely so this cannot go the other way.
+    expect(classify(~httpStatus=401, ~errorType="Unauthorized"))->toEqual(Some(Identity))
+  })
+
+  testSync("the local codes map to the same two kinds as the AppSync shapes", () => {
+    expect(classify(~httpStatus=200, ~extensionsCode="FORBIDDEN"))->toEqual(Some(Entitlement))
+    expect(classify(~httpStatus=200, ~extensionsCode="UNAUTHORIZED"))->toEqual(Some(Identity))
+  })
+
+  testSync("an unrecognised response is None, which is not 'allowed'", () => {
+    expect(classify(~httpStatus=200))->toEqual(None)
+    expect(classify(~httpStatus=200, ~errorType="ValidationError"))->toEqual(None)
+    expect(classify(~httpStatus=500))->toEqual(None)
+  })
+})
+
+describe("Auth_RefusalVocabulary.warrantsReauthentication", () => {
+  testSync("only an identity refusal asks the caller for new credentials", () => {
+    expect(warrantsReauthentication(Identity))->toBe(true)
+    expect(warrantsReauthentication(Entitlement))->toBe(false)
+  })
+
+  testSync("no adapter's entitlement refusal ends a session", () => {
+    // The regression this whole contract exists to prevent, stated once.
+    signals
+    ->Array.filter(s => s.kind == Entitlement)
+    ->Array.forEach(s => expect(warrantsReauthentication(s.kind))->toBe(false))
+  })
+})

package/tests/adapter/RefusalVocabularyTest.res.mjs

@@ -0,0 +1,79 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Auth_RefusalVocabulary$ReventlessCore from "../../src/adapter/Auth/Auth_RefusalVocabulary.res.mjs";
+
+globalThis.describe("Auth_RefusalVocabulary — the table", () => {
+  globalThis.test("names both adapters", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.signalsFor("Local").length).toBeGreaterThan(0);
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.signalsFor("AppSync").length).toBeGreaterThan(0);
+  });
+  globalThis.test("each adapter can express both refusals", () => {
+    [
+      "Local",
+      "AppSync"
+    ].forEach(adapter => {
+      let kinds = Auth_RefusalVocabulary$ReventlessCore.signalsFor(adapter).map(s => s.kind);
+      globalThis.expect(kinds.includes("Entitlement")).toBe(true);
+      globalThis.expect(kinds.includes("Identity")).toBe(true);
+    });
+  });
+  globalThis.test("within an adapter the two refusals are actually distinguishable", () => {
+    [
+      "Local",
+      "AppSync"
+    ].forEach(adapter => {
+      let signals = Auth_RefusalVocabulary$ReventlessCore.signalsFor(adapter);
+      let entitlement = signals.find(s => s.kind === "Entitlement");
+      let identity = signals.find(s => s.kind === "Identity");
+      if (entitlement === undefined) {
+        return Stdlib_JsError.throwWithMessage("adapter is missing one of the two refusals");
+      }
+      if (identity === undefined) {
+        return Stdlib_JsError.throwWithMessage("adapter is missing one of the two refusals");
+      }
+      let differs = entitlement.httpStatus !== identity.httpStatus || entitlement.discriminator !== identity.discriminator || entitlement.value !== identity.value;
+      globalThis.expect(differs).toBe(true);
+    });
+  });
+});
+
+globalThis.describe("Auth_RefusalVocabulary.classify", () => {
+  globalThis.test("classifies every row of the table as that row's kind", () => {
+    Auth_RefusalVocabulary$ReventlessCore.signals.forEach(s => {
+      let errorType = s.discriminator.includes("errorType") ? s.value : undefined;
+      let extensionsCode = s.discriminator === "extensions.code" ? s.value : undefined;
+      globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(s.httpStatus, errorType, extensionsCode)).toEqual(s.kind);
+    });
+  });
+  globalThis.test("Unauthorized and UnauthorizedException are opposite answers", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(200, "Unauthorized", undefined)).toEqual("Entitlement");
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(401, "UnauthorizedException", undefined)).toEqual("Identity");
+  });
+  globalThis.test("a 401 is identity even when a field error would say otherwise", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(401, "Unauthorized", undefined)).toEqual("Identity");
+  });
+  globalThis.test("the local codes map to the same two kinds as the AppSync shapes", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(200, undefined, "FORBIDDEN")).toEqual("Entitlement");
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(200, undefined, "UNAUTHORIZED")).toEqual("Identity");
+  });
+  globalThis.test("an unrecognised response is None, which is not 'allowed'", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(200, undefined, undefined)).toEqual(undefined);
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(200, "ValidationError", undefined)).toEqual(undefined);
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.classify(500, undefined, undefined)).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Auth_RefusalVocabulary.warrantsReauthentication", () => {
+  globalThis.test("only an identity refusal asks the caller for new credentials", () => {
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.warrantsReauthentication("Identity")).toBe(true);
+    globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.warrantsReauthentication("Entitlement")).toBe(false);
+  });
+  globalThis.test("no adapter's entitlement refusal ends a session", () => {
+    Auth_RefusalVocabulary$ReventlessCore.signals.filter(s => s.kind === "Entitlement").forEach(s => {
+      globalThis.expect(Auth_RefusalVocabulary$ReventlessCore.warrantsReauthentication(s.kind)).toBe(false);
+    });
+  });
+});
+
+/*  Not a pure module */

package/tests/admin/Platform_BakedManifestTest.res

@@ -89,6 +89,15 @@ let structures = [("Ordering@1.0.0", structure)]
 let bake = selections =>
   Platform_BakedManifest.curate(~structures, ~selections)
 
+// Every case below varies one include-list and means "everything" by the rest,
+// which is exactly what an omitted labelled argument says.
+let sel = (~plugin, ~views=?, ~commands=?, ~derived=?): Platform_BakedManifest.selection => {
+  plugin,
+  views,
+  commands,
+  derived,
+}
+
 let entries = (json: JSON.t) => json->JSON.Decode.array->Option.getOr([])
 
 let names = (entry: JSON.t, field: string) =>
@@ -110,19 +119,17 @@ let firstEntry = (r: result<JSON.t, Platform_BakedManifest.error>) =>
 describe("curate", () => {
   testSync("selects exactly the named components", () => {
     let entry =
-      bake([{plugin: "Ordering", views: Some(["Orders"]), commands: Some(["PlaceOrder"])}])
-      ->firstEntry
+      bake([sel(~plugin="Ordering", ~views=["Orders"], ~commands=["PlaceOrder"])])->firstEntry
     expect((entry->names("stateViewSlices"), entry->names("readModels")))->toEqual((["Orders"], []))
   })
 
   testSync("drops a write side whose commands were all excluded", () => {
-    let entry =
-      bake([{plugin: "Ordering", views: Some([]), commands: Some(["PlaceOrder"])}])->firstEntry
+    let entry = bake([sel(~plugin="Ordering", ~views=[], ~commands=["PlaceOrder"])])->firstEntry
     expect(entry->names("stateChangeSlices"))->toEqual(["PlaceOrder"])
   })
 
   testSync("unset views and commands include every public component", () => {
-    let entry = bake([{plugin: "Ordering", views: None, commands: None}])->firstEntry
+    let entry = bake([sel(~plugin="Ordering")])->firstEntry
     expect((
       entry->names("readModels"),
       entry->names("stateViewSlices"),
@@ -134,34 +141,72 @@ describe("curate", () => {
   // from, so an Internal view a kept command points at has to survive the bake.
   testSync("carries an Internal view referenced by an included command", () => {
     let entry =
-      bake([{plugin: "Ordering", views: Some(["Orders"]), commands: Some(["PlaceOrder"])}])
+      bake([sel(~plugin="Ordering", ~views=["Orders"], ~commands=["PlaceOrder"])])
       ->firstEntry
     expect(entry->names("internalQueryables"))->toEqual(["AvailableProducts"])
   })
 
   testSync("omits an Internal view no included command references", () => {
     let entry =
-      bake([{plugin: "Ordering", views: Some(["Orders"]), commands: Some(["ImportOrders"])}])
+      bake([sel(~plugin="Ordering", ~views=["Orders"], ~commands=["ImportOrders"])])
       ->firstEntry
     expect(entry->names("internalQueryables"))->toEqual([])
   })
 
-  testSync("an Internal view is never selectable as a view", () =>
+  // The pages a shell builds across a plugin's views do not exist on this side,
+  // so what the bake can do about them is state which kinds an audience gets and
+  // carry that to the shell. Absent and empty therefore have to stay two
+  // different answers all the way out to the JSON, which is what these three
+  // cases pin: nothing said ⇒ no key ⇒ every kind, and `[]` ⇒ a key ⇒ none.
+  let derivedOf = (entry: JSON.t) =>
+    entry
+    ->JSON.Decode.object
+    ->Option.flatMap(d => d->Dict.get("derivedPages"))
+    ->Option.map(v => v->JSON.Decode.array->Option.getOr([])->Array.filterMap(JSON.Decode.string))
+
+  testSync("unset derived says nothing, leaving every kind to the shell", () =>
+    expect(bake([sel(~plugin="Ordering")])->firstEntry->derivedOf)->toEqual(None)
+  )
+
+  testSync("an empty derived list is carried, and is not the same as unset", () =>
+    expect(bake([sel(~plugin="Ordering", ~derived=[])])->firstEntry->derivedOf)->toEqual(Some([]))
+  )
+
+  testSync("carries exactly the derived kinds named", () =>
+    expect(
+      bake([sel(~plugin="Ordering", ~derived=["lifecycles", "canvas"])])->firstEntry->derivedOf,
+    )->toEqual(Some(["lifecycles", "canvas"]))
+  )
+
+  // Against the vocabulary, never against this plugin: a kind that generates no
+  // page for these schemas is a fact about the plugin, not a typo, and a shop
+  // that names `lifecycles` before its views carry a status is early, not wrong.
+  testSync("fails naming a derived kind outside the vocabulary", () =>
+    expect(bake([sel(~plugin="Ordering", ~derived=["dashboards"])]))->toEqual(
+      Error(Platform_BakedManifest.UnknownDerived({plugin: "Ordering", kind: "dashboards"})),
+    )
+  )
+
+  testSync("accepts a kind this plugin generates no page for", () =>
     expect(
-      bake([{plugin: "Ordering", views: Some(["AvailableProducts"]), commands: None}]),
-    )->toEqual(
+      bake([sel(~plugin="Ordering", ~derived=["scheduler"])])->firstEntry->derivedOf,
+    )->toEqual(Some(["scheduler"]))
+  )
+
+  testSync("an Internal view is never selectable as a view", () =>
+    expect(bake([sel(~plugin="Ordering", ~views=["AvailableProducts"])]))->toEqual(
       Error(Platform_BakedManifest.UnknownView({plugin: "Ordering", view: "AvailableProducts"})),
     )
   )
 
   testSync("fails naming an unknown plugin", () =>
-    expect(bake([{plugin: "Shipping", views: None, commands: None}]))->toEqual(
+    expect(bake([sel(~plugin="Shipping")]))->toEqual(
       Error(Platform_BakedManifest.UnknownPlugin("Shipping")),
     )
   )
 
   testSync("fails naming an unknown command", () =>
-    expect(bake([{plugin: "Ordering", views: None, commands: Some(["CancelOrder"])}]))->toEqual(
+    expect(bake([sel(~plugin="Ordering", ~commands=["CancelOrder"])]))->toEqual(
       Error(Platform_BakedManifest.UnknownCommand({plugin: "Ordering", command: "CancelOrder"})),
     )
   )
@@ -169,7 +214,7 @@ describe("curate", () => {
   // The anti-drift assertion: include everything and the baked entry IS the
   // served entry. Any future divergence in the encoder shows up here first.
   testSync("an all-inclusive bake is byte-identical to the served entry", () => {
-    let baked = bake([{plugin: "Ordering", views: None, commands: None}])->firstEntry
+    let baked = bake([sel(~plugin="Ordering")])->firstEntry
     let served = Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId="Ordering@1.0.0",
       structure,
@@ -182,8 +227,8 @@ describe("curate", () => {
       Platform_BakedManifest.curate(
         ~structures=[("Ordering@1.0.0", structure), ("Catalog@1.0.0", structure)],
         ~selections=[
-          {plugin: "Catalog", views: Some([]), commands: Some([])},
-          {plugin: "Ordering", views: Some([]), commands: Some([])},
+          sel(~plugin="Catalog", ~views=[], ~commands=[]),
+          sel(~plugin="Ordering", ~views=[], ~commands=[]),
         ],
       )
     let ids =
@@ -208,7 +253,7 @@ describe("curate", () => {
   // makes this hold — the assertion guards that property, not a second code path.
   testSync("a curated entry carries the owner field the served entry carries", () => {
     let entry =
-      bake([{plugin: "Ordering", views: Some(["Orders"]), commands: Some(["PlaceOrder"])}])
+      bake([sel(~plugin="Ordering", ~views=["Orders"], ~commands=["PlaceOrder"])])
       ->firstEntry
     let ownerOf = (key, name) =>
       entry

package/tests/admin/Platform_BakedManifestTest.res.mjs

@@ -109,6 +109,15 @@ function bake(selections) {
   return Platform_BakedManifest$ReventlessCore.curate(structures, selections);
 }
 
+function sel(plugin, views, commands, derived) {
+  return {
+    plugin: plugin,
+    views: views,
+    commands: commands,
+    derived: derived
+  };
+}
+
 function entries(json) {
   return Stdlib_Option.getOr(Stdlib_JSON.Decode.array(json), []);
 }
@@ -127,11 +136,7 @@ function firstEntry(r) {
 
 globalThis.describe("curate", () => {
   globalThis.test("selects exactly the named components", () => {
-    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: ["Orders"],
-        commands: ["PlaceOrder"]
-      }]));
+    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", ["Orders"], ["PlaceOrder"], undefined)]));
     globalThis.expect([
       names(entry, "stateViewSlices"),
       names(entry, "readModels")
@@ -141,18 +146,15 @@ globalThis.describe("curate", () => {
     ]);
   });
   globalThis.test("drops a write side whose commands were all excluded", () => {
-    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: [],
-        commands: ["PlaceOrder"]
-      }]));
+    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", [], ["PlaceOrder"], undefined)]));
     globalThis.expect(names(entry, "stateChangeSlices")).toEqual(["PlaceOrder"]);
   });
   globalThis.test("unset views and commands include every public component", () => {
     let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
         plugin: "Ordering",
         views: undefined,
-        commands: undefined
+        commands: undefined,
+        derived: undefined
       }]));
     globalThis.expect([
       names(entry, "readModels"),
@@ -168,27 +170,49 @@ globalThis.describe("curate", () => {
     ]);
   });
   globalThis.test("carries an Internal view referenced by an included command", () => {
-    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: ["Orders"],
-        commands: ["PlaceOrder"]
-      }]));
+    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", ["Orders"], ["PlaceOrder"], undefined)]));
     globalThis.expect(names(entry, "internalQueryables")).toEqual(["AvailableProducts"]);
   });
   globalThis.test("omits an Internal view no included command references", () => {
-    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: ["Orders"],
-        commands: ["ImportOrders"]
-      }]));
+    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", ["Orders"], ["ImportOrders"], undefined)]));
     globalThis.expect(names(entry, "internalQueryables")).toEqual([]);
   });
-  globalThis.test("an Internal view is never selectable as a view", () => {
-    globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [{
+  let derivedOf = entry => Stdlib_Option.map(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(entry), d => d["derivedPages"]), v => Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(v), []), Stdlib_JSON.Decode.string));
+  globalThis.test("unset derived says nothing, leaving every kind to the shell", () => {
+    globalThis.expect(derivedOf(firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
         plugin: "Ordering",
-        views: ["AvailableProducts"],
-        commands: undefined
-      }])).toEqual({
+        views: undefined,
+        commands: undefined,
+        derived: undefined
+      }])))).toEqual(undefined);
+  });
+  globalThis.test("an empty derived list is carried, and is not the same as unset", () => {
+    globalThis.expect(derivedOf(firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", undefined, undefined, [])])))).toEqual([]);
+  });
+  globalThis.test("carries exactly the derived kinds named", () => {
+    globalThis.expect(derivedOf(firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", undefined, undefined, [
+        "lifecycles",
+        "canvas"
+      ])])))).toEqual([
+      "lifecycles",
+      "canvas"
+    ]);
+  });
+  globalThis.test("fails naming a derived kind outside the vocabulary", () => {
+    globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", undefined, undefined, ["dashboards"])])).toEqual({
+      TAG: "Error",
+      _0: {
+        TAG: "UnknownDerived",
+        plugin: "Ordering",
+        kind: "dashboards"
+      }
+    });
+  });
+  globalThis.test("accepts a kind this plugin generates no page for", () => {
+    globalThis.expect(derivedOf(firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", undefined, undefined, ["scheduler"])])))).toEqual(["scheduler"]);
+  });
+  globalThis.test("an Internal view is never selectable as a view", () => {
+    globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", ["AvailableProducts"], undefined, undefined)])).toEqual({
       TAG: "Error",
       _0: {
         TAG: "UnknownView",
@@ -201,7 +225,8 @@ globalThis.describe("curate", () => {
     globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [{
         plugin: "Shipping",
         views: undefined,
-        commands: undefined
+        commands: undefined,
+        derived: undefined
       }])).toEqual({
       TAG: "Error",
       _0: {
@@ -211,11 +236,7 @@ globalThis.describe("curate", () => {
     });
   });
   globalThis.test("fails naming an unknown command", () => {
-    globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: undefined,
-        commands: ["CancelOrder"]
-      }])).toEqual({
+    globalThis.expect(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", undefined, ["CancelOrder"], undefined)])).toEqual({
       TAG: "Error",
       _0: {
         TAG: "UnknownCommand",
@@ -228,9 +249,10 @@ globalThis.describe("curate", () => {
     let baked = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
         plugin: "Ordering",
         views: undefined,
-        commands: undefined
+        commands: undefined,
+        derived: undefined
       }]));
-    let served = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering@1.0.0", structure);
+    let served = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering@1.0.0", undefined, structure);
     globalThis.expect(JSON.stringify(baked)).toEqual(JSON.stringify(served));
   });
   globalThis.test("one entry per selection, in declaration order", () => {
@@ -244,16 +266,8 @@ globalThis.describe("curate", () => {
         structure
       ]
     ], [
-      {
-        plugin: "Catalog",
-        views: [],
-        commands: []
-      },
-      {
-        plugin: "Ordering",
-        views: [],
-        commands: []
-      }
+      sel("Catalog", [], [], undefined),
+      sel("Ordering", [], [], undefined)
     ]);
     let ids;
     ids = json.TAG === "Ok" ? Stdlib_Array.filterMap(entries(json._0), e => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(e), d => d["pluginId"]), Stdlib_JSON.Decode.string)) : [];
@@ -263,11 +277,7 @@ globalThis.describe("curate", () => {
     ]);
   });
   globalThis.test("a curated entry carries the owner field the served entry carries", () => {
-    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [{
-        plugin: "Ordering",
-        views: ["Orders"],
-        commands: ["PlaceOrder"]
-      }]));
+    let entry = firstEntry(Platform_BakedManifest$ReventlessCore.curate(structures, [sel("Ordering", ["Orders"], ["PlaceOrder"], undefined)]));
     let ownerOf = (key, name) => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(entry), d => d[key]), Stdlib_JSON.Decode.array), []), Stdlib_JSON.Decode.object).find(d => Primitive_object.equal(Stdlib_Option.flatMap(d["name"], Stdlib_JSON.Decode.string), name)), d => d["ownerField"]), Stdlib_JSON.Decode.string);
     let commandOwner = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Array.filterMap(Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(entry), d => d["stateChangeSlices"]), Stdlib_JSON.Decode.array), []), Stdlib_JSON.Decode.object).flatMap(w => Stdlib_Option.getOr(Stdlib_Option.flatMap(w["commands"], Stdlib_JSON.Decode.array), [])), Stdlib_JSON.Decode.object)[0], d => d["ownerField"]), Stdlib_JSON.Decode.string);
     globalThis.expect([
@@ -287,6 +297,7 @@ export {
   structure,
   structures,
   bake,
+  sel,
   entries,
   names,
   firstEntry,

package/tests/admin/Platform_ComponentDefinitionsApiTest.res.mjs

@@ -147,7 +147,7 @@ let structure = {
   requiredStoreDeclarations: undefined
 };
 
-let encoded = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", structure);
+let encoded = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", undefined, structure);
 
 let json = JSON.stringify(encoded);
 
@@ -255,7 +255,7 @@ globalThis.describe("translation-slice externalSystem round-trip", () => {
     requiredStores: undefined,
     requiredStoreDeclarations: undefined
   };
-  let externalJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", externalStructure));
+  let externalJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", undefined, externalStructure));
   globalThis.test("surfaces Some outbound externalSystem as its inner string", () => {
     globalThis.expect(externalJson.includes("\"externalSystem\":\"ShipperGateway\"")).toEqual(true);
   });
@@ -341,7 +341,7 @@ globalThis.describe("visibility filtering (deployed AutoUI hides Internal)", ()
     requiredStores: undefined,
     requiredStoreDeclarations: undefined
   };
-  let mixedEntry = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering", mixed);
+  let mixedEntry = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering", undefined, mixed);
   let namesAt = (entry, key) => Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(entry), o => o[key]), Stdlib_JSON.Decode.array), []), c => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(c), o => o["name"]), Stdlib_JSON.Decode.string));
   globalThis.test("excludes an Internal queryableDef from the encoded read-side", () => {
     globalThis.expect(namesAt(mixedEntry, "readModels")).toEqual(["Products"]);
@@ -357,7 +357,7 @@ globalThis.describe("visibility filtering (deployed AutoUI hides Internal)", ()
     ]);
   });
   globalThis.test("encodes internalQueryables as [] for an all-Public entry, not a missing key", () => {
-    let entry = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering", {
+    let entry = Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Ordering", undefined, {
       readModels: [qbl],
       stateViewSlices: [],
       stateChangeSlices: structure_stateChangeSlices,
@@ -459,7 +459,7 @@ globalThis.describe("allowedStates + statusField populated", () => {
     requiredStores: undefined,
     requiredStoreDeclarations: undefined
   };
-  let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Platform", structureWithStates));
+  let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Platform", undefined, structureWithStates));
   globalThis.test("encodes populated allowedStates as a JSON array", () => {
     globalThis.expect(json.includes("\"allowedStates\":[\"Inactive\"]")).toEqual(true);
   });
@@ -481,7 +481,7 @@ globalThis.describe("singleQueryField reaches the caller", () => {
     globalThis.expect(json.includes("\"singleQueryField\":\"Catalog_Product\"")).toEqual(true);
   });
   globalThis.test("encodes an unstated singular as null", () => {
-    let unstated = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", {
+    let unstated = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", undefined, {
       readModels: [{
           name: "Products",
           queryField: "Catalog_Products",
@@ -526,7 +526,7 @@ globalThis.describe("idField / idFieldSource reach the caller", () => {
     globalThis.expect(json.includes("\"idFieldSource\":\"convention\"")).toEqual(true);
   });
   globalThis.test("encodes an unresolved key as null on both fields", () => {
-    let unresolved = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", {
+    let unresolved = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("Catalog", undefined, {
       readModels: [{
           name: "Products",
           queryField: "Catalog_Products",

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -120,7 +120,7 @@ globalThis.describe("requiredAccess derived from the authorization rule", () =>
     globalThis.expect(viewNamed("Orders")).toEqual(undefined);
   });
   globalThis.test("nothing to require encodes as null, not an empty list", () => {
-    let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("AccessPlugin", structure));
+    let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("AccessPlugin", undefined, structure));
     globalThis.expect([
       json.includes(`"requiredAccess":null`),
       json.includes(`"requiredAccess":["Admin","Ops"]`),