@reventlessdev/reventless-core 3.0.0-alpha.253 → 3.0.0-alpha.255

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.255 (2026-09-04)
+
+### Features
+
+* **api:** a view says when a second *Id field took its key away ([10b5a4e](https://github.com/ReventlessDev/reventless-core/commit/10b5a4e41b01cfd27146f7f596573af27e4937d9))
+* **plugin:** a slice publishes which topics it subscribes to ([c689695](https://github.com/ReventlessDev/reventless-core/commit/c6896957ecb636204678222ac5a26b30870439cb))
+* **spec,traits:** an image carries the text that goes with it, and a set's first member is its primary ([e4e5845](https://github.com/ReventlessDev/reventless-core/commit/e4e58458aee7b3db5564727d358a3a9767362ca4))
+* **spec:** a field can say it selects one of the values its row already holds ([2ae50c3](https://github.com/ReventlessDev/reventless-core/commit/2ae50c34deee48508a9f1f39e3eef6a5d2f5df00))
+* **spec:** a field can say its value must not be rendered into a message ([3183f53](https://github.com/ReventlessDev/reventless-core/commit/3183f53a0ae667f794bbd1a3d77acf362dfa8e57))
+
+
+# 3.0.0-alpha.254 (2026-09-02)
+
+* feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))
+### Features
+
+* **dcb:** a boundary that cannot derive its scope says so ([db79969](https://github.com/ReventlessDev/reventless-core/commit/db79969df36bd90607425f6a22b4624227cfc4a0))
+
+### BREAKING CHANGES
+
+* `Capability_Messaging_Ses.make` is replaced by
+`Capability_Messaging.make(~name)`, which reads the transport and the address
+from config; the SES module keeps only `emailSender`. A deployment that named its
+sender in code must move it to `platform:messagingEmailSender` or the deploy is
+refused.
+
+
+
 # 3.0.0-alpha.253 (2026-09-01)
 
 **Note:** Version bump only for package @reventlessdev/reventless-core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.253",
+  "version": "3.0.0-alpha.255",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,22 +28,22 @@
   "dependencies": {
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.156",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.154",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.34",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.126",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.128",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.34"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-rc.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.76"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.77"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/adapter/Messaging/Messaging_Log_Backend.res

@@ -0,0 +1,98 @@
+// A logging messaging transport: accepts every message, delivers none, prints
+// each one to the log.
+//
+// Provider-neutral and therefore here rather than beside either platform's own
+// transport: both use it, and two copies would drift into two different ideas of
+// what a logged send looks like. It is the counterpart to
+// `Messaging_Ses_Backend` and deliberately the same shape — `channels` derived
+// from the sender, `send` answering the shared `Messaging` vocabulary, `provider`
+// closing over the sender. A slice reaches it through the injected capability
+// record and cannot tell which one it got, which is the property that makes
+// running a shop against it worth anything.
+//
+// **Accepting is the honest answer here, not a shortcut.** The alternative is
+// `Capabilities.none`, which reports `Unavailable` — a *retryable* outage, so
+// every notification is retried three times and then recorded as failed. A
+// delivery view that is all failures teaches the wrong thing about a competency
+// that works. Nothing leaves the process either way; the difference is only
+// whether the outcome tells the truth about the domain.
+//
+// It refuses nothing a real provider would refuse, and that is the tradeoff to
+// know: SES rejects a message with no subject, this does not, so a bug of that
+// shape is caught on the real transport and not here.
+//
+// Runtime-pure: no Pulumi import, so it can be bundled into a Lambda entry point
+// without dragging deploy-time modules into the cold-start graph.
+
+let log = Logger.fromEnv()
+
+/** Logged messages are numbered rather than given a random id: someone reading two
+    log lines wants to know they are two messages, and a counter says so at a
+    glance where a uuid does not. Per process, like the transport itself. */
+let sent = ref(0)
+
+/**
+The channels this transport can attempt.
+
+Derived from the sender exactly as SES derives it, so a platform that chose this
+transport but named no address publishes the same empty list an unprovisioned
+deployment does. SMS and push are absent for the same reason they are absent
+there — no transport — and answer `UnsupportedChannel`, which is settled rather
+than retried.
+*/
+let channels = (~sender: string): array<Reventless.Messaging.channel> =>
+  sender == "" ? [] : [Email]
+
+/** The message as it would have gone out, headers and all.
+
+    The whole point of the transport: someone checking that a notification says the
+    right thing needs the words, not a line saying words were sent. Rendered as
+    one record rather than a line per header so two concurrent sends cannot
+    interleave into one unreadable message. */
+let render = (
+  ~ref_: string,
+  ~sender: string,
+  ~to_: string,
+  ~message: Reventless.Messaging.message,
+) =>
+  [
+    `${ref_} — logged, not sent`,
+    `  From:    ${sender}`,
+    `  To:      ${to_}`,
+    `  Subject: ${message.subject->Option.getOr("(none)")}`,
+    "",
+    message.body,
+  ]->Array.join("\n")
+
+/** Accept the message, print it, deliver nothing. */
+let send = async (
+  ~sender: string,
+  ~recipient: Reventless.Messaging.recipient,
+  ~message: Reventless.Messaging.message,
+): result<Reventless.Messaging.receipt, Reventless.Messaging.failure> =>
+  switch recipient {
+  | ToSms(_) => Error(UnsupportedChannel(Sms))
+  | ToPush(_) => Error(UnsupportedChannel(Push))
+  | ToEmail(address) =>
+    if sender == "" {
+      // The wording an unprovisioned platform gave before this transport existed.
+      // It is what lands in the delivery view's `detail`, and a platform that
+      // provisions nothing should still read the way it always did.
+      Error(Unavailable("no messaging provider is configured for this platform"))
+    } else {
+      sent := sent.contents + 1
+      let ref_ = `log:${sent.contents->Int.toString}`
+      log.info(
+        ~comp="Messaging:Log",
+        render(~ref_, ~sender, ~to_=address->Reventless.Email.toString, ~message),
+      )
+      Ok({ref: ref_})
+    }
+  }
+
+/** The port, closed over the sender this platform was given. What a platform's
+    capability record carries when logging is the chosen transport. */
+let provider = (~sender: string): Reventless.Messaging.provider => {
+  channels: channels(~sender),
+  send: (~recipient, ~message) => send(~sender, ~recipient, ~message),
+}

package/src/adapter/Messaging/Messaging_Log_Backend.res.mjs

@@ -0,0 +1,86 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let sent = {
+  contents: 0
+};
+
+function channels(sender) {
+  if (sender === "") {
+    return [];
+  } else {
+    return ["Email"];
+  }
+}
+
+function render(ref_, sender, to_, message) {
+  return [
+    ref_ + ` — logged, not sent`,
+    `  From:    ` + sender,
+    `  To:      ` + to_,
+    `  Subject: ` + Stdlib_Option.getOr(message.subject, "(none)"),
+    "",
+    message.body
+  ].join("\n");
+}
+
+async function send(sender, recipient, message) {
+  switch (recipient.TAG) {
+    case "ToEmail" :
+      if (sender === "") {
+        return {
+          TAG: "Error",
+          _0: {
+            TAG: "Unavailable",
+            _0: "no messaging provider is configured for this platform"
+          }
+        };
+      }
+      sent.contents = sent.contents + 1 | 0;
+      let ref_ = `log:` + sent.contents.toString();
+      log.info("Messaging:Log", undefined, render(ref_, sender, recipient._0, message));
+      return {
+        TAG: "Ok",
+        _0: {
+          ref: ref_
+        }
+      };
+    case "ToSms" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Sms"
+        }
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "UnsupportedChannel",
+          _0: "Push"
+        }
+      };
+  }
+}
+
+function provider(sender) {
+  return {
+    channels: channels(sender),
+    send: (recipient, message) => send(sender, recipient, message)
+  };
+}
+
+export {
+  log,
+  sent,
+  channels,
+  render,
+  send,
+  provider,
+}
+/* log Not a pure module */

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -31,7 +31,7 @@ let sdlTypes: array<string> = [
   // `idField` to report.
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   // The subscriber's half of the port's translation table — see `handledEventDef`.
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
@@ -193,6 +193,10 @@ let encodeOutboundTranslationSliceDef = (o: outboundTranslationSliceDef): JSON.t
     // the external-system boundary box without workspace access. None → null.
     ("externalSystem", o.externalSystem->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("chapter", o.chapter->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    // Which topics this slice subscribes to, so a graph consumer can tell two
+    // topics carrying an event of the same name apart. `[]` means this plugin's
+    // own DCB log; null is a structure from before the field existed.
+    ("consumedSources", o.consumedSources->Option.mapOr(JSON.Encode.null, encodeStrings)),
   ])->JSON.Encode.object
 
 let encodeInboundTranslationSliceDef = (i: inboundTranslationSliceDef): JSON.t =>

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -12,7 +12,7 @@ let sdlTypes = [
   `type Platform_WriteSideDef {\n  name: String!\n  commands: [Platform_CommandDef!]!\n  linkedViews: [String!]!\n  consistencyRead: String\n  producedEventTypes: [String!]!\n  consumedEventTypes: [String!]!\n  events: [Platform_EventDef!]!\n  errors: [Platform_ErrorDef!]!\n  chapter: String\n}`,
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
   `type Platform_IssuedCommandDef {\n  name: String!\n  fromEventTypes: [String!]!\n}`,
@@ -303,6 +303,10 @@ function encodeOutboundTranslationSliceDef(o) {
     [
       "chapter",
       Stdlib_Option.mapOr(o.chapter, null, prim => prim)
+    ],
+    [
+      "consumedSources",
+      Stdlib_Option.mapOr(o.consumedSources, null, encodeStrings)
     ]
   ]);
 }

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -300,28 +300,34 @@ let rec scalarOfSchemaType = (st: SchemaType.schemaType): string =>
 let isKeyFieldName = (name: string): bool =>
   name->String.length > 2 && name->String.endsWith("Id")
 
+/** What the ladder below concluded. The two ways to have no key are opposite
+    mistakes, so they are kept apart rather than collapsed into `None`. */
+type keyFieldResolution =
+  | Resolved({field: string, rung: string})
+  | /** Several `*Id` fields and none matching the name — usually a field
+        somebody added to a view that used to have exactly one. */
+  Ambiguous({candidates: array<string>, conventional: string})
+  | NoCandidate
+
 /**
 The field that identifies a row, and which rung answered:
 
 - `"annotation"` — the state declares `@id`. Nothing outranks it.
 - `"convention"` — a field named `<singular entity name>Id` exists
-  (`Products` → `productId`). A guess, but one that can only fire on a field
-  that is actually there.
-- `"sole"` — the state has exactly one `*Id` field, so there is nothing else it
-  could be (`AvailableProducts` → `productId`).
-
-`None` is the honest answer for a state with several `*Id` fields and no name
-match (`ProductDemand`: `productId` + `categoryId`), or with none at all — those
-need `@id`. Convention outranks sole so a view carrying one foreign key and no
-key of its own is not keyed by the foreign key.
+  (`Products` → `productId`).
+- `"sole"` — the state has exactly one `*Id` field (`AvailableProducts`).
+
+Convention outranks sole so a view carrying one foreign key and no key of its own
+is not keyed by the foreign key. `resolveKeyField` is this, with both gaps
+flattened to `None`.
 */
-let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> => {
+let classifyKeyField = (~entityName: string, schema: S.t<unknown>): keyFieldResolution => {
   let declared = switch Reventless.StateAnnotations.getSpec(schema) {
   | Some({ids}) => ids->Array.get(0)
   | None => None
   }
   switch declared {
-  | Some(field) => Some((field, "annotation"))
+  | Some(field) => Resolved({field, rung: "annotation"})
   | None =>
     let candidates =
       SchemaType.fromSuryObject(~typeName="", schema)
@@ -333,15 +339,50 @@ let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(strin
       singular->String.slice(~start=0, ~end=1)->String.toLowerCase ++
       singular->String.slice(~start=1, ~end=singular->String.length) ++ "Id"
     if candidates->Array.includes(conventional) {
-      Some((conventional, "convention"))
+      Resolved({field: conventional, rung: "convention"})
     } else if candidates->Array.length == 1 {
-      Some((candidates->Array.getUnsafe(0), "sole"))
+      Resolved({field: candidates->Array.getUnsafe(0), rung: "sole"})
+    } else if Array.length(candidates) == 0 {
+      NoCandidate
     } else {
-      None
+      Ambiguous({candidates, conventional})
     }
   }
 }
 
+let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> =>
+  switch classifyKeyField(~entityName, schema) {
+  | Resolved({field, rung}) => Some((field, rung))
+  | Ambiguous(_) | NoCandidate => None
+  }
+
+/**
+What losing the key costs this view, said where the ladder is so a caller only
+has to report it.
+
+Invisible otherwise: the view keeps every field and every row, and loses its
+`<field>Eq` filter and its whole `orderBy` from the schema, so a client's
+narrowing silently becomes a page fetched and filtered on the client.
+
+`None` for `NoCandidate` as well as for a resolved key, and that is the whole
+judgement here. A read model over an aggregate keeps the row's id on the row key
+rather than in its state, so having no `*Id` field is its ordinary shape — warning
+about it would fire on most of them and get the rule silenced. `Ambiguous` is the
+accident: the view HAD a key and a second `*Id` field took it away.
+*/
+let keyFieldGapMessage = (resolution: keyFieldResolution): option<string> =>
+  switch resolution {
+  | Resolved(_) | NoCandidate => None
+  | Ambiguous({candidates, conventional}) =>
+    Some(
+      `has no row key: it declares no @id and its \`*Id\` fields ` ++
+      `(${candidates->Array.join(", ")}) include no "${conventional}" for the name to ` ++
+      `pick. Adding a second \`*Id\` field to a view that had one is what lands here, ` ++
+      `and it costs the view its filter and its whole orderBy in the schema. Declare ` ++
+      `@id on the field that identifies a row.`,
+    )
+  }
+
 // The component name the key-field convention is read against. `specName` is the
 // read model's own `Spec.name`; without it, `returnTypeName` minus its plugin
 // prefix is the same string (`Catalog_Product` → `Product`).

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -244,30 +244,59 @@ function isKeyFieldName(name) {
   }
 }
 
-function resolveKeyField(entityName, schema) {
+function classifyKeyField(entityName, schema) {
   let match = StateAnnotations$Reventless.getSpec(schema);
   let declared = match !== undefined ? match.ids[0] : undefined;
   if (declared !== undefined) {
-    return [
-      declared,
-      "annotation"
-    ];
+    return {
+      TAG: "Resolved",
+      field: declared,
+      rung: "annotation"
+    };
   }
   let candidates = Object.keys(Stdlib_Option.getOr(SchemaType$ReventlessCore.fromSuryObject("", schema), {})).filter(isKeyFieldName);
   let singular = Api_Naming$ReventlessCore.singularize(Api_Naming$ReventlessCore.stripViewSuffix(entityName));
   let conventional = singular.slice(0, 1).toLowerCase() + singular.slice(1, singular.length) + "Id";
   if (candidates.includes(conventional)) {
-    return [
-      conventional,
-      "convention"
-    ];
+    return {
+      TAG: "Resolved",
+      field: conventional,
+      rung: "convention"
+    };
   } else if (candidates.length === 1) {
+    return {
+      TAG: "Resolved",
+      field: candidates[0],
+      rung: "sole"
+    };
+  } else if (candidates.length === 0) {
+    return "NoCandidate";
+  } else {
+    return {
+      TAG: "Ambiguous",
+      candidates: candidates,
+      conventional: conventional
+    };
+  }
+}
+
+function resolveKeyField(entityName, schema) {
+  let match = classifyKeyField(entityName, schema);
+  if (typeof match !== "object" || match.TAG !== "Resolved") {
+    return;
+  } else {
     return [
-      candidates[0],
-      "sole"
+      match.field,
+      match.rung
     ];
-  } else {
+  }
+}
+
+function keyFieldGapMessage(resolution) {
+  if (typeof resolution !== "object" || resolution.TAG === "Resolved") {
     return;
+  } else {
+    return `has no row key: it declares no @id and its \`*Id\` fields ` + (`(` + resolution.candidates.join(", ") + `) include no "` + resolution.conventional + `" for the name to `) + `pick. Adding a second \`*Id\` field to a view that had one is what lands here, and it costs the view its filter and its whole orderBy in the schema. Declare @id on the field that identifies a row.`;
   }
 }
 
@@ -655,7 +684,9 @@ export {
   emptyCapability,
   scalarOfSchemaType,
   isKeyFieldName,
+  classifyKeyField,
   resolveKeyField,
+  keyFieldGapMessage,
   entityNameOf,
   deriveServerCapability,
   validateScanSortAlignment,

package/src/components/Api/SchemaType.res

@@ -60,6 +60,7 @@ let semanticCompositeNames = [
   (Reventless.Semantic.Id.money, "Money"),
   (Reventless.Semantic.Id.dateRange, "DateRange"),
   (Reventless.Semantic.Id.geoPoint, "GeoPoint"),
+  (Reventless.Semantic.Id.captionedImage, "CaptionedImage"),
 ]
 
 let canonicalName = (id: string): option<string> =>

package/src/components/Api/SchemaType.res.mjs

@@ -40,6 +40,10 @@ let semanticCompositeNames = [
   [
     Semantic$Reventless.Id.geoPoint,
     "GeoPoint"
+  ],
+  [
+    Semantic$Reventless.Id.captionedImage,
+    "CaptionedImage"
   ]
 ];
 

package/src/components/Api/SuryToJsonSchema.res

@@ -271,6 +271,24 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
         "x-reventless-semantic-target",
         jsonObject(withOptionalPlugin([("store", str(store))], plugin)),
       )
+    | MemberOf({plugin, view, field, content}) =>
+      // Same channel as the two above, and `view` and `content` are omitted on
+      // the same terms as `plugin`: absent means the collection is on the row
+      // this field is already part of, and that the member's kind is the
+      // reader's own to work out.
+      let optional = (pairs, key, value) =>
+        switch value {
+        | Some(v) => Array.concat(pairs, [(key, str(v))])
+        | None => pairs
+        }
+      obj->Dict.set(
+        "x-reventless-semantic-target",
+        jsonObject(
+          withOptionalPlugin([("field", str(field))], plugin)
+          ->optional("view", view)
+          ->optional("content", content),
+        ),
+      )
     }
     JSON.Encode.object(obj)
   }
@@ -291,10 +309,15 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
 // belongs to, leaving the field a plain string either way. Threading it here
 // also keeps it available on command variants, which carry no annotation spec
 // for `mergeAnnotations` to read.
+// `sensitive` rides here on the same reasoning as `owners`, and is read the same
+// way — off the sury schema by the caller. What it marks is a field whose value
+// must not be rendered into content somebody receives, which is a property of
+// the domain model rather than of the field's shape.
 and objectRefToJsonSchema = (
   ~annotations: option<Reventless.StateAnnotations.stateAnnotationSpec>=?,
   ~optional: array<string>=[],
   ~owners: array<string>=[],
+  ~sensitive: array<string>=[],
   fields: dict<SchemaType.schemaType>,
 ): JSON.t => {
   let props = Dict.make()
@@ -328,6 +351,23 @@ and objectRefToJsonSchema = (
     } else {
       withAnnotations
     }
+    // Last, so it can read the semantic both earlier paths may have written. A
+    // field whose semantic is a way of reaching a particular person is sensitive
+    // whether or not anybody marked it — the annotation is for the values a type
+    // cannot betray.
+    let withAnnotations = switch withAnnotations->JSON.Decode.object {
+    | Some(obj) =>
+      let bySemantic =
+        obj
+        ->Dict.get("x-reventless-semantic")
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.mapOr(false, Reventless.Sensitive.impliedBySemantic)
+      if sensitive->Array.includes(fieldName) || bySemantic {
+        obj->Dict.set("x-reventless-sensitive", JSON.Encode.bool(true))
+      }
+      JSON.Encode.object(obj)
+    | None => withAnnotations
+    }
     props->Dict.set(fieldName, withAnnotations)
     // Optional two ways, because neither source answers alone. `optional` is
     // read off the sury schema and is the only thing that can speak for a
@@ -362,6 +402,7 @@ let deriveObjectSchema = (schema: S.t<unknown>): JSON.t =>
       ~annotations?,
       ~optional=SchemaType.optionalFieldNames(schema),
       ~owners=Reventless.Owner.fieldNames(schema),
+      ~sensitive=Reventless.Sensitive.fieldNames(schema),
       fields,
     )
     // Surface component-level hints on the top-level object schema.