@reventlessdev/reventless-core 3.0.0-alpha.237 → 3.0.0-alpha.238

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.238 (2026-08-16)
+
+### Bug Fixes
+
+* **core:** stamp the owner from each DCB slice's own command schema ([6edbdf4](https://github.com/ReventlessDev/reventless-core/commit/6edbdf4680f2535597c3b560215aa514ceed27eb))
+### Features
+
+* **core:** check a declared lifecycle edge against the states that exist ([d427d92](https://github.com/ReventlessDev/reventless-core/commit/d427d92f8912b4dc9a9407c3c0cec3200d41a5f1))
+* **core:** report a lifecycle state no command can reach ([eb24dbd](https://github.com/ReventlessDev/reventless-core/commit/eb24dbd90df07185f0f4785c4bb726f5b617e7b2))
+* **ppx:** declare a command's lifecycle edge once, as [@transition](https://github.com/transition) ([dd35130](https://github.com/ReventlessDev/reventless-core/commit/dd3513014f14b71879ee21263c6755d3c3d95096))
+
+
 # 3.0.0-alpha.237 (2026-08-16)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.237",
+  "version": "3.0.0-alpha.238",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,21 +29,21 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.7",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.7",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.7",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.143",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.115"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.116",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.144"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-alpha.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.67"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.68"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/Message.res

@@ -69,7 +69,7 @@ let toCommandSchema' = (idSchema, commandSchema) =>
 // before a nested `@schema` field existed still decodes instead of bricking the
 // aggregate's log replay. These two entry points thread the memoized envelope schema;
 // `Reventless.Message.decode` (the other central decoder) is tolerant at the source.
-// See docs/plans/platform-infrastructure-in-plugin-list.md (durable fix option 2).
+// See docs/plans/done/platform-infrastructure-in-plugin-list.md (durable fix option 2).
 let decodeEvent' = (json, idSchema, eventSchema) =>
   json->parseJsonTolerant(toEventSchema'(idSchema, eventSchema))
 let decodeCommand' = (json, idSchema, commandSchema) =>

package/src/adapter/Monitoring/Monitoring.res

@@ -10,7 +10,7 @@ concern; this only exposes the choke point through which the framework says
 "I just provisioned an execution unit" and leaves what to do about it to the
 listener.
 
-See `docs/plans/monitoring-hook-seam.md`.
+See `docs/plans/done/monitoring-hook-seam.md`.
 */
 
 /**

package/src/admin/UiFragmentRegistry/StateChangeSlice/UiFragmentRegistry.res

@@ -1,6 +1,6 @@
 // UiFragmentRegistry StateChangeSlice — the write side of the platform UI-fragment
 // registry, extracted off the Plugin aggregate (see
-// docs/plans/event-sourced-fragment-registries.md).
+// docs/plans/done/event-sourced-fragment-registries.md).
 //
 // Commands are driven by the plugin runtime's connect handshake and routed here by the
 // admin PluginExtensionPoint's UI-fragment mapping (RegisterUiFragment on ConnectPlugin,

package/src/components/Aggregate/Aggregate_Callback.res

@@ -114,7 +114,7 @@ module Make = (
   // at append time → the conflict branch invalidates the entry and the retry
   // replays cold. Mirrors the StateChangeSlice decision-model cache, including
   // the fixed capacity (a per-aggregate knob is a future refinement — see
-  // docs/plans/aggregate-snapshotting.md).
+  // docs/plans/done/aggregate-snapshotting.md).
   let replayCacheCapacity = 100
   let replayCache: Lru.t<string, (Behavior.state, int)> = Lru.make(
     ~capacity=replayCacheCapacity,
@@ -122,7 +122,7 @@ module Make = (
 
   let resetCache = () => replayCache->Lru.clear
 
-  // Persisted-snapshot configuration (docs/plans/aggregate-snapshotting.md).
+  // Persisted-snapshot configuration (docs/plans/done/aggregate-snapshotting.md).
   // `None` (the default) keeps full replay; `Some({interval, stateSchema})`
   // seeds cold replays from the latest persisted snapshot and writes a fresh
   // one every `interval` events. Snapshots are a read optimization only — the

package/src/components/Api/ApiAllowedStatesHelpers.res

@@ -1,5 +1,5 @@
 // Read per-variant `allowedStates` metadata that the reventless-ppx
-// `@allowedStates([…])` attribute attaches to a command schema. Consumed by
+// an `@transition` from-set attaches to a command schema. Consumed by
 // `Plugin_Structure.toCommandDef` when building the `commandDef` records that
 // land in `Platform_ComponentDefinitions` so AutoUI can filter the per-row command
 // menu by the row's status.
@@ -7,8 +7,7 @@
 open ReventlessInfra.Api
 
 /** Returns the allowed-state list for a given command-variant name, or None
-    when the variant has no `@allowedStates` annotation (back-compat default
-    — the command shows on every row). */
+    when the variant declares no `@transition` (the command shows on every row). */
 let getAllowedStates = (
   commandSchema: S.t<unknown>,
   ~variantName: string,

package/src/components/Api/ApiTargetStateHelpers.res

@@ -1,5 +1,5 @@
 // Read per-variant `targetState` metadata that the reventless-ppx
-// `@targetState("…")` attribute attaches to a command schema. Consumed by
+// an `@transition` target attaches to a command schema. Consumed by
 // `Plugin_Structure.toCommandDef` when building the `commandDef` records that
 // land in `Platform_ComponentDefinitions`, so AutoUI's board drag resolver can
 // move a row by a *declared* transition instead of a name-stem guess. Mirrors
@@ -8,8 +8,9 @@
 open ReventlessInfra.Api
 
 /** Returns the declared target state for a given command-variant name, or None
-    when the variant has no `@targetState` annotation (back-compat default —
-    the resolver falls back to its name-stem heuristic). */
+    when the variant declares no target — either because it carries no
+    `@transition` at all, or because it declares a from-set only, which is a
+    command saying it does not move the row. */
 let getTargetState = (
   commandSchema: S.t<unknown>,
   ~variantName: string,

package/src/components/Dcb/Dcb_Builder.res

@@ -312,7 +312,7 @@ module Make = (
         // sweeps up sibling products. Cross-partition fan-out and capacity reads are
         // preserved (generalised rule 3). Safety guard: if any slice's partition is
         // ambiguous we keep the annotated values for the whole boundary rather than
-        // thread a partial inference. See docs/plans/dcb-tag-scope-inference.md.
+        // thread a partial inference. See docs/plans/done/dcb-tag-scope-inference.md.
         let inferenceShapes =
           stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) =>
             Reventless.DcbTag.sliceShapeFromSchemas(
@@ -761,28 +761,80 @@ module Make = (
         // + AppSync direct invocations (CommandGenerator.payload format)
         let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic)
 
-        // Shared generateCommand for AppSync direct invocations — all sync StateChangeSlices
-        // share the same DCB CommandTopic's publishJsons, so a single function suffices.
-        // commandSchema validation is skipped (permissive JSON.t schema) because AppSync
-        // already validates input against the SDL.
+        // generateCommand for AppSync direct invocations, one per command constructor.
+        //
+        // Every one of them shares this CommandTopic's publishJsons — the reason a
+        // single function used to suffice — and they differ in exactly one argument:
+        // the schema. That argument is not only a validator. `makeGenerateCommand`
+        // also reads it to find the fields a command marks as its owner, and stamps
+        // them with the caller. Handing it the permissive `S.json` (as this did, on
+        // the still-true grounds that AppSync has already validated against the SDL)
+        // makes that lookup answer "no owner fields" for every command there is — so
+        // the write publishes whatever owner the CLIENT sent, silently, and the row
+        // is wrong from then on.
+        //
+        // Per-slice decoding still happens inside `buildSliceHandler`; nothing here
+        // re-validates. The schema travels for what it says about ownership.
+        let dcbCommandSchemasByTag = {
+          let byTag = Dict.make()
+          stateChangeSlices->Array.forEach((module(S: StateChangeSlice.T)) => {
+            let commandSchema = S.Spec.commandSchema->Reventless.DcbTag.toUnknownSchema
+            if !(ApiNoApiHelpers.isNoApi(commandSchema)) {
+              Api_Naming.sliceMutationFields(
+                ~plugin=apiNamePrefix,
+                ~slice=S.Spec.name,
+                ~commandSchema,
+              )->Array.forEach(((_, tag)) => {
+                // The resolver injects the TAG alone, so two slices claiming one
+                // constructor name would make the stamp ambiguous — and the wrong
+                // arm of that ambiguity writes a row owned by nobody's decision.
+                // Multi-command slices cannot reach here (their mutation fields
+                // collide first), which leaves single-command slices, where the
+                // field names differ and nothing else would notice.
+                switch byTag->Dict.get(tag) {
+                | Some(_) =>
+                  log.error(
+                    ~comp="Dcb_Builder",
+                    `Two DCB slices in "${name}" both declare the command "${tag}". ` ++
+                    "Owner stamping resolves a command by that name alone, so it cannot " ++
+                    "tell them apart. Rename one of the constructors.",
+                  )
+                | None => byTag->Dict.set(tag, commandSchema)
+                }
+              })
+            }
+          })
+          byTag
+        }
+
         let dcbGenerateCommandOutput =
           dcbCommandTopic
           ->Component.operations
-          ->Pulumi.Output.apply(ops =>
-            CommandGenerator_Callback.makeGenerateCommand(
-              ~publishJsons=ops.publishJsons,
-              ~publishJsonsAndWait=?ops.publishJsonsAndWait,
-              ~serviceName=name,
-              ~commandSchema=S.json->S.castToUnknown,
-              ~componentKind=CommandGenerator_Callback.StateChangeSlice,
-              ~stripIdFromParams=false,
-            )
-          )
+          ->Pulumi.Output.apply(ops => {
+            let make = commandSchema =>
+              CommandGenerator_Callback.makeGenerateCommand(
+                ~publishJsons=ops.publishJsons,
+                ~publishJsonsAndWait=?ops.publishJsonsAndWait,
+                ~serviceName=name,
+                ~commandSchema,
+                ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+                ~stripIdFromParams=false,
+              )
+            let byTag = Dict.make()
+            dcbCommandSchemasByTag
+            ->Dict.toArray
+            ->Array.forEach(((tag, schema)) => byTag->Dict.set(tag, make(schema)))
+            // A command no slice claims keeps the permissive generator — what every
+            // command got before this change — so nothing that reaches this handler
+            // by another route starts failing. It also cannot stamp, which is why
+            // the unknown case is logged rather than left to look like a success.
+            (byTag, make(S.json->S.castToUnknown))
+          })
 
         let dcbHandler =
           (dcbHandlerBase, inboundReceiversOutput, dcbGenerateCommandOutput)
           ->Pulumi.Output.all3
-          ->Pulumi.Output.apply(((baseHandler, receivers, generateCommand)) => {
+          ->Pulumi.Output.apply(((baseHandler, receivers, (generatorsByTag, generateFallback))) => {
             let composite = (event, ctx) => {
               let raw: dict<JSON.t> = event->Obj.magic
               switch raw->Dict.get("__inboundTranslation") {
@@ -810,6 +862,17 @@ module Make = (
                 switch (raw->Dict.get("command"), raw->Dict.get("arguments")) {
                 | (Some(JSON.String(_)), Some(_)) =>
                   let payload: CommandGenerator.payload = event->Obj.magic
+                  let generateCommand = switch generatorsByTag->Dict.get(payload.command) {
+                  | Some(g) => g
+                  | None =>
+                    log.warn(
+                      ~comp="Dcb_Builder",
+                      `No DCB slice in "${name}" declares the command "${payload.command}", ` ++
+                      "so it is dispatched without an owner stamp. Any field the command " ++
+                      "marks as its owner keeps the value the caller sent.",
+                    )
+                    generateFallback
+                  }
                   (generateCommand(payload)->Effect.map(msgId => msgId->Obj.magic))->Obj.magic
                 | _ => baseHandler(event, ctx)
                 }

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -422,13 +422,42 @@ function Make(DcbEventLogStorage) {
         ]);
       })).apply(pairs => Object.fromEntries(pairs));
       let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic);
-      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, S.json, "StateChangeSlice", false));
+      let byTag = {};
+      stateChangeSlices.forEach(S => {
+        let commandSchema = S.Spec.commandSchema;
+        if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
+          Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).forEach(param => {
+            let tag = param[1];
+            let match = byTag[tag];
+            if (match !== undefined) {
+              return log.error("Dcb_Builder", undefined, `Two DCB slices in "` + name + `" both declare the command "` + tag + `". ` + "Owner stamping resolves a command by that name alone, so it cannot tell them apart. Rename one of the constructors.");
+            } else {
+              byTag[tag] = commandSchema;
+              return;
+            }
+          });
+          return;
+        }
+      });
+      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => {
+        let make = commandSchema => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, commandSchema, "StateChangeSlice", false);
+        let byTag$1 = {};
+        Object.entries(byTag).forEach(param => {
+          byTag$1[param[0]] = make(param[1]);
+        });
+        return [
+          byTag$1,
+          make(S.json)
+        ];
+      });
       let dcbHandler = Pulumi.all([
         dcbHandlerBase,
         inboundReceiversOutput,
         dcbGenerateCommandOutput
       ]).apply(param => {
-        let generateCommand = param[2];
+        let match = param[2];
+        let generateFallback = match[1];
+        let generatorsByTag = match[0];
         let receivers = param[1];
         let baseHandler = param[0];
         return (event, ctx) => {
@@ -448,11 +477,18 @@ function Make(DcbEventLogStorage) {
           }
           let match$1 = event["command"];
           let match$2 = event["arguments"];
-          if (typeof match$1 === "string" && match$2 !== undefined) {
-            return Effect.map(generateCommand(event), msgId => msgId);
-          } else {
+          if (match$1 === undefined) {
+            return baseHandler(event, ctx);
+          }
+          if (typeof match$1 !== "string") {
+            return baseHandler(event, ctx);
+          }
+          if (match$2 === undefined) {
             return baseHandler(event, ctx);
           }
+          let g = generatorsByTag[event.command];
+          let generateCommand = g !== undefined ? g : (log.warn("Dcb_Builder", undefined, `No DCB slice in "` + name + `" declares the command "` + event.command + `", ` + "so it is dispatched without an owner stamp. Any field the command marks as its owner keeps the value the caller sent."), generateFallback);
+          return Effect.map(generateCommand(event), msgId => msgId);
         };
       });
       let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));

package/src/components/EventLog/EventLog.res

@@ -25,7 +25,7 @@ type appendError =
 // staleness — consumers ignore a snapshot whose hash differs from their current
 // state schema and fall back to full replay. Snapshots are a read optimization
 // only; the OCC append remains the sole consistency primitive
-// (docs/plans/aggregate-snapshotting.md).
+// (docs/plans/done/aggregate-snapshotting.md).
 type snapshot = {seqNr: int, state: JSON.t, schemaHash: string}
 
 type append<'id, 'event> = (int, 'id, array<'event>) => promise<result<unit, appendError>>