@reventlessdev/reventless-core 3.0.0-alpha.254 → 3.0.0-alpha.255

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.255 (2026-09-04)
+
+### Features
+
+* **api:** a view says when a second *Id field took its key away ([10b5a4e](https://github.com/ReventlessDev/reventless-core/commit/10b5a4e41b01cfd27146f7f596573af27e4937d9))
+* **plugin:** a slice publishes which topics it subscribes to ([c689695](https://github.com/ReventlessDev/reventless-core/commit/c6896957ecb636204678222ac5a26b30870439cb))
+* **spec,traits:** an image carries the text that goes with it, and a set's first member is its primary ([e4e5845](https://github.com/ReventlessDev/reventless-core/commit/e4e58458aee7b3db5564727d358a3a9767362ca4))
+* **spec:** a field can say it selects one of the values its row already holds ([2ae50c3](https://github.com/ReventlessDev/reventless-core/commit/2ae50c34deee48508a9f1f39e3eef6a5d2f5df00))
+* **spec:** a field can say its value must not be rendered into a message ([3183f53](https://github.com/ReventlessDev/reventless-core/commit/3183f53a0ae667f794bbd1a3d77acf362dfa8e57))
+
+
 # 3.0.0-alpha.254 (2026-09-02)
 
 * feat(aws)!: the messaging sender is configuration, and a stack can choose to only log ([23b8b4b](https://github.com/ReventlessDev/reventless-core/commit/23b8b4bfe9c70555de4d74266ca686cb427485ca))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.254",
+  "version": "3.0.0-alpha.255",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,21 +29,21 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.8",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.156",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.155",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.127",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.128",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.34"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-rc.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.76"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.77"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -31,7 +31,7 @@ let sdlTypes: array<string> = [
   // `idField` to report.
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   // The subscriber's half of the port's translation table — see `handledEventDef`.
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
@@ -193,6 +193,10 @@ let encodeOutboundTranslationSliceDef = (o: outboundTranslationSliceDef): JSON.t
     // the external-system boundary box without workspace access. None → null.
     ("externalSystem", o.externalSystem->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("chapter", o.chapter->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    // Which topics this slice subscribes to, so a graph consumer can tell two
+    // topics carrying an event of the same name apart. `[]` means this plugin's
+    // own DCB log; null is a structure from before the field existed.
+    ("consumedSources", o.consumedSources->Option.mapOr(JSON.Encode.null, encodeStrings)),
   ])->JSON.Encode.object
 
 let encodeInboundTranslationSliceDef = (i: inboundTranslationSliceDef): JSON.t =>

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -12,7 +12,7 @@ let sdlTypes = [
   `type Platform_WriteSideDef {\n  name: String!\n  commands: [Platform_CommandDef!]!\n  linkedViews: [String!]!\n  consistencyRead: String\n  producedEventTypes: [String!]!\n  consumedEventTypes: [String!]!\n  events: [Platform_EventDef!]!\n  errors: [Platform_ErrorDef!]!\n  chapter: String\n}`,
   `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n  namedWhenRetired: Boolean!\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
-  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
+  `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n  consumedSources: [String!]\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_HandledEventDef {\n  name: String!\n  toCommandTypes: [String!]!\n}`,
   `type Platform_IssuedCommandDef {\n  name: String!\n  fromEventTypes: [String!]!\n}`,
@@ -303,6 +303,10 @@ function encodeOutboundTranslationSliceDef(o) {
     [
       "chapter",
       Stdlib_Option.mapOr(o.chapter, null, prim => prim)
+    ],
+    [
+      "consumedSources",
+      Stdlib_Option.mapOr(o.consumedSources, null, encodeStrings)
     ]
   ]);
 }

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -300,28 +300,34 @@ let rec scalarOfSchemaType = (st: SchemaType.schemaType): string =>
 let isKeyFieldName = (name: string): bool =>
   name->String.length > 2 && name->String.endsWith("Id")
 
+/** What the ladder below concluded. The two ways to have no key are opposite
+    mistakes, so they are kept apart rather than collapsed into `None`. */
+type keyFieldResolution =
+  | Resolved({field: string, rung: string})
+  | /** Several `*Id` fields and none matching the name — usually a field
+        somebody added to a view that used to have exactly one. */
+  Ambiguous({candidates: array<string>, conventional: string})
+  | NoCandidate
+
 /**
 The field that identifies a row, and which rung answered:
 
 - `"annotation"` — the state declares `@id`. Nothing outranks it.
 - `"convention"` — a field named `<singular entity name>Id` exists
-  (`Products` → `productId`). A guess, but one that can only fire on a field
-  that is actually there.
-- `"sole"` — the state has exactly one `*Id` field, so there is nothing else it
-  could be (`AvailableProducts` → `productId`).
-
-`None` is the honest answer for a state with several `*Id` fields and no name
-match (`ProductDemand`: `productId` + `categoryId`), or with none at all — those
-need `@id`. Convention outranks sole so a view carrying one foreign key and no
-key of its own is not keyed by the foreign key.
+  (`Products` → `productId`).
+- `"sole"` — the state has exactly one `*Id` field (`AvailableProducts`).
+
+Convention outranks sole so a view carrying one foreign key and no key of its own
+is not keyed by the foreign key. `resolveKeyField` is this, with both gaps
+flattened to `None`.
 */
-let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> => {
+let classifyKeyField = (~entityName: string, schema: S.t<unknown>): keyFieldResolution => {
   let declared = switch Reventless.StateAnnotations.getSpec(schema) {
   | Some({ids}) => ids->Array.get(0)
   | None => None
   }
   switch declared {
-  | Some(field) => Some((field, "annotation"))
+  | Some(field) => Resolved({field, rung: "annotation"})
   | None =>
     let candidates =
       SchemaType.fromSuryObject(~typeName="", schema)
@@ -333,15 +339,50 @@ let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(strin
       singular->String.slice(~start=0, ~end=1)->String.toLowerCase ++
       singular->String.slice(~start=1, ~end=singular->String.length) ++ "Id"
     if candidates->Array.includes(conventional) {
-      Some((conventional, "convention"))
+      Resolved({field: conventional, rung: "convention"})
     } else if candidates->Array.length == 1 {
-      Some((candidates->Array.getUnsafe(0), "sole"))
+      Resolved({field: candidates->Array.getUnsafe(0), rung: "sole"})
+    } else if Array.length(candidates) == 0 {
+      NoCandidate
     } else {
-      None
+      Ambiguous({candidates, conventional})
     }
   }
 }
 
+let resolveKeyField = (~entityName: string, schema: S.t<unknown>): option<(string, string)> =>
+  switch classifyKeyField(~entityName, schema) {
+  | Resolved({field, rung}) => Some((field, rung))
+  | Ambiguous(_) | NoCandidate => None
+  }
+
+/**
+What losing the key costs this view, said where the ladder is so a caller only
+has to report it.
+
+Invisible otherwise: the view keeps every field and every row, and loses its
+`<field>Eq` filter and its whole `orderBy` from the schema, so a client's
+narrowing silently becomes a page fetched and filtered on the client.
+
+`None` for `NoCandidate` as well as for a resolved key, and that is the whole
+judgement here. A read model over an aggregate keeps the row's id on the row key
+rather than in its state, so having no `*Id` field is its ordinary shape — warning
+about it would fire on most of them and get the rule silenced. `Ambiguous` is the
+accident: the view HAD a key and a second `*Id` field took it away.
+*/
+let keyFieldGapMessage = (resolution: keyFieldResolution): option<string> =>
+  switch resolution {
+  | Resolved(_) | NoCandidate => None
+  | Ambiguous({candidates, conventional}) =>
+    Some(
+      `has no row key: it declares no @id and its \`*Id\` fields ` ++
+      `(${candidates->Array.join(", ")}) include no "${conventional}" for the name to ` ++
+      `pick. Adding a second \`*Id\` field to a view that had one is what lands here, ` ++
+      `and it costs the view its filter and its whole orderBy in the schema. Declare ` ++
+      `@id on the field that identifies a row.`,
+    )
+  }
+
 // The component name the key-field convention is read against. `specName` is the
 // read model's own `Spec.name`; without it, `returnTypeName` minus its plugin
 // prefix is the same string (`Catalog_Product` → `Product`).

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -244,30 +244,59 @@ function isKeyFieldName(name) {
   }
 }
 
-function resolveKeyField(entityName, schema) {
+function classifyKeyField(entityName, schema) {
   let match = StateAnnotations$Reventless.getSpec(schema);
   let declared = match !== undefined ? match.ids[0] : undefined;
   if (declared !== undefined) {
-    return [
-      declared,
-      "annotation"
-    ];
+    return {
+      TAG: "Resolved",
+      field: declared,
+      rung: "annotation"
+    };
   }
   let candidates = Object.keys(Stdlib_Option.getOr(SchemaType$ReventlessCore.fromSuryObject("", schema), {})).filter(isKeyFieldName);
   let singular = Api_Naming$ReventlessCore.singularize(Api_Naming$ReventlessCore.stripViewSuffix(entityName));
   let conventional = singular.slice(0, 1).toLowerCase() + singular.slice(1, singular.length) + "Id";
   if (candidates.includes(conventional)) {
-    return [
-      conventional,
-      "convention"
-    ];
+    return {
+      TAG: "Resolved",
+      field: conventional,
+      rung: "convention"
+    };
   } else if (candidates.length === 1) {
+    return {
+      TAG: "Resolved",
+      field: candidates[0],
+      rung: "sole"
+    };
+  } else if (candidates.length === 0) {
+    return "NoCandidate";
+  } else {
+    return {
+      TAG: "Ambiguous",
+      candidates: candidates,
+      conventional: conventional
+    };
+  }
+}
+
+function resolveKeyField(entityName, schema) {
+  let match = classifyKeyField(entityName, schema);
+  if (typeof match !== "object" || match.TAG !== "Resolved") {
+    return;
+  } else {
     return [
-      candidates[0],
-      "sole"
+      match.field,
+      match.rung
     ];
-  } else {
+  }
+}
+
+function keyFieldGapMessage(resolution) {
+  if (typeof resolution !== "object" || resolution.TAG === "Resolved") {
     return;
+  } else {
+    return `has no row key: it declares no @id and its \`*Id\` fields ` + (`(` + resolution.candidates.join(", ") + `) include no "` + resolution.conventional + `" for the name to `) + `pick. Adding a second \`*Id\` field to a view that had one is what lands here, and it costs the view its filter and its whole orderBy in the schema. Declare @id on the field that identifies a row.`;
   }
 }
 
@@ -655,7 +684,9 @@ export {
   emptyCapability,
   scalarOfSchemaType,
   isKeyFieldName,
+  classifyKeyField,
   resolveKeyField,
+  keyFieldGapMessage,
   entityNameOf,
   deriveServerCapability,
   validateScanSortAlignment,

package/src/components/Api/SchemaType.res

@@ -60,6 +60,7 @@ let semanticCompositeNames = [
   (Reventless.Semantic.Id.money, "Money"),
   (Reventless.Semantic.Id.dateRange, "DateRange"),
   (Reventless.Semantic.Id.geoPoint, "GeoPoint"),
+  (Reventless.Semantic.Id.captionedImage, "CaptionedImage"),
 ]
 
 let canonicalName = (id: string): option<string> =>

package/src/components/Api/SchemaType.res.mjs

@@ -40,6 +40,10 @@ let semanticCompositeNames = [
   [
     Semantic$Reventless.Id.geoPoint,
     "GeoPoint"
+  ],
+  [
+    Semantic$Reventless.Id.captionedImage,
+    "CaptionedImage"
   ]
 ];
 

package/src/components/Api/SuryToJsonSchema.res

@@ -271,6 +271,24 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
         "x-reventless-semantic-target",
         jsonObject(withOptionalPlugin([("store", str(store))], plugin)),
       )
+    | MemberOf({plugin, view, field, content}) =>
+      // Same channel as the two above, and `view` and `content` are omitted on
+      // the same terms as `plugin`: absent means the collection is on the row
+      // this field is already part of, and that the member's kind is the
+      // reader's own to work out.
+      let optional = (pairs, key, value) =>
+        switch value {
+        | Some(v) => Array.concat(pairs, [(key, str(v))])
+        | None => pairs
+        }
+      obj->Dict.set(
+        "x-reventless-semantic-target",
+        jsonObject(
+          withOptionalPlugin([("field", str(field))], plugin)
+          ->optional("view", view)
+          ->optional("content", content),
+        ),
+      )
     }
     JSON.Encode.object(obj)
   }
@@ -291,10 +309,15 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
 // belongs to, leaving the field a plain string either way. Threading it here
 // also keeps it available on command variants, which carry no annotation spec
 // for `mergeAnnotations` to read.
+// `sensitive` rides here on the same reasoning as `owners`, and is read the same
+// way — off the sury schema by the caller. What it marks is a field whose value
+// must not be rendered into content somebody receives, which is a property of
+// the domain model rather than of the field's shape.
 and objectRefToJsonSchema = (
   ~annotations: option<Reventless.StateAnnotations.stateAnnotationSpec>=?,
   ~optional: array<string>=[],
   ~owners: array<string>=[],
+  ~sensitive: array<string>=[],
   fields: dict<SchemaType.schemaType>,
 ): JSON.t => {
   let props = Dict.make()
@@ -328,6 +351,23 @@ and objectRefToJsonSchema = (
     } else {
       withAnnotations
     }
+    // Last, so it can read the semantic both earlier paths may have written. A
+    // field whose semantic is a way of reaching a particular person is sensitive
+    // whether or not anybody marked it — the annotation is for the values a type
+    // cannot betray.
+    let withAnnotations = switch withAnnotations->JSON.Decode.object {
+    | Some(obj) =>
+      let bySemantic =
+        obj
+        ->Dict.get("x-reventless-semantic")
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.mapOr(false, Reventless.Sensitive.impliedBySemantic)
+      if sensitive->Array.includes(fieldName) || bySemantic {
+        obj->Dict.set("x-reventless-sensitive", JSON.Encode.bool(true))
+      }
+      JSON.Encode.object(obj)
+    | None => withAnnotations
+    }
     props->Dict.set(fieldName, withAnnotations)
     // Optional two ways, because neither source answers alone. `optional` is
     // read off the sury schema and is the only thing that can speak for a
@@ -362,6 +402,7 @@ let deriveObjectSchema = (schema: S.t<unknown>): JSON.t =>
       ~annotations?,
       ~optional=SchemaType.optionalFieldNames(schema),
       ~owners=Reventless.Owner.fieldNames(schema),
+      ~sensitive=Reventless.Sensitive.fieldNames(schema),
       fields,
     )
     // Surface component-level hints on the top-level object schema.

package/src/components/Api/SuryToJsonSchema.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as Sensitive$Reventless from "@reventlessdev/reventless-spec/src/components/Sensitive.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as SchemaType$ReventlessCore from "./SchemaType.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
@@ -232,7 +233,7 @@ function fromSchemaType(st) {
           ]
         ]);
       case "ObjectRef" :
-        return objectRefToJsonSchema(undefined, undefined, undefined, st._1);
+        return objectRefToJsonSchema(undefined, undefined, undefined, undefined, st._1);
       case "Enum" :
         return Object.fromEntries([
           [
@@ -269,7 +270,7 @@ function armToJsonSchema(tag, armType) {
   if (armType.TAG !== "ObjectRef") {
     return fromSchemaType(armType);
   }
-  let base = objectRefToJsonSchema(undefined, undefined, undefined, armType._1);
+  let base = objectRefToJsonSchema(undefined, undefined, undefined, undefined, armType._1);
   let obj = Stdlib_JSON.Decode.object(base);
   if (obj === undefined) {
     return base;
@@ -303,26 +304,47 @@ function withSemantic(fieldSchema, sem) {
   obj["x-reventless-semantic-source"] = "type";
   let match = sem.payload;
   if (typeof match === "object") {
-    if (match.TAG === "ReferenceTo") {
-      let match$1 = match._0;
-      obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
-          "entity",
-          match$1.entity
-        ]], match$1.plugin));
-    } else {
-      let match$2 = match._0;
-      obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
-          "store",
-          match$2.store
-        ]], match$2.plugin));
+    switch (match.TAG) {
+      case "ReferenceTo" :
+        let match$1 = match._0;
+        obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
+            "entity",
+            match$1.entity
+          ]], match$1.plugin));
+        break;
+      case "StoredIn" :
+        let match$2 = match._0;
+        obj["x-reventless-semantic-target"] = Object.fromEntries(withOptionalPlugin([[
+            "store",
+            match$2.store
+          ]], match$2.plugin));
+        break;
+      case "MemberOf" :
+        let match$3 = match._0;
+        let optional = (pairs, key, value) => {
+          if (value !== undefined) {
+            return pairs.concat([[
+                key,
+                value
+              ]]);
+          } else {
+            return pairs;
+          }
+        };
+        obj["x-reventless-semantic-target"] = Object.fromEntries(optional(optional(withOptionalPlugin([[
+            "field",
+            match$3.field
+          ]], match$3.plugin), "view", match$3.view), "content", match$3.content));
+        break;
     }
   }
   return obj;
 }
 
-function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, fields) {
+function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, sensitiveOpt, fields) {
   let optional = optionalOpt !== undefined ? optionalOpt : [];
   let owners = ownersOpt !== undefined ? ownersOpt : [];
+  let sensitive = sensitiveOpt !== undefined ? sensitiveOpt : [];
   let props = {};
   let required = [];
   let internal = Stdlib_Option.getOr(Stdlib_Option.flatMap(annotations, spec => spec.internal), []);
@@ -343,7 +365,18 @@ function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, fields) {
     } else {
       withAnnotations$1 = withAnnotations;
     }
-    props[fieldName] = withAnnotations$1;
+    let obj$1 = Stdlib_JSON.Decode.object(withAnnotations$1);
+    let withAnnotations$2;
+    if (obj$1 !== undefined) {
+      let bySemantic = Stdlib_Option.mapOr(Stdlib_Option.flatMap(obj$1["x-reventless-semantic"], Stdlib_JSON.Decode.string), false, Sensitive$Reventless.impliedBySemantic);
+      if (sensitive.includes(fieldName) || bySemantic) {
+        obj$1["x-reventless-sensitive"] = true;
+      }
+      withAnnotations$2 = obj$1;
+    } else {
+      withAnnotations$2 = withAnnotations$1;
+    }
+    props[fieldName] = withAnnotations$2;
     if (!optional.includes(fieldName) && !isNullableType(fieldType)) {
       required.push(fieldName);
       return;
@@ -377,7 +410,7 @@ function deriveObjectSchema(schema) {
       ]]);
   }
   let annotations = StateAnnotations$Reventless.getSpec(schema);
-  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), Owner$Reventless.fieldNames(schema), fields);
+  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), Owner$Reventless.fieldNames(schema), Sensitive$Reventless.fieldNames(schema), fields);
   if (annotations === undefined) {
     return objSchema;
   }

package/src/plugin/component/Plugin_Structure.res

@@ -1282,6 +1282,13 @@ let make = (
     | Checked(failures) => failures->Array.forEach(f => retiredFailures->Array.push(f)->ignore)
     }
 
+  // Warned rather than refused: an unkeyed view still answers, just without a
+  // filter or an ordering, and a lint that stops a deploy gets silenced.
+  let recordKeyField = (~entityName, stateSchema) =>
+    GraphQL_FragmentGenerator.classifyKeyField(~entityName, stateSchema)
+    ->GraphQL_FragmentGenerator.keyFieldGapMessage
+    ->Option.forEach(why => log.warn(~comp="Plugin_Structure", `${name}/${entityName} ${why}`))
+
   let readModelDefs =
     readModels
     ->Array.map((
@@ -1300,6 +1307,7 @@ let make = (
       let consumed = qualify(~prefix=name, R.consumedEventNames)
       recordRetired(~entityName=R.Spec.name, stateSchema)
       recordLifecycle(~entityName=R.Spec.name, stateSchema)
+      recordKeyField(~entityName=R.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: R.Spec.name,
         queryField: qf.listFieldName,
@@ -1340,6 +1348,7 @@ let make = (
       )
       recordRetired(~entityName=SVS.Spec.name, stateSchema)
       recordLifecycle(~entityName=SVS.Spec.name, stateSchema)
+      recordKeyField(~entityName=SVS.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: SVS.Spec.name,
         queryField: qf.listFieldName,
@@ -1452,6 +1461,10 @@ let make = (
       targetName: OTS.Spec.targetName,
       externalSystem: OTS.Spec.externalSystem,
       chapter: chapterOf(OTS.Spec.name),
+      // Published verbatim, `[]` included: `[]` is the declared default meaning
+      // this plugin's own DCB log, and resolving it here to a derived name would
+      // be a second place that name is spelled.
+      consumedSources: Some(OTS.Spec.sourceNames),
     }: Reventless.Plugin.outboundTranslationSliceDef))
 
   // ── Inbound translation slices ────────────────────────────────────────────

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -962,6 +962,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       retiredFailures.push(f);
     });
   };
+  let recordKeyField = (entityName, stateSchema) => Stdlib_Option.forEach(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField(entityName, stateSchema)), why => log.warn("Plugin_Structure", undefined, name + `/` + entityName + ` ` + why));
   let readModelDefs = readModels.map(R => {
     let qf = Api_Naming$ReventlessCore.queryFieldNamesForReadModel(name, R.Spec.name, undefined);
     let stateSchema = R.Spec.stateSchema;
@@ -970,6 +971,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = qualify(name, R.consumedEventNames);
     recordRetired(R.Spec.name, stateSchema);
     recordLifecycle(R.Spec.name, stateSchema);
+    recordKeyField(R.Spec.name, stateSchema);
     return {
       name: R.Spec.name,
       queryField: qf.listFieldName,
@@ -1001,6 +1003,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let keyField = GraphQL_FragmentGenerator$ReventlessCore.resolveKeyField(SVS.Spec.name, stateSchema);
     recordRetired(SVS.Spec.name, stateSchema);
     recordLifecycle(SVS.Spec.name, stateSchema);
+    recordKeyField(SVS.Spec.name, stateSchema);
     return {
       name: SVS.Spec.name,
       queryField: qf.listFieldName,
@@ -1071,7 +1074,8 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     inboundCommandTypes: qualify(name, DcbTag$Reventless.extractAllVariantNames(OTS.Spec.inboundCommandSchema)),
     targetName: OTS.Spec.targetName,
     externalSystem: OTS.Spec.externalSystem,
-    chapter: componentChapters[OTS.Spec.name]
+    chapter: componentChapters[OTS.Spec.name],
+    consumedSources: OTS.Spec.sourceNames
   }));
   let inboundTranslationSliceDefs = inboundTranslationSlices.map(ITS => ({
     name: ITS.Spec.name,

package/tests/admin/AdminApiSchemaDriftTest.res

@@ -128,6 +128,7 @@ let outbound: outboundTranslationSliceDef = {
   targetName: Some("Shipment"),
   externalSystem: Some("Shipper"),
   chapter: Some("Fulfilment"),
+  consumedSources: Some(["OrderingDcbEventLog"]),
 }
 
 let inbound: inboundTranslationSliceDef = {

package/tests/admin/AdminApiSchemaDriftTest.res.mjs

@@ -199,13 +199,16 @@ let outbound_externalSystem = "Shipper";
 
 let outbound_chapter = "Fulfilment";
 
+let outbound_consumedSources = ["OrderingDcbEventLog"];
+
 let outbound = {
   name: "ToShipper",
   consumedEventTypes: outbound_consumedEventTypes,
   inboundCommandTypes: outbound_inboundCommandTypes,
   targetName: outbound_targetName,
   externalSystem: outbound_externalSystem,
-  chapter: outbound_chapter
+  chapter: outbound_chapter,
+  consumedSources: outbound_consumedSources
 };
 
 let inbound_commandTypes = ["RecordPayment"];

package/tests/admin/Platform_ComponentDefinitionsApiTest.res

@@ -77,6 +77,7 @@ let structure: pluginStructure = {
       targetName: None,
       externalSystem: None,
       chapter: None,
+      consumedSources: None,
     },
   ],
   inboundTranslationSlices: [
@@ -227,6 +228,7 @@ describe("translation-slice externalSystem round-trip", () => {
         targetName: None,
         externalSystem: Some("ShipperGateway"),
         chapter: None,
+        consumedSources: None,
       },
     ],
     inboundTranslationSlices: [

package/tests/admin/Platform_ComponentDefinitionsApiTest.res.mjs

@@ -118,7 +118,8 @@ let structure_outboundTranslationSlices = [{
     inboundCommandTypes: ["Ship"],
     targetName: undefined,
     externalSystem: undefined,
-    chapter: undefined
+    chapter: undefined,
+    consumedSources: undefined
   }];
 
 let structure_inboundTranslationSlices = [{
@@ -245,7 +246,8 @@ globalThis.describe("translation-slice externalSystem round-trip", () => {
       inboundCommandTypes: ["Ship"],
       targetName: undefined,
       externalSystem: "ShipperGateway",
-      chapter: undefined
+      chapter: undefined,
+      consumedSources: undefined
     }];
   let externalStructure_inboundTranslationSlices = [{
       name: "FromBilling",

package/tests/admin/Platform_PluginStructuresApiTest.res

@@ -183,4 +183,36 @@ describe("absent optional collections", () => {
   testSync("encodes absent requiredStores as null", () =>
     expect(bareJson->String.includes("\"requiredStores\":null"))->toEqual(true)
   )
+
+  // The case the frozen corpus cannot reach: every fixture in it carries
+  // `"outboundTranslationSlices":[]`, so no stored payload has an outbound slice
+  // to be missing a field. A structure written before `consumedSources` existed
+  // has no such key, and the schema alone refuses it — `S.nullAsOption` is
+  // `T | null`, and the variant that also accepts `undefined` fails sury's
+  // jsonable validation inside a union payload, which is where a structure
+  // travels. `parseJsonTolerant` is what makes the absence survivable, and it is
+  // the path the Plugin aggregate replays through.
+  testSync("an outbound slice stored before consumedSources existed still replays", () =>
+    expect(
+      (
+        `{"name":"ToShipper","consumedEventTypes":[],"inboundCommandTypes":[],` ++
+        `"targetName":null,"externalSystem":null,"chapter":null}`
+      )
+      ->JSON.parseOrThrow
+      ->Reventless.Message.parseJsonTolerant(outboundTranslationSliceDefSchema)
+      ->(slice => slice.consumedSources),
+    )->toEqual(None)
+  )
+
+  testSync("an explicit null decodes as None", () =>
+    expect(
+      (
+        `{"name":"ToShipper","consumedEventTypes":[],"inboundCommandTypes":[],` ++
+        `"targetName":null,"externalSystem":null,"chapter":null,"consumedSources":null}`
+      )
+      ->JSON.parseOrThrow
+      ->Reventless.Util_Sury.fromJson(outboundTranslationSliceDefSchema)
+      ->(slice => slice.consumedSources),
+    )->toEqual(None)
+  )
 })

package/tests/admin/Platform_PluginStructuresApiTest.res.mjs

@@ -4,6 +4,9 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
+import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
+import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Platform_PluginStructuresApi$ReventlessCore from "../../src/admin/Platform_PluginStructuresApi.res.mjs";
 
 let publicRm_consumedEventTypes = ["ProductAdded"];
@@ -237,6 +240,12 @@ globalThis.describe("absent optional collections", () => {
   globalThis.test("encodes absent requiredStores as null", () => {
     globalThis.expect(bareJson.includes("\"requiredStores\":null")).toEqual(true);
   });
+  globalThis.test("an outbound slice stored before consumedSources existed still replays", () => {
+    globalThis.expect(Message$Reventless.parseJsonTolerant(JSON.parse(`{"name":"ToShipper","consumedEventTypes":[],"inboundCommandTypes":[],"targetName":null,"externalSystem":null,"chapter":null}`), Plugin$Reventless.outboundTranslationSliceDefSchema).consumedSources).toEqual(undefined);
+  });
+  globalThis.test("an explicit null decodes as None", () => {
+    globalThis.expect(Util_Sury$Reventless.fromJson(JSON.parse(`{"name":"ToShipper","consumedEventTypes":[],"inboundCommandTypes":[],"targetName":null,"externalSystem":null,"chapter":null,"consumedSources":null}`), Plugin$Reventless.outboundTranslationSliceDefSchema).consumedSources).toEqual(undefined);
+  });
 });
 
 export {

package/tests/api/GraphQL_FragmentGeneratorTest.res

@@ -139,6 +139,53 @@ describe("resolveKeyField — the ladder", () => {
   })
 })
 
+// Losing the key is invisible — the view keeps every field and every row, and
+// drops its `<field>Eq` filter and its whole `orderBy` from the SDL. These pin
+// which of the two ways to lose it is worth saying out loud.
+describe("keyFieldGapMessage — which gap is worth a warning", () => {
+  let gapFor = (~entityName, schema) =>
+    GraphQL_FragmentGenerator.classifyKeyField(~entityName, schema->S.castToUnknown)
+    ->GraphQL_FragmentGenerator.keyFieldGapMessage
+
+  // The accident §14b.2 named: the view had `productId` alone and somebody added
+  // `categoryId`, so `sole` stopped firing and the name matches neither.
+  testSync("a second `*Id` field taking the key away is named, with both fields", () => {
+    let schema = S.schema(s =>
+      {"productId": s.matches(S.string), "categoryId": s.matches(S.string)}
+    )
+    let message = gapFor(~entityName="ProductDemand", schema)->Option.getOr("")
+    expect(message->String.includes("productId, categoryId"))->toBe(true)
+    expect(message->String.includes("productDemandId"))->toBe(true)
+  })
+
+  // A read model over an aggregate keeps the row's id on the row key, not in its
+  // state. Warning here would fire on most of them and get the rule silenced —
+  // six views across the example plugins are exactly this shape.
+  testSync("a state with no `*Id` field at all is silent, not warned about", () =>
+    expect(
+      gapFor(
+        ~entityName="Customers",
+        S.schema(s => {"email": s.matches(S.string), "address": s.matches(S.string)}),
+      ),
+    )->toEqual(None)
+  )
+
+  testSync("a resolved key says nothing", () =>
+    expect(
+      gapFor(~entityName="Orders", S.schema(s => {"orderId": s.matches(S.string)})),
+    )->toEqual(None)
+  )
+
+  testSync("an @id-less view whose name picks one of its `*Id` fields is fine", () =>
+    expect(
+      gapFor(
+        ~entityName="Products",
+        S.schema(s => {"productId": s.matches(S.string), "categoryId": s.matches(S.string)}),
+      ),
+    )->toEqual(None)
+  )
+})
+
 describe("deriveServerCapability — inferred keys reach the SDL surface", () => {
   let capabilityFor = (~entityName, schema) =>
     GraphQL_FragmentGenerator.deriveServerCapability(~entityName, schema->S.castToUnknown)

package/tests/api/GraphQL_FragmentGeneratorTest.res.mjs

@@ -148,6 +148,38 @@ globalThis.describe("resolveKeyField — the ladder", () => {
   });
 });
 
+globalThis.describe("keyFieldGapMessage — which gap is worth a warning", () => {
+  globalThis.test("a second `*Id` field taking the key away is named, with both fields", () => {
+    let schema = Sury.$schema(s => ({
+      productId: s.m(Sury.string),
+      categoryId: s.m(Sury.string)
+    }));
+    let message = Stdlib_Option.getOr(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField("ProductDemand", schema)), "");
+    globalThis.expect(message.includes("productId, categoryId")).toBe(true);
+    globalThis.expect(message.includes("productDemandId")).toBe(true);
+  });
+  globalThis.test("a state with no `*Id` field at all is silent, not warned about", () => {
+    let schema = Sury.$schema(s => ({
+      email: s.m(Sury.string),
+      address: s.m(Sury.string)
+    }));
+    globalThis.expect(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField("Customers", schema))).toEqual(undefined);
+  });
+  globalThis.test("a resolved key says nothing", () => {
+    let schema = Sury.$schema(s => ({
+      orderId: s.m(Sury.string)
+    }));
+    globalThis.expect(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField("Orders", schema))).toEqual(undefined);
+  });
+  globalThis.test("an @id-less view whose name picks one of its `*Id` fields is fine", () => {
+    let schema = Sury.$schema(s => ({
+      productId: s.m(Sury.string),
+      categoryId: s.m(Sury.string)
+    }));
+    globalThis.expect(GraphQL_FragmentGenerator$ReventlessCore.keyFieldGapMessage(GraphQL_FragmentGenerator$ReventlessCore.classifyKeyField("Products", schema))).toEqual(undefined);
+  });
+});
+
 globalThis.describe("deriveServerCapability — inferred keys reach the SDL surface", () => {
   globalThis.test("an inferred key yields an eq filter and a sort field", () => {
     let schema = Sury.$schema(s => ({

package/tests/api/SuryToJsonSchemaTest.res

@@ -119,6 +119,78 @@ describe("SuryToJsonSchema:", () => {
     })
   })
 
+  describe("deriveObjectSchema with a sensitive field:", () => {
+    let sensitiveOf = (json, name) =>
+      getPropertyOf(json, name)->Option.flatMap(s => getProperty(s, "x-reventless-sensitive"))
+    let ownerOf = (json, name) =>
+      getPropertyOf(json, name)->Option.flatMap(s => getProperty(s, "x-reventless-owner"))
+
+    let json = SuryToJsonSchema.deriveObjectSchema(
+      S.schema(s =>
+        {
+          "resetToken": s.matches(Reventless.Sensitive.string),
+          "note": s.matches(S.string),
+          "contact": s.matches(Reventless.Email.schema),
+        }
+      )->S.castToUnknown,
+    )
+
+    testSync("the marked field carries x-reventless-sensitive", () =>
+      expect(sensitiveOf(json, "resetToken"))->toEqual(Some(JSON.Encode.bool(true)))
+    )
+
+    // The control. Absent means "not stated", and a reader that misses the
+    // marker renders the value — so a bug that marked everything would look like
+    // caution while a bug that marked nothing leaks. Both need catching, and
+    // only this assertion catches the first.
+    testSync("an unmarked string field carries nothing", () =>
+      expect(sensitiveOf(json, "note"))->toBe(None)
+    )
+
+    // A contact detail is sensitive whether or not anybody wrote it down: the
+    // whole meaning of the semantic is "how to reach a particular person".
+    testSync("an email field is sensitive with no annotation", () =>
+      expect(sensitiveOf(json, "contact"))->toEqual(Some(JSON.Encode.bool(true)))
+    )
+
+    testSync("the field is still a plain string on the wire", () =>
+      expect(
+        getPropertyOf(json, "resetToken")->Option.flatMap(s => getProperty(s, "type")),
+      )->toEqual(Some(JSON.Encode.string("string")))
+    )
+
+    // Same trap as the owner case, and worse in consequence: a reader that only
+    // inspects the outer schema answers "not sensitive" for an optional field,
+    // and the value goes into a message.
+    testSync("an optional sensitive field is still recognised", () => {
+      let optJson = SuryToJsonSchema.deriveObjectSchema(
+        S.schema(s =>
+          {
+            "resetToken": s.matches(S.option(Reventless.Sensitive.string)),
+          }
+        )->S.castToUnknown,
+      )
+      expect(sensitiveOf(optJson, "resetToken"))->toEqual(Some(JSON.Encode.bool(true)))
+    })
+
+    // The composition rule. `mark` wraps rather than replaces, so a field that
+    // is both an owner and sensitive keeps both — a marker that silently
+    // replaced the other would unscope a view or unmask a value.
+    testSync("sensitivity composes with ownership on one field", () => {
+      let bothJson = SuryToJsonSchema.deriveObjectSchema(
+        S.schema(s =>
+          {
+            "customerId": s.matches(Reventless.Sensitive.mark(Reventless.Owner.string)),
+          }
+        )->S.castToUnknown,
+      )
+      expect((sensitiveOf(bothJson, "customerId"), ownerOf(bothJson, "customerId")))->toEqual((
+        Some(JSON.Encode.bool(true)),
+        Some(JSON.Encode.bool(true)),
+      ))
+    })
+  })
+
   describe("deriveObjectSchema with stateAnnotations metadata:", () => {
     let withSpec = (schema, spec) =>
       schema->S.Metadata.set(~id=Reventless.StateAnnotations.stateAnnotationsId, spec)
@@ -927,6 +999,91 @@ describe("SuryToJsonSchema:", () => {
     })
   })
 
+  // A selection, not an input. The whole point of the id is that it travels the
+  // same channel as a store declaration and says something a store declaration
+  // cannot: the candidates are on the row, so nothing is provisioned for it.
+  describe("a member-reference field:", () => {
+    let targetOf = (json, name) =>
+      getPropertyOf(json, name)->Option.flatMap(s =>
+        getProperty(s, "x-reventless-semantic-target")
+      )
+
+    testSync("carries the collection, the view holding it, and what a member is", () => {
+      let json = SuryToJsonSchema.deriveObjectSchema(
+        S.schema(s =>
+          {
+            "productImage": s.matches(
+              Reventless.MemberRef.of_(
+                ~view="Products",
+                ~content=Reventless.Semantic.Id.imageRef,
+                ~field="productImages",
+              ),
+            ),
+          }
+        )->S.castToUnknown,
+      )
+      expect(
+        getPropertyOf(json, "productImage")->Option.flatMap(s =>
+          getProperty(s, "x-reventless-semantic")
+        ),
+      )->toEqual(Some(JSON.Encode.string("memberRef")))
+      expect(targetOf(json, "productImage"))->toEqual(
+        Some(
+          JSON.Encode.object(
+            Dict.fromArray([
+              ("field", JSON.Encode.string("productImages")),
+              ("view", JSON.Encode.string("Products")),
+              ("content", JSON.Encode.string("imageRef")),
+            ]),
+          ),
+        ),
+      )
+    })
+
+    // The second position: a declaration on a view's own state, where the
+    // collection is on the same record and naming a view would invite the reader
+    // to think another one could be meant.
+    testSync("omits the view where the collection is on this very record", () =>
+      expect(
+        targetOf(
+          SuryToJsonSchema.deriveObjectSchema(
+            S.schema(s =>
+              {"productImage": s.matches(Reventless.MemberRef.of_(~field="productImages"))}
+            )->S.castToUnknown,
+          ),
+          "productImage",
+        ),
+      )->toEqual(
+        Some(JSON.Encode.object(Dict.fromArray([("field", JSON.Encode.string("productImages"))]))),
+      )
+    )
+
+    // The assertion the whole design rests on, and the one a reader will want to
+    // see rather than infer: a `memberRef` field declares NO store, so the
+    // provisioning walk passes it by and no upload endpoint is bound. This is
+    // exactly what `imageRef` gets today, reached through a different payload.
+    testSync("declares no store, so nothing is provisioned for it", () =>
+      expect(
+        Reventless.StorageRef.getFieldStore(
+          Reventless.MemberRef.of_(~view="Products", ~field="productImages"),
+        ),
+      )->toBe(None)
+    )
+
+    testSync("stays a plain string on the wire", () =>
+      expect(
+        getPropertyOf(
+          SuryToJsonSchema.deriveObjectSchema(
+            S.schema(s =>
+              {"productImage": s.matches(Reventless.MemberRef.of_(~field="productImages"))}
+            )->S.castToUnknown,
+          ),
+          "productImage",
+        )->Option.flatMap(s => getProperty(s, "type")),
+      )->toEqual(Some(JSON.Encode.string("string")))
+    )
+  })
+
   // The claim the branded scalars rest on: marking a field adds an annotation,
   // not a shape. A string stays a string and a number stays a number on the
   // wire, which is what makes them retrofittable onto a log that already has

package/tests/api/SuryToJsonSchemaTest.res.mjs

@@ -13,8 +13,11 @@ import * as Percent$Reventless from "@reventlessdev/reventless-spec/src/semantic
 import * as Currency$Reventless from "@reventlessdev/reventless-spec/src/semantic/Currency.res.mjs";
 import * as DateTime$Reventless from "@reventlessdev/reventless-spec/src/types/DateTime.res.mjs";
 import * as GeoPoint$Reventless from "@reventlessdev/reventless-spec/src/semantic/GeoPoint.res.mjs";
+import * as Semantic$Reventless from "@reventlessdev/reventless-spec/src/semantic/Semantic.res.mjs";
 import * as DateRange$Reventless from "@reventlessdev/reventless-spec/src/semantic/DateRange.res.mjs";
+import * as MemberRef$Reventless from "@reventlessdev/reventless-spec/src/semantic/MemberRef.res.mjs";
 import * as Reference$Reventless from "@reventlessdev/reventless-spec/src/components/Reference.res.mjs";
+import * as Sensitive$Reventless from "@reventlessdev/reventless-spec/src/components/Sensitive.res.mjs";
 import * as StorageRef$Reventless from "@reventlessdev/reventless-spec/src/semantic/StorageRef.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 import * as SuryToJsonSchema$ReventlessCore from "../../src/components/Api/SuryToJsonSchema.res.mjs";
@@ -130,6 +133,45 @@ globalThis.describe("SuryToJsonSchema:", () => {
       globalThis.expect(ownerOf(optJson, "customerId")).toEqual(true);
     });
   });
+  globalThis.describe("deriveObjectSchema with a sensitive field:", () => {
+    let sensitiveOf = (json, name) => Stdlib_Option.flatMap(getPropertyOf(json, name), s => getProperty(s, "x-reventless-sensitive"));
+    let ownerOf = (json, name) => Stdlib_Option.flatMap(getPropertyOf(json, name), s => getProperty(s, "x-reventless-owner"));
+    let json = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+      resetToken: s.m(Sensitive$Reventless.string),
+      note: s.m(Sury.string),
+      contact: s.m(Email$Reventless.schema)
+    })));
+    globalThis.test("the marked field carries x-reventless-sensitive", () => {
+      globalThis.expect(sensitiveOf(json, "resetToken")).toEqual(true);
+    });
+    globalThis.test("an unmarked string field carries nothing", () => {
+      globalThis.expect(sensitiveOf(json, "note")).toBe(undefined);
+    });
+    globalThis.test("an email field is sensitive with no annotation", () => {
+      globalThis.expect(sensitiveOf(json, "contact")).toEqual(true);
+    });
+    globalThis.test("the field is still a plain string on the wire", () => {
+      globalThis.expect(Stdlib_Option.flatMap(getPropertyOf(json, "resetToken"), s => getProperty(s, "type"))).toEqual("string");
+    });
+    globalThis.test("an optional sensitive field is still recognised", () => {
+      let optJson = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+        resetToken: s.m(Sury.$option(Sensitive$Reventless.string))
+      })));
+      globalThis.expect(sensitiveOf(optJson, "resetToken")).toEqual(true);
+    });
+    globalThis.test("sensitivity composes with ownership on one field", () => {
+      let bothJson = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+        customerId: s.m(Sensitive$Reventless.mark(Owner$Reventless.string))
+      })));
+      globalThis.expect([
+        sensitiveOf(bothJson, "customerId"),
+        ownerOf(bothJson, "customerId")
+      ]).toEqual([
+        true,
+        true
+      ]);
+    });
+  });
   globalThis.describe("deriveObjectSchema with stateAnnotations metadata:", () => {
     globalThis.test("emits x-reventless-id on field listed in ids", () => {
       let schema = Sury.$schema(s => ({
@@ -872,6 +914,45 @@ globalThis.describe("SuryToJsonSchema:", () => {
       globalThis.expect(semanticOf(json, "imageUrl")).toEqual("storageRef");
     });
   });
+  globalThis.describe("a member-reference field:", () => {
+    let targetOf = (json, name) => Stdlib_Option.flatMap(getPropertyOf(json, name), s => getProperty(s, "x-reventless-semantic-target"));
+    globalThis.test("carries the collection, the view holding it, and what a member is", () => {
+      let json = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+        productImage: s.m(MemberRef$Reventless.of_(undefined, "Products", Semantic$Reventless.Id.imageRef, "productImages"))
+      })));
+      globalThis.expect(Stdlib_Option.flatMap(getPropertyOf(json, "productImage"), s => getProperty(s, "x-reventless-semantic"))).toEqual("memberRef");
+      globalThis.expect(targetOf(json, "productImage")).toEqual(Object.fromEntries([
+        [
+          "field",
+          "productImages"
+        ],
+        [
+          "view",
+          "Products"
+        ],
+        [
+          "content",
+          "imageRef"
+        ]
+      ]));
+    });
+    globalThis.test("omits the view where the collection is on this very record", () => {
+      globalThis.expect(targetOf(SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+        productImage: s.m(MemberRef$Reventless.of_(undefined, undefined, undefined, "productImages"))
+      }))), "productImage")).toEqual(Object.fromEntries([[
+          "field",
+          "productImages"
+        ]]));
+    });
+    globalThis.test("declares no store, so nothing is provisioned for it", () => {
+      globalThis.expect(StorageRef$Reventless.getFieldStore(MemberRef$Reventless.of_(undefined, "Products", undefined, "productImages"))).toBe(undefined);
+    });
+    globalThis.test("stays a plain string on the wire", () => {
+      globalThis.expect(Stdlib_Option.flatMap(getPropertyOf(SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({
+        productImage: s.m(MemberRef$Reventless.of_(undefined, undefined, undefined, "productImages"))
+      }))), "productImage"), s => getProperty(s, "type"))).toEqual("string");
+    });
+  });
   globalThis.describe("branded scalars keep their underlying shape:", () => {
     let keyOf = (json, name, key) => Stdlib_Option.flatMap(getPropertyOf(json, name), s => getProperty(s, key));
     let json = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(Sury.$schema(s => ({

package/tests/plugin/PluginStructureTest.res

@@ -1300,6 +1300,28 @@ describe("Plugin_Structure.make — Phase 2 graph fields", () => {
       )->toBe(Some("currency"))
     })
 
+    testSync("@sensitive flows through the PPX to x-reventless-sensitive", () => {
+      expect(
+        annotatedSchema
+        ->getPropertyOf("contact")
+        ->Option.flatMap(s => getProperty(s, "x-reventless-sensitive"))
+        ->Option.flatMap(JSON.Decode.bool),
+      )->toBe(Some(true))
+    })
+
+    // The case the marker exists for. A renderer composes from an event payload,
+    // and the annotation path `deriveObjectSchema` reads for state is
+    // state-only — so a marker that lived there would be absent exactly where
+    // the value is about to be interpolated into a message.
+    testSync("@sensitive reaches an event variant's payload, not only state", () =>
+      expect(
+        Reventless.Sensitive.variantFieldNames(
+          PsAnnotatedView.consumedEventSchema->S.castToUnknown,
+          ~variant="ItemRecorded",
+        ),
+      )->toEqual(["contact"])
+    )
+
     testSync("@metric flows through the PPX to x-reventless-metric {aggregate,label}", () => {
       let metricObj =
         annotatedSchema

package/tests/plugin/PluginStructureTest.res.mjs

@@ -11,6 +11,7 @@ import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/component
 import * as DateTime$Reventless from "@reventlessdev/reventless-spec/src/types/DateTime.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Reference$Reventless from "@reventlessdev/reventless-spec/src/components/Reference.res.mjs";
+import * as Sensitive$Reventless from "@reventlessdev/reventless-spec/src/components/Sensitive.res.mjs";
 import * as StorageRef$Reventless from "@reventlessdev/reventless-spec/src/semantic/StorageRef.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../src/components/Api/Api_Naming.res.mjs";
 import * as PsShipOrder$ReventlessCore from "./StateChangeSlice/PsShipOrder.res.mjs";
@@ -1444,6 +1445,12 @@ globalThis.describe("Plugin_Structure.make — Phase 2 graph fields", () => {
     globalThis.test("@semantic(\"currency\") flows through the PPX to x-reventless-semantic", () => {
       globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(getPropertyOf(annotatedSchema, "total"), s => getProperty(s, "x-reventless-semantic")), Stdlib_JSON.Decode.string)).toBe("currency");
     });
+    globalThis.test("@sensitive flows through the PPX to x-reventless-sensitive", () => {
+      globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(getPropertyOf(annotatedSchema, "contact"), s => getProperty(s, "x-reventless-sensitive")), Stdlib_JSON.Decode.bool)).toBe(true);
+    });
+    globalThis.test("@sensitive reaches an event variant's payload, not only state", () => {
+      globalThis.expect(Sensitive$Reventless.variantFieldNames(PsAnnotatedView$ReventlessCore.consumedEventSchema, "ItemRecorded")).toEqual(["contact"]);
+    });
     globalThis.test("@metric flows through the PPX to x-reventless-metric {aggregate,label}", () => {
       let metricObj = Stdlib_Option.flatMap(getPropertyOf(annotatedSchema, "total"), s => getProperty(s, "x-reventless-metric"));
       globalThis.expect([

package/tests/plugin/StateViewSlice/PsAnnotatedView.res

@@ -7,7 +7,16 @@
 
 @schema
 type consumedEvent =
-  | ItemRecorded({itemId: string, ownerId: string, version: string, name: string, total: float})
+  | ItemRecorded({
+      itemId: string,
+      ownerId: string,
+      version: string,
+      name: string,
+      total: float,
+      // On the event, not just the state: a renderer composes from an event
+      // payload, so this is the case the marker has to reach.
+      @sensitive contact: string,
+    })
 
 @live(false)
 @schema
@@ -17,10 +26,11 @@ type state = {
   @index("byOwner") ownerId: string,
   name: string,
   @semantic("currency") @metric({aggregate: "sum", label: "Revenue"}) total: float,
+  @sensitive contact: string,
 }
 
 let project = ({event}: Reventless.StateViewSlice.consumed<consumedEvent>) =>
   switch event {
-  | ItemRecorded({itemId, ownerId, version, name, total}) =>
-    [Set(itemId, {itemId, ownerId, version, name, total})]
+  | ItemRecorded({itemId, ownerId, version, name, total, contact}) =>
+    [Set(itemId, {itemId, ownerId, version, name, total, contact})]
   }

package/tests/plugin/StateViewSlice/PsAnnotatedView.res.mjs

@@ -3,6 +3,7 @@
 import * as Sury from "sury";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as Sensitive$Reventless from "@reventlessdev/reventless-spec/src/components/Sensitive.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 
 let consumedEventSchema = Sury.$schema(s => ({
@@ -11,7 +12,8 @@ let consumedEventSchema = Sury.$schema(s => ({
   ownerId: s.m(DcbTag$Reventless.string),
   version: s.m(Sury.string),
   name: s.m(Sury.string),
-  total: s.m(Sury.float)
+  total: s.m(Sury.float),
+  contact: s.m(Sensitive$Reventless.string)
 }));
 
 let stateSchema = Sury.$schema(s => ({
@@ -19,7 +21,8 @@ let stateSchema = Sury.$schema(s => ({
   version: s.m(Sury.string),
   ownerId: s.m(Sury.string),
   name: s.m(Sury.string),
-  total: s.m(Sury.float)
+  total: s.m(Sury.float),
+  contact: s.m(Sensitive$Reventless.string)
 }));
 
 function project(param) {
@@ -33,7 +36,8 @@ function project(param) {
         version: event.version,
         ownerId: event.ownerId,
         name: event.name,
-        total: event.total
+        total: event.total,
+        contact: event.contact
       }
     }];
 }

package/tests/plugin/pluginDefinitionRequiredScalars.txt

@@ -94,6 +94,12 @@
 .structure.inboundTranslationSlices[].name: string
 .structure.inboundTranslationSlices[].targetName: string
 .structure.outboundTranslationSlices[].consumedEventTypes[]: string
+# `consumedSources` is itself `js_nullable` and is NEW, so no persisted payload
+# carries the array: a stored structure heals to null and this line is never
+# reached — the same call `traitDeclarations` made below. Required inside it
+# because a source name is a topic key the slice subscribes to, and a fabricated
+# `""` would name a topic that does not exist rather than saying nothing.
+.structure.outboundTranslationSlices[].consumedSources[]: string
 .structure.outboundTranslationSlices[].inboundCommandTypes[]: string
 .structure.outboundTranslationSlices[].name: string
 .structure.readModels[].consumedEventTypes[]: string